# ExecSat - Executive Branch OSINT Scanner

## What It Does

ExecSat monitors the President, Vice President, and Cabinet for movements, statements, and executive actions. It tracks the entire executive branch from the White House to independent agencies.

## Commands

| Command | Action |
|---------|--------|
| **"execsat scan"** | Run all monitors across POTUS, VP, and Cabinet |
| **"execsat scan potus"** | President: schedule, statements, Truth Social, Air Force One |
| **"execsat scan vp"** | Vice President: schedule, statements, Air Force Two |
| **"execsat scan cabinet"** | All Cabinet secretaries + key agency heads |
| **"execsat scan agencies"** | Executive agencies: State, Defense, DOJ, Treasury, etc. |
| **"execsat scan military"** | Combatant commands, DOD, Pentagon briefings |
| **"execsat scan regulatory"** | Federal Register, proposed rules, executive orders |
| **"execsat on/off"** | Master switch |

## Alert Levels

| Level | Meaning |
|-------|---------|
| 🔴 CRITICAL | Major EO, military strike, Cabinet resignation, emergency declaration |
| 🟠 HIGH | Significant policy announcement, travel to conflict zone, agency action |
| 🟡 MEDIUM | Routine briefing, travel, statement |
| 🟢 LOW | Baseline, no significant activity |

## Categories

| Category | Monitors |
|----------|----------|
| **potus-schedule** | Daily guidance, public events, travel |
| **potus-statements** | Truth Social posts, speeches, press conferences |
| **potus-tracking** | Air Force One (SAM 28000/29000) location via ADS-B |
| **vp-schedule** | Daily guidance, events, travel |
| **vp-statements** | Speeches, interviews, statements |
| **vp-tracking** | Air Force Two (C-32A) location via ADS-B |
| **cabinet-state** | Secretary of State: briefings, travel, diplomatic activity |
| **cabinet-defense** | Secretary of Defense: Pentagon briefings, military policy |
| **cabinet-treasury** | Secretary of Treasury: sanctions, economic policy |
| **cabinet-ag** | Attorney General: DOJ announcements, prosecutions |
| **cabinet-homeland** | Secretary of DHS: border, security advisories |
| **cabinet-rest** | Remaining Cabinet members: Agriculture, Commerce, Education, Energy, HHS, HUD, Interior, Labor, Transportation, VA |
| **white-house** | Press briefings, statements, executive orders, proclamations |
| **federal-register** | Executive orders, proposed rules, final rules |
| **combatant-commands** | CENTCOM, EUCOM, INDOPACOM, AFRICOM, etc. |
| **independent-agencies** | Federal Reserve, SEC, FCC, FTC, etc. |

## Data Sources

Primary (Tier 1): White House schedule, Federal Register API, State.gov, Defense.gov, Justice.gov, Treasury.gov, ADS-B Exchange

Secondary (Tier 2): Truth Social (no API, requires monitoring), Cabinet social media, agency RSS feeds

Tertiary (Tier 3): FOIA reading rooms, Inspector General reports, GAO reports

## Execution Flow

1. **Check switch**: Read `memory/execsat-switch.json`. If disabled, exit.
2. **Category selection**: Based on command, select monitors to run.
3. **Search cascade**: For each monitor, execute search queries or fetch data from sources.
4. **Alert classification**: Apply thresholds, assign alert level.
5. **Compile report**: Aggregate findings into structured output.
6. **Log**: Save to `memory/execsat/scan-log.json`.

## Output Format

```
🏛️ EXECSAT SCAN — [CATEGORY] — [TIMESTAMP]
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

[Alert Level] MONITOR NAME
- Finding: [what was found]
- Source: [where it came from]
- Significance: [why it matters]
```

## Files

- `references/monitors.json` — Monitor definitions with sources, queries, thresholds
- `scripts/execsat_scan.py` — Switch/log manager CLI (optional)
- `memory/execsat/scan-log.json` — Scan history
- `memory/execsat-switch.json` — Master switch

## API Keys Required

| Service | Purpose | Get Key |
|---------|---------|---------|
| ADS-B Exchange | Air Force One/Two tracking | https://www.adsbexchange.com/data/ |
| Federal Register | EOs, rules, notices | None required (open API) |
| Regulations.gov | Public comments, proposed rules | https://api.regulations.gov |

## Special Notes

### Air Force One/Two Tracking
- SAM 28000 and SAM 29000 are the VC-25A aircraft used as Air Force One
- C-32A (757-200) is used as Air Force Two for VP travel
- Transponders are often turned off for sensitive travel
- ADS-B Exchange API provides real-time tracking when transponders are on

### Truth Social Monitoring
- No official API
- Requires third-party monitoring tools or scraping
- Factba.se archives Truth Social posts with search

### Cabinet Social Media
- Most Cabinet secretaries have official and personal accounts
- Track on X, Truth Social, and Bluesky
- @unitedstates GitHub project maintains lists of official accounts