Skyview CIE — Communications Intelligence Engine v2.6 Operational Intake + Conversations

Founder/Admin Communications Intelligence Lab

Shared global communications-intelligence environment for lawful, authorized communications metadata, device history, location observations, entity resolution, relationship analysis, and evidence-backed temporal reconstruction. The Founder/Admin Lab is the first validation surface, not a scale limit.

Global Number Capacity

∞

architecture not capped

Founder Test Seed

1

+1 332-250-6348

Numbering Scope

GLOBAL

E.164 + national context

Country Context

ITU

country code aware

Source Classes

OPEN

adapter-based global ingest

Provenance Coverage

100%

every normalized claim traced

Shared Engine Capability Stack

CIE CORE

ACQUIREauthorized exports, device records, account data, test telemetry

PARSEprovider-specific adapters and file/API interpretation

NORMALIZEcommon event, number, device, identity and location schema

RESOLVEnumber ↔ person ↔ device ↔ account ↔ place relationships

ANALYZEtimeline, network, co-location, recurrence, geofence, relationship scoring

PROVEsource lineage, confidence, timestamps, hash/evidence references

Global Seed / Founder Test Health

CONTROLLED

Authorization

Founder number explicitly authorized for testing

Identity Resolution

Founder seed entity created; additional subjects unrestricted

Temporal Coverage

Open-ended temporal model; test windows configurable

Location Coverage

Location sources optional and independently authorized

Evidence Rule

no derived claim without source pointer + confidence

Remote Workflow

global intake → verify authority → normalize number → ingest → resolve → analyze

Recent Normalized Activity

SIMULATED LAB DATA

13:02:18

CIE-TEST-000001 ↔ GLOBAL-004 communication event

Call metadata normalized from authorized test export · duration 03:42 · confidence 1.00

12:44:51

GLOBAL-003 entered test geofence G-02

Consented device location observation · horizontal accuracy 18 m · confidence 0.94

12:17:09

New number-to-device relationship confirmed

GLOBAL-006 ↔ DEV-009 via matching authorized account and device export fields

11:58:26

GLOBAL-002 ↔ GLOBAL-007 recurring contact pattern updated

7 qualifying events inside current proof window · relationship score 0.82

Architecture Guardrails

LOCKED FOR v0.1

Shared Engine

CIE remains reusable by SecureSight, defense/government systems and Founder/Admin research.

Data Separation

Source record, normalized observation and analytic inference remain distinct objects.

No Silent Merge

Entity merges require explicit evidence and retain merge history.

Temporal First

Every observation carries observed, effective and ingested timestamps where available.

Evidence First

Every relationship, geofence hit and derived pattern points back to supporting observations.

Access Authority

FOUNDER / ADMIN SUPREME

Founder/Admin

Highest CIE internal authority · no internal authorization or case-approval gate

Government

Operational deployment tier · requires case/authority validation

Professional / Analyst

Paid private tiers with scoped capabilities

Public

Open-facing intelligence surface

Global Number Intelligence Lab

The lab supports unrestricted authorized test subjects under a global number model. The first seeded record is the Founder/Admin's own NYC number, normalized to E.164. Additional domestic or international numbers can be added without redesign.

Selected Subject

CIE-TEST-000001

Proof Checks

GLOBAL MODEL READY

Authorized Source Matrix

Source classes define what CIE can ingest when a lawful/authorized record is actually available. This layer describes capability, not guaranteed access.

Carrier / Account Exports

Call-detail records, account-owned metadata, line/device associations where provided by the authorized source.

Consented Device History

Location history, call metadata and app/device records supplied by participating test devices.

Forensic / Backup Exports

Lawfully obtained backups or forensic extractions mapped into evidence-preserving parsers.

MDM / Test-Agent Telemetry

Controlled device telemetry for validating event, device and location normalization.

Contact / Address Books

Consented contact metadata used for number naming and relationship corroboration.

Subscriber-Supplied Records

Bills, screenshots, exports and records supplied directly by the account/record holder.

Open Reference Intelligence

Non-sensitive reference context and canonicalization support; never treated as sole proof of private activity.

Government / Restricted Inputs

Reserved adapter class for authorized institutional deployments; disabled in Founder/Admin v0.1.

Source Handling Contract

EVIDENCE FIRST

source_record → immutable intake metadata raw_artifact → original or referenced evidence object parser_run → adapter + version + timestamp + result normalized_observation → common CIE schema entity_link → evidence-backed number/person/device/account/place association analytic_claim → derived result + supporting observation IDs + confidence provenance_chain → complete lineage back to source_record / raw_artifact

Canonical Number / Entity Model

CIE treats a phone number as an identifier that may change hands over time—not as a permanent person identity. Ownership, control, device association and observed usage are temporal relationships.

Phone Number

number_id

stable internal UUID

e164

canonical international form

country_code

ITU-T E.164 country calling code

national_number

country-aware national significant number

region_context

numbering-plan / service / portability context

valid_from / to

temporal assignment window

verification

claimed / observed / verified

Entity

entity_id

person / organization / account

names

aliases + source-backed variants

roles

subscriber / user / contact / owner

confidence

per relationship, not global identity certainty

merge_history

reversible, auditable entity resolution

Device / Account / Place

device_id

IMEI/serial/hash when lawfully supplied

account_id

provider/account context

place_id

canonical location/geofence object

relationships

typed, temporal and evidence-backed

provenance

source IDs on every association

Canonical Relationship Types

SUBSCRIBER_OF USES_NUMBER USES_DEVICE ASSIGNED_TO CONTACTED CO_LOCATED_WITH OBSERVED_AT MEMBER_OF_ACCOUNT ASSOCIATED_WITH

Global Numbering Standard

NO FIXED NUMBER LIMIT

Canonical storage

E.164 form when valid/known, preserving source formatting separately

International support

country calling codes, variable-length national numbers, service codes and portability context

Source value

original dialed/displayed number retained exactly as observed

Normalization

parse with country/region context; never infer identity from number format alone

Temporal ownership

subscriber/user/device associations are time-bounded and evidence-backed

Scale

single Founder number → thousands/millions of numbers without schema change

Phone Timeline

Unified temporal reconstruction across communications, device, account and location observations. Derived events remain visually distinguishable from direct observations.

Unified Event Stream

OBSERVED + DERIVED

Temporal Rules

observed_at

when event/location occurred

effective_from/to

for assignment or state intervals

ingested_at

when CIE received the record

source_timezone

preserved before normalization

precision

exact / minute / hour / day / inferred window

event_type

CALL, SMS, LOCATION, DEVICE, ACCOUNT, RELATIONSHIP

Communications Network Graph

Relationship edges are backed by normalized communication events. Edge thickness represents observed interaction density inside the selected proof window.

Communications Relationship Network

72-HOUR WINDOW

Communications Conversation Explorer

Skyview-native conversation analysis surface for authorized communications data. This mixes in some of the deeper chat-analysis feel from your reference while remaining a CIE product surface — conversation list, threaded content, participants, timing, and evidence details tied back to source artifacts and normalized communication events.

