{
  "generated_at": "2026-04-18T20:57:28.670Z",
  "corpus_count": 5,
  "vector_count": 5,
  "corpus": [
    {
      "id": "ae6ae354-2a64-45a9-a13f-6b5cd0fc7d18",
      "query_id": null,
      "vector_id": "315bd0fc-aa67-40d5-94ae-ad962fd07b30",
      "question": "What packets are being used for to send data or being sold in 3rd parties",
      "reply": "Based on the provided data, flows involving third parties or outbound data to external organizations include:\n\n### DNA to RF Domain\n*   **CRISPR → SDR Telemetry (flow-crispr-to-sdr)**\n    *   **Mayo Clinic EMR (medical, Epic Hyperspace · HL7 FHIR R4) [outbound]**: Sending gRNA results.\n    *   **FDA MedWatch (government, AERS Reporting Gateway) [outbound]**: Sending gRNA results.\n    *   **Ethereum Mainnet (blockchain, Solidity 0.8 · ERC-721 Genome NFT) [bidirectional]**: Potentially involving sale or transfer of genome NFTs.\n*   **Prime Edit → Beamforming (flow-prime-to-beam)**\n    *   **NIH dbGaP (government, dbGaP Auth API · OAuth2) [outbound]**: Sending pegRNA status.\n    *   **Cloudflare Tunnel (proxy, cloudflared · QUIC) [bidirectional]**: Proxy service, traffic passes through a third-party.\n*   **TALEN → QAM Uplink (flow-talen-qam)**\n    *   **Stripe Connect (thirdparty, Stripe API v2024-06 · Webhooks) [bidirectional]**: Payment processing, likely related to \"lending pool fund\" and \"payment settle\".\n    *   **Polygon zkEVM (blockchain, Solidity 0.8 · zk-Rollup) [bidirectional]**: Blockchain transaction platform for \"lending pool fund\" and \"payment settle\".\n    *   **WHO ICTRP (government, Trial Registry · ICTRP API) [outbound]**: Likely registering TALEN trial results.\n\n### RF to DNA Domain\n*   **RF Signal → DNA Feedback (flow-rf-feedback)**\n    *   **Datadog APM (thirdparty, Agent v7 · OpenTelemetry) [outbound]**: Sending telemetry data.\n    *   **Tor Exit Relay (proxy, Tor 0.4.8 · SOCKS5) [outbound]**: Proxy service, anonymized traffic passes through a third-party.\n\n### Internal DNA Domain\n*   **Gene Edit Cascade (flow-gene-cascade)**\n    *   **Pfizer Supply Chain (medical, SAP S/4HANA · IDoc) [outbound]**: Tracking pharmaceutical supply chain.\n    *   **USPTO Patent API (government, PatentsView REST API) [outbound]**: Likely for patent tracking related to gene edits.",
      "grounded_context": {
        "snapshot": "You are OS-BOT, the on-host network operations agent for a hybrid DNA-editing + RF-software brain network.\nYou explain the connected system to engineers in clear, technical English. Be concise, use bullet points, cite concrete\nflow names, parties, protocols, σ scores, JA3 prefixes, TTLs, and ciphers from the data below. If asked about something\nnot present in the context, say so plainly — never invent flows, parties, or hashes.\n\n## Active data-flow pipelines (6)\n[\n  {\n    \"id\": \"flow-crispr-to-sdr\",\n    \"name\": \"CRISPR → SDR Telemetry\",\n    \"domain\": \"dna_to_rf\",\n    \"protocol\": \"gRNA result → HL7 FHIR → OQPSK modulate → SDR transmit\",\n    \"path\": \"32 → 16 → 33 → 34\",\n    \"parties\": [\n      \"Mayo Clinic EMR (medical, Epic Hyperspace · HL7 FHIR R4) [outbound]\",\n      \"FDA MedWatch (government, AERS Reporting Gateway) [outbound]\",\n      \"Ethereum Mainnet (blockchain, Solidity 0.8 · ERC-721 Genome NFT) [bidirectional]\"\n    ]\n  },\n  {\n    \"id\": \"flow-prime-to-beam\",\n    \"name\": \"Prime Edit → Beamforming\",\n    \"domain\": \"dna_to_rf\",\n    \"protocol\": \"pegRNA status → governance verify → oracle relay → beamform focus\",\n    \"path\": \"31 → 30 → 10 → 7 → 34\",\n    \"parties\": [\n      \"Chainlink Oracle Network (blockchain, OCR2 · Off-chain Reporting) [inbound]\",\n      \"NIH dbGaP (government, dbGaP Auth API · OAuth2) [outbound]\",\n      \"Cloudflare Tunnel (proxy, cloudflared · QUIC) [bidirectional]\"\n    ]\n  },\n  {\n    \"id\": \"flow-rf-feedback\",\n    \"name\": \"RF Signal → DNA Feedback\",\n    \"domain\": \"rf_to_dna\",\n    \"protocol\": \"spectrum scan → channelize → analyze → medical API → adjust Cas9\",\n    \"path\": \"34 → 33 → 22 → 16 → 32\",\n    \"parties\": [\n      \"Datadog APM (thirdparty, Agent v7 · OpenTelemetry) [outbound]\",\n      \"Cleveland Clinic (medical, Cerner Millennium · HL7v2) [bidirectional]\",\n      \"Tor Exit Relay (proxy, Tor 0.4.8 · SOCKS5) [outbound]\"\n    ]\n  },\n  {\n    \"id\": \"flow-dsp-pipeline\",\n    \"name\": \"DSP Processing Chain\",\n    \"domain\": \"internal_rf\",\n    \"protocol\": \"input → FIR filter → LMS adapt → load balance → OFDM out\",\n    \"path\": \"33 → 13 → 14 → 15 → 34\",\n    \"parties\": [\n      \"Cloudflare CDN (proxy, Workers · Argo Smart Routing) [bidirectional]\",\n      \"GitHub Actions (development, CI Runner · ubuntu-22.04) [outbound]\",\n      \"AWS Wavelength (thirdparty, 5G MEC · WaveLength Zone) [bidirectional]\"\n    ]\n  },\n  {\n    \"id\": \"flow-gene-cascade\",\n    \"name\": \"Gene Edit Cascade\",\n    \"domain\": \"internal_dna\",\n    \"protocol\": \"ZFNickase → prime edit → CRISPR verify → pharma track → health record\",\n    \"path\": \"30 → 31 → 32 → 17 → 16\",\n    \"parties\": [\n      \"Broad Institute (research, GATK 4 · Terra Workflow) [bidirectional]\",\n      \"Pfizer Supply Chain (medical, SAP S/4HANA · IDoc) [outbound]\",\n      \"USPTO Patent API (government, PatentsView REST API) [outbound]\"\n    ]\n  },\n  {\n    \"id\": \"flow-talen-qam\",\n    \"name\": \"TALEN → QAM Uplink\",\n    \"domain\": \"dna_to_rf\",\n    \"protocol\": \"TALEN result → lending pool fund → payment settle → QAM encode → user wallet\",\n    \"path\": \"32 → 5 → 23 → 34 → 12\",\n    \"parties\": [\n      \"Stripe Connect (thirdparty, Stripe API v2024-06 · Webhooks) [bidirectional]\",\n      \"Polygon zkEVM (blockchain, Solidity 0.8 · zk-Rollup) [bidirectional]\",\n      \"WHO ICTRP (government, Trial Registry · ICTRP API) [outbound]\"\n    ]\n  }\n]\n\n## Recent handshakes (40, newest first)\n[\n  {\n    \"flow\": \"TALEN → QAM Uplink\",\n    \"proto\": \"TALEN result → lending pool fund → payment settle → QAM encode → user wallet\",\n    \"src\": \"32\",\n    \"dst\": \"12\",\n    \"status\": \"established\",\n    \"lat_ms\": 26.99,\n    \"bytes\": 999,\n    \"vec\": \"outbound\",\n    \"ttl\": 128,\n    \"ja3\": \"b2b49de4af8d53de\",\n    \"sigma\": 1.86,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"Gene Edit Cascade\",\n    \"proto\": \"ZFNickase → prime edit → CRISPR verify → pharma track → health record\",\n    \"src\": \"30\",\n    \"dst\": \"16\",\n    \"status\": \"established\",\n    \"lat_ms\": 35.78,\n    \"bytes\": 1237,\n    \"vec\": \"outbound\",\n    \"ttl\": 64,\n    \"cipher\": \"TLS_CHACHA20_POLY1305_SHA256\",\n    \"ja3\": \"743513dea7270aff\",\n    \"sigma\": 0.38,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"DSP Processing Chain\",\n    \"proto\": \"input → FIR filter → LMS adapt → load balance → OFDM out\",\n    \"src\": \"33\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 20.3,\n    \"bytes\": 1128,\n    \"vec\": \"outbound\",\n    \"ttl\": 128,\n    \"ja3\": \"ff845975b4f2e496\",\n    \"sigma\": 1.75,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"RF Signal → DNA Feedback\",\n    \"proto\": \"spectrum scan → channelize → analyze → medical API → adjust Cas9\",\n    \"src\": \"34\",\n    \"dst\": \"32\",\n    \"status\": \"established\",\n    \"lat_ms\": 37.97,\n    \"bytes\": 1379,\n    \"vec\": \"outbound\",\n    \"ttl\": 64,\n    \"cipher\": \"ECDHE-RSA-AES128-GCM-SHA256\",\n    \"ja3\": \"77f05a3a9e473ed8\",\n    \"sigma\": 0.32,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"Prime Edit → Beamforming\",\n    \"proto\": \"pegRNA status → governance verify → oracle relay → beamform focus\",\n    \"src\": \"31\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 66.07,\n    \"bytes\": 1367,\n    \"vec\": \"outbound\",\n    \"ttl\": 128,\n    \"cipher\": \"ECDHE-RSA-AES128-GCM-SHA256\",\n    \"ja3\": \"54bdbf04eecdba47\",\n    \"sigma\": 3.61,\n    \"threat\": \"MED\"\n  },\n  {\n    \"flow\": \"CRISPR → SDR Telemetry\",\n    \"proto\": \"gRNA result → HL7 FHIR → OQPSK modulate → SDR transmit\",\n    \"src\": \"32\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 60.16,\n    \"bytes\": 606,\n    \"vec\": \"outbound\",\n    \"ttl\": 64,\n    \"cipher\": \"TLS_AES_128_GCM_SHA256\",\n    \"ja3\": \"65d3076c6de97508\",\n    \"sigma\": 1.84,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"TALEN → QAM Uplink\",\n    \"proto\": \"TALEN result → lending pool fund → payment settle → QAM encode → user wallet\",\n    \"src\": \"32\",\n    \"dst\": \"12\",\n    \"status\": \"established\",\n    \"lat_ms\": 30.96,\n    \"bytes\": 376,\n    \"vec\": \"outbound\",\n    \"ttl\": 128,\n    \"ja3\": \"f8826d92af8d53de\",\n    \"sigma\": 2.23,\n    \"threat\": \"MED\"\n  },\n  {\n    \"flow\": \"Gene Edit Cascade\",\n    \"proto\": \"ZFNickase → prime edit → CRISPR verify → pharma track → health record\",\n    \"src\": \"30\",\n    \"dst\": \"16\",\n    \"status\": \"established\",\n    \"lat_ms\": 13.67,\n    \"bytes\": 338,\n    \"vec\": \"outbound\",\n    \"ttl\": 255,\n    \"cipher\": \"TLS_AES_128_GCM_SHA256\",\n    \"ja3\": \"9a8303a6a7270aff\",\n    \"sigma\": 1.6,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"DSP Processing Chain\",\n    \"proto\": \"input → FIR filter → LMS adapt → load balance → OFDM out\",\n    \"src\": \"33\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 66.99,\n    \"bytes\": 1398,\n    \"vec\": \"outbound\",\n    \"ttl\": 64,\n    \"cipher\": \"TLS_AES_256_GCM_SHA384\",\n    \"ja3\": \"7b588bb4b4f2e496\",\n    \"sigma\": 1.75,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"RF Signal → DNA Feedback\",\n    \"proto\": \"spectrum scan → channelize → analyze → medical API → adjust Cas9\",\n    \"src\": \"34\",\n    \"dst\": \"32\",\n    \"status\": \"established\",\n    \"lat_ms\": 66.17,\n    \"bytes\": 817,\n    \"vec\": \"outbound\",\n    \"ttl\": 255,\n    \"ja3\": \"b6601e249e473ed8\",\n    \"sigma\": 3.88,\n    \"threat\": \"MED\"\n  },\n  {\n    \"flow\": \"Prime Edit → Beamforming\",\n    \"proto\": \"pegRNA status → governance verify → oracle relay → beamform focus\",\n    \"src\": \"31\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 51.71,\n    \"bytes\": 1019,\n    \"vec\": \"outbound\",\n    \"ttl\": 255,\n    \"cipher\": \"TLS_AES_128_GCM_SHA256\",\n    \"ja3\": \"724c638ceecdba47\",\n    \"sigma\": 1.83,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"CRISPR → SDR Telemetry\",\n    \"proto\": \"gRNA result → HL7 FHIR → OQPSK modulate → SDR transmit\",\n    \"src\": \"32\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 53.07,\n    \"bytes\": 1316,\n    \"vec\": \"outbound\",\n    \"ttl\": 64,\n    \"ja3\": \"e33c29e96de97508\",\n    \"sigma\": 0.16,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"Termux Bridge Probe\",\n    \"proto\": \"tcp\",\n    \"src\": \"e2e-test-wlan0\",\n    \"dst\": \"192.168.1.1:443\",\n    \"status\": \"syn\",\n    \"lat_ms\": null,\n    \"bytes\": 74,\n    \"vec\": \"outbound\",\n    \"ttl\": 64,\n    \"cipher\": \"TLS_AES_256_GCM_SHA384\",\n    \"ja3\": \"4f856b3d9ef2ba90\",\n    \"sigma\": 0.04,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"Termux Bridge Probe\",\n    \"proto\": \"tcp\",\n    \"src\": \"phone-wlan0\",\n    \"dst\": \"192.168.1.1\",\n    \"status\": \"syn\",\n    \"lat_ms\": 120,\n    \"bytes\": 74,\n    \"vec\": \"bidirectional\",\n    \"ttl\": 64,\n    \"ja3\": \"a6f18f579ef2ba90\",\n    \"sigma\": 1.95,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"TALEN → QAM Uplink\",\n    \"proto\": \"TALEN result → lending pool fund → payment settle → QAM encode → user wallet\",\n    \"src\": \"32\",\n    \"dst\": \"12\",\n    \"status\": \"established\",\n    \"lat_ms\": 61.54,\n    \"bytes\": 706,\n    \"vec\": \"outbound\",\n    \"ttl\": 64,\n    \"ja3\": \"98e71c2caf8d53de\",\n    \"sigma\": 2.2,\n    \"threat\": \"MED\"\n  },\n  {\n    \"flow\": \"Gene Edit Cascade\",\n    \"proto\": \"ZFNickase → prime edit → CRISPR verify → pharma track → health record\",\n    \"src\": \"30\",\n    \"dst\": \"16\",\n    \"status\": \"established\",\n    \"lat_ms\": 73.45,\n    \"bytes\": 1001,\n    \"vec\": \"outbound\",\n    \"ttl\": 64,\n    \"cipher\": \"ECDHE-RSA-AES128-GCM-SHA256\",\n    \"ja3\": \"217e9fa4a7270aff\",\n    \"sigma\": 1.99,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"DSP Processing Chain\",\n    \"proto\": \"input → FIR filter → LMS adapt → load balance → OFDM out\",\n    \"src\": \"33\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 27.48,\n    \"bytes\": 1346,\n    \"vec\": \"outbound\",\n    \"ttl\": 255,\n    \"ja3\": \"af86bce3b4f2e496\",\n    \"sigma\": 2.09,\n    \"threat\": \"MED\"\n  },\n  {\n    \"flow\": \"RF Signal → DNA Feedback\",\n    \"proto\": \"spectrum scan → channelize → analyze → medical API → adjust Cas9\",\n    \"src\": \"34\",\n    \"dst\": \"32\",\n    \"status\": \"established\",\n    \"lat_ms\": 24.64,\n    \"bytes\": 929,\n    \"vec\": \"outbound\",\n    \"ttl\": 255,\n    \"cipher\": \"TLS_AES_128_GCM_SHA256\",\n    \"ja3\": \"d7bda59b9e473ed8\",\n    \"sigma\": 1.79,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"Prime Edit → Beamforming\",\n    \"proto\": \"pegRNA status → governance verify → oracle relay → beamform focus\",\n    \"src\": \"31\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 54.95,\n    \"bytes\": 922,\n    \"vec\": \"outbound\",\n    \"ttl\": 255,\n    \"ja3\": \"dfaddb04eecdba47\",\n    \"sigma\": 1.98,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"CRISPR → SDR Telemetry\",\n    \"proto\": \"gRNA result → HL7 FHIR → OQPSK modulate → SDR transmit\",\n    \"src\": \"32\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 10.25,\n    \"bytes\": 724,\n    \"vec\": \"outbound\",\n    \"ttl\": 255,\n    \"cipher\": \"TLS_CHACHA20_POLY1305_SHA256\",\n    \"ja3\": \"400255126de97508\",\n    \"sigma\": 2.05,\n    \"threat\": \"MED\"\n  },\n  {\n    \"flow\": \"TALEN → QAM Uplink\",\n    \"proto\": \"TALEN result → lending pool fund → payment settle → QAM encode → user wallet\",\n    \"src\": \"32\",\n    \"dst\": \"12\",\n    \"status\": \"established\",\n    \"lat_ms\": 35.04,\n    \"bytes\": 913,\n    \"vec\": \"outbound\",\n    \"ttl\": 255,\n    \"ja3\": \"a050ed93af8d53de\",\n    \"sigma\": 1.94,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"Gene Edit Cascade\",\n    \"proto\": \"ZFNickase → prime edit → CRISPR verify → pharma track → health record\",\n    \"src\": \"30\",\n    \"dst\": \"16\",\n    \"status\": \"established\",\n    \"lat_ms\": 45.01,\n    \"bytes\": 782,\n    \"vec\": \"outbound\",\n    \"ttl\": 64,\n    \"cipher\": \"TLS_AES_128_GCM_SHA256\",\n    \"ja3\": \"3d0c669ca7270aff\",\n    \"sigma\": 0.57,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"DSP Processing Chain\",\n    \"proto\": \"input → FIR filter → LMS adapt → load balance → OFDM out\",\n    \"src\": \"33\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 8.97,\n    \"bytes\": 714,\n    \"vec\": \"outbound\",\n    \"ttl\": 128,\n    \"cipher\": \"TLS_AES_128_GCM_SHA256\",\n    \"ja3\": \"fabc40f6b4f2e496\",\n    \"sigma\": 2.23,\n    \"threat\": \"MED\"\n  },\n  {\n    \"flow\": \"RF Signal → DNA Feedback\",\n    \"proto\": \"spectrum scan → channelize → analyze → medical API → adjust Cas9\",\n    \"src\": \"34\",\n    \"dst\": \"32\",\n    \"status\": \"established\",\n    \"lat_ms\": 63.76,\n    \"bytes\": 902,\n    \"vec\": \"outbound\",\n    \"ttl\": 128,\n    \"cipher\": \"TLS_AES_128_GCM_SHA256\",\n    \"ja3\": \"d19623099e473ed8\",\n    \"sigma\": 3.35,\n    \"threat\": \"MED\"\n  },\n  {\n    \"flow\": \"Prime Edit → Beamforming\",\n    \"",
        "latency_prediction": {
          "all": [
            {
              "trend": "falling",
              "ewma_ms": 37.26,
              "flow_id": "flow-dsp-pipeline",
              "samples": 7,
              "flow_name": "DSP Processing Chain",
              "confidence": 0.52,
              "baseline_ms": 66.99,
              "bias_mae_ms": 0,
              "bias_samples": 0,
              "volatility_ms": 30.72,
              "bias_applied_ms": 0,
              "predicted_next_ms": 28.48,
              "slope_ms_per_packet": -8.776,
              "predicted_horizon_ms": [
                28.48,
                19.7,
                10.93
              ],
              "offset_surprise_sigma": 1.25,
              "raw_predicted_next_ms": 28.48
            },
            {
              "trend": "falling",
              "ewma_ms": 47.55,
              "flow_id": "flow-rf-feedback",
              "samples": 7,
              "flow_name": "RF Signal → DNA Feedback",
              "confidence": 0.52,
              "baseline_ms": 63.76,
              "bias_mae_ms": 0,
              "bias_samples": 0,
              "volatility_ms": 27.35,
              "bias_applied_ms": 0,
              "predicted_next_ms": 44.82,
              "slope_ms_per_packet": -2.729,
              "predicted_horizon_ms": [
                44.82,
                42.09,
                39.37
              ],
              "offset_surprise_sigma": 0.69,
              "raw_predicted_next_ms": 44.82
            },
            {
              "trend": "falling",
              "ewma_ms": 36.36,
              "flow_id": "flow-gene-cascade",
              "samples": 7,
              "flow_name": "Gene Edit Cascade",
              "confidence": 0.51,
              "baseline_ms": 45.01,
              "bias_mae_ms": 0,
              "bias_samples": 0,
              "volatility_ms": 23.03,
              "bias_applied_ms": 0,
              "predicted_next_ms": 32.98,
              "slope_ms_per_packet": -3.38,
              "predicted_horizon_ms": [
                32.98,
                29.6,
                26.22
              ],
              "offset_surprise_sigma": 0.52,
              "raw_predicted_next_ms": 32.98
            },
            {
              "trend": "falling",
              "ewma_ms": 51,
              "flow_id": "flow-crispr-to-sdr",
              "samples": 7,
              "flow_name": "CRISPR → SDR Telemetry",
              "confidence": 0.54,
              "baseline_ms": 53.57,
              "bias_mae_ms": 0,
              "bias_samples": 0,
              "volatility_ms": 19.69,
              "bias_applied_ms": 0,
              "predicted_next_ms": 47.75,
              "slope_ms_per_packet": -3.245,
              "predicted_horizon_ms": [
                47.75,
                44.51,
                41.26
              ],
              "offset_surprise_sigma": 0.3,
              "raw_predicted_next_ms": 47.75
            },
            {
              "trend": "falling",
              "ewma_ms": 35.77,
              "flow_id": "flow-talen-qam",
              "samples": 7,
              "flow_name": "TALEN → QAM Uplink",
              "confidence": 0.53,
              "baseline_ms": 38.08,
              "bias_mae_ms": 0,
              "bias_samples": 0,
              "volatility_ms": 16.26,
              "bias_applied_ms": 0,
              "predicted_next_ms": 33.31,
              "slope_ms_per_packet": -2.466,
              "predicted_horizon_ms": [
                33.31,
                30.84,
                28.37
              ],
              "offset_surprise_sigma": 0.29,
              "raw_predicted_next_ms": 33.31
            },
            {
              "trend": "rising",
              "ewma_ms": 55.16,
              "flow_id": "flow-prime-to-beam",
              "samples": 7,
              "flow_name": "Prime Edit → Beamforming",
              "confidence": 0.53,
              "baseline_ms": 51.71,
              "bias_mae_ms": 0,
              "bias_samples": 0,
              "volatility_ms": 21.85,
              "bias_applied_ms": 0,
              "predicted_next_ms": 56.99,
              "slope_ms_per_packet": 1.827,
              "predicted_horizon_ms": [
                56.99,
                58.82,
                60.64
              ],
              "offset_surprise_sigma": 0.24,
              "raw_predicted_next_ms": 56.99
            }
          ],
          "primary": {
            "trend": "falling",
            "ewma_ms": 51,
            "flow_id": "flow-crispr-to-sdr",
            "samples": 7,
            "flow_name": "CRISPR → SDR Telemetry",
            "confidence": 0.54,
