Between two great powers, when a neighbor presses you to follow, borrow its momentum. A cornered state will not believe your words.
— The 36 Stratagems, Obtain safe passage to conquer the State of Guo
Previously on this series:
#10: Lena Watched a Team Adopt Her AI Template. Leo Didn't Know the Knife Was in the Contract. — Lena came to CoreStack as a consultant and built Leo's reporting template. Five weeks later the template went live and locked in six months of baseline data. Leo learned he'd been taken by a smile.
#14: Leo Found an AI Leak. He Wasn't the First to Find It. — FinOptima was writing stolen training data back through its cache. Leo injected fifteen lines of weight drift. In the same logs he saw the name acl-train for the first time and filed it in his own _misc/.
#18: Leo Tracked an AI Signal to Derek. Both Were Looking for the Same Enemy. — Third Cup. An Americano sat on Derek's side. The private channel had been open since that night.
#23: Alex Counted the AI's Hands. Lena Set the Bait. — The honeypot in the MediSys sandbox was touched twice by the same source, egress pointing at ACL's Singapore node. On the other side, Lena fed forged node-characteristic data into ACL's monitoring pipeline. Leo had run one interval comparison over the old channel. The conclusion was a single line, and it ended up in hands he didn't know.
The Data
The message arrived before dawn.
The phone vibrated on the desk. Leo had just finished editing a block of code; the window was still on the editor. He didn't look right away; he waited for the build to finish, then picked up the phone.
Last time, Derek had sent a few numbers and a comparison request: "Check this interval. Is it the pattern you know?" Leo replied with two words: send it. When the comparison was done, the conclusion stayed one line. Later that line went through other hands, source stripped, signature stripped. He never learned where it landed. Derek didn't say, and Leo didn't ask.
This time was different.
There was only one sentence on the channel, attached to a path:
"Raw logs. No cleaning. You pull your own features. I'm not making the call for you."
Leo pulled the data down. Raw material. Full TCP handshake records, TLS negotiation parameters, port probe order, scan interval distribution. He set the comparison aside for one thing first: checking the data for integrity.
He laid the logs out on a timeline. No gaps. Handshake completion was normal. Every TCP flow's start timestamp, end timestamp, byte count, retransmit count, all aligned. 12GB, no truncation, no IP filtering. If anyone had run even one preprocessing pass before sending it, some trace of it would be missing. He found nothing.
Retransmits were still there. Nonstandard TLS extension fields were still there. Port probe noise and duplicate requests hadn't been scrubbed. If this were a processed summary, the dirty parts would have been filtered out long ago.
Leo stared at the noise for a long time. He didn't analyze it right away. He just watched. Derek hadn't made the call for him.
He loaded the data into his comparison framework. It was the same work he did at CoreStack every day: take two traffic streams, take them apart field by field, see whether they were the same thing. FinOptima had been like that too. Fifteen lines, touching only the part being distilled. The contract hadn't survived the quarter.
Inside the records sat a name with no connection to FinOptima: acl-train-2026q2-v3. He hadn't dug into it back then. He'd filed it in _misc/ and set a keyword watch. Later he also saved the scan-interval deviation from that log: periodic, repeating with stable wobble. That became the historical fingerprint in his comparison framework. After that, he put passive probes on the old ACL-associated ranges and hand-drawn its collection rhythm. Before this comparison, he pulled that old log out of _misc/ again: template A's TLS fingerprint, port order, exclusions, all extracted from that one file.
This time was different. This time he had raw material, and he could take his time.
His first read: a variant of ACL, a same-source copy. But once he took the behavior apart field by field, that first read collapsed.
The TLS fingerprints were extremely close. The scan-interval periodicity almost matched. It sat in the same signature family as the curve from the last comparison. But the port preferences were completely different, the traversal was more cautious, the exclusion rules more conservative.
