# *Sat Codebase — Legacy Snapshot

This is the as-found state of the entire `*sat` family of OSINT/intelligence scanners — four scanner skills (warsat, repsat, scosat, execsat) plus the SIGINT signal-reading pipeline that feeds them — all cobbled together inside an old OpenClaw workspace (`~/.openclaw/workspace/`).

Packaged on 2026-06-03 from `/root/.openclaw/workspace/`.

---

## What's in here

```
sat-pkg/
├── scripts/                                  # The core *sat engine
│   ├── warsat-delta.py                       #   756 lines — baseline diff engine
│   ├── warsat-orbital.py                     #   846 lines — orbital platform + prediction engine
│   ├── threat_actor_indicators.py            #   495 lines — keyword library (warsat)
│   └── threat_actor_indicators_v4_additions.py
│
├── signal-pipeline/                          # The "signal reading pipeline"
│   ├── signal-collectors/
│   │   └── signal_collector_reddit_feeds.py   #   raw Reddit ingestion
│   ├── signal-analyzers/                     #   five iterations
│   │   ├── signal_analyzer.py
│   │   ├── signal_analyzer_premium.py
│   │   ├── signal_analyzer_v2.py
│   │   ├── signal_analyzer_v3_early_warning.py
│   │   └── signal_analyzer_v3_expanded.py
│   ├── sigint-system/
│   │   ├── sigint_shipping_integration.py    #   shipping AIS → SIGINT bridge
│   │   ├── sigint_healthcheck.py
│   │   └── extract_real_signals.py
│   └── scrapers/                             #   OSINT data fetchers
│       ├── multi_source_monitor.py
│       ├── multi_osint_search.py (+ _final, _real)
│       ├── gnews_scraper.py
│       ├── reddit_fixed.py
│       ├── run_scrapers_new.py
│       ├── convert_real_to_dashboard.py
│       ├── dashboard_api_generator.py
│       └── shipping_tracker.py
│
├── skills/                                   # Four *sat skill definitions
│   ├── warsat/                               #   the only one with real code
│   │   ├── SKILL.md
│   │   ├── references/monitors.json          #   45 monitors / 6 domains
│   │   └── scripts/warsat_scan.py            #   126 lines — scan log + killswitch
│   ├── repsat/                               #   legislative branch
│   │   ├── SKILL.md
│   │   └── references/monitors.json          #   8 categories of congressional monitors
│   ├── scosat/                               #   judicial branch
│   │   ├── SKILL.md
│   │   └── references/monitors.json          #   SCOTUS + circuits + DOJ
│   └── execsat/                              #   executive branch
│       ├── SKILL.md
│       └── references/monitors.json          #   POTUS + Cabinet + agencies
│
├── skills-pkg/                               # The same skills as .skill zip files
│   ├── warsat.skill
│   ├── repsat.skill
│   ├── scosat.skill
│   └── execsat.skill
│
├── memory/                                   # Runtime data
│   ├── sat-runtime/                          #   per-sat state
│   │   ├── README.md
│   │   ├── baseline.md, scan-log.json, …
│   │   ├── execsat-scan-log.json
│   │   └── satellite-keys.json               #   API keys for all 3 non-warsat sats
│   ├── sat-memory/                           #   warsat analysis memos
│   ├── all-sats/                             #   cross-sat view (single 2026-04-14 snapshot)
│   ├── sigint-analysis/                      #   9 sigint analysis markdown files
│   ├── sigint-reports/                       #   5 daily analysis reports + 1 shipping integration
│   ├── signal_results/                       #   ★ 184 MB · 19,339 raw collector outputs
│   │   ├── gdelt/                            #     14,416 files
│   │   ├── newsapi/                          #      2,726 files
│   │   ├── newsdata/                         #      2,179 files
│   │   ├── reddit_feeds/                     #          2 files
│   │   └── shipping_tracker/                 #         16 files
│   └── switch-state/                         #   4 master killswitch files
│       ├── wartrack-switch.json
│       ├── repsat-switch.json
│       ├── scosat-switch.json
│       └── execsat-switch.json
│
├── intel/                                    # Cross-domain signal captures
│   ├── structural_store/iran_structural.json
│   ├── theories/iran_escalation_theory.md
│   └── iran/{signals,briefings}/             #   one snapshot each
│
├── public/dashboards/
│   └── sigint.html                           #   the public SIGINT dashboard
│
├── vault/Projects/Warsat/
│   └── Warsat.md
│
├── docs/                                     # SIGINT system + integration docs
│   ├── COMPLETE_SIGINT_SYSTEM.md
│   ├── SIGINT_DEPLOYMENT.md
│   ├── SIGINT_MAINTENANCE.md
│   ├── SIGINT_EARLY_WARNING_STATUS.md
│   ├── SIGINT_V4_INTEGRATION_PLAN.md
│   ├── REAL_DATA_INTEGRATION_FRAMEWORK.md
│   ├── REAL_DATA_INTEGRATION_GUIDE.md
│   ├── INTELLIGENCE_SOURCES.json
│   ├── THREAT_ACTOR_FRAMEWORK.md
│   ├── compensation-analysis.md
│   ├── compensation-review.md
│   └── compensation-review.html
│
├── README.md                                 #   this file
└── docs/ARCHITECTURE-NOTES.md                #   what I saw in the shape
```