★

Favorites

⌖

Locations

👤

Contacts

✉

Messages

☎

Calls

🗓

Calendar

📸

Media

🧭

Commands

⚙

Config

ℹ

Device Info

Chats

AUTHORIZED VIEW

	Type	Timestamp	Participants
★	SMS	2026-09-13 11:47	Founder ↔ Contact A
★	App	2026-09-13 10:22	Founder ↔ Contact B
★	SMS	2026-09-13 08:31	Founder ↔ Contact C
★	MMS	2026-09-12 15:02	Founder ↔ Contact A
★	App	2026-09-12 13:45	Founder ↔ Group-01
★	SMS	2026-09-11 18:20	Founder ↔ Contact D

Conversation

THREAD VIEW

2026-09-13 08:21 · Contact C

Meeting window discussed. Route timing suggests a possible overlap with the G-02 corridor visit cluster.

2026-09-13 08:24 · Founder

Acknowledged. Timeline event can be aligned with the geospatial playback frame and communications sequence.

2026-09-13 08:27 · Contact C

Location pin shared for later review. Treat as source content and preserve original metadata.

2026-09-13 08:31 · Founder

Understood. Relationship, timeline and location support should stay linked under the same evidence chain.

2026-09-13 08:35 · System note

Message content shown here is demonstration text for the interface. In production, authorized message artifacts, timestamps, source app, attachments and normalization status appear here.

Details

EVIDENCE

Conversation ID

CONV-00041

Participants

Founder · Contact C

Source app

SMS / authorized export

Artifacts

MSG-00211 to MSG-00215

Attachment refs

1 possible location pin / no binary opened

Temporal support

Timeline events aligned

Geo support

linked to playback frame 2026-09-13 08:31

Relationship edge

CONTACTED / recurring

Integrity

raw artifact retained; normalized messages linked

Analyst note

Conversation Explorer should bridge chat, calls, attachments, locations and entities in one thread view.

Conversation Intelligence Model

SKYVIEW NATIVE

conversation

thread-level object containing participants, source-app context, message references, time bounds and case relationships

message_event

individual communication object with sender, recipients, body, attachment refs, timestamps, deletion/recovery state and provenance

communication_linkage

maps calls, chats, files, locations, contacts and entities into one cross-evidence thread

thread intelligence

detects recurrence, meeting arrangements, shared locations, file-sharing and entity overlap patterns

important rule

CIE does not become a clone. It adopts useful depth: tri-pane review, detail fidelity, evidence support and cross-linked intelligence.

Full Geospatial Stack

CIE geospatial intelligence now spans raw GPS heat signatures, route reconstruction, historical playback, multi-target co-location, recurring place inference, source-fusion scoring, geofence intelligence and Belize-ready operational layering. The map is only one surface; the geospatial stack is the larger system behind it.

GPS observations

0

awaiting ingest

Geofences

3

configured surface

Playback range

72h

demo operational window

Co-location groups

4

mock analytic clusters

Recurring places

5

home/work/stay candidates

Source fusion

4-LAYER

GPS · Wi‑Fi · cell · app

Historical playback: 2026-09-12 08:00 2026-09-13 14:30 current frame 2026-09-14 18:00

FDR-001

ROUTE-02

DWELL-01

MEET-03

WORK-CAND

Playback / targetsLive frame

FDR-001

Last frame · 13:42 · GPS weighted

›

DEV-003

Co-location overlap · 12 min

›

LOC-011

Recurring place candidate · 4 visits

›

GPS observations

Route reconstruction

Co-location signals

Cell-site layer

Stay-point inference

Map mode: weighted intelligence

Playback Frame

CaseCIE-FDR-000001

Target+13322506348

Current frame2026-09-13 14:30

Confidence modeWeighted

Movement stateTransit → dwell

Source Fusion

Layer	Role	Weight
GPS	Primary coordinate source	1.00
Wi‑Fi	Indoor/place corroboration	0.71
Cellular	Fallback / broad area	0.48
App-derived	visit & semantic cues	0.66

Recurring Place Inference

Home candidate

LOC-004 · strongest overnight dwell pattern

Work candidate

LOC-011 · recurring weekday daytime concentration

Meeting node

LOC-019 · repeated short overlap windows

Belize Layer Readiness

Operational concept

Belize districts, villages, roads, ports, telecom and national geofences can be layered without changing the geospatial engine.

Projection use

Belize government, national security, telecom analysis, transportation and cross-border intelligence.

Multi-Target Co-Location Intelligence

OVERLAP ANALYSIS

CL-001 · G-02 Corridor

Targets

FDR-001 · DEV-003 · MEET-04

Overlap

12 min shared presence

Support

GPS + route timing + visit sequence

CL-002 · Southwest Node

Targets

FDR-001 · LOC-019

Pattern

Repeated short-duration meet behavior

Score

0.84 derived confidence

Rule

Co-location requires temporal overlap + spatial proximity + supporting source accuracy, not just two points on the same map.

Device Path Reconstruction

ROUTE STACK

Seq	Segment	Mode	Support	State
01	North cluster → Central grid	Transit	GPS primary	OBSERVED
02	Central grid → G-02 corridor	Transit	GPS + Wi‑Fi context	CORROBORATED
03	G-02 corridor	Dwell	GPS cluster + time window	INFERRED STAY
04	G-02 corridor → Work candidate	Transit	Weighted route reconstruction	DERIVED

Reconstruction rule

Gaps, jumps and sparse areas must remain visually obvious; CIE should never imply continuous travel where the evidence only supports partial path reconstruction.

Historical Playback & Stay Detection

TIME-AWARE

08:14

Movement begins from overnight cluster

Potential home-candidate departure window · supporting overnight dwell pattern

09:06

First geofence entry recorded

G-01 enter · GPS source · route segment initiated

11:53

Primary dwell state at G-02 corridor

Weighted dwell threshold exceeded · visit classified as significant

14:30

Playback frame on current surface

Transition from dwell → transit toward recurring work candidate

Stay-point logic

minimum duration + spatial compactness + reappearance frequency + time-of-day profile

Belize Operational Projection

NATIONAL READY

Administrative layers

districts, cities, villages, constituencies, border zones, maritime/port areas and critical infrastructure

Transport overlays

highways, feeder roads, water crossings, airports, bus terminals and movement corridors

Telecom overlays

cell sectors, tower footprints, service coverage and communications-network context where authorized

Use cases

communications intelligence, public safety, national investigations, border monitoring and evidence-backed movement reconstruction

Engine rule

Belize is a projection layer, not a one-off design. The geospatial engine stays global while supporting Belize-specific operational intelligence.

Geofence Event Table

PROVENANCE ATTACHED

Time	Target	Fence	Event	Source	Confidence
2026-09-13 09:06	DEV-003	G-01	ENTER	GPS	0.92
2026-09-13 09:42	DEV-003	G-01	EXIT	GPS	0.91
2026-09-13 11:53	FDR-001	G-02	ENTER	GPS + Wi‑Fi	0.95
2026-09-13 12:11	FDR-001	G-02	EXIT	GPS + Wi‑Fi	0.94
2026-09-12 16:20	MEET-04	G-03	DWELL WINDOW	Derived	0.84

Geospatial Stack Rules

FULL STACK

Modes

Heatmap, pins, routes, co-location, stay points, source-fusion and playback modes should be switchable without changing the underlying evidence model.

Observed vs derived

Raw coordinates, fused coordinates, visit clusters, home/work inference and route reconstruction remain analytically distinct.

