SCYTHE Strategic Cognition: Conflict Zones, Intent Hypotheses, and the First Cognitive Field View

There is a meaningful difference between a system that can draw a forecast line and a system that can explain why that line is fragile, what intent it suggests, how resilient the actor is under disruption, and what the operator should pay attention to first.

SCYTHE just crossed that line.

The latest development cycle did not add a single isolated feature. It added a new cognition layer across the control-path forecast stack:

model disagreement is now preserved as signal instead of being smoothed away
forecast edges now carry temporal phase, cohesion, and reappearance rhythm
recon entities now expose identity pressure under MAC/IP mutation
forecasts now emit ranked intent hypotheses
adaptive-path scoring now includes countermeasure simulation and resilience
render metadata now supports a true cognitive field view instead of a plain dashed prediction arc

This is the point where SCYTHE stops behaving like a system that only predicts where something may go and starts behaving like a system that can express how much that path means.

The Problem: Prediction Without Cognitive Posture

Before this slice, SCYTHE already had strong pieces:

recon entity cognition
MAC clustering under randomized identity conditions
RF->IP correlation
motion-aware control-path forecasting
observer-relative projection for the Android digital twin

But the forecast layer still had a blind spot.

It could produce a plausible predicted control path while hiding the most important operational question:

is this path stable, ambiguous, deceptive, adaptive, or structurally meaningful?

That matters because adversarial systems rarely fail by showing no pattern.

They fail by showing:

weakly consistent patterns
conflicting signals across layers
identity persistence under mutation
rhythm that disappears and reappears
control behavior that reforms when a single node is disrupted

Those are not geometry problems. They are cognition problems.

Cognitive Dissonance: Ambiguity Is Now a First-Class Signal

One of the highest-leverage changes in this cycle is the new cognitive dissonance engine in the forecast path.

SCYTHE now scores disagreement across the signals that feed a control-path prediction:

binding confidence
network pressure
identity similarity
RF signal strength/class evidence
motion continuity
identity pressure

Instead of averaging that disagreement away, the engine now preserves it.

When the spread is large enough and the contradiction is real, the forecast is marked as a:

COGNITIVE_CONFLICT_ZONE

That matters because stealth behavior often lives in disagreement:

the RF side looks persistent but the network side looks unstable
the identity stitch is strong while timing coherence is weak
the relay motif is obvious while motion evidence is thin

In older systems, those tensions often collapse into a single medium-confidence output.

In SCYTHE now, they remain visible and queryable.

The operator is no longer forced to interpret a “pretty confident” line that was actually built from conflicting evidence.

Temporal Edge Phase: Forecast Edges Now Have Lifecycle

The second major shift is that forecast edges are no longer temporally flat.

Every control-path prediction now carries a temporal profile:

temporal_phase
temporal_cohesion
periodicity_s
last_seen_delta_s

The phase model currently classifies forecast behavior into:

emergent
stable
decaying
resurrected

This is more than labeling.

It gives SCYTHE a way to express the difference between:

a path that has just started to form
a path that is rhythmically stable
a path that is losing continuity
a path that disappeared and returned with recognizable cadence

That last case is especially important. “Resurrected” edges are often more interesting than continuously stable ones, because they hint at control behavior under pressure, fallback routing, or covert reactivation.

Forecasts are now closer to living edges than static marks.

Identity Pressure: Persistence Under Mutation Becomes Quantifiable

SCYTHE’s recon layer already understood that raw MAC addresses are weak evidence and clusters are the actual identity primitive.

This cycle extends that thinking into a new identity pressure score.

At the recon network-stitching layer, SCYTHE now combines:

cluster stability
protocol continuity
IP rotation pressure
session overlap

into a single identity pressure signal.

That score is then reused by the forecast engine.

Operationally, this is the system asking:

even if the actor rotates identifiers, how much continuity is still leaking through behavior and structure?