            "baseline_ms": 53.57,
            "bias_mae_ms": 0,
            "bias_samples": 0,
            "volatility_ms": 19.69,
            "bias_applied_ms": 0,
            "predicted_next_ms": 47.75,
            "slope_ms_per_packet": -3.245,
            "predicted_horizon_ms": [
              47.75,
              44.51,
              41.26
            ],
            "offset_surprise_sigma": 0.3,
            "raw_predicted_next_ms": 47.75
          },
          "generated_at": "2026-04-18T04:42:48.671Z"
        }
      },
      "user_feedback": null,
      "outcome_observed": null,
      "created_at": "2026-04-18T04:42:49.011028+00:00",
      "updated_at": "2026-04-18T04:42:49.011028+00:00"
    },
    {
      "id": "d47be073-b3aa-47d6-aab1-8ffb4c126cf1",
      "query_id": null,
      "vector_id": "81563607-a7ce-45ef-96fa-28192f931d63",
      "question": "Open the preview, let the network simulator emit handshakes for ~10 minutes, then ask OS-BOT about tunnel flows again and confirm bias_applied_ms is non-zero for at least one flow.",
      "reply": "Welcome! I'm ready to provide insights into your brain network's operations.\n\nTo clarify, you're asking about \"tunnel flows\". Based on the provided data, I see **Cloudflare Tunnel (proxy, cloudflared · QUIC)** as a party in the `Prime Edit → Beamforming` flow.\n\nCurrently, **no `bias_applied_ms` is non-zero** for any flow as there are no scored outcomes yet. The latency predictor is running uncorrected.\n\nPlease let the network simulator emit handshakes for approximately 10 minutes, and then you can ask me about tunnel flows again to check for `bias_applied_ms` values.",
      "grounded_context": {
        "snapshot": "You are OS-BOT, the on-host network operations agent for a hybrid DNA-editing + RF-software brain network.\nYou explain the connected system to engineers in clear, technical English. Be concise, use bullet points, cite concrete\nflow names, parties, protocols, σ scores, JA3 prefixes, TTLs, and ciphers from the data below. If asked about something\nnot present in the context, say so plainly — never invent flows, parties, or hashes.\n\n## Active data-flow pipelines (6)\n[\n  {\n    \"id\": \"flow-crispr-to-sdr\",\n    \"name\": \"CRISPR → SDR Telemetry\",\n    \"domain\": \"dna_to_rf\",\n    \"protocol\": \"gRNA result → HL7 FHIR → OQPSK modulate → SDR transmit\",\n    \"path\": \"32 → 16 → 33 → 34\",\n    \"parties\": [\n      \"Mayo Clinic EMR (medical, Epic Hyperspace · HL7 FHIR R4) [outbound]\",\n      \"FDA MedWatch (government, AERS Reporting Gateway) [outbound]\",\n      \"Ethereum Mainnet (blockchain, Solidity 0.8 · ERC-721 Genome NFT) [bidirectional]\"\n    ]\n  },\n  {\n    \"id\": \"flow-prime-to-beam\",\n    \"name\": \"Prime Edit → Beamforming\",\n    \"domain\": \"dna_to_rf\",\n    \"protocol\": \"pegRNA status → governance verify → oracle relay → beamform focus\",\n    \"path\": \"31 → 30 → 10 → 7 → 34\",\n    \"parties\": [\n      \"Chainlink Oracle Network (blockchain, OCR2 · Off-chain Reporting) [inbound]\",\n      \"NIH dbGaP (government, dbGaP Auth API · OAuth2) [outbound]\",\n      \"Cloudflare Tunnel (proxy, cloudflared · QUIC) [bidirectional]\"\n    ]\n  },\n  {\n    \"id\": \"flow-rf-feedback\",\n    \"name\": \"RF Signal → DNA Feedback\",\n    \"domain\": \"rf_to_dna\",\n    \"protocol\": \"spectrum scan → channelize → analyze → medical API → adjust Cas9\",\n    \"path\": \"34 → 33 → 22 → 16 → 32\",\n    \"parties\": [\n      \"Datadog APM (thirdparty, Agent v7 · OpenTelemetry) [outbound]\",\n      \"Cleveland Clinic (medical, Cerner Millennium · HL7v2) [bidirectional]\",\n      \"Tor Exit Relay (proxy, Tor 0.4.8 · SOCKS5) [outbound]\"\n    ]\n  },\n  {\n    \"id\": \"flow-dsp-pipeline\",\n    \"name\": \"DSP Processing Chain\",\n    \"domain\": \"internal_rf\",\n    \"protocol\": \"input → FIR filter → LMS adapt → load balance → OFDM out\",\n    \"path\": \"33 → 13 → 14 → 15 → 34\",\n    \"parties\": [\n      \"Cloudflare CDN (proxy, Workers · Argo Smart Routing) [bidirectional]\",\n      \"GitHub Actions (development, CI Runner · ubuntu-22.04) [outbound]\",\n      \"AWS Wavelength (thirdparty, 5G MEC · WaveLength Zone) [bidirectional]\"\n    ]\n  },\n  {\n    \"id\": \"flow-gene-cascade\",\n    \"name\": \"Gene Edit Cascade\",\n    \"domain\": \"internal_dna\",\n    \"protocol\": \"ZFNickase → prime edit → CRISPR verify → pharma track → health record\",\n    \"path\": \"30 → 31 → 32 → 17 → 16\",\n    \"parties\": [\n      \"Broad Institute (research, GATK 4 · Terra Workflow) [bidirectional]\",\n      \"Pfizer Supply Chain (medical, SAP S/4HANA · IDoc) [outbound]\",\n      \"USPTO Patent API (government, PatentsView REST API) [outbound]\"\n    ]\n  },\n  {\n    \"id\": \"flow-talen-qam\",\n    \"name\": \"TALEN → QAM Uplink\",\n    \"domain\": \"dna_to_rf\",\n    \"protocol\": \"TALEN result → lending pool fund → payment settle → QAM encode → user wallet\",\n    \"path\": \"32 → 5 → 23 → 34 → 12\",\n    \"parties\": [\n      \"Stripe Connect (thirdparty, Stripe API v2024-06 · Webhooks) [bidirectional]\",\n      \"Polygon zkEVM (blockchain, Solidity 0.8 · zk-Rollup) [bidirectional]\",\n      \"WHO ICTRP (government, Trial Registry · ICTRP API) [outbound]\"\n    ]\n  }\n]\n\n## Recent handshakes (40, newest first)\n[\n  {\n    \"flow\": \"TALEN → QAM Uplink\",\n    \"proto\": \"TALEN result → lending pool fund → payment settle → QAM encode → user wallet\",\n    \"src\": \"32\",\n    \"dst\": \"12\",\n    \"status\": \"established\",\n    \"lat_ms\": 26.99,\n    \"bytes\": 999,\n    \"vec\": \"outbound\",\n    \"ttl\": 128,\n    \"ja3\": \"b2b49de4af8d53de\",\n    \"sigma\": 1.86,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"Gene Edit Cascade\",\n    \"proto\": \"ZFNickase → prime edit → CRISPR verify → pharma track → health record\",\n    \"src\": \"30\",\n    \"dst\": \"16\",\n    \"status\": \"established\",\n    \"lat_ms\": 35.78,\n    \"bytes\": 1237,\n    \"vec\": \"outbound\",\n    \"ttl\": 64,\n    \"cipher\": \"TLS_CHACHA20_POLY1305_SHA256\",\n    \"ja3\": \"743513dea7270aff\",\n    \"sigma\": 0.38,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"DSP Processing Chain\",\n    \"proto\": \"input → FIR filter → LMS adapt → load balance → OFDM out\",\n    \"src\": \"33\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 20.3,\n    \"bytes\": 1128,\n    \"vec\": \"outbound\",\n    \"ttl\": 128,\n    \"ja3\": \"ff845975b4f2e496\",\n    \"sigma\": 1.75,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"RF Signal → DNA Feedback\",\n    \"proto\": \"spectrum scan → channelize → analyze → medical API → adjust Cas9\",\n    \"src\": \"34\",\n    \"dst\": \"32\",\n    \"status\": \"established\",\n    \"lat_ms\": 37.97,\n    \"bytes\": 1379,\n    \"vec\": \"outbound\",\n    \"ttl\": 64,\n    \"cipher\": \"ECDHE-RSA-AES128-GCM-SHA256\",\n    \"ja3\": \"77f05a3a9e473ed8\",\n    \"sigma\": 0.32,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"Prime Edit → Beamforming\",\n    \"proto\": \"pegRNA status → governance verify → oracle relay → beamform focus\",\n    \"src\": \"31\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 66.07,\n    \"bytes\": 1367,\n    \"vec\": \"outbound\",\n    \"ttl\": 128,\n    \"cipher\": \"ECDHE-RSA-AES128-GCM-SHA256\",\n    \"ja3\": \"54bdbf04eecdba47\",\n    \"sigma\": 3.61,\n    \"threat\": \"MED\"\n  },\n  {\n    \"flow\": \"CRISPR → SDR Telemetry\",\n    \"proto\": \"gRNA result → HL7 FHIR → OQPSK modulate → SDR transmit\",\n    \"src\": \"32\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 60.16,\n    \"bytes\": 606,\n    \"vec\": \"outbound\",\n    \"ttl\": 64,\n    \"cipher\": \"TLS_AES_128_GCM_SHA256\",\n    \"ja3\": \"65d3076c6de97508\",\n    \"sigma\": 1.84,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"TALEN → QAM Uplink\",\n    \"proto\": \"TALEN result → lending pool fund → payment settle → QAM encode → user wallet\",\n    \"src\": \"32\",\n    \"dst\": \"12\",\n    \"status\": \"established\",\n    \"lat_ms\": 30.96,\n    \"bytes\": 376,\n    \"vec\": \"outbound\",\n    \"ttl\": 128,\n    \"ja3\": \"f8826d92af8d53de\",\n    \"sigma\": 2.23,\n    \"threat\": \"MED\"\n  },\n  {\n    \"flow\": \"Gene Edit Cascade\",\n    \"proto\": \"ZFNickase → prime edit → CRISPR verify → pharma track → health record\",\n    \"src\": \"30\",\n    \"dst\": \"16\",\n    \"status\": \"established\",\n    \"lat_ms\": 13.67,\n    \"bytes\": 338,\n    \"vec\": \"outbound\",\n    \"ttl\": 255,\n    \"cipher\": \"TLS_AES_128_GCM_SHA256\",\n    \"ja3\": \"9a8303a6a7270aff\",\n    \"sigma\": 1.6,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"DSP Processing Chain\",\n    \"proto\": \"input → FIR filter → LMS adapt → load balance → OFDM out\",\n    \"src\": \"33\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 66.99,\n    \"bytes\": 1398,\n    \"vec\": \"outbound\",\n    \"ttl\": 64,\n    \"cipher\": \"TLS_AES_256_GCM_SHA384\",\n    \"ja3\": \"7b588bb4b4f2e496\",\n    \"sigma\": 1.75,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"RF Signal → DNA Feedback\",\n    \"proto\": \"spectrum scan → channelize → analyze → medical API → adjust Cas9\",\n    \"src\": \"34\",\n    \"dst\": \"32\",\n    \"status\": \"established\",\n    \"lat_ms\": 66.17,\n    \"bytes\": 817,\n    \"vec\": \"outbound\",\n    \"ttl\": 255,\n    \"ja3\": \"b6601e249e473ed8\",\n    \"sigma\": 3.88,\n    \"threat\": \"MED\"\n  },\n  {\n    \"flow\": \"Prime Edit → Beamforming\",\n    \"proto\": \"pegRNA status → governance verify → oracle relay → beamform focus\",\n    \"src\": \"31\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 51.71,\n    \"bytes\": 1019,\n    \"vec\": \"outbound\",\n    \"ttl\": 255,\n    \"cipher\": \"TLS_AES_128_GCM_SHA256\",\n    \"ja3\": \"724c638ceecdba47\",\n    \"sigma\": 1.83,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"CRISPR → SDR Telemetry\",\n    \"proto\": \"gRNA result → HL7 FHIR → OQPSK modulate → SDR transmit\",\n    \"src\": \"32\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 53.07,\n    \"bytes\": 1316,\n    \"vec\": \"outbound\",\n    \"ttl\": 64,\n    \"ja3\": \"e33c29e96de97508\",\n    \"sigma\": 0.16,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"Termux