Source layering

GPS, Wi‑Fi, cell-site, app-derived and user-supplied coordinates should retain separate trust characteristics.

Playback

Every map frame should be reproducible from a defined time window, target set, filters and versioned geospatial logic.

Belize projection

National mapping layers, border/crossing intelligence and local administrative overlays can be mounted on the same engine without sacrificing global standards.

No false precision

Sparse source points, low-accuracy cell estimates and inferred routes must remain visually distinguishable from precise GPS traces.

Geospatial Data Model

INGESTION-READY

Core Observation Layer

geo_source_session

one acquisition/ingest session from a location-capable source

geo_observation

atomic coordinate/time observation with source accuracy and metadata

geo_artifact_link

original artifact / record pointer supporting the observation

Derived Geospatial Layer

geo_track_segment

ordered route/path reconstruction segment

geo_stay_point

dwell/stay inference with duration and compactness metrics

geo_place_candidate

home/work/meeting/recurring place candidate object

Operational Intelligence Layer

geo_geofence

defined boundary/polygon/circle with metadata and purpose

geo_geofence_event

enter/exit/dwell transitions tied to source observations

geo_colocation_event

multi-target overlap event with spatial + temporal support

Geospatial Ingestion Pipeline

SOURCE → INTELLIGENCE

1. REGISTERsource class, authorization, target entity/device and acquisition context

2. INGESTcapture raw exports/artifacts and integrity references without mutation

3. PARSEadapter extracts coordinates, times, place hints, accuracies and source fields

4. NORMALIZEconvert to canonical geo_observation objects with full provenance

5. DERIVEtracks, stays, places, co-location, geofence and fusion runs

6. PROJECTplayback, maps, reports, Belize layers and application surfaces

Supported source families

device location history, app exports, EXIF/media coordinates, cloud/account history, Wi‑Fi observations, cell/network context and user-supplied authorized records.

Canonical Geo Observation Schema

EXAMPLE

geo_observation - observation_id - source_session_id - subject_entity_id - source_type # gps / wifi / cell / app / exif / user-supplied - observed_at - source_timezone - latitude - longitude - altitude - horizontal_accuracy_m - vertical_accuracy_m - speed_mps - bearing_deg - source_place_hint - original_source_path - raw_record_pointer - integrity_ref - parser_run_id - confidence - verification_state - ingested_at

Derived Objects & Playback Model

TIME-AWARE

Object	Purpose	Key Inputs
geo_fusion_run	weighted source fusion for map frame / track generation	GPS + Wi‑Fi + cell + app signals
geo_track_segment	reconstruct route segments while preserving gaps	ordered geo_observation set
geo_stay_point	identify dwell behavior and visit windows	time + spatial compactness
geo_place_candidate	home/work/meeting/other recurring place inference	repeat visits + time profile
geo_playback_frame	reproducible UI time frame for historical review	filters + target set + logic version
geo_colocation_event	multi-target overlap event	temporal overlap + proximity + accuracy

Playback rule

Every rendered frame should be reproducible from defined source observations, filters, confidence mode, logic version and target set.

Belize Map-Layer Architecture

PROJECTION LAYER

geo_map_layer - layer_id - name - scope # global / country / belize / city / case - geometry_type # point / line / polygon / raster / sector - source_reference - layer_class # admin / transport / telecom / critical-infra / border - style_profile - effective_from / to - provenance_ref Examples: - Belize districts - Villages / towns / cities - Road and transport corridors - Ports / airports / border zones - Tower / sector coverage where authorized - Protected facilities / national assets

Evidence / Provenance

CIE preserves the distinction between raw evidence, parsed fields, normalized observations and analytic conclusions. A conclusion without traceable supporting observations is not accepted into the evidence layer.

Claim Trace Example

FULL LINEAGE

Claim

REL-00017 · CIE-TEST-000001 CONTACTED GLOBAL-004

Claim type

directly observed relationship event

Normalized observation

OBS-004271 · CALL · 2026-09-14T13:02:18−06:00

Parser run

PARSE-00098 · carrier_csv_adapter v0.1

Raw artifact

ART-00012 · authorized_test_export_03.csv · SHA-256 recorded

Source record

SRC-00003 · account-holder supplied export · authorization verified

Confidence

1.00 for communication event; identity links scored separately

Required Provenance Fields

source_record_id raw_artifact_id source_type authorization_basis acquired_at parser_name parser_version parser_run_id normalized_observation_id source_field_map time_normalization confidence supporting_observation_ids[] hash / integrity reference analyst/system action history

Verification States

RAW

received, not interpreted

PARSED

fields extracted by known adapter

NORMALIZED

mapped to common CIE schema

CORROBORATED

supported by multiple independent observations

DERIVED

analytic inference; support links mandatory

DISPUTED

conflicting evidence preserved, not overwritten

Digital Forensics Workbench

Deep evidence workbench for authorized device, backup, account, carrier and exported-data examinations. Source artifacts remain immutable; parsed records, normalized observations and analytic findings are separate layers.

CASE CIE-FDR-000001 Founder seed +13322506348 Evidence integrity ON Chain-of-custody ON No device extraction loaded yet

Analyzed DataGLOBAL

Communications0

Calls0

SMS / MMS0

Contacts0

Voicemail0

Devices & NetworksREADY

Devices0

SIM / eSIM0

Wi‑Fi0

Bluetooth0

Cellular Context0

Location IntelligenceREADY

Location Records0

Geofences0

Routes / Movement0

Co-location0

ApplicationsPARSER SET

Messaging Apps0

Email Accounts0

Browsers0

Cloud / Sync0

ArtifactsREADY

Media0

Documents0

Archives0

Deleted / Recovered0

Artifacts

0

awaiting authorized source

Parsed Records

0

adapter output

Recovered Records

0

deleted / reconstructed

Integrity

READY

hash + audit chain

Founder Case Intake

AUTHORIZED SEED

Case

CIE-FDR-000001

Founder number

+1 332-250-6348 · canonical +13322506348

Current state

Identity/number seed registered; no fabricated communications or device artifacts inserted.

Next evidence

Authorized phone export, backup, carrier/account export, device telemetry, or other supplied source.

Evidence Inspector

Selection

Founder number seed

Canonical

+13322506348

Type

Phone Number Identifier

Source

Founder supplied

Authorization

Owner-authorized test record

Verification

Verified as supplied seed; activity not yet ingested

Hash

N/A — identifier record, not binary artifact

Created

2026-09-14

Analytic Actions

Media Intelligence & Classification

Evidence-oriented media indexing for authorized extractions. CIE stores classification results as analytic metadata and preserves the original artifact, source path, integrity hash, timestamps and parser/model version.

MediaCLASSIFIERS

Images0

Video0

Audio0

Screenshots0

Documents0

ClassificationEXTENSIBLE

Faces0

Photo IDs0

Vehicles0

Maps0

Handwriting0

Invoices / Receipts0

Evidence slot 01

Evidence slot 02

Evidence slot 03

Evidence slot 04

Evidence slot 05

Evidence slot 06

Evidence slot 07

Evidence slot 08

Evidence slot 09

Evidence slot 10

Classification Engine

Faces

Vehicles

Documents

Maps

Screenshots

Handwriting

Photo IDs

Receipts

Devices

Required Artifact Detail

Source path

preserved verbatim

Filesystem

source volume + logical path

Timestamps

created / modified / accessed / deleted where available

Integrity

SHA-256 + optional MD5 compatibility

Classifier

model/version/confidence recorded

File Systems & Artifact Explorer

Deep traversal of authorized extraction containers, backups, logical filesystems, application sandboxes, databases and recovered/deleted artifacts with source-path fidelity.