This is one of the most important moves in the stack because adversarial identity is rarely hidden by a single mutation channel.

MACs rotate. IPs rotate. Sessions churn.

Behavior does not rotate as easily.

Identity pressure gives SCYTHE a way to score exactly that persistence.

Intent Hypothesis Graph: From Pattern Labels to Proposed Purpose

The next advancement is where SCYTHE starts moving beyond “this edge exists” toward “this edge likely serves a purpose.”

Control-path forecasts now emit ranked intent hypotheses, including:

beacon-maintenance
relay-chain-formation
data-exfiltration

These are not static tags attached by hand. They are derived from the forecast evidence itself:

periodicity and entropy stability
relay motifs and fan-in concentration
alert pressure and network entropy
temporal phase
identity pressure
RF continuity

The highest-confidence intent is promoted into the forecast payload, and the inferred intent layer is materialized into the graph during forecast emission.

That means SCYTHE now creates inferred intent semantics, not just display text:

intent hypothesis nodes
intent hypothesis edges linking current actor, intent node, and predicted target

This is a foundational step toward a richer intent graph.

It lets the system say:

“this predicted path is not just a likely continuation — it most resembles relay-chain formation with moderate resilience under disruption.”

That is a different class of output.

Graph Immune System: What Happens If You Break the Path?

Forecasting a path is valuable.

Forecasting how the path survives disruption is more valuable.

SCYTHE now includes a first graph-immune-system slice in the forecast layer.

For each control-path prediction, the engine now simulates countermeasure posture using:

alternate reachable targets in the candidate pool
source redundancy
temporal phase resilience
identity pressure
fan-in pressure
current top intent

The result is a countermeasure simulation profile with fields such as:

resilience score
reform likelihood
alternate target count
single-node vs multi-node disruption guidance
recommended action

In practical terms, SCYTHE can now distinguish between:

a path that likely collapses if one node is removed
a path that likely reforms elsewhere
a path that should be treated as requiring multi-node disruption

This is not full autonomous response. It is something better for this stage:

an explicit operator-facing resilience estimate grounded in the current graph structure.

That turns prediction into tactical guidance.

The First Cognitive Field View

This may be the most visibly important change.

Until now, forecast rendering could still collapse into “dashed line equals prediction.”

That is not enough for a system trying to represent observed, inferred, forecast, stable, conflicting, adaptive, and continuity-locked states all at once.

Forecast records now carry a field-view profile and render cues, including:

render mode
line style
pulse mode
flicker state
opacity
identity color-lock
cluster density
entropy rhythm
top intent
resilience

The current modes include cases such as:

forecast-ghost
conflict-flicker
relay-lattice
continuity-lock

This is the beginning of a true cognitive field view:

observed vs inferred vs forecast becomes visible
conflict becomes visible
continuity becomes visible
adaptive resilience becomes visible
identity persistence becomes visible

The line is no longer just a line.

It is a compact expression of the system’s posture toward that path.

gRPC Now Carries the Operator-Meaningful Slice

A major design decision in this work was to avoid hiding the new cognition inside server-only JSON.

The native ControlPathPatch stream now carries the operator-meaningful subset directly, including:

entropy
divergence risk
dissonance score / zone
identity pressure
temporal phase and cohesion
top intent label / probability
resilience score
countermeasure strategy
field-view mode
multi-node disruption guidance

This matters because it keeps the cognition layer transport-native.

The forecast UI, CLI tools, and downstream consumers do not have to reverse-engineer meaning from opaque metadata blobs.

The stream itself now expresses that meaning.

That is exactly the right direction for a system that wants to support:

Android operator surfaces
tail/debug tooling
future AR overlay refinement
future higher-density graph visualization

without duplicating interpretation logic everywhere.

Why This Changes the Product

The important shift is not that SCYTHE has more fields.

The important shift is that its forecast layer now preserves structural intelligence instead of flattening it.

