AEGIS: The App Suite Behind the Intelligence Platform
A walkthrough of the sovereign, on-premise service stack that turns Telegram, feeds, media, and graph data into operational intelligence.
What AEGIS Is
AEGIS is not a single monolith. It is a coordinated suite of apps built to ingest, correlate, analyze, and surface intelligence without handing the data off to a cloud service or a black-box vendor stack.
The design is intentionally sovereign: each service owns its own schema, all communication stays on localhost, and the entire platform is built around a single source of truth. The point is operational control, not loose app sprawl.
In practice, that means the stack can keep growing without the data model fragmenting underneath it. Every piece has a narrow job, and every piece can be replaced or tuned without rewriting the whole system.
The five layers
Each service owns its own schema, all communication stays on localhost, and everything writes back to one source of truth. The ordering is real — each layer only makes sense once the one beneath it exists.
Ingestion
vigil is the source-of-truth writer. It ingests Telegram content and preserves edits and deletions, media, replies, forwards, membership events and profile changes, writing the normalized record to vigil.db.
herald pulls in RSS and news feeds, deduplicates, and tags them. Together they give two reliable entry points: live messaging on one side, public reporting on the other.
The AI queue
hourglass is the traffic cop — the only service that talks directly to the inference backends, which keeps the rest of the platform from stepping on itself. Oracle traffic gets a dedicated lane, batch LLM work stays separated so it cannot block interactive work, and embedding jobs run through a local CPU lane.
That separation matters because operator chat, batch analysis and embedding generation have very different latency profiles.
Analysis pipeline
psyche handles behaviour — timing, repetition, escalation, and other actor-level patterns that only become visible once the message stream is normalized.
logos handles content and narrative: themes, threat language, manipulation tactics, and local translation of non-English material.
nexus handles the graph, turning replies, mentions and shared channels into relationship data — who amplifies whom, where clusters form, which bridges connect otherwise separate groups.
Intelligence and command
sentinel watches for alerts in real time. persona looks at identity and bot-like behaviour. oracle gives investigators an analyst-facing interface. argus supports the embedding lane and retrieval stack, with cassandra and meridian rounding out intelligence and workflow support.
This is where the platform stops being a pipeline and starts behaving like an operating environment.
Automation and records
shepherd, cipher and archivum handle the operational glue: automation, protected handling, and the archival work that keeps the platform usable once data volume starts to climb.
There is room for optional machine-learning experiments where a specific problem needs them, but the default assumption stays that the system runs locally and stays auditable.
How the Pieces Fit Together
Data lands in Vigil or Herald, gets routed through the analysis pipeline, is scored and correlated by the intelligence layer, and then becomes visible in the dashboard, alerts, reports, graph visualizations, and API responses that operators actually use.
The point is not to be clever in one isolated place. The point is to move from raw collection to usable operational context without losing ownership of the data along the way.
What It Looked Like In Practice
The first serious run was enough to shut things down for a while. The crawl crossed 4.3TB of data in under six months and pulled in more than 2 million messages and vectors.
It also surfaced six genuine psychological operations and hundreds of threat actors. More importantly, it started exposing coordinated influence campaigns, keyword-triggered troll behavior, and repeated attempts to shape discourse across high-traffic channels.
That is the kind of result that makes the stack feel real. It was not just storing data. It was finding structure in it fast enough to become difficult to keep feeding safely.
Why It Matters
AEGIS works because it is built like a suite of apps, not a monolith. Each service has a narrow job, the data model stays consistent, and the AI layer is centralized instead of sprayed across the stack.
That gives me a platform that can grow without turning into a pile of hidden dependencies. It also makes the system easier to inspect, easier to reason about, and much harder to accidentally blur into something I cannot control.
Back to blog