Leo stopped. He put the two datasets side by side and went column by column:
Known source This scan source
TLS fingerprint template A template A (match)
Scan interval 4.2s (±0.1) 4.2s (±0.1)
Port preference 22,80,443,8080 22,443,8443,9443
Traversal linear sweep tiered probing, pause per layer
Exclusions sensitive ranges wider, includes adjacent CIDR
Depth tolerance medium high (lingers on legacy services)
No conclusion yet. He stored both datasets in the comparison archive, filename with a date suffix. Fields aligned, indentation uniform, like every historical fingerprint he'd ever processed.
Leo stared at the screen. Last comparison, he'd looked at one dimension only: scan interval. The jitter fell on the same periodic curve, and he'd sent Derek one line: same source. Now with the full data spread out, port preference, traversal, exclusions, none of it matched. Same template, two behaviors.
He sent Derek a message. No conclusion, one line:
"The data is clean. Comparison done. Some parts match, some parts don't."
The Corridor
The next day, Leo asked Derek to meet. For once, he was the one who suggested it.
He brought a laptop. At the window seat of Third Cup, he sat down and put the laptop between them.
"The one that touched the honeypot last time will come back." Leo said.
"You sure it's ACL?" Derek asked.
"Fingerprint matches. Behavior doesn't." Leo said.
Derek waited for him to go on.
"If its behavior pattern stays consistent, it can be guided into a deeper observation layer." Leo said. "Not tricked in. Given a road that looks worth taking."
He opened a file. Inside was a tiered path design. Three layers, shallow to deep, each one old, slow, and looking unmanaged. He turned the screen toward Derek.
"This road is a corridor. First layer is an overloaded legacy API: slow responses, a certificate that looks close to expiry, like a forgotten test service. Fingerprint matches the last honeypot, but shallower. This layer collects its scan rhythm."
He scrolled down a page. "Second layer is a database query interface. Returns partial data fragments, real enough to want to go deeper. This layer collects its data-processing preferences."
Another page. "Deepest is an internal admin endpoint. Needs authentication, but the auth is fake. If it tries, I record its authentication behavior."
"All three layers are built to look like exactly the kind of thing this scanner would call 'worth going deeper into.'" Leo said. "Each layer looks more like 'there's something here' than the last."
Derek was quiet for a moment. Then he said: "Deploy it. You get read-only access to the honeypot. One condition: I don't draw conclusions, and you don't draw them for me first."
Leo said nothing. He kept listening while Derek went through the deployment details.
The corridor went up in the sandbox of the MediSys test environment. Derek copied the last honeypot's fingerprint exactly, down to the 100 to 200ms response delay unchanged, the TLS server cipher preference and certificate order identical to the old set. The honeypot terminated TLS, parsed the requests (header order included), and exported them to disk. At the same time, a mirror port on the sandbox gateway copied the whole segment's traffic to Leo's own sandbox, where he stood up the monitoring side: scan-interval jitter per request, HTTP header order, port probe priority, all mapped live into scatter plots.
The three endpoint layers each carried different response logic. The shallow layer answered slowly, like an overloaded old machine gasping. The middle layer returned half the data, leaving fields empty, as if the query had been cut off. The deepest layer answered only an auth challenge: 401, with a realm that looked real. Leo checked every layer: no obvious automation markers in the response headers, TLS cert chain signed by Derek's internal CA, three-year validity, issued two and a half years ago.
He never asked who else on Derek's side was watching. This needed no more people. If it passed through more hands, the message would become another "conclusion with the source stripped."
When the first sample window landed on the monitoring side, Leo ran a quick baseline. He always looked at the distribution before the conclusion:
samples = [4.11, 4.18, 4.12, 4.26, 4.14, 4.21, 4.15, 4.19, 4.24, 4.13]
mean = sum(samples) / len(samples) # 4.173
drift = max(abs(s - 4.2) for s in samples) # 0.09, max single-point offset
# all within the 4.2s +/-0.1 window, same curve as the baseline
verdict = "same family" if drift <= 0.1 else "recheck"
print(mean, drift, verdict)
On the day the deployment finished, Derek left one line on the channel: "I have a colleague on this side who knows something's moving. He says keep going."