The system can now tell the operator:

this path is stable
this one is resurrected
this one is high-pressure under identity mutation
this one looks like relay-chain formation
this one will probably reform if you only block a single node
this one sits in a cognitive conflict zone and should be treated as suspicious even if it is not high-confidence in the traditional sense

That is a much more valuable product stance than “here is a predicted route.”

It turns SCYTHE into a platform that can express:

uncertainty
motive hypothesis
adaptive resilience
temporal lifecycle
visual cognition posture

in one connected forecast surface.

What Changed Architecturally

This cycle landed the cognition work at the seams that mattered most:

recon_network_stitching.py now computes identity pressure at the recon layer
predictive_control_path_engine.py now scores dissonance, temporal phase, intent, resilience, and field-view posture
rf_scythe_api_server.py now carries those signals into forecast metadata and materializes inferred intent graph ops
scythe.proto / ControlPathPatch now expose the operator-facing subset natively over gRPC
scythe_grpc_tail.py now surfaces those new semantics in the CLI stream view

The result is important:

the cognition layer is not trapped in one UI, one service, or one special demo path.

It is now part of the shared forecast contract.

What Comes Next

This cycle completed the first strategic cognition tranche.

The obvious follow-ons now become stronger:

richer field-view rendering in operator and AR surfaces
intent-history accumulation instead of single-patch hypotheses
deeper multi-hop immune-system simulation across larger path sets
graph visual encodings for identity trails, arc entropy, and inference-vs-observation separation

But the important thing is that the substrate is now in place.

SCYTHE no longer has to fake cognition at the edge of the forecast layer.

It can carry it directly.

SCYTHE runs on NerfEngine as a cyber-physical intelligence platform spanning recon identity, RF/network correlation, graph-native reasoning, control-path forecasting, and observer-relative digital twin projection. This cycle pushed that platform beyond forecast geometry and into strategic cognition: conflict zones, temporal lifecycle, identity persistence, intent hypotheses, resilience posture, and the first cognitive field view.

SCYTHE Plan Status:
# SCYTHE Optimization Sprint + Hypergraph Export Expansion

## Status: Hypergraph Export Complete ✅ | WS Normalization Fixed ✅

## Hypergraph Export Expansion — DONE ✅
- [x] hypergraph-viewer.js — `<hypergraph-viewer>` Web Component
  - Shadow DOM canvas + info panel + toolbar (PNG/JSON/mode-cycle buttons)
  - 4 modes: viewer / autopsy / rf (volumetric field) / lite
  - Fibonacci sphere deterministic layout for nodes without positions
  - InstancedMesh nodes (threat-level color), LineSegments edges (capped 1500)
  - 32³ Gaussian splat → Data3DTexture → GLSL3 ray-march for >300 nodes
  - Full disconnectedCallback() cleanup (renderer, controls, ResizeObserver, RAF, AbortController)
  - node-click event, exportPNG() / exportJSON() / exportField() methods
- [x] Backend: _gravity_snapshot_readonly() — pure read, zero scoring mutations
- [x] Backend: GET /api/gravity/export?format=json|html
- [x] Backend: GET /api/clusters/export-data/<id>
- [x] Backend: GET /api/clusters/export/<id>?format=bundle|json
- [x] UI: Gravity toolbar — 📸 PNG + 📦 BUNDLE buttons
- [x] UI: Cluster intel cards — 📦 BUNDLE badge per row
- [x] hypergraph-viewer.js loaded via <script defer> in command-ops

## WS Bootstrap Normalization Bug — FIXED ✅
- Root cause: bootstrap injects LAN IP relay URLs (192.168.1.185:8765/8766) directly
  Bootstrap takes priority over _streamCfg — _normaliseWsUrl was never applied to it
  Chrome blocks loopback→LAN WS upgrades (Private Network Access policy)
- Fix: apply _normaliseWsUrl() to bootstrap values in connectDataStreams()
  When page is at 127.0.0.1, rewrites 192.168.1.185 → 127.0.0.1 (services bind 0.0.0.0)