Filesystem Tree

NO SOURCE LOADED

/ extraction-root0

user / application data0

databases0

media0

documents0

system artifacts0

deleted / recovered0

Artifact Contract

FORENSIC

Path fidelity

Never replace the original source path with a normalized display path.

Container

Track volume/image/backup/container of origin.

Recovery state

allocated / deleted / carved / reconstructed / partial.

Database origin

table, row/key, WAL/journal context where available.

Integrity

Artifact hash and extraction hash stored independently.

Extraction Manager

Central registry for authorized source acquisitions. CIE can ingest logical exports, backups, carrier/account records, MDM/test telemetry, forensic extraction outputs and cloud/account exports through versioned adapters.

Extraction Registry

ADAPTER-BASED

ID	Case	Source Type	Subject	State	Integrity	Parser
EXT-SEED-0001	CIE-FDR-000001	Founder-supplied identifier	+13322506348	REGISTERED	N/A	identity_seed v0.3
—	—	Device / Backup / Carrier / Cloud	—	AWAITING SOURCE	—	—

Acquisition

Case ID · authorization · source owner/custodian · acquisition method · acquisition time · operator · tool/version · source identifiers.

Integrity

Whole-artifact SHA-256 · optional compatibility hashes · manifest · parser-run linkage · immutable original reference.

Processing

Adapter → parser → normalization → entity resolution → indexing → timeline → network → media → evidence support.

Reports / Case Export

Case-grade outputs preserve what was observed, what was derived, the supporting evidence, verification state, source lineage and analyst/system actions.

Evidence Report

Source inventory, integrity hashes, artifacts, normalized observations, provenance chains and chain-of-custody entries.

Communications Report

Calls/messages, number normalization, participants, temporal patterns, network relationships and source references.

Location Report

Location observations, source accuracy, geofence entries/exits, movement windows, co-location findings and confidence.

Case Export Rules

AUDITABLE

Observed vs derived

Always separated in generated output.

Timestamps

Original timezone and normalized timezone retained.

Confidence

Per claim/relationship, with supporting evidence IDs.

Redaction

Projection/report-level redaction without mutating underlying evidence.

Audit

Every report generation event logged with version and filters.

Ingestion Architecture

Adapter-based design keeps CIE reusable across Skyview products. Application projections consume normalized CIE intelligence rather than parsing source systems independently.

Shared CIE Pipeline

APPLICATION-AGNOSTIC

NUMBER REGISTRYE.164, source form, country plan, temporal assignment, portability context

SOURCE REGISTRYsource identity, authorization, scope, freshness, retention

INTAKEimmutable record + artifact pointer + integrity metadata

ADAPTERSCSV, JSON, device export, backup, API/test-agent adapters

NORMALIZERevents, numbers, entities, devices, accounts, places, timestamps

ENTITY RESOLUTIONtemporal links + confidence + merge history

INTELLIGENCEtimeline, network, recurrence, geofence, co-location, patterns

EVIDENCElineage, hashes, source pointers, supporting observations

PROJECTIONSSecureSight / government / defense / Founder Lab / future apps

Core Tables / Collections

cie_sources cie_authorizations cie_artifacts cie_parser_runs cie_numbers cie_entities cie_devices cie_accounts cie_places cie_observations cie_relationships cie_geofences cie_geofence_events cie_geo_source_sessions cie_geo_observations cie_geo_track_segments cie_geo_stay_points cie_geo_place_candidates cie_geo_fusion_runs cie_geo_playback_frames cie_geo_colocation_events cie_geo_map_layers cie_analytic_claims cie_claim_support cie_provenance cie_audit_log

Remote-Number Workflow

v0.1

STEP 01

Register target number / test subject

Create internal number record; no identity assumption.

STEP 02

Record authorization and source scope

Define what data is supplied and by whom.

STEP 03

Ingest authorized records

Preserve raw source, acquisition metadata and integrity reference.

STEP 04

Normalize and resolve

Canonicalize numbers, entities, devices, accounts, locations and time.

STEP 05

Analyze and project

Generate timeline, graph, geofence and relationships with evidence lineage.

Backend Schema Specification

Implementation-ready canonical schema groups for CIE. The model separates acquisition, raw artifacts, normalized communications, entities, geospatial observations, derived intelligence, provenance, access control and application projections.

Core Case / Evidence Tables

CANONICAL

Table	Purpose	Primary Keys / Important Fields
cie_cases	Top-level case container	case_id, title, jurisdiction, owner_org, classification, status, opened_at
cie_case_subjects	Subjects/targets linked to a case	case_subject_id, case_id, entity_id, role, authorization_scope
cie_sources	Source registry	source_id, source_type, custodian, acquisition_basis, provider, region
cie_authorizations	Authority/consent boundaries	authorization_id, case_id, subject_id, scope, valid_from, valid_to, document_ref
cie_artifacts	Raw evidence artifact registry	artifact_id, source_id, case_id, path, mime_type, size, sha256, acquired_at
cie_artifact_manifests	Collection/extraction manifest	manifest_id, extraction_id, tool, version, operator, created_at
cie_parser_runs	Versioned parser execution	parser_run_id, adapter_name, version, artifact_id, started_at, completed_at, state
cie_audit_log	Immutable system/analyst action log	audit_id, actor_id, action_type, object_type, object_id, occurred_at

Canonical Entity / Communications Tables

GLOBAL

Table	Purpose	Primary Keys / Important Fields
cie_entities	Person/org/account/unknown actor	entity_id, entity_type, display_name, verification_state
cie_entity_names	Aliases and source-backed name variants	entity_name_id, entity_id, value, source_ref, confidence
cie_numbers	Global phone identifier registry	number_id, e164, source_value, country_code, national_number, region_context
cie_devices	Device registry	device_id, platform, model, imei_hash, serial_hash, source_ref
cie_accounts	Carrier/app/account registry	account_id, provider, external_account_ref, owner_entity_id
cie_relationships	Typed temporal entity links	relationship_id, type, subject_id, object_id, valid_from, valid_to, confidence
cie_conversations	Thread-level communications object	conversation_id, source_app, started_at, ended_at, participant_count
cie_messages	Individual message event	message_id, conversation_id, sender_entity_id, sent_at, body_ref, deletion_state
cie_calls	Call event	call_id, from_number_id, to_number_id, started_at, duration_s, disposition
cie_attachments	Communications attachment linkage	attachment_id, message_id, artifact_id, attachment_type

