H3XA
H3XA / Technical offering

The operational record

H3XA fuses cyber, infrastructure, and physical telemetry into one provenance-first record. A situation opens by place, then by time. The month window is UTC, from the first of the month through the next month. Episodes, the assessment, public reporting for that window, and the briefing are one record.

01/

From a measurement to a situation

Observation
Source-owned. Preserved as it was acquired.
↓
Event
An occurrence derived from related measurements.
↓
Situation
The operational condition those events belong to.
↓
Assessment
The derived reading, kept with its provenance.

Observed events, inferences, and predictions stay separate. A missing collection window stays missing. It is not rewritten as a quiet period, and it is not filled with an invented event.

02/

What enters the assessment

May feed the assessment
  • Infrastructure observations
  • IODA, Voidly, and Cloudflare measurements
  • Derived events and situations
Stays in the setting
  • Aviation and maritime context
  • Physical hazards
  • Headlines and public reporting
  • Catalog and dependency notes

Co-occurrence is recorded. It is not an input to the score. Country markers are centroids: an approximate geographic representation, not a measured incident coordinate. Aviation positions, maritime positions, and geotagged notes remain context. Incomplete source coverage is an incomplete record, not confirmation that nothing happened.

03/

History is kept, not rewritten

01
A later analysis is a new assessment

When a new analysis has derivation inputs, H3XA writes a successor and links it to the assessment it follows. The stored head is left as it was.

02
A gap stays labeled

An assessment whose derivation cannot be replayed is labeled. The missing derivation is not invented, and the historical values are not replaced.

03
The public picture omits the stored score

The anonymous picture shows current conditions, methodology, and provenance. Stored stress and situation records are read in the operational workspace.

Exact scoring weights, thresholds, and the collection schedule stay in internal documentation. The public method is the trust model: evidence remains distinguishable from the assessment built on it.

04/

What this product is for

H3XA is the system of record for those derived conditions. Source observations remain attributed to the feeds that produced them. Catalog totals stay catalog totals. They are not reported as operational counts. A cyber, infrastructure, or physical observation enters the record through that provenance path, and it remains separable from the assessment H3XA writes.