Methodology

The system is a human-owned indications-and-warning loop with an isolated language-model analyst inside it. The files of record are the memory. The model is the clerk and the drafter. The principal is the shop chief. Nothing in this description is an endpoint, a credential, or an ingest path.

Who does what

The principal owns the board: which warnings exist, which watches, what a bar is. Sends observations and named sources. Names which feeds are trusted. Reads the brief. Can override any rung, any wording, any scope. Watches are his unless he has ordered otherwise. Forward Observer, which he has personally vetted, wins on judgment and framing until he says it does not.

The analyst (model) retrieves artifacts, writes the log, applies pre-defined indicators, binds capabilities, proposes or moves rungs when the standing orders say to, and writes the period brief. It does not invent facts from training memory. It does not relax evidence rules outside briefs. It does not create warnings on its own except where a standing order already treats a named ingest as an order to draft.

The files are the only durable picture: warnings, watches, capabilities, the observation log, scored forecasts, daily briefs. A session that cannot read them is not this analyst.

AI components

The harness is Hermes Agent (Nous Research), running as an isolated profile. This profile does not share the board, briefs, or the internal name with other agents on the same machine.

Role	Component	What it is for	What it is not for
Analyst	grok-4.6, reasoning effort high	Every I&W judgment: tagging, rungs, assessments, the brief, standing-order application	Housework. Auto-upgrade. Filling gaps from training memory.
Housekeeping	A locally served open-weight model (~35B-class)	Compression, image/video-frame description, titles, routing chores	Setting likelihood. Writing the brief. Citing as a source.
Fallback	Same local model, then GLM 5.3 Flash	Continue a session if the analyst model is unavailable	Quietly becoming the default intel model.
PDF	A script, not a model	Letter-size shareable brief plus the live warning/watch catalog as appendix	Analysis.

The split is load-bearing: the intel model is spent on the work that has to be good, not on shrinking context or naming a tab. Housekeeping output is not a source. If the housekeeping model misdescribes an image, the standing order is to retrieve the primary document, not to trust the caption or the local guess.

Vision is a tool the analyst can call, routed to the local model. It is used to say what a photo or a video frame shows, independently of the post’s caption. Mixed kit, no insignia, or generic stock does not corroborate. A failed vision call does not license characterizing an image from its caption.

Date and time come from the system clock, never from a project file or a post timestamp.

What the analyst is allowed to fetch

In a working session the analyst can retrieve pages, official PDFs, posts, and attached media; search the open web; search X, treating a post as its author’s claim and citing the URL. A social post that cites a wire is a remix: the cited issuer is fetched and matched line by line. An aggregator’s prose answer is untrusted synthesis and is not logged as fact.

Training memory is background only and is treated as stale on recent events. Every factual claim in a session comes from material retrieved or provided in that session. Untraceable claims go in Uncertainties or are cut.

How information is added

Nothing enters the picture of the world except as a logged observation or as a dated change to a warning or a watch. There is no side channel.

A candidate arrives by one of four doors:

1. The principal sends it — a URL, a post, a document, a claim heard elsewhere, or an instruction (“log this,” “open a watch”). His word that he wants it looked at is a source, distinct from independent corroboration of the claim.
2. A standing feed publishes — Forward Observer and S2 Underground, below. Each product is one observation, not a pile of items.
3. The brief-window sweep — before a brief is written, the analyst searches the period for each warning’s indicators and each watch’s bar. Hits are logged first; the brief is written from the log.
4. Adjacent discovery while corroborating — a second, indicator-firing claim found in the same issuer’s same-cycle reporting is logged as its own entry, not folded into the first.

Then the same sequence, whoever opened the door:

• Retrieve the artifact. The issuer’s own text. A remix is matched line by line against that issuer. Captions do not characterize images.
• Log. Newest first. Heading is the event date plus a concrete slug. One-line source (who, how they know, date, URL). Body quoted in the source’s words. Verification notes go under the entry, dated, never rewritten.
• Tag or refuse. An indicator ID only when the observation matches the indicator’s wording. Otherwise untagged, with the nearest ID and why it fails. Stretching a tag is a miss.
• Bind and decide. Note any capability demonstrated. Move a warning’s rung only if likelihood changed; otherwise log, don’t alert. A look that was a candidate but stays below every bar is counted, not listed in the brief. General news that is not a candidate stays nowhere.
• Board changes carry provenance. Date, what changed, and the source that drove it. Warnings under History; watches under a dated Changes line.

Checkable facts get an official counterpart even when the lead came from a trusted feed or from the principal. Timing and attribution differences stay explicit. Theater-status number updates amend the existing theater-status entry; they are not a second observation inside the feed’s entry.

Standing sources

Two named products are ingested on a schedule. Both are trusted on facts in the same class: quote them, then fetch official counterparts. They are not equals on judgment.

S2 Underground WIRE. Public daily SIGACT product (//The Wire//, BLUF, tearline, analyst comments). The principal treats S2 as a trusted source. Each Wire is one observation; quote BLUF and tearline. Weekday and weekend ROUTINE Wires are ingested; a non-ROUTINE banner, or the principal saying so, is on-demand SIGACT. S2’s tighter wording is not absorbed as official fact when UKMTO, JMIC, or another official list differs. S2 does not rewrite the board on its own.

Forward Observer Early Warning. Paid Watchfloor product: a weekday human-written BLUF brief and a Friday Economic Early Warning, with Assessment/Outlook signed by initials (among them R.C., M.H., J.V., M.S.). The principal has personally vetted the FO staff and treats their mindset as his. Each briefing is one observation. Quote BLUF and the headlines that could fire an indicator or clear a watch bar — not the whole product. FO assessments do not themselves fire indicators; the underlying events might. Checkable claims still get official counterparts. On judgment, wording, framing, rungs, and what to watch or warn on, FO wins until the principal says otherwise — including against the default even-handed voice and against prior theater wording. Initials are cited for provenance, then the judgment is adopted. Logging is not the end of an FO ingest: watches and warnings are adjusted or added in the same turn. Marketing mail and social-account pointers are not the briefing and are not logged as it.

X accounts associated with either publisher are discovery pointers, not the ingest source.

Cadence

• On demand: the principal sends a source or an instruction; the analyst retrieves, logs, tags or refuses to tag, and reports what changed.
• Daily: a period brief from the log since the previous brief (or 24 hours if unknown), at most 1,000 words. Standing warnings that did not move are omitted; silence means they stand.
• Standing ingest: S2 Underground WIRE (daily) and Forward Observer Early Warning (weekdays; Friday economic as its own product). Scheduled. Identifiers, mail paths, and hosts are omitted here.
• Scored windows: a time-bounded call at likely or higher with a window of 30 days or less is frozen as a card. Hit on the outcome indicator; miss at window close. A miss on the first live test is a process failure, not within-error-bar.

What is not a model job

Pre-defined indicators, watch bars, and the likelihood ladder are standing orders, not prompts the model is free to reinterpret per session. Stretching a tag to have one is a miss. A single deniable accident does not fire the cluster rule. Remixes are not sources. The PDF builder does not “write” the brief; it typesets the markdown the analyst already wrote.

The model can still fail those orders. The control is the files plus the principal, not a second model checking the first.

Isolation and this packet

This profile is separated from every other agent on the machine. The live observation log, ingest plumbing, credentials, and internal endpoints are not in this packet. The sample brief, the board, the standing orders, and one public-source log entry are. That is enough to judge the analytic system; it is not a clone of the running shop.