Geospatial + Analytic Tables

DERIVED SEPARATELY

Table	Purpose	Key Fields
cie_geo_source_sessions	One geospatial source ingest/extraction session	session_id, source_id, subject_id, started_at, ended_at, adapter_version
cie_geo_observations	Atomic observed coordinate/time facts	observation_id, lat, lon, accuracy_m, source_type, observed_at, provenance_ref
cie_geo_track_segments	Route/path reconstruction segments	segment_id, start_obs_id, end_obs_id, gap_state, confidence
cie_geo_stay_points	Dwell/stay inference	stay_id, centroid_lat, centroid_lon, start_at, end_at, radius_m, confidence
cie_geo_place_candidates	Home/work/meeting/recurring place candidates	place_candidate_id, class, recurrence_count, time_profile, confidence
cie_geo_geofences	Circle/polygon intelligence boundary	geofence_id, geometry, purpose, effective_from, effective_to
cie_geo_geofence_events	Enter/exit/dwell transitions	event_id, geofence_id, subject_id, event_type, occurred_at, confidence
cie_geo_colocation_events	Multi-target spatiotemporal overlap	event_id, window_start, window_end, proximity_m, support_count
cie_analytic_claims	Derived intelligence claim	claim_id, claim_type, subject_id, confidence, verification_state
cie_claim_support	Observation/artifact support graph	claim_id, support_object_type, support_object_id, weight
cie_provenance	Lineage chain	provenance_id, object_type, object_id, source_record_id, artifact_id, parser_run_id

Source Adapter Matrix

CIE ingests multiple authorized source families through versioned adapters. Adapters map provider/tool-specific fields into stable Skyview canonical objects while preserving original values and source paths.

Adapter Registry

EXTENSIBLE

Adapter

Source Family

Canonical Output

State

Priority

identity_seed

Founder/Admin

Number + entity seed + authorization metadata

READY

P0

carrier_csv

Carrier/account export

Calls, SMS metadata, number assignments, account/device relations

SPEC

P0

device_location_json

Consented device history

geo_source_session + geo_observations

SPEC

P0

backup_message_db

Device backup/database

Conversations, messages, contacts, attachments

SPEC

P1

forensic_export

Tool output / extraction package

Artifacts + parsed records + file paths + integrity metadata

SPEC

P1

mdm_agent_feed

MDM/test telemetry

Device state, network context, location observations, audit events

SPEC

P1

cloud_account_export

Authorized cloud/account export

Messages, files, logins, locations, contacts

SPEC

P2

exif_media

Media metadata

Artifacts + geo observations + timestamps + device hints

SPEC

P2

wifi_history

Network/device export

Wi‑Fi network observations + place corroboration

SPEC

P2

cell_context

Authorized telecom/network context

Cell/sector observations + broad-area geo support

RESTRICTED

P3

Adapter Contract

adapter_name adapter_version source_family accepted_file_types[] accepted_schema_versions[] field_mapping_version normalization_targets[] validation_rules[] parser_warnings[] unsupported_fields[] provenance_strategy test_vectors[]

Normalization Rule

Never discard the original source value. Every normalized field must retain a source-field pointer, parser version and transformation note when a value changes representation.

Adapter Safety

Unsupported or ambiguous records should enter a quarantine/review state rather than being silently coerced into a canonical object.

API Contracts / JSON Shapes

Stable application-facing contracts let SecureSight, government deployments and future Skyview products consume CIE without depending on any one carrier, forensic tool or source format.

POST /cie/v1/ingest/source

SOURCE REGISTRATION

{ "case_id": "CIE-FDR-000001", "source_type": "carrier_export", "subject": { "entity_id": "ENT-FDR-000001", "number_e164": "+13322506348" }, "authorization_id": "AUTH-000001", "provider": "example-provider", "acquired_at": "2026-09-14T13:00:00-06:00", "artifacts": [ { "filename": "authorized_export.csv", "sha256": "…", "size_bytes": 0 } ] }

GET /cie/v1/cases/{id}/timeline

APPLICATION CONTRACT

{ "case_id": "CIE-FDR-000001", "window": { "from": "2026-09-12T00:00:00-06:00", "to": "2026-09-14T23:59:59-06:00" }, "events": [ { "event_id": "EVT-000001", "event_type": "CALL", "observed_at": "…", "participants": ["ENT-1","ENT-2"], "verification_state": "NORMALIZED", "provenance_ref": "PROV-000001" } ] }

GET /cie/v1/geo/playback

GEOSPATIAL

{ "case_id": "CIE-FDR-000001", "targets": ["ENT-FDR-000001"], "frame_at": "2026-09-13T14:30:00-06:00", "layers": ["gps","wifi","cell","app"], "mode": "weighted", "logic_version": "geo-fusion-0.1", "observations": [], "track_segments": [], "stay_points": [], "geofence_events": [], "colocation_events": [] }

GET /cie/v1/conversations/{id}

THREAD VIEW

{ "conversation_id": "CONV-000041", "participants": [ {"entity_id":"ENT-1","role":"participant"}, {"entity_id":"ENT-2","role":"participant"} ], "source_app": "sms", "messages": [], "attachments": [], "linked_events": [], "linked_locations": [], "provenance": [] }

API Design Rules

LOCKED PRINCIPLES

Versioning

All public/private application contracts use versioned endpoints and explicit schema versions.

Observed vs derived

Observed records and analytic claims never share an ambiguous payload shape.

Provenance

Every evidence-bearing object exposes a provenance reference.

Access control

Fields and endpoints are projection-aware so public, analyst, professional and enterprise/government tiers can receive different views without mutating source evidence.

Case / Evidence Object Model

CIE treats case management and evidence integrity as foundational objects, not afterthoughts. Everything analysts see must trace back through a case, authorization scope, source, artifact and parser/normalization lineage.

Casecase_id
classification
jurisdiction
owner organization
status / retention
subjects[]
authorizations[]

Evidence Artifactartifact_id
source_id
original filename/path
hashes
size / MIME
acquisition metadata
immutability state

Provenance Chainsource_record
raw_artifact
parser_run
normalized_object
analytic_claim
report/export event
audit history

Evidence State Machine

EXPLICIT

REGISTEREDEvidence source recorded with case + authorization context.

ACQUIREDArtifact received and hashed; manifest generated.

PARSEDAdapter extracted source fields using a versioned parser.

NORMALIZEDCanonical objects created without altering originals.

CORROBORATEDIndependent supporting observations increase confidence.

DERIVEDAnalytic inference built from linked support objects.

EXPORTEDReport/projection generated and audit event recorded.

Communications Data Model

One communications model supports calls, SMS/MMS, app chats, attachments, contacts, participants and conversation-level intelligence without tying CIE to one operating system or messaging platform.

Communication Objects

CANONICAL

conversation

thread container with source-app context and participants

message

individual text/content event with sender, recipients, timestamps and state

call

voice/video call event with numbers/entities, duration, direction and disposition

attachment

artifact linked to a communication event

participant

entity-number-account role inside a conversation or call

contact_record

source-native contact entry retained separately from resolved entity identity

Cross-Intelligence Linkage

SKYVIEW ADVANTAGE

message → location

location pins, EXIF, app metadata or temporal alignment can link message events to geo observations.

conversation → relationship

recurrence, directionality, response cadence and participant overlap contribute to relationship scoring.

call → network graph

calls become time-bounded network edges with source and confidence.

attachment → evidence

attachments stay tied to raw artifacts, hashes and original source paths.

thread → timeline

conversation events project onto the unified phone timeline without losing app/source context.

Belize Overlay Catalog

Belize-specific layers are application projections mounted onto the global geospatial engine. They should be source-backed, versioned and replaceable without changing CIE’s core schema.