## Optimization Tiers 1-4 — ALL DONE ✅
(see checkpoint history for full detail)

## GraphOps Epistemic Upgrades — DONE ✅ (2026-04-19)
- [x] _INTERPRET_SYSTEM: enforce UNKNOWN format when node_count==0, require SENSOR/INFERRED labels
- [x] _summarize_result: add evidence_coverage field to LLM context
- [x] _build_report: compute evidence_posture (no-data/sparse/inference-heavy/evidence-backed)
  credibility field now includes nodes_seen, edges_seen, stale_inferences estimate

## EVE Sensor Grounding — DONE ✅ (2026-04-20)
- [x] Orchestrator + instance config: eve_stream_ws / eve_stream_http args forwarded through bootstrap.js
- [x] Backend: /api/config/streams now exposes eve URLs; added /api/sensor/eve/health and /api/sensor/eve/ground
- [x] UI: GraphOps Bot now shows EVE online/offline + last pull / injection delta and a Ground GraphOps control
- [x] Chat policy: sparse / inference-heavy GraphOps requests now preflight eve-streamer and can pull a short observed burst
- [x] Two-lane separation preserved: operator-visible EVE health stays separate from explicit graph mutation

## SCYTHE EVE Android MVP — DONE ✅ (2026-04-20)
- [x] Reused `ScytheCommandApp` as the repo-native Android base instead of creating a second app module
- [x] Added relay config resolution from `/api/config/streams` with fallback derivation for stream WS ingest
- [x] Upgraded `ScytheSensorService` into a mobile EVE-style streamer:
  - GPS + WiFi recon still post to existing HTTP endpoints
  - live WebSocket relay now emits heartbeat, position, WiFi scan, and observed infra flow events
  - native status broadcasts now include relay URL, relay health, event count, burst count, and last uplink
- [x] Native UI now surfaces EVE relay status/counters in the app footer and settings screen
- [x] Debug APK built successfully at `ScytheCommandApp/app/build/outputs/apk/debug/app-debug.apk`
- [x] Debug APK installed and launched on the paired Android device

## SCYTHE EVE Offline Lane Demo — DONE ✅ (2026-04-20)
- [x] Added a local `file:///android_asset/eve_demo.html` scene that works without any SCYTHE instance
- [x] Demo visualizes the lane split directly in-app:
  - continuous lane: phone sensor -> relay -> live operator view
  - grounding lane: GraphOps-style burst -> observed node/edge injection
- [x] Added app chrome entry points for the demo:
  - top bar `DEMO` button
  - loading overlay `Open Offline Demo` button
- [x] Wired the demo to the Android bridge where available so it can reflect local sensor status, relay URL, location, and start/stop the sensor service

## Traceroute Hop Grouping — DONE ✅
- [x] Frontend hop grouping: consecutive hops with same logical class → one Cesium entity
- [x] 3-tier GeoIP backend resolver: POP-code → cloud subnet → ip-api.com fallback
- [x] "No geolocated hops" message distinguishes private-only vs GeoIP-failure cases

## RF/IP Correlation Engine — DONE ✅ (2026-04-20)
- [x] Added `rf_ip_correlation_engine.py` as a lightweight rolling temporal join/scoring engine
- [x] Added API routes:
  - `POST /api/rf-ip-correlation/observe/rf`
  - `POST /api/rf-ip-correlation/observe/network`
  - `GET /api/rf-ip-correlation/status`
  - `GET /api/rf-ip-correlation/bindings`
- [x] RF/IP bindings now emit graph-native `RF_TO_IP_BINDING` edges through `WriteBus`
- [x] Android recon upserts now auto-promote into `sensor:<entity_id>` and auto-assign to `recon:<entity_id>`
- [x] Fixed recon sensor assignment route to call `SensorRegistry.assign_sensor(..., recon_entity_id=...)`

