AEGIS: The App Suite Behind the Intelligence Platform

A walkthrough of the sovereign, on-premise service stack that turns Telegram, feeds, media, and graph data into operational intelligence.

What AEGIS Is

AEGIS is not a single monolith. It is a coordinated suite of apps built to ingest, correlate, analyze, and surface intelligence without handing the data off to a cloud service or a black-box vendor stack.

The design is intentionally sovereign: each service owns its own schema, all communication stays on localhost, and the entire platform is built around a single source of truth. The point is operational control, not loose app sprawl.

In practice, that means the stack can keep growing without the data model fragmenting underneath it. Every piece has a narrow job, and every piece can be replaced or tuned without rewriting the whole system.

Layer 1: Ingestion

vigil is the source-of-truth writer. It ingests Telegram content, preserves edits and deletions, tracks media, replies, forwards, membership events, and profile changes, and writes the normalized record to vigil.db.

herald pulls in RSS and news feeds, deduplicates them, tags them, and keeps the open-source side of the picture current.

Together they give AEGIS two reliable entry points: live messaging on one side and public reporting on the other.

Layer 2: The AI Queue

hourglass is the traffic cop. It is the only service that talks directly to the inference backends, which keeps the rest of the platform from stepping on one another.

• Oracle traffic gets its own dedicated lane.
• Other LLM work stays separated so batch analysis does not block interactive work.
• Embedding jobs run through a local CPU lane so retrieval does not compete with the chat path.

That separation matters because operator chat, batch analysis, and embedding generation have very different latency profiles.

Layer 3: Analysis Pipeline

psyche handles behavior. It looks at timing, repetition, escalation, and other actor-level patterns that are easier to see once the message stream has been normalized.

logos handles content and narrative. It extracts themes, flags threat language and manipulation tactics, and translates non-English content locally when needed.

nexus handles the graph. It turns replies, mentions, and shared channels into relationship data so you can see who is amplifying whom, where clusters form, and which bridges connect otherwise separate groups.

That pipeline is what turns raw messages into something the rest of the platform can reason over.

Layer 4: Intelligence and Command

sentinel watches for alerts in real time. persona looks at identity and bot-like behavior. oracle gives investigators an analyst-facing interface. argus supports the embedding lane and retrieval stack. cassandra and meridian round out the command layer with additional intelligence and workflow support.

This layer is where the platform stops being a pipeline and starts behaving like an operating environment.

Layer 5: Automation and Records

shepherd, cipher, and archivum handle the operational glue: automation, protected handling, and archival work that keeps the platform usable once the data volume starts to climb.

There is also room for optional machine-learning experiments when a specific problem needs them, but the default assumption is still that the system should run locally and stay auditable.

How the Pieces Fit Together

Data lands in Vigil or Herald, gets routed through the analysis pipeline, is scored and correlated by the intelligence layer, and then becomes visible in the dashboard, alerts, reports, graph visualizations, and API responses that operators actually use.

The point is not to be clever in one isolated place. The point is to move from raw collection to usable operational context without losing ownership of the data along the way.

What It Looked Like In Practice

The first serious run was enough to shut things down for a while. The crawl crossed 4.3TB of data in under six months and pulled in more than 2 million messages and vectors.

It also surfaced six genuine psychological operations and hundreds of threat actors. More importantly, it started exposing coordinated influence campaigns, keyword-triggered troll behavior, and repeated attempts to shape discourse across high-traffic channels.

That is the kind of result that makes the stack feel real. It was not just storing data. It was finding structure in it fast enough to become difficult to keep feeding safely.

Why It Matters

AEGIS works because it is built like a suite of apps, not a monolith. Each service has a narrow job, the data model stays consistent, and the AI layer is centralized instead of sprayed across the stack.

That gives me a platform that can grow without turning into a pile of hidden dependencies. It also makes the system easier to inspect, easier to reason about, and much harder to accidentally blur into something I cannot control.