Administrative

Districts, municipalities, villages, constituencies, protected areas and local jurisdiction boundaries.

Roads & Movement

Primary highways, feeder roads, bridges, crossings, ferry points and strategic transport corridors.

Ports & Maritime

Ports, marine terminals, waterways, maritime approach zones and coastal monitoring areas.

Airports & Airfields

International airport, municipal airports, airstrips and aviation geofences.

Border Intelligence

Official crossings, border corridors, customs/immigration points and case-defined cross-border zones.

Telecom

Carrier infrastructure, tower/sector footprints, coverage layers and service context where authorized.

Critical Infrastructure

Energy, water, communications, government, hospitals, emergency and strategically important facilities.

Public Safety

Police, fire, emergency, courts, detention and incident-response geospatial layers.

Tourism / Events

Major resorts, ports of entry, tourism districts, festivals and high-volume public gathering zones.

Education

Schools, universities and campus geofences for authorized institutional/public-safety uses.

Health

Hospitals, clinics, emergency access routes and health-facility service regions.

Case Layers

Private, case-defined polygons, routes, sites, surveillance zones and temporary operational overlays.

Overlay Metadata Contract

VERSIONED

{ "layer_id": "BZ-ROAD-PRIMARY-001", "name": "Primary Road Network", "scope": "belize", "geometry_type": "line", "source_reference": "verified source URI / dataset reference", "layer_class": "transport", "effective_from": "2026-01-01", "effective_to": null, "style_profile": "cie-transport-v1", "provenance_ref": "PROV-LAYER-001" }

Import Workflow Screens

Real ingest should be operator-friendly and evidence-safe. The workflow registers the source, validates authority, accepts artifacts, selects the adapter, previews field mappings, runs normalization and shows a manifest before intelligence becomes available.

1 · Case & Authority 2 · Source 3 · Artifact 4 · Adapter 5 · Mapping 6 · Validate 7 · Normalize 8 · Manifest

Case

CIE-FDR-000001 · Founder/Admin Test

Authorized Subject

+1 332-250-6348 · +13322506348

Authorization

Founder-owned test data · owner-authorized

Source family

Select: Carrier / Device / Backup / Cloud / MDM / Forensic Export

Artifact

No source file loaded in this visual build

Adapter

Auto-detect or operator-select versioned adapter

Integrity

SHA-256 generated before parsing

Quarantine rule

Unknown fields / ambiguous records held for review

Pre-Normalization Preview

FIELD MAPPING

Source Field	Example	Canonical Target	Transform	State
phone_number	1.332.250.6348	cie_numbers.e164	normalize → +13322506348	READY
timestamp	09/14/2026 13:02	observed_at	timezone-aware ISO-8601	REVIEW TZ
lat/lon	—	cie_geo_observations	source-specific parser	OPTIONAL
contact_name	—	cie_entity_names	retain source value + confidence	OPTIONAL

Import Validation

BEFORE COMMIT

Authorization

valid and in scope

Artifact hash

required before parser execution

Adapter compatibility

must match source family / schema version

Field mapping

all transformations previewed and logged

Warnings

operator-visible; no silent coercion

Post-Import Manifest

GENERATED

Artifact count

N

Parsed records

N

Normalized objects

N

Quarantined records

N

Created relationships

N

Provenance coverage

100% required

Number Intelligence Query

CIE’s operational starting point is a phone number — not a CSV, device backup or cooperative target. The deployment resolves and queries connected authorized sources automatically according to the operator’s permissions, case authority and source availability.

Founder/Admin query mode

NUMBER-ONLY · INTERNAL AUTHORIZATION BYPASS

Normalized / Source Returns

Ready.

Raw Connector Response

{}

Phone number

Canonical E.164

+13322506348

Query mode

Founder/Admin number-only proof

Current evidence state

Identifier registered; no live external source connectors attached in this test build.

Operational Rule

NUMBER-ONLY

Founder/Admin supplies

Phone number only

Government supplies

Phone number + required case/authority context

Target supplies

Nothing

CIE supplies

Source orchestration, normalization, entity resolution, timeline/network/geo projections and provenance

If a source is not connected

CIE reports unavailable / not authorized rather than fabricating data

Number-Only Intelligence Orchestration

DEPLOYMENT-AWARE

1. INPUTOperator enters any domestic or international phone number.

2. NORMALIZEE.164, country/plan context, source formatting preserved.

3. ACCESS CLASSFounder/Admin bypasses internal authorization gates. Government must pass case/authority validation.

4. SOURCE BROKERCIE discovers which connected sources can answer the query.

5. RESOLVENumber ↔ entity ↔ account ↔ device ↔ location relationships.

6. ANALYZECalls, messages, network graph, timeline, geospatial and co-location intelligence.

7. PROVEEvery returned fact keeps source, legal/authority scope and provenance.

CIE Access Authority Matrix

LOCKED

Grade	Internal Authorization	Case Gate	Source-Broker Visibility	System Governance
FOUNDER / ADMIN	NONE REQUIRED	BYPASS	FULL	FULL
GOVERNMENT	REQUIRED	REQUIRED	DEPLOYMENT / ROLE SCOPED	NO
PROFESSIONAL	SUBSCRIPTION / ROLE	WORKFLOW DEPENDENT	PRIVATE-TIER SCOPED	NO
ANALYST	SUBSCRIPTION / ROLE	WORKFLOW DEPENDENT	LIMITED	NO
PUBLIC	N/A	N/A	PUBLIC SOURCES ONLY	NO

Connected Source Broker

WHAT CIE QUERIES

Carrier / Telecom Records

CONNECTED WHEN AUTHORIZED

CDRs, subscriber/account associations, network events, cell-site/sector context and other records made available through an agency’s lawful process or telecom integration.

Agency Case Systems

DEPLOYMENT CONNECTOR

Prior cases, known numbers, contacts, reports, aliases and agency-owned evidence repositories.

Seized / Forensic Device Data

CASE-DEPENDENT

Extraction outputs already lawfully obtained by the agency can be indexed and linked automatically by number/entity.

Government Intelligence Sources

ROLE / AUTHORITY CONTROLLED

Restricted source adapters can be exposed only in deployments and roles that are authorized to use them.

Open / Reference Intelligence

READY

Public or reference context may support numbering-plan resolution, public identity context and corroboration, but is not treated as proof of private activity.

Telecom / Network Metadata

CONNECTOR REQUIRED

Roaming, network, tower/sector or device/network context where the connected provider or agency source legally exposes it.

Historical CIE Holdings

READY ONCE POPULATED

Any number/entity already encountered in prior authorized CIE cases becomes searchable subject to retention and access policy.

Unavailable Sources

NO SILENT GUESSING

If CIE is not connected to a source or the operator lacks authority, the source remains unavailable and no synthetic result is inserted.

Founder Test Number

CIE-TEST-000001

Input

+1 332-250-6348

Canonical

+13322506348

Role

Founder/Admin control number · supreme internal authority

Internal authorization gate

BYPASSED

Current live connectors

None in this live HostGator build

Expected production behavior

Query every authorized connected source and aggregate only returned records.