**19,434 files, ~185 MB uncompressed.** The bulk is `signal_results/` (184 MB of raw collector JSON).

---

## What the four sats actually cover

| Skill | Branch | What it monitors | Real code? |
|-------|--------|------------------|------------|
| **warsat** | Military / geopolitical | air assets, naval, ground, cyber, proxy, infrastructure (6 domains, 45 monitors) | ✅ yes — `warsat-delta.py`, `warsat-orbital.py`, `warsat_scan.py` |
| **repsat** | Legislative (Congress) | House/Senate floor, committees, members, legislation, lobbying, STOCK Act | ⚠️ skeleton — SKILL.md + monitors.json, no scripts |
| **scosat** | Judicial (SCOTUS + fed courts) | SCOTUS docket/orders/opinions, justices, circuits, DOJ, FBI, nominations | ⚠️ skeleton — same |
| **execsat** | Executive (POTUS + Cabinet) | POTUS/VP, Cabinet, agencies, Federal Register, combatant commands, ADS-B tracking | ⚠️ skeleton — same |

So as found: **only warsat has actual Python code.** The other three are monitor-definition stubs. The pattern was clearly meant to be repeated: each new *sat would have its own `*sat-delta.py` and `*sat-orbital.py` derived from warsat's, but it was never finished.

## The signal reading pipeline

There is a separate set of scripts — the **SIGINT** system — that runs as a feeder for the *sats. Three layers, per `COMPLETE_SIGINT_SYSTEM.md`:

1. **Pre-mainstream signals** (3:00 AM UTC) — `signal_collector_reddit_feeds.py`, plus `multi_osint_search*.py`, `gnews_scraper.py`, `reddit_fixed.py`. Lead time: 12–24 h ahead of mainstream.
2. **Institutional coordination** (3:00 AM UTC) — Pentagon/State/White House press monitoring. Lead time: 0–24 h.
3. **Market signals** (every 6 h) — `shipping_tracker.py` + oil/P&I/AIS. Lead time: real-time.

Collectors dump raw JSON to `memory/signal_results/{gdelt,newsapi,newsdata,reddit_feeds,shipping_tracker}/`. Five iterations of `signal_analyzer*.py` parse those into "findings." The SIGINT integration code (`sigint_shipping_integration.py`) is meant to bridge the shipping feed into the warsat scan pipeline.

The full archive of collected raw signals is included in `memory/signal_results/` — 184 MB. It's what an analyst would want to see for "what did the pipeline actually catch."

---

## How it was wired (in the old OpenClaw)

- All paths hardcoded relative to `~/.openclaw/workspace/`.
- The `*sat.skill` zip files in `skills-pkg/` are byte-identical to the unpacked `skills/*sat/` directories — packaged copies sitting next to the unpacked ones. Magic.
- Only warsat has any actual `scripts/` content. The other three have empty `scripts/` directories.
- `signal_results/` is read by the analyzers; nothing ever deletes from it. 184 MB has accumulated since March 2026.
- Each *sat has a killswitch in `memory/switch-state/`. The warsat one is called `wartrack-switch.json` (legacy name from before the *sat family was unified).
- The `INTELLIGENCE_SOURCES.json` and `THREAT_ACTOR_FRAMEWORK.md` describe the data taxonomy that the 45 warsat monitors and the SIGINT collectors are built on.

---

## What's missing entirely (for the spec author)

- **Only 1 of 4 sats has code.** The warsat-delta/warsat-orbital pattern needs to be replicated for repsat/scosat/execsat — or, better, factored out so the *sat "engine" is shared.
- **Five versions of `signal_analyzer*.py` with no clear supersedence.** v1, premium, v2, v3_early_warning, v3_expanded. Probably v3_expanded is current. There's no way to tell without reading them.
- **Three versions of `multi_osint_search*.py`** (`multi_osint_search.py`, `_final.py`, `_real.py`). Same problem.
- **No tests anywhere.**
- **No config file.** The signal results dir, the monitor JSON paths, the API keys, the tier lists — all hardcoded.
- **No migration story.** When the workspace moves, `satellite-keys.json`, the killswitches, and the 184 MB of cached signal results are left behind.
- **No retention policy on `signal_results/`.** 19,339 files, growing.
- **The signal-reading pipeline is loose-coupled by JSON files** — collectors write, analyzers read, no shared schema.
- **The SIGINT "shipping integration" looks aspirational** — there's an integration script but it's unclear what calls it or what it returns to.

---

## What is NOT in this package

To keep scope tight:

- **Conspiracy research archive** (`memory/archive/conspiracy-full.md`, `conspiracy-audit/`) — separate project.
- **Backups** in `/root/backups/essential-only/` and `/root/backups/critical/` — duplicate copies.
- **The hermes import mirror** at `/root/.hermes/skills/openclaw-imports/warsat/` — third copy, identical.
- **The openclaw orchestrator code** itself — the *sats were leaf skills inside it.
- **`__pycache__/` bytecode, `node_modules/`, `.git/`** — generated/installed.
- **The `sellsat/` project** at `/root/sellsat/` — separate satellite-sales thing, different codebase.
- **Compiled `.pyc` files** — generated.