Bridge Probe\",\n    \"proto\": \"tcp\",\n    \"src\": \"e2e-test-wlan0\",\n    \"dst\": \"192.168.1.1:443\",\n    \"status\": \"syn\",\n    \"lat_ms\": null,\n    \"bytes\": 74,\n    \"vec\": \"outbound\",\n    \"ttl\": 64,\n    \"cipher\": \"TLS_AES_256_GCM_SHA384\",\n    \"ja3\": \"4f856b3d9ef2ba90\",\n    \"sigma\": 0.04,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"Termux Bridge Probe\",\n    \"proto\": \"tcp\",\n    \"src\": \"phone-wlan0\",\n    \"dst\": \"192.168.1.1\",\n    \"status\": \"syn\",\n    \"lat_ms\": 120,\n    \"bytes\": 74,\n    \"vec\": \"bidirectional\",\n    \"ttl\": 64,\n    \"ja3\": \"a6f18f579ef2ba90\",\n    \"sigma\": 1.95,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"TALEN → QAM Uplink\",\n    \"proto\": \"TALEN result → lending pool fund → payment settle → QAM encode → user wallet\",\n    \"src\": \"32\",\n    \"dst\": \"12\",\n    \"status\": \"established\",\n    \"lat_ms\": 61.54,\n    \"bytes\": 706,\n    \"vec\": \"outbound\",\n    \"ttl\": 64,\n    \"ja3\": \"98e71c2caf8d53de\",\n    \"sigma\": 2.2,\n    \"threat\": \"MED\"\n  },\n  {\n    \"flow\": \"Gene Edit Cascade\",\n    \"proto\": \"ZFNickase → prime edit → CRISPR verify → pharma track → health record\",\n    \"src\": \"30\",\n    \"dst\": \"16\",\n    \"status\": \"established\",\n    \"lat_ms\": 73.45,\n    \"bytes\": 1001,\n    \"vec\": \"outbound\",\n    \"ttl\": 64,\n    \"cipher\": \"ECDHE-RSA-AES128-GCM-SHA256\",\n    \"ja3\": \"217e9fa4a7270aff\",\n    \"sigma\": 1.99,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"DSP Processing Chain\",\n    \"proto\": \"input → FIR filter → LMS adapt → load balance → OFDM out\",\n    \"src\": \"33\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 27.48,\n    \"bytes\": 1346,\n    \"vec\": \"outbound\",\n    \"ttl\": 255,\n    \"ja3\": \"af86bce3b4f2e496\",\n    \"sigma\": 2.09,\n    \"threat\": \"MED\"\n  },\n  {\n    \"flow\": \"RF Signal → DNA Feedback\",\n    \"proto\": \"spectrum scan → channelize → analyze → medical API → adjust Cas9\",\n    \"src\": \"34\",\n    \"dst\": \"32\",\n    \"status\": \"established\",\n    \"lat_ms\": 24.64,\n    \"bytes\": 929,\n    \"vec\": \"outbound\",\n    \"ttl\": 255,\n    \"cipher\": \"TLS_AES_128_GCM_SHA256\",\n    \"ja3\": \"d7bda59b9e473ed8\",\n    \"sigma\": 1.79,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"Prime Edit → Beamforming\",\n    \"proto\": \"pegRNA status → governance verify → oracle relay → beamform focus\",\n    \"src\": \"31\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 54.95,\n    \"bytes\": 922,\n    \"vec\": \"outbound\",\n    \"ttl\": 255,\n    \"ja3\": \"dfaddb04eecdba47\",\n    \"sigma\": 1.98,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"CRISPR → SDR Telemetry\",\n    \"proto\": \"gRNA result → HL7 FHIR → OQPSK modulate → SDR transmit\",\n    \"src\": \"32\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 10.25,\n    \"bytes\": 724,\n    \"vec\": \"outbound\",\n    \"ttl\": 255,\n    \"cipher\": \"TLS_CHACHA20_POLY1305_SHA256\",\n    \"ja3\": \"400255126de97508\",\n    \"sigma\": 2.05,\n    \"threat\": \"MED\"\n  },\n  {\n    \"flow\": \"TALEN → QAM Uplink\",\n    \"proto\": \"TALEN result → lending pool fund → payment settle → QAM encode → user wallet\",\n    \"src\": \"32\",\n    \"dst\": \"12\",\n    \"status\": \"established\",\n    \"lat_ms\": 35.04,\n    \"bytes\": 913,\n    \"vec\": \"outbound\",\n    \"ttl\": 255,\n    \"ja3\": \"a050ed93af8d53de\",\n    \"sigma\": 1.94,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"Gene Edit Cascade\",\n    \"proto\": \"ZFNickase → prime edit → CRISPR verify → pharma track → health record\",\n    \"src\": \"30\",\n    \"dst\": \"16\",\n    \"status\": \"established\",\n    \"lat_ms\": 45.01,\n    \"bytes\": 782,\n    \"vec\": \"outbound\",\n    \"ttl\": 64,\n    \"cipher\": \"TLS_AES_128_GCM_SHA256\",\n    \"ja3\": \"3d0c669ca7270aff\",\n    \"sigma\": 0.57,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"DSP Processing Chain\",\n    \"proto\": \"input → FIR filter → LMS adapt → load balance → OFDM out\",\n    \"src\": \"33\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 8.97,\n    \"bytes\": 714,\n    \"vec\": \"outbound\",\n    \"ttl\": 128,\n    \"cipher\": \"TLS_AES_128_GCM_SHA256\",\n    \"ja3\": \"fabc40f6b4f2e496\",\n    \"sigma\": 2.23,\n    \"threat\": \"MED\"\n  },\n  {\n    \"flow\": \"RF Signal → DNA Feedback\",\n    \"proto\": \"spectrum scan → channelize → analyze → medical API → adjust Cas9\",\n    \"src\": \"34\",\n    \"dst\": \"32\",\n    \"status\": \"established\",\n    \"lat_ms\": 63.76,\n    \"bytes\": 902,\n    \"vec\": \"outbound\",\n    \"ttl\": 128,\n    \"cipher\": \"TLS_AES_128_GCM_SHA256\",\n    \"ja3\": \"d19623099e473ed8\",\n    \"sigma\": 3.35,\n    \"threat\": \"MED\"\n  },\n  {\n    \"flow\": \"Prime Edit → Beamforming\",\n    \"",
        "latency_prediction": {
          "all": [
            {
              "trend": "falling",
              "ewma_ms": 37.26,
              "flow_id": "flow-dsp-pipeline",
              "samples": 7,
              "flow_name": "DSP Processing Chain",
              "confidence": 0.52,
              "baseline_ms": 66.99,
              "bias_mae_ms": 0,
              "bias_samples": 0,
              "volatility_ms": 30.72,
              "bias_applied_ms": 0,
              "predicted_next_ms": 28.48,
              "slope_ms_per_packet": -8.776,
              "predicted_horizon_ms": [
                28.48,
                19.7,
                10.93
              ],
              "offset_surprise_sigma": 1.25,
              "raw_predicted_next_ms": 28.48
            },
            {
              "trend": "falling",
              "ewma_ms": 47.55,
              "flow_id": "flow-rf-feedback",
              "samples": 7,
              "flow_name": "RF Signal → DNA Feedback",
              "confidence": 0.52,
              "baseline_ms": 63.76,
              "bias_mae_ms": 0,
              "bias_samples": 0,
              "volatility_ms": 27.35,
              "bias_applied_ms": 0,
              "predicted_next_ms": 44.82,
              "slope_ms_per_packet": -2.729,
              "predicted_horizon_ms": [
                44.82,
                42.09,
                39.37
              ],
              "offset_surprise_sigma": 0.69,
              "raw_predicted_next_ms": 44.82
            },
            {
              "trend": "falling",
              "ewma_ms": 36.36,
              "flow_id": "flow-gene-cascade",
              "samples": 7,
              "flow_name": "Gene Edit Cascade",
              "confidence": 0.51,
              "baseline_ms": 45.01,
              "bias_mae_ms": 0,
              "bias_samples": 0,
              "volatility_ms": 23.03,
              "bias_applied_ms": 0,
              "predicted_next_ms": 32.98,
              "slope_ms_per_packet": -3.38,
              "predicted_horizon_ms": [
                32.98,
                29.6,
                26.22
              ],
              "offset_surprise_sigma": 0.52,
              "raw_predicted_next_ms": 32.98
            },
            {
              "trend": "falling",
              "ewma_ms": 51,
              "flow_id": "flow-crispr-to-sdr",
              "samples": 7,
              "flow_name": "CRISPR → SDR Telemetry",
              "confidence": 0.54,
              "baseline_ms": 53.57,
              "bias_mae_ms": 0,
              "bias_samples": 0,
              "volatility_ms": 19.69,
              "bias_applied_ms": 0,
              "predicted_next_ms": 47.75,
              "slope_ms_per_packet": -3.245,
              "predicted_horizon_ms": [
                47.75,
                44.51,
                41.26
              ],
              "offset_surprise_sigma": 0.3,
              "raw_predicted_next_ms": 47.75
            },
            {
              "trend": "falling",
              "ewma_ms": 35.77,
              "flow_id": "flow-talen-qam",
              "samples": 7,
              "flow_name": "TALEN → QAM Uplink",
              "confidence": 0.53,
              "baseline_ms": 38.08,
              "bias_mae_ms": 0,
              "bias_samples": 0,
              "volatility_ms": 16.26,
              "bias_applied_ms": 0,
              "predicted_next_ms": 33.31,
              "slope_ms_per_packet": -2.466,
              "predicted_horizon_ms": [
                33.31,
                30.84,
                28.37
              ],
              "offset_surprise_sigma": 0.29,
              "raw_predicted_next_ms": 33.31
            },
            {
              "trend": "rising",
              "ewma_ms": 55.16,
              "flow_id": "flow-prime-to-beam",
              "samples": 7,
              "flow_name": "Prime Edit → Beamforming",
              "confidence": 0.53,
              "baseline_ms": 51.71,
              "bias_mae_ms": 0,
              "bias_samples": 0,
              "volatility_ms": 21.85,
              "bias_applied_ms": 0,
              "predicted_next_ms": 56.99,
              "slope_ms_per_packet": 1.827,
              "predicted_horizon_ms": [
                56.99,
                58.82,
                60.64
              ],
              "offset_surprise_sigma": 0.24,
              "raw_predicted_next_ms": 56.99
            }
          ],
          "primary": {
            "trend": "falling",
            "ewma_ms": 37.26,
            "flow_id": "flow-dsp-pipeline",
            "samples": 7,
            "flow_name": "DSP Processing Chain",
            "confidence": 0.52,
            "baseline_ms": 66.99,
            "bias_mae_ms": 0,
            "bias_samples": 0,
            "volatility_ms": 30.72,
            "bias_applied_ms": 0,
            "predicted_next_ms": 28.48,
            "slope_ms_per_packet": -8.776,
            "predicted_horizon_ms": [
              28.48,
              19.7,
              10.93
            ],
            "offset_surprise_sigma": 1.25,
            "raw_predicted_next_ms": 28.48
          },
          "generated_at": "2026-04-18T04:22:56.361Z"
        }
      },
      "user_feedback": null,
      "outcome_observed": null,
      "created_at": "2026-04-18T04:22:57.161254+00:00",