What the Analyst Sees When Sources Respond

AUTO-POPULATED

Subscriber / identity

only if returned by an authorized source

Call history

auto-populates Phone Timeline + Network Graph

Messages / chats

auto-populate Conversation Explorer where source content exists

Device/account links

populate canonical entity relationships

Location/network observations

populate GeoStack with source accuracy and provenance

Live Production Proof

CIE proof is based on connected or ingested evidence only. The proof path shows source status, actual returned record counts, correlation readiness, and provenance without inserting synthetic communications records.

BACKEND CHECKING

NUMBER INPUTCanonical E.164 number query.

SOURCE BROKERDispatch to currently configured source classes.

REAL RETURNSOnly records actually returned or already ingested.

CORRELATIONCalls, messages, devices, relationships and geo.

CLAIMSObserved facts remain separate from derived findings.

PROVENANCESource and lineage remain attached.

Founder/Admin Authorized Proof

REAL QUERY PATH

Founder number

+1 332-250-6348

Canonical

+13322506348

Proof rule

No communications, messages, geo or identity facts are fabricated when a source returns no record.

Backend / Source Status

HOSTGATOR

PHP API	checking…
Datastore	checking…
Connector registry	checking…
Audit	checking…

Source Acquisition Layer

CIE's acquisition core begins with a phone number. The engine normalizes it, checks the active access grade, dispatches the query to configured connectors, ingests returned records, resolves entities/devices/accounts, and populates call, text, relationship and geospatial intelligence with provenance.

Number → Intelligence Acquisition Pipeline

CORE ENGINE

1. NUMBERAny domestic or international phone number.

2. NORMALIZEE.164 + numbering-plan context.

3. TRUSTFounder/Admin bypass; governed roles evaluated.

4. BROKERDispatch to every enabled connector.

5. INGESTCalls, texts, devices, accounts, geo, references.

6. CORRELATEEntity + device + relationship resolution.

7. INTELLIGENCETimeline, conversations, graph, GeoStack, provenance.

Call Acquisition Object

CANONICAL

call_id

stable CIE event ID

from / to

canonical number/entity links

start / end

timezone-aware timestamps

duration / direction

source-backed event metadata

network context

carrier / route / sector fields when returned

provenance

connector + source-record + parser lineage

Text / Message Acquisition Object

CANONICAL

message_id

stable CIE event ID

participants

sender/recipient entity-number links

content

body or source reference when returned

attachments

artifact links + hashes

time / app

source app + timestamps + deletion/recovery state

provenance

connector + artifact + parser lineage

Trust Intelligence Layer

Trust Intelligence governs who, what, and which source path can exercise sensitive CIE capabilities. Founder/Admin remains the supreme internal authority; every other access class is evaluated against trust, compartment, mission, behavior and capability policy.

Founder/Admin

SUPREME

No internal CIE authorization gate. Full platform oversight and trust-policy control.

Operator Trust

DYNAMIC

Identity, role, behavior, query history, anomalies, revocations and mission context.

Source Trust

WEIGHTED

Reliability, freshness, provenance quality, conflict history and verification state.

Session Trust

LIVE

Credential state, device/session risk, network context and active anomalies.

Capability-Level Gating

NOT ROLE-ONLY

Number Resolution

Founder/Admin · trusted government · professional scopes

Call Record Intelligence

Capability-specific trust decision

Text / Conversation Intelligence

Capability-specific trust decision

High-Sensitivity Geo

Optional dual-control / compartment policy

Bulk Export

Trust threshold + audit + optional secondary approval

Revoked Session

Immediate capability shutdown and audit event

Trust Signals

Operator

identity assurance · role · training · history · revocation state

Behavior

query velocity · unusual targets · export patterns · failed access attempts

Mission

case/operation compartment · need-to-know · expiry

Source

provider trust · freshness · data-quality score · conflict rate

Claim

support count · provenance quality · corroboration · dispute state

Immutable Trust Audit

Every query

who · when · target · capability · connector set

Every decision

allow / deny / dual-control / revoke with policy version

Every export

scope · recipient · reason · filters · checksum

Every anomaly

signal · severity · response · resolution

Connector Control

Founder/Admin control plane for enabling, testing and governing live acquisition connectors. Credentials are stored server-side in the protected CIE data directory; operators query by number and do not manually upload source files.

Connector Registry

FOUNDER / ADMIN

Connector	Class	State	Capabilities	Trust
Loading…

Connector Credential Vault

SERVER-SIDE

Connector ID

Endpoint URL

API Key / Token

Capabilities

Source Capability Matrix

This matrix defines the real acquisition classes CIE is built to ingest. A phone number remains the query key; the connected source determines what records are available.

Real Acquisition Classes

PRODUCTION MODEL

Source class	Calls	SMS/MMS metadata	Message content	Device	Geo/network	Typical evidence form
Telecom CDR / Charging Records	YES	SOMETIMES	NO	NETWORK IDS	CELL/ROUTE	CDR files / carrier exports / charging records
Retained-Data Handover / Disclosure	YES	YES	DEPENDS ON SOURCE	POSSIBLE	POSSIBLE	Authorized retained-data response / disclosure
Communications-Content Repository	METADATA	YES	YES	POSSIBLE	POSSIBLE	Messaging/service repository exports
Device / Mobile Forensics	YES	YES	YES	YES	YES	Authorized forensic extraction / parsed artifacts
Enterprise / Agency Evidence Repository	IF HELD	IF HELD	IF HELD	IF HELD	IF HELD	Case/evidence system APIs and exports
Geo / Network Repository	NO	NO	NO	DEVICE LINK	YES	GPS/Wi-Fi/cell/network observations
CIE Historical Holdings	IF INGESTED	IF INGESTED	IF INGESTED	IF INGESTED	IF INGESTED	Previously normalized CIE evidence

Acquisition Semantics

QUERY KEYPhone number in canonical E.164 format.

SOURCE DISPATCHCIE queries every enabled source class available to the deployment.

Production repository for authorized mobile-forensic outputs. Once evidence has been ingested and indexed, the operator can continue using CIE's number-only query workflow; the target does not interact with CIE.

Repository Intake

FOUNDER / ADMIN

Accepted format

CIE forensic JSON bundle / ALEAPP-iLEAPP normalized export

Purpose

Index real call, message, device and geo artifacts by phone number

Repository Status

REAL HOLDINGS

Bundles	checking…
Calls	checking…
Messages	checking…
Geo	checking…
Indexed numbers	checking…

Indexed Evidence Sources

Bundle	Case	Source	Numbers	Calls	Messages	Geo	Imported
No repository data loaded.

Telecom CDR + Retained-Data Repository

Production intake for authorized telecom call-detail records and retained-data disclosures. CIE indexes records by phone number and correlates them with existing forensic and internal holdings.

Telecom / Retained-Data Intake

FOUNDER / ADMIN

Accepted

CIE telecom JSON bundle · 3GPP-like CDR export · retained-data normalized export

Indexes

subject numbers · counterparties · call events · SMS metadata · network context

Repository Status

REAL HOLDINGS

Bundles	checking…
Calls	checking…
SMS metadata	checking…
Indexed numbers	checking…

Indexed Telecom Sources

Bundle	Case	Source	Numbers	Calls	SMS Meta	Imported
No telecom data loaded.

Correlation Intelligence

CIE correlates telecom CDR/SMS metadata, forensic calls/messages, geo evidence, and internal holdings around a phone number to produce a unified communications timeline and relationship model.