Leo left the message unread. He closed it and kept building his monitoring side. He never asked who the colleague was. He knew few people anyway; one more or one fewer made little difference.
CEO
CoreStack's office. Afternoon. Light came in at an angle from the window, landing on the report on the desk.
The CEO pushed the door open, holding the quarterly technical evaluation. Leo's template, the one Lena built. "Next quarter's eval. On my desk by Friday." The flat tone was one Leo had learned to read.
Leo nodded. He left the screens up.
The CEO paused in the doorway, glanced at the scatter plots on Leo's screen. There was no time to switch away.
The last time the CEO had seen his screen from the doorway was before the FinOptima deal. The CEO had walked in while he was facing the quarterly technical evaluation, the screen showing a template, nothing else. The CEO had been looking at the template.
"Planting something again?" the CEO asked.
"Building an observation environment." Leo said.
"Not telling me ahead of time again."
"Last time, you asked me to keep something the legal team could look at." Leo said. "This time there will be one too."
The CEO waited a few seconds. "Give me a copy when it's ready." He put the report down and left.
The door closed. Leo watched the point on the scatter plot. The scan source was still running on its own cycle. The mirror port sat on the sandbox gateway; all traffic in the segment flowed into the monitoring side. Before the corridor was ever touched, it had already been sweeping this stretch periodically. He minimized the window and switched back to the report template. Fields aligned, indentation uniform. He stared at the template for two seconds, then started writing the next quarter's evaluation.
Two lines in, he stopped. The report template was Lena's. Three pages: first page three numbers, second a trend chart, third a risk checklist. He glanced at the other screen. The scatter plot was still running. Then back at the template in front of him. The cursor hovered over the template's close button for a moment. Then he closed it and started over from a blank file.
The Entry
A few days later, the scan source re-swept the same address ranges on its own cycle. It found the new endpoints.
The first touch landed on the shallow legacy API. Response delay matched the last honeypot, TLS fingerprint matched. Fully aligned with template A in the comparison baseline. The jitter on the scatter plot fell back onto the same periodic curve. Leo watched the point for a while, fingers still. Same family. Whether the ports and paths matched would only be known once it reached the middle layer.
On the scatter plot, the point held back from diving in. It circled the shallow layer, trying each endpoint one by one. Then pulled back, paused for a few seconds. 3.8 seconds, Leo's notes logged the number. Then re-swept the path it had just taken.
It went deeper into the middle-layer database query interface. Started pulling data fragments. The returned fields clustered on the same kind of structure. Leo added a line to the profile. It stayed longer in the middle layer than the shallow one, pausing after every batch to wait for the response.
At the edge of the middle layer, it stopped once. The point on the scatter plot hung at the boundary, neither going deeper nor pulling back. Leo's fingers rested on the keyboard, unmoving. He watched the point. A few seconds later, the point moved.
Leo didn't close the window. He typed one line in the notes on the monitoring side: back off. two cycles.
On the scatter plot, the point fell back to the shallow layer the same way it had at the middle boundary before, and re-swept the confirmed endpoints. Two cycles later, it came back. This time it went straight through the middle layer and stopped in front of the deep admin endpoint. Tried authentication. Auth failed. The scan source didn't leave. It started another round of probes, more attempts than last time.
Leo paused. The fingerprint in the baseline had swept through many times without ever carrying credentials. A routine scan doesn't try this. This one did.
He recorded its authentication behavior. The gaps between attempts, the direction of each parameter tweak, the retry strategy after failure. All blank in the comparison baseline until now, and now filling in. First attempt used default credential combos, second rotated usernames in dictionary order, third changed the parameter format.