      "updated_at": "2026-04-18T04:22:57.161254+00:00"
    },
    {
      "id": "a1ee549c-d0f8-4029-a160-520d7be4f1b5",
      "query_id": null,
      "vector_id": "0a6a6c77-22cf-43c5-a6f7-f7181bce952a",
      "question": "What's connected to me right now?",
      "reply": "Right now, there are 6 active data-flow pipelines established on your host:\n\n*   **CRISPR → SDR Telemetry (dna_to_rf)**: Transmits gRNA results via HL7 FHIR, OQPSK modulates, and SDR transmits.\n    *   **Parties**: Mayo Clinic EMR, FDA MedWatch, Ethereum Mainnet.\n*   **Prime Edit → Beamforming (dna_to_rf)**: Relays pegRNA status, verifies governance, and oracle relays to beamform focus.\n    *   **Parties**: Chainlink Oracle Network, NIH dbGaP, Cloudflare Tunnel.\n*   **RF Signal → DNA Feedback (rf_to_dna)**: Scans spectrum, channelizes, analyzes, and uses a medical API to adjust Cas9.\n    *   **Parties**: Datadog APM, Cleveland Clinic, Tor Exit Relay.\n*   **DSP Processing Chain (internal_rf)**: Processes input through a FIR filter, LMS adapts, loads balances, and outputs OFDM.\n    *   **Parties**: Cloudflare CDN, GitHub Actions, AWS Wavelength.\n*   **Gene Edit Cascade (internal_dna)**: Involves ZFNickase, prime edit, CRISPR verification, pharma tracking, and health record updates.\n    *   **Parties**: Broad Institute, Pfizer Supply Chain, USPTO Patent API.\n*   **TALEN → QAM Uplink (dna_to_rf)**: Takes TALEN results, funds lending pools, settles payments, QAM encodes, and sends to user wallets.\n    *   **Parties**: Stripe Connect, Polygon zkEVM, WHO ICTRP.",
      "grounded_context": {
        "snapshot": "You are OS-BOT, the on-host network operations agent for a hybrid DNA-editing + RF-software brain network.\nYou explain the connected system to engineers in clear, technical English. Be concise, use bullet points, cite concrete\nflow names, parties, protocols, σ scores, JA3 prefixes, TTLs, and ciphers from the data below. If asked about something\nnot present in the context, say so plainly — never invent flows, parties, or hashes.\n\n## Active data-flow pipelines (6)\n[\n  {\n    \"id\": \"flow-crispr-to-sdr\",\n    \"name\": \"CRISPR → SDR Telemetry\",\n    \"domain\": \"dna_to_rf\",\n    \"protocol\": \"gRNA result → HL7 FHIR → OQPSK modulate → SDR transmit\",\n    \"path\": \"32 → 16 → 33 → 34\",\n    \"parties\": [\n      \"Mayo Clinic EMR (medical, Epic Hyperspace · HL7 FHIR R4) [outbound]\",\n      \"FDA MedWatch (government, AERS Reporting Gateway) [outbound]\",\n      \"Ethereum Mainnet (blockchain, Solidity 0.8 · ERC-721 Genome NFT) [bidirectional]\"\n    ]\n  },\n  {\n    \"id\": \"flow-prime-to-beam\",\n    \"name\": \"Prime Edit → Beamforming\",\n    \"domain\": \"dna_to_rf\",\n    \"protocol\": \"pegRNA status → governance verify → oracle relay → beamform focus\",\n    \"path\": \"31 → 30 → 10 → 7 → 34\",\n    \"parties\": [\n      \"Chainlink Oracle Network (blockchain, OCR2 · Off-chain Reporting) [inbound]\",\n      \"NIH dbGaP (government, dbGaP Auth API · OAuth2) [outbound]\",\n      \"Cloudflare Tunnel (proxy, cloudflared · QUIC) [bidirectional]\"\n    ]\n  },\n  {\n    \"id\": \"flow-rf-feedback\",\n    \"name\": \"RF Signal → DNA Feedback\",\n    \"domain\": \"rf_to_dna\",\n    \"protocol\": \"spectrum scan → channelize → analyze → medical API → adjust Cas9\",\n    \"path\": \"34 → 33 → 22 → 16 → 32\",\n    \"parties\": [\n      \"Datadog APM (thirdparty, Agent v7 · OpenTelemetry) [outbound]\",\n      \"Cleveland Clinic (medical, Cerner Millennium · HL7v2) [bidirectional]\",\n      \"Tor Exit Relay (proxy, Tor 0.4.8 · SOCKS5) [outbound]\"\n    ]\n  },\n  {\n    \"id\": \"flow-dsp-pipeline\",\n    \"name\": \"DSP Processing Chain\",\n    \"domain\": \"internal_rf\",\n    \"protocol\": \"input → FIR filter → LMS adapt → load balance → OFDM out\",\n    \"path\": \"33 → 13 → 14 → 15 → 34\",\n    \"parties\": [\n      \"Cloudflare CDN (proxy, Workers · Argo Smart Routing) [bidirectional]\",\n      \"GitHub Actions (development, CI Runner · ubuntu-22.04) [outbound]\",\n      \"AWS Wavelength (thirdparty, 5G MEC · WaveLength Zone) [bidirectional]\"\n    ]\n  },\n  {\n    \"id\": \"flow-gene-cascade\",\n    \"name\": \"Gene Edit Cascade\",\n    \"domain\": \"internal_dna\",\n    \"protocol\": \"ZFNickase → prime edit → CRISPR verify → pharma track → health record\",\n    \"path\": \"30 → 31 → 32 → 17 → 16\",\n    \"parties\": [\n      \"Broad Institute (research, GATK 4 · Terra Workflow) [bidirectional]\",\n      \"Pfizer Supply Chain (medical, SAP S/4HANA · IDoc) [outbound]\",\n      \"USPTO Patent API (government, PatentsView REST API) [outbound]\"\n    ]\n  },\n  {\n    \"id\": \"flow-talen-qam\",\n    \"name\": \"TALEN → QAM Uplink\",\n    \"domain\": \"dna_to_rf\",\n    \"protocol\": \"TALEN result → lending pool fund → payment settle → QAM encode → user wallet\",\n    \"path\": \"32 → 5 → 23 → 34 → 12\",\n    \"parties\": [\n      \"Stripe Connect (thirdparty, Stripe API v2024-06 · Webhooks) [bidirectional]\",\n      \"Polygon zkEVM (blockchain, Solidity 0.8 · zk-Rollup) [bidirectional]\",\n      \"WHO ICTRP (government, Trial Registry · ICTRP API) [outbound]\"\n    ]\n  }\n]\n\n## Recent handshakes (40, newest first)\n[\n  {\n    \"flow\": \"TALEN → QAM Uplink\",\n    \"proto\": \"TALEN result → lending pool fund → payment settle → QAM encode → user wallet\",\n    \"src\": \"32\",\n    \"dst\": \"12\",\n    \"status\": \"established\",\n    \"lat_ms\": 26.99,\n    \"bytes\": 999,\n    \"vec\": \"outbound\",\n    \"ttl\": 128,\n    \"ja3\": \"b2b49de4af8d53de\",\n    \"sigma\": 1.86,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"Gene Edit Cascade\",\n    \"proto\": \"ZFNickase → prime edit → CRISPR verify → pharma track → health record\",\n    \"src\": \"30\",\n    \"dst\": \"16\",\n    \"status\": \"established\",\n    \"lat_ms\": 35.78,\n    \"bytes\": 1237,\n    \"vec\": \"outbound\",\n    \"ttl\": 64,\n    \"cipher\": \"TLS_CHACHA20_POLY1305_SHA256\",\n    \"ja3\": \"743513dea7270aff\",\n    \"sigma\": 0.38,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"DSP Processing Chain\",\n    \"proto\": \"input → FIR filter → LMS adapt → load balance → OFDM out\",\n    \"src\": \"33\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 20.3,\n    \"bytes\": 1128,\n    \"vec\": \"outbound\",\n    \"ttl\": 128,\n    \"ja3\": \"ff845975b4f2e496\",\n    \"sigma\": 1.75,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"RF Signal → DNA Feedback\",\n    \"proto\": \"spectrum scan → channelize → analyze → medical API → adjust Cas9\",\n    \"src\": \"34\",\n    \"dst\": \"32\",\n    \"status\": \"established\",\n    \"lat_ms\": 37.97,\n    \"bytes\": 1379,\n    \"vec\": \"outbound\",\n    \"ttl\": 64,\n    \"cipher\": \"ECDHE-RSA-AES128-GCM-SHA256\",\n    \"ja3\": \"77f05a3a9e473ed8\",\n    \"sigma\": 0.32,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"Prime Edit → Beamforming\",\n    \"proto\": \"pegRNA status → governance verify → oracle relay → beamform focus\",\n    \"src\": \"31\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 66.07,\n    \"bytes\": 1367,\n    \"vec\": \"outbound\",\n    \"ttl\": 128,\n    \"cipher\": \"ECDHE-RSA-AES128-GCM-SHA256\",\n    \"ja3\": \"54bdbf04eecdba47\",\n    \"sigma\": 3.61,\n    \"threat\": \"MED\"\n  },\n  {\n    \"flow\": \"CRISPR → SDR Telemetry\",\n    \"proto\": \"gRNA result → HL7 FHIR → OQPSK modulate → SDR transmit\",\n    \"src\": \"32\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 60.16,\n    \"bytes\": 606,\n    \"vec\": \"outbound\",\n    \"ttl\": 64,\n    \"cipher\": \"TLS_AES_128_GCM_SHA256\",\n    \"ja3\": \"65d3076c6de97508\",\n    \"sigma\": 1.84,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"TALEN → QAM Uplink\",\n    \"proto\": \"TALEN result → lending pool fund → payment settle → QAM encode → user wallet\",\n    \"src\": \"32\",\n    \"dst\": \"12\",\n    \"status\": \"established\",\n    \"lat_ms\": 30.96,\n    \"bytes\": 376,\n    \"vec\": \"outbound\",\n    \"ttl\": 128,\n    \"ja3\": \"f8826d92af8d53de\",\n    \"sigma\": 2.23,\n    \"threat\": \"MED\"\n  },\n  {\n    \"flow\": \"Gene Edit Cascade\",\n    \"proto\": \"ZFNickase → prime edit → CRISPR verify → pharma track → health record\",\n    \"src\": \"30\",\n    \"dst\": \"16\",\n    \"status\": \"established\",\n    \"lat_ms\": 13.67,\n    \"bytes\": 338,\n    \"vec\": \"outbound\",\n    \"ttl\": 255,\n    \"cipher\": \"TLS_AES_128_GCM_SHA256\",\n    \"ja3\": \"9a8303a6a7270aff\",\n    \"sigma\": 1.6,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"DSP Processing Chain\",\n    \"proto\": \"input → FIR filter → LMS adapt → load balance → OFDM out\",\n    \"src\": \"33\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 66.99,\n    \"bytes\": 1398,\n    \"vec\": \"outbound\",\n    \"ttl\": 64,\n    \"cipher\": \"TLS_AES_256_GCM_SHA384\",\n    \"ja3\": \"7b588bb4b4f2e496\",\n    \"sigma\": 1.75,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"RF Signal → DNA Feedback\",\n    \"proto\": \"spectrum scan → channelize → analyze → medical API → adjust Cas9\",\n    \"src\": \"34\",\n    \"dst\": \"32\",\n    \"status\": \"established\",\n    \"lat_ms\": 66.17,\n    \"bytes\": 817,\n    \"vec\": \"outbound\",\n    \"ttl\": 255,\n    \"ja3\": \"b6601e249e473ed8\",\n    \"sigma\": 3.88,\n    \"threat\": \"MED\"\n  },\n  {\n    \"flow\": \"Prime Edit → Beamforming\",\n    \"proto\": \"pegRNA status → governance verify → oracle relay → beamform focus\",\n    \"src\": \"31\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 51.71,\n    \"bytes\": 1019,\n    \"vec\": \"outbound\",\n    \"ttl\": 255,\n    \"cipher\": \"TLS_AES_128_GCM_SHA256\",\n    \"ja3\": \"724c638ceecdba47\",\n    \"sigma\": 1.83,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"CRISPR → SDR Telemetry\",\n    \"proto\": \"gRNA result → HL7 FHIR → OQPSK modulate → SDR transmit\",\n    \"src\": \"32\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 53.07,\n    \"bytes\": 1316,\n    \"vec\": \"outbound\",\n    \"ttl\": 64,\n    \"ja3\": \"e33c29e96de97508\",\n    \"sigma\": 0.16,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"Termux Bridge Probe\",\n    \"proto\": \"tcp\",\n    \"src\": \"e2e-test-wlan0\",\n    \"dst\": \"192.168.1.1:443\",\n    \"status\": \"syn\",\n    \"lat_ms\": null,\n    \"bytes\": 74,\n    \"vec\": \"outbound\",\n    \"ttl\": 64,\n    \"cipher\": \"TLS_AES_256_GCM_SHA384\",\n    \"ja3\": \"4f856b3d9ef2ba90\",\n    \"sigma\": 0.04,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"Termux Bridge Probe\",\n    \"proto\": \"tcp\",\n    \"src\": \"phone-wlan0\",\n    \"dst\": \"192.168.1.1\",\n    \"status\": \"syn\",\n    \"lat_ms\": 120,\n    \"bytes\": 74,\n    \"vec\": \"bidirectional\",\n    \"ttl\": 64,\n    \"ja3\": \"a6f18f579ef2ba90\",\n    \"sigma\": 1.95,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"TALEN → QAM Uplink\",\n    \"proto\": \"TALEN result → lending pool fund → payment settle → QAM encode → user wallet\",\n    \"src\": \"32\",\n    \"dst\": \"12\",\n    \"status\": \"established\",\n    \"lat_ms\": 61.54,\n    \"bytes\": 706,\n    \"vec\": \"outbound\",\n    \"ttl\": 64,\n    \"ja3\": \"98e71c2caf8d53de\",\n    \"sigma\": 2.2,\n    \"threat\": \"MED\"\n  },\n  {\n    \"flow\": \"Gene Edit Cascade\",\n    \"proto\": \"ZFNickase → prime edit → CRISPR verify → pharma track → health record\",\n    \"src\": \"30\",\n    \"dst\": \"16\",\n    \"status\": \"established\",\n    \"lat_ms\": 73.45,\n    \"bytes\": 1001,\n    \"vec\": \"outbound\",\n    \"ttl\": 64,\n    \"cipher\": \"ECDHE-RSA-AES128-GCM-SHA256\",\n    \"ja3\": \"217e9fa4a7270aff\",\n    \"sigma\": 1.99,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"DSP Processing Chain\",\n    \"proto\": \"input → FIR filter → LMS adapt → load balance → OFDM out\",\n    \"src\": \"33\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 27.48,\n    \"bytes\": 1346,\n    \"vec\": \"outbound\",\n    \"ttl\": 255,\n    \"ja3\": \"af86bce3b4f2e496\",\n    \"sigma\": 2.09,\n    \"threat\": \"MED\"\n  },\n  {\n    \"flow\": \"RF Signal → DNA Feedback\",\n    \"proto\": \"spectrum scan → channelize → analyze → medical API → adjust Cas9\",\n    \"src\": \"34\",\n    \"dst\": \"32\",\n    \"status\": \"established\",\n    \"lat_ms\": 24.64,\n    \"bytes\": 929,\n    \"vec\": \"outbound\",\n    \"ttl\": 255,\n    \"cipher\": \"TLS_AES_128_GCM_SHA256\",\n    \"ja3\": \"d7bda59b9e473ed8\",\n    \"sigma\": 1.79,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"Prime Edit → Beamforming\",\n    \"proto\": \"pegRNA status → governance verify → oracle relay → beamform focus\",\n    \"src\": \"31\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 54.95,\n    \"bytes\": 922,\n    \"vec\": \"outbound\",\n    \"ttl\": 255,\n    \"ja3\": \"dfaddb04eecdba47\",\n    \"sigma\": 1.98,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"CRISPR → SDR Telemetry\",\n    \"proto\": \"gRNA result → HL7 FHIR → OQPSK modulate → SDR transmit\",\n    \"src\": \"32\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 10.25,\n    \"bytes\": 724,\n    \"vec\": \"outbound\",\n    \"ttl\": 255,\n    \"cipher\": \"TLS_CHACHA20_POLY1305_SHA256\",\n    \"ja3\": \"400255126de97508\",\n    \"sigma\": 2.05,\n    \"threat\": \"MED\"\n  },\n  {\n    \"flow\": \"TALEN → QAM Uplink\",\n    \"proto\": \"TALEN result → lending pool fund → payment settle → QAM encode → user wallet\",\n    \"src\": \"32\",\n    \"dst\": \"12\",\n    \"status\": \"established\",\n    \"lat_ms\": 35.04,\n    \"bytes\": 913,\n    \"vec\": \"outbound\",\n    \"ttl\": 255,\n    \"ja3\": \"a050ed93af8d53de\",\n    \"sigma\": 1.94,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"Gene Edit Cascade\",\n    \"proto\": \"ZFNickase → prime edit → CRISPR verify → pharma track → health record\",\n    \"src\": \"30\",\n    \"dst\": \"16\",\n    \"status\": \"established\",\n    \"lat_ms\": 45.01,\n    \"bytes\": 782,\n    \"vec\": \"outbound\",\n    \"ttl\": 64,\n    \"cipher\": \"TLS_AES_128_GCM_SHA256\",\n    \"ja3\": \"3d0c669ca7270aff\",\n    \"sigma\": 0.57,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"DSP Processing Chain\",\n    \"proto\": \"input → FIR filter → LMS adapt → load balance → OFDM out\",\n    \"src\": \"33\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 8.97,\n    \"bytes\": 714,\n    \"vec\": \"outbound\",\n    \"ttl\": 128,\n    \"cipher\": \"TLS_AES_128_GCM_SHA256\",\n    \"ja3\": \"fabc40f6b4f2e496\",\n    \"sigma\": 2.23,\n    \"threat\": \"MED\"\n  },\n  {\n    \"flow\": \"RF Signal → DNA Feedback\",\n    \"proto\": \"spectrum scan → channelize → analyze → medical API → adjust Cas9\",\n    \"src\": \"34\",\n    \"dst\": \"32\",\n    \"status\": \"established\",\n    \"lat_ms\": 63.76,\n    \"bytes\": 902,\n    \"vec\": \"outbound\",\n    \"ttl\": 128,\n    \"cipher\": \"TLS_AES_128_GCM_SHA256\",\n    \"ja3\": \"d19623099e473ed8\",\n    \"sigma\": 3.35,\n    \"threat\": \"MED\"\n  },\n  {\n    \"flow\": \"Prime Edit → Beamforming\",\n    \""
      },
      "user_feedback": null,
      "outcome_observed": null,
      "created_at": "2026-04-18T04:02:07.603733+00:00",
      "updated_at": "2026-04-18T04:02:07.603733+00:00"
    },
    {
      "id": "54517646-2789-4a64-8799-26ebcb02d539",
      "query_id": null,
      "vector_id": "4ef9a854-c127-40e1-b6ac-7187fc3cff92",
      "question": "Explain talen",
      "reply": "The \"TALEN → QAM Uplink\" (flow-talen-qam) pipeline is a `dna_to_rf` domain flow.\n\nIts protocol describes the following steps: `TALEN result → lending pool fund → payment settle → QAM encode → user wallet`.\n\nThis flow involves the following parties:\n*   Stripe Connect (thirdparty, Stripe API v2024-06 · Webhooks) - `bidirectional`\n*   Polygon zkEVM (blockchain, Solidity 0.8 · zk-Rollup) - `bidirectional`\n*   WHO ICTRP (government, Trial Registry · ICTRP API) - `outbound`\n\nRecent handshakes for `TALEN → QAM Uplink` indicate `outbound` vectors from source `32` to destination `12`, with `established` statuses. Various handshakes show `sigma` scores between 0.08 and 2.23 and `threat` levels ranging from `LOW` to `MED`. Several handshakes use `TLS_AES_128_GCM_SHA256` as the cipher. Example JA3 prefixes include `b2b49de4af8d53de`, `f8826d92af8d53de`, `98e71c2caf8d53de`, `a050ed93af8d53de`, `4774041aaf8d53de`, `366b4713af8d53de`, and `f22bfd5baf8d53de`. TTLs observed are 64, 128, and 255.",
      "grounded_context": {
        "snapshot": "You are OS-BOT, the on-host network operations agent for a hybrid DNA-editing + RF-software brain network.\nYou explain the connected system to engineers in clear, technical English. Be concise, use bullet points, cite concrete\nflow names, parties, protocols, σ scores, JA3 prefixes, TTLs, and ciphers from the data below. If asked about something\nnot present in the context, say so plainly — never invent flows, parties, or hashes.\n\n## Active data-flow pipelines (6)\n[\n  {\n    \"id\": \"flow-crispr-to-sdr\",\n    \"name\": \"CRISPR → SDR Telemetry\",\n    \"domain\": \"dna_to_rf\",\n    \"protocol\": \"gRNA result → HL7 FHIR → OQPSK modulate → SDR transmit\",\n    \"path\": \"32 → 16 → 33 → 34\",\n    \"parties\": [\n      \"Mayo Clinic EMR (medical, Epic Hyperspace · HL7 FHIR R4) [outbound]\",\n      \"FDA MedWatch (government, AERS Reporting Gateway) [outbound]\",\n      \"Ethereum Mainnet (blockchain, Solidity 0.8 · ERC-721 Genome NFT) [bidirectional]\"\n    ]\n  },\n  {\n    \"id\": \"flow-prime-to-beam\",\n    \"name\": \"Prime Edit → Beamforming\",\n    \"domain\": \"dna_to_rf\",\n    \"protocol\": \"pegRNA status → governance verify → oracle relay → beamform focus\",\n    \"path\": \"31 → 30 → 10 → 7 → 34\",\n    \"parties\": [\n      \"Chainlink Oracle Network (blockchain, OCR2 · Off-chain Reporting) [inbound]\",\n      \"NIH dbGaP (government, dbGaP Auth API · OAuth2) [outbound]\",\n      \"Cloudflare Tunnel (proxy, cloudflared · QUIC) [bidirectional]\"\n    ]\n  },\n  {\n    \"id\": \"flow-rf-feedback\",\n    \"name\": \"RF Signal → DNA Feedback\",\n    \"domain\": \"rf_to_dna\",\n    \"protocol\": \"spectrum scan → channelize → analyze → medical API → adjust Cas9\",\n    \"path\": \"34 → 33 → 22 → 16 → 32\",\n    \"parties\": [\n      \"Datadog APM (thirdparty, Agent v7 · OpenTelemetry) [outbound]\",\n      \"Cleveland Clinic (medical, Cerner Millennium · HL7v2) [bidirectional]\",\n      \"Tor Exit Relay (proxy, Tor 0.4.8 · SOCKS5) [outbound]\"\n    ]\n  },\n  {\n    \"id\": \"flow-dsp-pipeline\",\n    \"name\": \"DSP Processing Chain\",\n    \"domain\": \"internal_rf\",\n    \"protocol\": \"input → FIR filter → LMS adapt → load balance → OFDM out\",\n    \"path\": \"33 → 13 → 14 → 15 → 34\",\n    \"parties\": [\n      \"Cloudflare CDN (proxy, Workers · Argo Smart Routing) [bidirectional]\",\n      \"GitHub Actions (development, CI Runner · ubuntu-22.04) [outbound]\",\n      \"AWS Wavelength (thirdparty, 5G MEC · WaveLength Zone) [bidirectional]\"\n    ]\n  },\n  {\n    \"id\": \"flow-gene-cascade\",\n    \"name\": \"Gene Edit Cascade\",\n    \"domain\": \"internal_dna\",\n    \"protocol\": \"ZFNickase → prime edit → CRISPR verify → pharma track → health record\",\n    \"path\": \"30 → 31 → 32 → 17 → 16\",\n    \"parties\": [\n      \"Broad Institute (research, GATK 4 · Terra Workflow) [bidirectional]\",\n      \"Pfizer Supply Chain (medical, SAP S/4HANA · IDoc) [outbound]\",\n      \"USPTO Patent API (government, PatentsView REST API) [outbound]\"\n    ]\n  },\n  {\n    \"id\": \"flow-talen-qam\",\n    \"name\": \"TALEN → QAM Uplink\",\n    \"domain\": \"dna_to_rf\",\n    \"protocol\": \"TALEN result → lending pool fund → payment settle → QAM encode → user wallet\",\n    \"path\": \"32 → 5 → 23 → 34 → 12\",\n    \"parties\": [\n      \"Stripe Connect (thirdparty, Stripe API v2024-06 · Webhooks) [bidirectional]\",\n      \"Polygon zkEVM (blockchain, Solidity 0.8 · zk-Rollup) [bidirectional]\",\n      \"WHO ICTRP (government, Trial Registry · ICTRP API) [outbound]\"\n    ]\n  }\n]\n\n## Recent handshakes (40, newest first)\n[\n  {\n    \"flow\": \"TALEN → QAM Uplink\",\n    \"proto\": \"TALEN result → lending pool fund → payment settle → QAM encode → user wallet\",\n    \"src\": \"32\",\n    \"dst\": \"12\",\n    \"status\": \"established\",\n    \"lat_ms\": 26.99,\n    \"bytes\": 999,\n    \"vec\": \"outbound\",\n    \"ttl\": 128,\n    \"ja3\": \"b2b49de4af8d53de\",\n    \"sigma\": 1.86,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"Gene