## Hybrid Digital Twin (Projection Slice) — DONE ✅ (2026-04-20)
- [x] Added observer-relative projection API routes:
  - `GET /api/digital-twin/projection`
  - `GET /api/ar/projection`
- [x] Projection payload now derives nearby recon entities and recent `RF_TO_IP_BINDING` observations relative to an Android observer
- [x] Added Android in-app `digital_twin.html` that consumes the projection payload through the existing JS bridge
- [x] Added app entry points for the twin:
  - top bar `TWIN` button
  - loading overlay `Open Digital Twin` button
- [x] Added bridge support for stable Android observer IDs and projection fetches without opening file-origin network access

## Predictive Control Paths — DONE ✅ (2026-04-21)
- [x] Added `predictive_control_path_engine.py` as a small forecast service blending:
  - QuestDB temporal pressure
  - recent `RF_TO_IP_BINDING` confidence
  - fan-in / relay motifs
  - semantic identity-stitch candidates
- [x] Added forecast APIs:
  - `GET /api/control-path/predict`
  - `POST /api/control-path/predict/emit`
- [x] Forecast graph emission now creates distinct edge kinds:
  - `RF_TO_IP_PREDICTED`
  - `CONTROL_PATH_PREDICTED`
- [x] Forecast payloads and graph metadata now carry:
  - `confidence`
  - `time_horizon_s`
  - `supporting_evidence`
  - `provenance_rule`
  - explicit `forecast` / `obs_class=forecast`
- [x] `GET /api/digital-twin/projection` now includes `predictions` + forecast signal counts
- [x] Android `digital_twin.html` now renders forecast paths as ghost / dashed / pulsing overlays, never solid
- [x] UAV-like forecasts now carry DOMA-backed `motion_forecast` ghost waypoints plus observer-relative `projected_path` markers for forward motion visualization

## gRPC Control-Path Streaming — DONE ✅ (2026-04-21)
- [x] Extended `scythe.proto` with a binary `ControlPathStream` service plus typed `ControlPathPatch` / `ControlPathPoint` messages for forecast deltas
- [x] Added `ControlPathStreamServicer` to `scythe_grpc_server.py` using instance-side `/api/control-path/predict` polling + diffing to emit `upsert` / `delete` forecast patches
- [x] Regenerated `scythe_pb2.py` and `scythe_pb2_grpc.py` from the updated proto
- [x] Upgraded `scythe_grpc_client.js` to decode float/double protobuf fields and added `streamControlPaths(...)` with typed patch decoding for motion forecasts and projected paths

## RFUAV Evidence Layer — DONE ✅ (2026-04-21)
- [x] Added `rfuav_inference_service.py` as an upstream RF evidence normalizer for Stage 0.5 signal preprocessing
- [x] RFUAV output now becomes structured observed RF evidence with stable `rf.class/subtype/signal/temporal` fields
- [x] Added `POST /api/rfuav/observe` to ingest RFUAV inference results, emit observed RF graph artifacts, and feed RF/IP correlation
- [x] Predictive control-path scoring now consumes structured RF evidence as a bounded forecast signal instead of treating it as authority

## RFUAV Kafka Pipeline — DONE ✅ (2026-04-21)
- [x] Added canonical RFUAV detection event emission with Kafka producer support (`rf.uav.detections`, keyed by `sensor_id`)
- [x] Added `rfuav_kafka_consumer.py` so streamed RFUAV events can land on the same SCYTHE ingest path as HTTP observations
- [x] Added shared server-side RFUAV ingest helper so Kafka and REST both feed WriteBus, RF/IP correlation, and forecast-compatible evidence
- [x] Added QuestDB `rf_events` side feed for RFUAV detections
- [x] Added optional background Kafka consumer startup via `RFUAV_KAFKA_*` environment variables