0Unified events

0Counterparties

0Cross-source matches

0Source classes

Relationship Intelligence

SOURCE-AWARE

Counterparty	Calls	Messages	First seen	Last seen	Sources	Strength
Run correlation.

Cross-Source Corroboration

EVIDENCE

Type	Counterparty	Time	Sources	Confidence
Run correlation.

Unified Communications Timeline

CALLS · SMS · MESSAGES · GEO

Run correlation to build the unified timeline.

Entity + Device Resolution

CIE resolves phone numbers, devices, SIMs, accounts, persons/entities and recurring counterparties into a single communications identity graph. Observed links and inferred links remain separately labeled with confidence and provenance.

0Entities

0Devices

0SIM / IMSI

0Accounts

0Resolved links

Resolved Identity Graph

SOURCE-AWARE

Run resolution.

Resolution Evidence

OBSERVED / INFERRED

From	Relation	To	Basis	Confidence
Run resolution.

Resolved Objects

ENTITY · DEVICE · SIM · ACCOUNT

Type	ID	Display	Source	Verification
Run resolution.

Geo-Identity Fusion

CIE fuses location observations with resolved phone numbers, SIMs, devices and entity links. Precise GPS, network-derived observations and inferred place candidates remain visibly distinct.

0Observations

0Recurring places

0Track segments

0Co-locations

0Geofence events

Resolved Geo Objects

SOURCE-AWARE

Run geo fusion.

Recurring Places

INFERRED

Place	Visits	First	Last	Basis	Confidence
Run geo fusion.

Co-location Intelligence

ENTITY / DEVICE

Counterparty	Time	Distance	Source	Confidence
Run geo fusion.

Geofence Events

ENTER / EXIT

Geofence	Event	Time	Location	Source
Run geo fusion.

Geo Movement Timeline

GPS · CELL · WIFI · APP

Run geo fusion.

Unified Intelligence Case View

Single operational surface for a number/case. CIE assembles communications, relationships, entity/device resolution, geospatial intelligence, corroboration, trust state, and provenance into one evidence-aware view.

0Calls

0Messages

0Counterparties

0Devices / SIMs

0Geo observations

0Corroborated

Unified Timeline

LIVE CASE ASSEMBLY

Load a case.

Resolved Identity / Devices

OBSERVED + INFERRED

Load a case.

Top Relationships

Counterparty	Calls	Messages	Strength
Load a case.

Geo Intelligence

Place / Event	Count	Confidence
Load a case.

Corroboration

Type	Counterparty	Sources	Confidence
Load a case.

Trust Intelligence

CONTROL PLANE

Load a case.

Evidence / Provenance Summary

SOURCE LINEAGE

Load a case.

Case Management + Evidence Export

Convert a number-centered intelligence picture into a formal CIE case with subjects, status, notes, evidence inventory, audit state, and exportable provenance manifests.

Create / Update Case

FOUNDER / ADMIN

Case ID

Status

Primary Number

Priority

Case Title

Subjects / Notes

Case Export

MANIFEST + PROVENANCE

Selected Case

None

{}

Case Registry

PERSISTENT

Case	Title	Number	Status	Priority	Evidence	Updated
Loading…

Trust Enforcement + Multi-User Control

Operational Trust Intelligence control plane for user identity, role, compartments, session trust, capability access, revocation, dual-control and audit enforcement.

0Users

0Active

0Revoked

0Policies

0Dual-control pending

User / Trust Profile

FOUNDER / ADMIN

User ID

Display Name

Role

Status

Trust Score

Compartments

Capability Check

ENFORCED

User ID

Capability

Case / Compartment

User Registry

User	Role	Status	Trust	Compartments	Last Update
Loading…

Pending Dual-Control Requests

Request	User	Capability	Target	Status
Loading…

Session Security + Behavior Anomaly Detection

CIE continuously evaluates session trust and operator behavior. Abnormal query velocity, repeated denials, unusual target access, export spikes, compartment violations and revoked sessions generate trust events and can reduce or terminate access.

0Active sessions

0Suspicious sessions

0Revoked sessions

0Open anomalies

0Critical anomalies

Session Control

TRUST-AWARE

User ID

Session Label

Initial Trust

State

Anomaly Scan

BEHAVIOR ENGINE

Signals

query velocity · denials · target novelty · export spikes · compartment failures · session state

Actions

flag · downgrade trust · suspicious state · revoke session · audit

Sessions

Session	User	State	Trust	Last Seen
Loading…

Anomalies

Severity	User / Session	Signal	Score	Status
Loading…

Source Trust + Data Quality Intelligence

CIE evaluates the reliability of every source feeding the engine. Trust now includes freshness, provenance completeness, parser health, conflict rate, corroboration history, evidence integrity and observed source performance.

0Sources scored

0High trust

0Open conflicts

0Low quality

0Parser healthy

Source Quality Profile

FOUNDER / ADMIN

Connector ID

Base Trust

Freshness Score

Provenance Score

Parser Health

Integrity Score

Quality Scan

EVIDENCE-AWARE

Signals

freshness · parser success · provenance completeness · integrity · conflicts · corroboration

Outcome

effective trust · quality grade · conflict flags · claim weighting

Source Trust Registry

Source	Effective Trust	Freshness	Provenance	Parser	Integrity	Conflicts
Loading…

Conflict Intelligence

Conflict	Type	Source A	Source B	Severity	Status
Loading…

Claim Intelligence

CIE converts normalized evidence into explicit analytic claims while preserving the difference between observed facts, derived inferences, contradictions and adjudicated findings.

0Total claims

0Observed

0Inferred

0Conflicted

0High confidence

Claim Registry

EVIDENCE-BACKED

Build claims for a number.

Manual Claim / Adjudication

FOUNDER / ADMIN

Claim Text

Claim Type

State

Confidence

Number

Claim Support / Contradiction Matrix

Claim	Evidence Type	Evidence Ref	Relation	Source	Weight
Build claims.

Intelligence Reporting + Executive Briefing

Generate an evidence-aware intelligence report from the current CIE case picture. Reports summarize key findings while retaining links back to claims, source trust, contradictions, provenance and underlying evidence.

0Claims

0High confidence

0Conflicts

0Source classes

0Evidence items

Executive Intelligence Brief

EVIDENCE-AWARE

Build a report.

Report Control

FOUNDER / ADMIN

Report ID

—

Generated

—

Integrity

—

Top Claims

Claim	Type	State	Confidence	Support
Build a report.

Contradictions / Caveats

Build a report.

Source Operations + Evidence Intake

Direct CSV/JSON intake, automatic schema mapping, immutable raw-artifact vaulting, ingest-job tracking, connector health and real-time number orchestration.

Direct Source File Intake

REAL RECORDS

Source File

Record Type

Source Connector

Subject Number

Select a CSV or JSON source file. No synthetic records are generated.

Real-Time Source Orchestration

NUMBER → SOURCES

Phone Number

Source	State	Latency	Returned
No orchestration run yet.

Connector Health + Evidence Vault

Connector	Configured	Health	Last Check	Latency	Failures
Loading…

Conversation Reconstruction

Rebuild actual ingested message records into participant-aware threads by phone number and source application while retaining record-level evidence underneath.

Conversation Threads

INGESTED EVIDENCE ONLY

Rebuild conversations for a number.