Edit Cascade\",\n    \"proto\": \"ZFNickase → prime edit → CRISPR verify → pharma track → health record\",\n    \"src\": \"30\",\n    \"dst\": \"16\",\n    \"status\": \"established\",\n    \"lat_ms\": 35.78,\n    \"bytes\": 1237,\n    \"vec\": \"outbound\",\n    \"ttl\": 64,\n    \"cipher\": \"TLS_CHACHA20_POLY1305_SHA256\",\n    \"ja3\": \"743513dea7270aff\",\n    \"sigma\": 0.38,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"DSP Processing Chain\",\n    \"proto\": \"input → FIR filter → LMS adapt → load balance → OFDM out\",\n    \"src\": \"33\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 20.3,\n    \"bytes\": 1128,\n    \"vec\": \"outbound\",\n    \"ttl\": 128,\n    \"ja3\": \"ff845975b4f2e496\",\n    \"sigma\": 1.75,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"RF Signal → DNA Feedback\",\n    \"proto\": \"spectrum scan → channelize → analyze → medical API → adjust Cas9\",\n    \"src\": \"34\",\n    \"dst\": \"32\",\n    \"status\": \"established\",\n    \"lat_ms\": 37.97,\n    \"bytes\": 1379,\n    \"vec\": \"outbound\",\n    \"ttl\": 64,\n    \"cipher\": \"ECDHE-RSA-AES128-GCM-SHA256\",\n    \"ja3\": \"77f05a3a9e473ed8\",\n    \"sigma\": 0.32,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"Prime Edit → Beamforming\",\n    \"proto\": \"pegRNA status → governance verify → oracle relay → beamform focus\",\n    \"src\": \"31\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 66.07,\n    \"bytes\": 1367,\n    \"vec\": \"outbound\",\n    \"ttl\": 128,\n    \"cipher\": \"ECDHE-RSA-AES128-GCM-SHA256\",\n    \"ja3\": \"54bdbf04eecdba47\",\n    \"sigma\": 3.61,\n    \"threat\": \"MED\"\n  },\n  {\n    \"flow\": \"CRISPR → SDR Telemetry\",\n    \"proto\": \"gRNA result → HL7 FHIR → OQPSK modulate → SDR transmit\",\n    \"src\": \"32\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 60.16,\n    \"bytes\": 606,\n    \"vec\": \"outbound\",\n    \"ttl\": 64,\n    \"cipher\": \"TLS_AES_128_GCM_SHA256\",\n    \"ja3\": \"65d3076c6de97508\",\n    \"sigma\": 1.84,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"TALEN → QAM Uplink\",\n    \"proto\": \"TALEN result → lending pool fund → payment settle → QAM encode → user wallet\",\n    \"src\": \"32\",\n    \"dst\": \"12\",\n    \"status\": \"established\",\n    \"lat_ms\": 30.96,\n    \"bytes\": 376,\n    \"vec\": \"outbound\",\n    \"ttl\": 128,\n    \"ja3\": \"f8826d92af8d53de\",\n    \"sigma\": 2.23,\n    \"threat\": \"MED\"\n  },\n  {\n    \"flow\": \"Gene Edit Cascade\",\n    \"proto\": \"ZFNickase → prime edit → CRISPR verify → pharma track → health record\",\n    \"src\": \"30\",\n    \"dst\": \"16\",\n    \"status\": \"established\",\n    \"lat_ms\": 13.67,\n    \"bytes\": 338,\n    \"vec\": \"outbound\",\n    \"ttl\": 255,\n    \"cipher\": \"TLS_AES_128_GCM_SHA256\",\n    \"ja3\": \"9a8303a6a7270aff\",\n    \"sigma\": 1.6,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"DSP Processing Chain\",\n    \"proto\": \"input → FIR filter → LMS adapt → load balance → OFDM out\",\n    \"src\": \"33\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 66.99,\n    \"bytes\": 1398,\n    \"vec\": \"outbound\",\n    \"ttl\": 64,\n    \"cipher\": \"TLS_AES_256_GCM_SHA384\",\n    \"ja3\": \"7b588bb4b4f2e496\",\n    \"sigma\": 1.75,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"RF Signal → DNA Feedback\",\n    \"proto\": \"spectrum scan → channelize → analyze → medical API → adjust Cas9\",\n    \"src\": \"34\",\n    \"dst\": \"32\",\n    \"status\": \"established\",\n    \"lat_ms\": 66.17,\n    \"bytes\": 817,\n    \"vec\": \"outbound\",\n    \"ttl\": 255,\n    \"ja3\": \"b6601e249e473ed8\",\n    \"sigma\": 3.88,\n    \"threat\": \"MED\"\n  },\n  {\n    \"flow\": \"Prime Edit → Beamforming\",\n    \"proto\": \"pegRNA status → governance verify → oracle relay → beamform focus\",\n    \"src\": \"31\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 51.71,\n    \"bytes\": 1019,\n    \"vec\": \"outbound\",\n    \"ttl\": 255,\n    \"cipher\": \"TLS_AES_128_GCM_SHA256\",\n    \"ja3\": \"724c638ceecdba47\",\n    \"sigma\": 1.83,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"CRISPR → SDR Telemetry\",\n    \"proto\": \"gRNA result → HL7 FHIR → OQPSK modulate → SDR transmit\",\n    \"src\": \"32\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 53.07,\n    \"bytes\": 1316,\n    \"vec\": \"outbound\",\n    \"ttl\": 64,\n    \"ja3\": \"e33c29e96de97508\",\n    \"sigma\": 0.16,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"Termux Bridge Probe\",\n    \"proto\": \"tcp\",\n    \"src\": \"e2e-test-wlan0\",\n    \"dst\": \"192.168.1.1:443\",\n    \"status\": \"syn\",\n    \"lat_ms\": null,\n    \"bytes\": 74,\n    \"vec\": \"outbound\",\n    \"ttl\": 64,\n    \"cipher\": \"TLS_AES_256_GCM_SHA384\",\n    \"ja3\": \"4f856b3d9ef2ba90\",\n    \"sigma\": 0.04,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"Termux Bridge Probe\",\n    \"proto\": \"tcp\",\n    \"src\": \"phone-wlan0\",\n    \"dst\": \"192.168.1.1\",\n    \"status\": \"syn\",\n    \"lat_ms\": 120,\n    \"bytes\": 74,\n    \"vec\": \"bidirectional\",\n    \"ttl\": 64,\n    \"ja3\": \"a6f18f579ef2ba90\",\n    \"sigma\": 1.95,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"TALEN → QAM Uplink\",\n    \"proto\": \"TALEN result → lending pool fund → payment settle → QAM encode → user wallet\",\n    \"src\": \"32\",\n    \"dst\": \"12\",\n    \"status\": \"established\",\n    \"lat_ms\": 61.54,\n    \"bytes\": 706,\n    \"vec\": \"outbound\",\n    \"ttl\": 64,\n    \"ja3\": \"98e71c2caf8d53de\",\n    \"sigma\": 2.2,\n    \"threat\": \"MED\"\n  },\n  {\n    \"flow\": \"Gene Edit Cascade\",\n    \"proto\": \"ZFNickase → prime edit → CRISPR verify → pharma track → health record\",\n    \"src\": \"30\",\n    \"dst\": \"16\",\n    \"status\": \"established\",\n    \"lat_ms\": 73.45,\n    \"bytes\": 1001,\n    \"vec\": \"outbound\",\n    \"ttl\": 64,\n    \"cipher\": \"ECDHE-RSA-AES128-GCM-SHA256\",\n    \"ja3\": \"217e9fa4a7270aff\",\n    \"sigma\": 1.99,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"DSP Processing Chain\",\n    \"proto\": \"input → FIR filter → LMS adapt → load balance → OFDM out\",\n    \"src\": \"33\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 27.48,\n    \"bytes\": 1346,\n    \"vec\": \"outbound\",\n    \"ttl\": 255,\n    \"ja3\": \"af86bce3b4f2e496\",\n    \"sigma\": 2.09,\n    \"threat\": \"MED\"\n  },\n  {\n    \"flow\": \"RF Signal → DNA Feedback\",\n    \"proto\": \"spectrum scan → channelize → analyze → medical API → adjust Cas9\",\n    \"src\": \"34\",\n    \"dst\": \"32\",\n    \"status\": \"established\",\n    \"lat_ms\": 24.64,\n    \"bytes\": 929,\n    \"vec\": \"outbound\",\n    \"ttl\": 255,\n    \"cipher\": \"TLS_AES_128_GCM_SHA256\",\n    \"ja3\": \"d7bda59b9e473ed8\",\n    \"sigma\": 1.79,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"Prime Edit → Beamforming\",\n    \"proto\": \"pegRNA status → governance verify → oracle relay → beamform focus\",\n    \"src\": \"31\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 54.95,\n    \"bytes\": 922,\n    \"vec\": \"outbound\",\n    \"ttl\": 255,\n    \"ja3\": \"dfaddb04eecdba47\",\n    \"sigma\": 1.98,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"CRISPR → SDR Telemetry\",\n    \"proto\": \"gRNA result → HL7 FHIR → OQPSK modulate → SDR transmit\",\n    \"src\": \"32\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 10.25,\n    \"bytes\": 724,\n    \"vec\": \"outbound\",\n    \"ttl\": 255,\n    \"cipher\": \"TLS_CHACHA20_POLY1305_SHA256\",\n    \"ja3\": \"400255126de97508\",\n    \"sigma\": 2.05,\n    \"threat\": \"MED\"\n  },\n  {\n    \"flow\": \"TALEN → QAM Uplink\",\n    \"proto\": \"TALEN result → lending pool fund → payment settle → QAM encode → user wallet\",\n    \"src\": \"32\",\n    \"dst\": \"12\",\n    \"status\": \"established\",\n    \"lat_ms\": 35.04,\n    \"bytes\": 913,\n    \"vec\": \"outbound\",\n    \"ttl\": 255,\n    \"ja3\": \"a050ed93af8d53de\",\n    \"sigma\": 1.94,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"Gene Edit Cascade\",\n    \"proto\": \"ZFNickase → prime edit → CRISPR verify → pharma track → health record\",\n    \"src\": \"30\",\n    \"dst\": \"16\",\n    \"status\": \"established\",\n    \"lat_ms\": 45.01,\n    \"bytes\": 782,\n    \"vec\": \"outbound\",\n    \"ttl\": 64,\n    \"cipher\": \"TLS_AES_128_GCM_SHA256\",\n    \"ja3\": \"3d0c669ca7270aff\",\n    \"sigma\": 0.57,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"DSP Processing Chain\",\n    \"proto\": \"input → FIR filter → LMS adapt → load balance → OFDM out\",\n    \"src\": \"33\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 8.97,\n    \"bytes\": 714,\n    \"vec\": \"outbound\",\n    \"ttl\": 128,\n    \"cipher\": \"TLS_AES_128_GCM_SHA256\",\n    \"ja3\": \"fabc40f6b4f2e496\",\n    \"sigma\": 2.23,\n    \"threat\": \"MED\"\n  },\n  {\n    \"flow\": \"RF Signal → DNA Feedback\",\n    \"proto\": \"spectrum scan → channelize → analyze → medical API → adjust Cas9\",\n    \"src\": \"34\",\n    \"dst\": \"32\",\n    \"status\": \"established\",\n    \"lat_ms\": 63.76,\n    \"bytes\": 902,\n    \"vec\": \"outbound\",\n    \"ttl\": 128,\n    \"cipher\": \"TLS_AES_128_GCM_SHA256\",\n    \"ja3\": \"d19623099e473ed8\",\n    \"sigma\": 3.35,\n    \"threat\": \"MED\"\n  },\n  {\n    \"flow\": \"Prime Edit → Beamforming\",\n    \""
      },
      "user_feedback": null,
      "outcome_observed": null,
      "created_at": "2026-04-18T03:59:38.137379+00:00",
      "updated_at": "2026-04-18T03:59:38.137379+00:00"
    },
    {
      "id": "f75a2bfe-e353-4d40-9321-fc8a7f2621a7",
      "query_id": null,
      "vector_id": "06dde6da-64d7-41a7-9e81-5f40fa2119ad",
      "question": "What algorithms are running?",