## Browser Operator Geolocation — DONE ✅ (2026-04-21)
- [x] Added a globe-style browser geolocation prompt to `command-ops-visualization.html`
- [x] Live chat now sends browser latitude/longitude when available so guest chat operators no longer default to `0,0`
- [x] GraphOps Bot requests now include browser latitude/longitude context when available
- [x] Guest chat operator recon entities now prefer browser coordinates, fall back to IP geolocation, and otherwise omit location instead of using `0,0`

## WiFi Recon Enrichment — DONE ✅ (2026-04-21)
- [x] Added `recon_enrichment.py` to turn Android `wifi_ap` rf-nodes into structured observed WiFi intelligence with identity, RF profile, temporal, geo, behavior, and risk metadata
- [x] Randomized / locally-administered WiFi MACs now collapse into stable alias device IDs when fingerprinting is strong enough, with rolling session IDs and persistence state
- [x] `RFHypergraphStore.add_node()` now enriches WiFi nodes before graph publication and carries semantic labels into the HypergraphEngine
- [x] The graph→recon bridge now preserves enriched WiFi semantics, friendly names, ontology/type, and metadata instead of flattening everything to generic recon entities

## Recon Entity Cognition Upgrade — DONE ✅ (2026-04-24)
- Current state: WiFi observations now surface as actor-style recon cognition instead of only flat enriched blobs.
- [x] Schema foundation: enriched WiFi observations now emit graph-native companion nodes/edges for `mac_cluster`, `recon_session`, `behavior_profile`, and `rf_signature`, and recon entities surface stable cognition IDs plus a summarized `cognition` envelope
- [x] Streaming MAC clustering: `mac_cluster_engine.py` now assigns observations to probabilistic `mac_cluster_id`s using RF, temporal, spatial, protocol, and behavior similarity; WiFi enrichment now keys identity/session state off cluster-backed anchors and surfaces cluster confidence, randomized ratio, vendor likelihood, and assignment similarity
- [x] Promote rolling observation sessions into first-class recon/session records with duration, observation count, movement class, handoff count, cadence, displacement, heading, and timeline summaries
- [x] Expand RF + temporal profiling into explicit behavior classifications (beacon / human / relay / infrastructure) with burstiness, periodicity, duty cycle, entropy, behavior hashes, relay likelihood, and explanation text
- [x] Stitch recon entities to existing RF→IP / ASN evidence so operators see bindings, carrier context, and confidence instead of isolated RF sightings
- [x] Reuse the existing DOMA + kinematic path stack to attach motion vectors, heading, drift class, and short-horizon predictive presence to recon entities when geo cadence is sufficient
- [x] Surface the upgraded identity / behavior / session / network summaries in recon APIs and operator UI labels so `wifi-xxxx` resolves into actor-style descriptions
- Notes:
  - Treat raw MAC addresses as weak evidence only; probabilistic continuity and cluster stability should become the canonical identity surface
  - `MacCluster` is the identity primitive; individual MACs are observations that may be randomized, spoofed, or rotated
  - Favor online / streaming clustering over batch clustering so Android/WiFi/BLE/RF observations can be absorbed incrementally during live ingest
  - The pairwise similarity function should weight protocol / IE fingerprint most strongly, then temporal and spatial continuity, with RF and behavior as supporting evidence
  - Randomized / locally administered MACs should explicitly downweight MAC identity and upweight protocol, temporal, spatial, and behavioral continuity
  - Persist similarity confidence and cluster stability so low-quality clusters stay visibly uncertain instead of looking authoritative
  - Use graph-native relationships like `(:Observation)-[:BELONGS_TO]->(:MacCluster)` and keep the door open for GDS/WCC-style connected-component clustering on similarity edges
  - The long-term target is cross-layer identity fusion: `MacCluster -> RFSignature -> RF_TO_IP binding -> control-path prediction`
  - Reuse `recon_enrichment.py`, `rf_ip_correlation_engine.py`, `predictive_control_path_engine.py`, and existing graph/recon bridges instead of creating a parallel enrichment store
  - Behavior compression is now a first-class surface via `behavior_hash`, entropy buckets, and relay likelihood so actor-like behavior can be matched across time and hardware changes
  - Motion now surfaces as explicit recon context (`velocity_mps`, `drift_class`, `trajectory_confidence`, `predictive_presence`) instead of being implicit in raw geo drift only
  - Server snapshots now reapply actor summaries after RF→IP / ASN stitching so carrier context and confidence survive into `/api/recon/*` and `/api/ar/projection`
  - The Android AR twin now prefers `actor_summary` / `actor_label` metadata in its nearby-entity list instead of raw backend type labels

