inquire
Field notes/Workspace
Two analysts sketching a workspace map next to their laptops10.11Field note · Workspace
#workspace#ui
2 min readInquire desk

The console got a name, and so did everything else

Workspace surfaces now carry their own names, and the dashboard opens by asking which one you want.

A naming problem, not a feature

We had a naming problem. Everything in the workspace was called after how it was built — console, stealer-logs, breach-graph — which is fine for the repo and useless for the person using it. So each surface gets a name now and the code keeps its own vocabulary underneath.

What each surface is called now

Prism is the search console. Lattice is the graph workspace. Undertow is the infostealer corpus. Ledger is history, Pass is billing, Beacon is notifications, Circle is the team. Arbiter is new and does the identity-verification pass. None of this changes what the tools do; it changes what you call them when you ask someone to open one.

The dashboard asks before it drops you somewhere

The dashboard no longer drops you straight into a grid. It asks first: Ember, Meridian, or Vantage. Ember is one search bar and nothing else. Meridian puts the canvas up front with the live probe stream, which is the setup people doing real work kept rebuilding by hand every session. Vantage keeps the whole catalogue visible with the analysis surfaces pulled forward. The pick is stored per browser and you can change it later — it only decides what you see first, not what you can reach.

Arbiter scores the record before you spend a lookup

Arbiter is the other new piece. Give it a country and whatever identity attributes you have — name, date of birth, phone, national ID, street, city — and it scores how complete and how internally consistent the record is before you spend a lookup on it. It will not invent a result it does not have. If the record is thin it says so.

Telegram picked up a second path

Telegram lookup picked up a second path. The MTProto session stays, but there is now a lane that talks to an external index first and falls back to the session when that comes back empty. The endpoint is configured from the environment, so it stays a config change instead of a code change.

Checked against the running build

Everything here was checked against the running build, not against a mock: the mode gate renders and persists, the renamed surfaces resolve to the routes they always did, and the Arbiter pass runs its score on real input.

IQ

The Inquire desk

Build notes from the console and the lanes behind it. Written when something actually changes, with the numbers attached.

Related notes

View all

Explore more from Inquire

You already know the first question.

One field, the whole catalogue behind it, and every answer filed with the module that produced it.