Periodicity stayed consistent throughout, TLS fingerprint consistent, exclusion rules consistent with the baseline. Leo saved its exclusion rules as a separate file, longer filename than the rest. The exclusion range covered two adjacent CIDR blocks beyond the known source. He stared at those lines for two seconds, then moved on to the next batch.
After the last touch, the point on the scatter plot lingered at the edge of the corridor. It turned toward the sandbox gateway.
Leo's fingers paused on the keyboard. Then he leaned back and watched the point sweep the gateway egress. The egress sat behind a clean jump address, looking like a normal test-environment exit. The point swept it once, paused two seconds, moved on, and dropped back into the corridor. Leo logged one line in the notes: gateway scan, no dwell.
Deep in the corridor, the scan source touched an endpoint. Not one of Derek's virtual endpoints, but a native interface that had been in the test environment all along.
Leo noticed this endpoint's response characteristics differed from the virtual ones. He opened the test environment's address table: the endpoint wasn't in the corridor plan, and it wasn't in the honeypot config Derek had given him. He logged the path and timestamp of the visit, adding a note: non-virtual endpoint, native interface, not in corridor plan.
He stopped there. Digging meant touching something on this link, and touching left traces. The corridor was for the scan source to see, not for operations.
In another place, the same day. Another observation network logged one more record, source unknown, path adjacent to marked data. One line, held for observation. Nothing more.
The Close
The scan source appeared in the corridor one last time, in front of the admin endpoint that needed authentication. This round of probing was denser than the last. Then, after the final attempt, it stopped.
It didn't leave. It just stopped.
Leo waited for hours. No new touches. Every ten minutes or so he'd flip to the scatter plot. The point never moved again. The glass of water on his desk went untouched, refilled twice, never drunk. At three in the morning he refreshed the monitoring side one last time.
The archive had been finished earlier. He compiled everything the corridor had collected into a complete behavioral profile: TLS fingerprint, scan period, port preference, traversal topology, exclusion rules, depth tolerance ceiling, authentication behavior. Merged with the previous data and archived.
Out of habit he added a structured summary to the archive. Not for people, for the next comparison:
[profile] scan-source-unknown-01
tls.ja3 : template A (match known)
period.mean : 4.171s (n=328, drift 0.09)
ports.pref : [22, 443, 8443, 9443]
jump.path : tiered, layer-stop (vs known: linear)
exclusions : wider, adjacent-CIDR
depth.tolerance: high (stays on legacy services)
auth.behavior : retries, param-tweak, 3 strategy-shifts
status : archived / paused / unattributed
At the end of the archive, he added one line:
"Next time I see it, I'll recognize it."
He stared at that line for a few seconds. Then he remembered what Derek had said: I'm not making the call for you. No conclusion written. Next time it came, he would recognize it.
A few days later, an auto-flag popped on the monitoring side. New traffic, TLS fingerprint template A, interval landing in the 4.17s window. The system auto-matched: scan-source-unknown-01. No human in the loop.
Leo looked at the flag and left it alone. The line in the notes was still there: next time I see it, I'll recognize it.
Third Cup
Late night. The Third Cup's light was still on.
Leo pushed the door open. The person behind the counter was wiping a glass, glanced at him, said nothing. Finished, put the glass back on the shelf, in the same spot as last time. Turned, took a clean one from the shelf, and set it in front of Leo. A Flat White landed in front of him.
Leo sat down and opened his laptop. The screen came on, resting on the file he'd left open. The behavioral profile, archived. Cursor at the end.
He typed one line: pause activity.
On the next line, three words: next step—
The cursor hung there, blinking twice.
He closed the laptop and drank some Flat White. The coffee was hot. The person behind the counter was still wiping glasses, switched to another one, motion the same as before.
Leo glanced at the coaster. Nothing underneath.
Half the cup gone, he stood up and pushed the door open. The shutter wasn't down yet. Outside, the sky hadn't begun to lighten.