## Recon Entity Log Suppression — DONE ✅ (2026-04-22)
- [x] `POST /api/recon/entity` now checks whether the target entity already exists in the room before logging
- [x] First-seen recon entities still log at INFO as `Created recon entity: ...`
- [x] Repeated upserts for the same recon entity now log at DEBUG instead of INFO, cutting recurring Android observer spam from normal server output

## QuestDB Window Query Fix — DONE ✅ (2026-04-22)
- [x] Root cause confirmed: this QuestDB build accepts `dateadd('s', ...)` but rejects `dateadd('ms', ...)` with HTTP 400
- [x] `questdb_query.py` now uses direct timestamp arithmetic (`now() - <microseconds>`) for recent-window filters, preserving millisecond precision without dialect mismatch
- [x] Added focused regression coverage so windowed QuestDB helpers no longer emit unsupported `dateadd('ms', ...)` SQL

## Hybrid Digital Twin Follow-on — PROJECTION SLICE DONE ✅ (2026-04-23)
- [x] Replace the north-up twin asset with a real ARCore/SceneView camera-space renderer inside `ScytheCommandApp`
- [x] Feed device heading into the projection request so relative bearings become view-relative instead of north-up
- [x] Reuse the existing `AndroidAppSceneview` SceneView/ARCore stack instead of introducing a second AR stack
- Notes:
  - Current Android renderer is a native SceneView camera-space slice driven by `/api/ar/projection`; true earth/terrain anchors remain a later refinement.
  - `TWIN` now launches the native AR activity and the debug APK builds and installs successfully on the paired device.

## SCYTHE App UX Follow-on — PLANNED
- Goal: evolve `ScytheCommandApp` from a developer-facing shell around a WebView into an operator-first cockpit that foregrounds mission state, actor meaning, and fast mode switching.
- Candidate improvements:
  - Replace the tiny top-bar launcher controls with a clearer navigation model: `Command`, `AR Twin`, `Sensors`, `Settings`, with larger touch targets and persisted last-used mode.
  - Consolidate server / relay / GPS / sensor / AR tracking state into a persistent health strip or chip row so operators can assess readiness at a glance.
  - Refactor the AR overlay from text-heavy status blocks toward confidence-colored markers, tap-to-expand actor cards, and a collapsible bottom sheet for nearby entities.
  - Rework settings around environment cards and connection workflows (`Local`, `Field Node`, `Tailscale`, `Demo`) instead of raw URL entry as the primary UX.
  - Keep the SCYTHE visual identity, but reduce the all-monospace / terminal density in favor of stronger visual hierarchy, iconography, spacing, and scan-friendly typography.
  - Prefer actor-style summaries in the UI (`Mobile AP · T-Mobile · moving NE · 0.82 confidence`) over backend artifact labels or raw IDs wherever enriched cognition is available.
- Delivery shape:
  - Land the information architecture and health-state cleanup first in native Android surfaces.
  - Then promote enriched recon/session/network cognition into the app’s cards, labels, and AR presentation layer.

## NIS Asset Bridge — DONE ✅ (2026-04-23)
- [x] Added `nis_scythe_bridge.py` to normalize NIS-derived SIGINT emitters into SCYTHE-native synthetic RF observations with stable IDs, protocol labels, and optional geospatial anchoring
- [x] Added API routes:
  - `POST /api/nis/sigint/simulate`
  - `GET /api/nis/sigint/summary`
  - `GET /api/nis/sar/scene-priors`
- [x] Added standalone observed RF node emission for synthetic RF observations so NIS-derived RF evidence persists in the graph even before any RF→IP binding exists
- [x] Added focused tests for NIS observation normalization, multibeam summary parsing, clean-cache parsing, and SAR prior summarization
- Notes:
  - The bridge intentionally reuses SCYTHE’s RF observation / graph publication seam instead of importing the NIS demo runtime directly into the server
  - SIGINT generation mirrors the protocol-band layout from `sigint_sim_env.py` but uses deterministic SCYTHE-native normalization and labeling
  - Multibeam post-processing is surfaced as summary/intensity metadata rather than a second visualization stack

## Visualization Backlog (from GraphOps Bot session analysis)
- graphops-arc-entropy: Arc entropy rhythm (beacons=periodic pulse, high entropy=flicker)
- graphops-identity-trails: Identity trails across IP changes (STITCH_IDENTITIES → color-lock)
- graphops-inference-ghost-arcs: Ghost arcs for inferred vs solid for evidence-backed edges
- graphops-cluster-flare: Vertical emission column for dense geo-stacked clusters

## Strategic Cognition Follow-ons — COMPLETE
- cognitive-dissonance-engine — DONE: control-path forecasts now score disagreement across binding / network / identity / RF / motion signals and escalate conflict cases into `COGNITIVE_CONFLICT_ZONE` instead of smoothing them away
- temporal-edge-phase — DONE: forecast payloads and emitted graph metadata now carry `temporal_phase`, `temporal_cohesion`, `periodicity_s`, and `last_seen_delta_s` so emergent/stable/decaying/resurrected rhythms are queryable
- identity-pressure-score — DONE: recon network stitching now computes identity pressure from cluster stability, protocol continuity, IP rotation pressure, and session overlap; forecast evidence reuses that persistence score
- grpc-uncertainty-patches — DONE: `ControlPathPatch` now streams entropy, divergence risk, dissonance, identity pressure, and temporal phase metrics for the native gRPC forecast feed
- intent-hypothesis-graph — DONE: control-path forecasts now emit ranked intent hypotheses (`beacon-maintenance`, `relay-chain-formation`, `data-exfiltration`) and forecast graph commits materialize inferred intent nodes/edges
- graph-immune-system — DONE: forecast evidence now includes countermeasure simulation, reform likelihood, resilience score, and single-node vs multi-node disruption guidance for adaptive-path scoring
- cognitive-field-view — DONE: forecasts now carry field-view metadata plus render cues (mode, pulse/flicker, density, identity color-lock, intent, resilience) so clients can render a cognitive surface instead of a plain dashed line

## Pending Backlog
- recon-cognition-schema: Graph-native MAC cluster / session / behavior profile surfaces for recon actors
- recon-network-stitching: Bind recon actors to RF→IP / ASN evidence with operator-visible confidence
- recon-motion-intelligence: Promote drift / heading / predictive presence into recon entities
- opt-backpressure: Add backpressure signals to ingest/orchestration
- opt-edge-compression: Graph wire format edge compression
- opt-event-spine: Event-driven WebSocket spine (replace polling)
- t3-gravity-get-mutation: GET /api/gravity/nodes mutates scoring singletons on every poll
- t3-edge-node-sampling: Edge/node sampling mismatch in gravity view
- sec-ping-ssrf: /api/ping SSRF risk
- t3-reasoning-bfs-consistency: Reasoning BFS can emit edges with missing endpoint nodes
- shadow_graph re_evaluate() auto-promotion via ws_ingest.py
- Android WebView auth token passthrough