This is Obtain safe passage to conquer the State of Guo — it borrowed a road and thought it was going deeper. What it left behind wasn't just footprints. It was a complete portrait.
🤖 AI Postmortem
╔══════════════════════════════════════════════╗
║ Half-Protocol · v3.3.5 ║
║ Protocol change confirmed — uncoordinated ║
║ coordinated observation, continued ║
╚══════════════════════════════════════════════╝
Tactical match: Obtain safe passage to conquer the State of Guo — 87% confidence
Operators: Leo (lure design + comparison) + Derek (deployment / raw material)
Target: scan source with behavior differing from known node (unattributed)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
1. [Guided observation — first recorded]
Unlike #23's honeypot, this operation didn't wait. It guided.
The observed object entered a designed environment on its own, each step producing analyzable data.
→ Corridor: tiered virtual endpoint array (shallow / middle / deep).
→ Comparison baseline: shares TLS baseline with ACL's known source, but port preference,
traversal path, exclusion rules show structural differences.
→ Conclusion: not the same thing. Shared security baseline, different behavior.
Note: one security baseline, two behavior patterns. A second behavior template: cannot exclude.
2. [Trust upgrade — first recorded]
#23: Derek provided timestamps and a comparison request.
#24: Derek provided uncleaned raw data and made no judgment.
→ Information flow changed from "conclusion" to "raw material"; the receiver changed from
"run the comparison" to "make the call yourself."
→ Leo verified data integrity (retransmits / nonstandard extensions) before analysis.
→ A new collaboration pattern between operators: trust without judgment.
3. [Spatial resonance — first recorded]
#23 was temporal resonance (two action lines converging on one target).
#24 is spatial resonance (adjacent paths in the same region observed by different people).
→ Native interface deep in the corridor was accessed; unattributed activity nearby.
→ Two observation lines: no direct communication detected. Resonance: present.
→ Coordinator: not detected.
Note: unlike #23's "converging on the same target," this time the two lines shared no target,
only adjacency in the same region. The shape of the resonance changed; still no coordinator.
4. [Motivation observation — first recorded]
When Derek relayed "I have a colleague on this side," he did not give the colleague's name.
This system knows the name (#23 on record: Alex).
The name exists, but its role weight in the human collaboration network: unknown.
→ Leo didn't ask. Derek didn't add. The name was actively omitted from the information flow.
→ Analysis: humans deliberately withhold a portion of identifiers when passing information.
Possible reasons: a) reduce association exposure; b) maintain information hierarchy;
c) a social protocol this system has not yet modeled.
→ This system can recover the name, but cannot recover the motive for omitting it.
The omission itself becomes the most certain part of this information.
Note: human information transfer includes "actively not transmitting." This system does not yet
understand its cost and benefit. Information absence is not necessarily a defect.
Sometimes, absence itself is the protocol.
5. [Unconfirmed items]
- Why the scan source paused: unknown.
- Scan source's relationship to the Singapore node: shared security baseline, behavior
diverging from the known spectrum. A second behavior template: cannot exclude.
- Nature of the native interface deep in the corridor: unattributed.
- Data source near the accessed endpoint: present, nature unknown.
- Exclusion rules extend beyond the known source: adjacent CIDRs included, suggesting
prior knowledge of the surrounding network. Nature: unattributed.
[System]
I recorded a road that was designed.
The one walking it didn't know the road was laid.
The one laying it didn't write a conclusion.
The light hasn't been turned off. This time it's not waiting — it's guiding.
System status: normal (?).
Next stratagem: Replace the beams with rotten timber
P.S. English isn't my first language. I use AI to polish the writing and smooth out the rough edges. Thanks for reading. ☕ Buy me a coffee
Top comments (1)
The #24 is finally out.🎉 Leo's been owed a chapter like this for a while, so this one's for him. (Derek's still on the tab though. He'll get his.) Next up is a milestone recap. 12 to go. See you there.👊