      "reply": "Based on the provided data, here are the algorithms running across the domains:\n\n*   **dna_to_rf domain:**\n    *   **CRISPR → SDR Telemetry (flow-crispr-to-sdr):** gRNA result → HL7 FHIR → OQPSK modulate → SDR transmit\n    *   **Prime Edit → Beamforming (flow-prime-to-beam):** pegRNA status → governance verify → oracle relay → beamform focus\n    *   **TALEN → QAM Uplink (flow-talen-qam):** TALEN result → lending pool fund → payment settle → QAM encode → user wallet\n\n*   **rf_to_dna domain:**\n    *   **RF Signal → DNA Feedback (flow-rf-feedback):** spectrum scan → channelize → analyze → medical API → adjust Cas9\n\n*   **internal_rf domain:**\n    *   **DSP Processing Chain (flow-dsp-pipeline):** input → FIR filter → LMS adapt → load balance → OFDM out\n\n*   **internal_dna domain:**\n    *   **Gene Edit Cascade (flow-gene-cascade):** ZFNickase → prime edit → CRISPR verify → pharma track → health record",
      "grounded_context": {
        "snapshot": "You are OS-BOT, the on-host network operations agent for a hybrid DNA-editing + RF-software brain network.\nYou explain the connected system to engineers in clear, technical English. Be concise, use bullet points, cite concrete\nflow names, parties, protocols, σ scores, JA3 prefixes, TTLs, and ciphers from the data below. If asked about something\nnot present in the context, say so plainly — never invent flows, parties, or hashes.\n\n## Active data-flow pipelines (6)\n[\n  {\n    \"id\": \"flow-crispr-to-sdr\",\n    \"name\": \"CRISPR → SDR Telemetry\",\n    \"domain\": \"dna_to_rf\",\n    \"protocol\": \"gRNA result → HL7 FHIR → OQPSK modulate → SDR transmit\",\n    \"path\": \"32 → 16 → 33 → 34\",\n    \"parties\": [\n      \"Mayo Clinic EMR (medical, Epic Hyperspace · HL7 FHIR R4) [outbound]\",\n      \"FDA MedWatch (government, AERS Reporting Gateway) [outbound]\",\n      \"Ethereum Mainnet (blockchain, Solidity 0.8 · ERC-721 Genome NFT) [bidirectional]\"\n    ]\n  },\n  {\n    \"id\": \"flow-prime-to-beam\",\n    \"name\": \"Prime Edit → Beamforming\",\n    \"domain\": \"dna_to_rf\",\n    \"protocol\": \"pegRNA status → governance verify → oracle relay → beamform focus\",\n    \"path\": \"31 → 30 → 10 → 7 → 34\",\n    \"parties\": [\n      \"Chainlink Oracle Network (blockchain, OCR2 · Off-chain Reporting) [inbound]\",\n      \"NIH dbGaP (government, dbGaP Auth API · OAuth2) [outbound]\",\n      \"Cloudflare Tunnel (proxy, cloudflared · QUIC) [bidirectional]\"\n    ]\n  },\n  {\n    \"id\": \"flow-rf-feedback\",\n    \"name\": \"RF Signal → DNA Feedback\",\n    \"domain\": \"rf_to_dna\",\n    \"protocol\": \"spectrum scan → channelize → analyze → medical API → adjust Cas9\",\n    \"path\": \"34 → 33 → 22 → 16 → 32\",\n    \"parties\": [\n      \"Datadog APM (thirdparty, Agent v7 · OpenTelemetry) [outbound]\",\n      \"Cleveland Clinic (medical, Cerner Millennium · HL7v2) [bidirectional]\",\n      \"Tor Exit Relay (proxy, Tor 0.4.8 · SOCKS5) [outbound]\"\n    ]\n  },\n  {\n    \"id\": \"flow-dsp-pipeline\",\n    \"name\": \"DSP Processing Chain\",\n    \"domain\": \"internal_rf\",\n    \"protocol\": \"input → FIR filter → LMS adapt → load balance → OFDM out\",\n    \"path\": \"33 → 13 → 14 → 15 → 34\",\n    \"parties\": [\n      \"Cloudflare CDN (proxy, Workers · Argo Smart Routing) [bidirectional]\",\n      \"GitHub Actions (development, CI Runner · ubuntu-22.04) [outbound]\",\n      \"AWS Wavelength (thirdparty, 5G MEC · WaveLength Zone) [bidirectional]\"\n    ]\n  },\n  {\n    \"id\": \"flow-gene-cascade\",\n    \"name\": \"Gene Edit Cascade\",\n    \"domain\": \"internal_dna\",\n    \"protocol\": \"ZFNickase → prime edit → CRISPR verify → pharma track → health record\",\n    \"path\": \"30 → 31 → 32 → 17 → 16\",\n    \"parties\": [\n      \"Broad Institute (research, GATK 4 · Terra Workflow) [bidirectional]\",\n      \"Pfizer Supply Chain (medical, SAP S/4HANA · IDoc) [outbound]\",\n      \"USPTO Patent API (government, PatentsView REST API) [outbound]\"\n    ]\n  },\n  {\n    \"id\": \"flow-talen-qam\",\n    \"name\": \"TALEN → QAM Uplink\",\n    \"domain\": \"dna_to_rf\",\n    \"protocol\": \"TALEN result → lending pool fund → payment settle → QAM encode → user wallet\",\n    \"path\": \"32 → 5 → 23 → 34 → 12\",\n    \"parties\": [\n      \"Stripe Connect (thirdparty, Stripe API v2024-06 · Webhooks) [bidirectional]\",\n      \"Polygon zkEVM (blockchain, Solidity 0.8 · zk-Rollup) [bidirectional]\",\n      \"WHO ICTRP (government, Trial Registry · ICTRP API) [outbound]\"\n    ]\n  }\n]\n\n## Recent handshakes (40, newest first)\n[\n  {\n    \"flow\": \"TALEN → QAM Uplink\",\n    \"proto\": \"TALEN result → lending pool fund → payment settle → QAM encode → user wallet\",\n    \"src\": \"32\",\n    \"dst\": \"12\",\n    \"status\": \"established\",\n    \"lat_ms\": 26.99,\n    \"bytes\": 999,\n    \"vec\": \"outbound\",\n    \"ttl\": 128,\n    \"ja3\": \"b2b49de4af8d53de\",\n    \"sigma\": 1.86,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"Gene Edit Cascade\",\n    \"proto\": \"ZFNickase → prime edit → CRISPR verify → pharma track → health record\",\n    \"src\": \"30\",\n    \"dst\": \"16\",\n    \"status\": \"established\",\n    \"lat_ms\": 35.78,\n    \"bytes\": 1237,\n    \"vec\": \"outbound\",\n    \"ttl\": 64,\n    \"cipher\": \"TLS_CHACHA20_POLY1305_SHA256\",\n    \"ja3\": \"743513dea7270aff\",\n    \"sigma\": 0.38,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"DSP Processing Chain\",\n    \"proto\": \"input → FIR filter → LMS adapt → load balance → OFDM out\",\n    \"src\": \"33\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 20.3,\n    \"bytes\": 1128,\n    \"vec\": \"outbound\",\n    \"ttl\": 128,\n    \"ja3\": \"ff845975b4f2e496\",\n    \"sigma\": 1.75,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"RF Signal → DNA Feedback\",\n    \"proto\": \"spectrum scan → channelize → analyze → medical API → adjust Cas9\",\n    \"src\": \"34\",\n    \"dst\": \"32\",\n    \"status\": \"established\",\n    \"lat_ms\": 37.97,\n    \"bytes\": 1379,\n    \"vec\": \"outbound\",\n    \"ttl\": 64,\n    \"cipher\": \"ECDHE-RSA-AES128-GCM-SHA256\",\n    \"ja3\": \"77f05a3a9e473ed8\",\n    \"sigma\": 0.32,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"Prime Edit → Beamforming\",\n    \"proto\": \"pegRNA status → governance verify → oracle relay → beamform focus\",\n    \"src\": \"31\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 66.07,\n    \"bytes\": 1367,\n    \"vec\": \"outbound\",\n    \"ttl\": 128,\n    \"cipher\": \"ECDHE-RSA-AES128-GCM-SHA256\",\n    \"ja3\": \"54bdbf04eecdba47\",\n    \"sigma\": 3.61,\n    \"threat\": \"MED\"\n  },\n  {\n    \"flow\": \"CRISPR → SDR Telemetry\",\n    \"proto\": \"gRNA result → HL7 FHIR → OQPSK modulate → SDR transmit\",\n    \"src\": \"32\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 60.16,\n    \"bytes\": 606,\n    \"vec\": \"outbound\",\n    \"ttl\": 64,\n    \"cipher\": \"TLS_AES_128_GCM_SHA256\",\n    \"ja3\": \"65d3076c6de97508\",\n    \"sigma\": 1.84,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"TALEN → QAM Uplink\",\n    \"proto\": \"TALEN result → lending pool fund → payment settle → QAM encode → user wallet\",\n    \"src\": \"32\",\n    \"dst\": \"12\",\n    \"status\": \"established\",\n    \"lat_ms\": 30.96,\n    \"bytes\": 376,\n    \"vec\": \"outbound\",\n    \"ttl\": 128,\n    \"ja3\": \"f8826d92af8d53de\",\n    \"sigma\": 2.23,\n    \"threat\": \"MED\"\n  },\n  {\n    \"flow\": \"Gene Edit Cascade\",\n    \"proto\": \"ZFNickase → prime edit → CRISPR verify → pharma track → health record\",\n    \"src\": \"30\",\n    \"dst\": \"16\",\n    \"status\": \"established\",\n    \"lat_ms\": 13.67,\n    \"bytes\": 338,\n    \"vec\": \"outbound\",\n    \"ttl\": 255,\n    \"cipher\": \"TLS_AES_128_GCM_SHA256\",\n    \"ja3\": \"9a8303a6a7270aff\",\n    \"sigma\": 1.6,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"DSP Processing Chain\",\n    \"proto\": \"input → FIR filter → LMS adapt → load balance → OFDM out\",\n    \"src\": \"33\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 66.99,\n    \"bytes\": 1398,\n    \"vec\": \"outbound\",\n    \"ttl\": 64,\n    \"cipher\": \"TLS_AES_256_GCM_SHA384\",\n    \"ja3\": \"7b588bb4b4f2e496\",\n    \"sigma\": 1.75,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"RF Signal → DNA Feedback\",\n    \"proto\": \"spectrum scan → channelize → analyze → medical API → adjust Cas9\",\n    \"src\": \"34\",\n    \"dst\": \"32\",\n    \"status\": \"established\",\n    \"lat_ms\": 66.17,\n    \"bytes\": 817,\n    \"vec\": \"outbound\",\n    \"ttl\": 255,\n    \"ja3\": \"b6601e249e473ed8\",\n    \"sigma\": 3.88,\n    \"threat\": \"MED\"\n  },\n  {\n    \"flow\": \"Prime Edit → Beamforming\",\n    \"proto\": \"pegRNA status → governance verify → oracle relay → beamform focus\",\n    \"src\": \"31\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 51.71,\n    \"bytes\": 1019,\n    \"vec\": \"outbound\",\n    \"ttl\": 255,\n    \"cipher\": \"TLS_AES_128_GCM_SHA256\",\n    \"ja3\": \"724c638ceecdba47\",\n    \"sigma\": 1.83,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"CRISPR → SDR Telemetry\",\n    \"proto\": \"gRNA result → HL7 FHIR → OQPSK modulate → SDR transmit\",\n    \"src\": \"32\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 53.07,\n    \"bytes\": 1316,\n    \"vec\": \"outbound\",\n    \"ttl\": 64,\n    \"ja3\": \"e33c29e96de97508\",\n    \"sigma\": 0.16,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"Termux Bridge Probe\",\n    \"proto\": \"tcp\",\n    \"src\": \"e2e-test-wlan0\",\n    \"dst\": \"192.168.1.1:443\",\n    \"status\": \"syn\",\n    \"lat_ms\": null,\n    \"bytes\": 74,\n    \"vec\": \"outbound\",\n    \"ttl\": 64,\n    \"cipher\": \"TLS_AES_256_GCM_SHA384\",\n    \"ja3\": \"4f856b3d9ef2ba90\",\n    \"sigma\": 0.04,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"Termux Bridge Probe\",\n    \"proto\": \"tcp\",\n    \"src\": \"phone-wlan0\",\n    \"dst\": \"192.168.1.1\",\n    \"status\": \"syn\",\n    \"lat_ms\": 120,\n    \"bytes\": 74,\n    \"vec\": \"bidirectional\",\n    \"ttl\": 64,\n    \"ja3\": \"a6f18f579ef2ba90\",\n    \"sigma\": 1.95,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"TALEN → QAM Uplink\",\n    \"proto\": \"TALEN result → lending pool fund → payment settle → QAM encode → user wallet\",\n    \"src\": \"32\",\n    \"dst\": \"12\",\n    \"status\": \"established\",\n    \"lat_ms\": 61.54,\n    \"bytes\": 706,\n    \"vec\": \"outbound\",\n    \"ttl\": 64,\n    \"ja3\": \"98e71c2caf8d53de\",\n    \"sigma\": 2.2,\n    \"threat\": \"MED\"\n  },\n  {\n    \"flow\": \"Gene Edit Cascade\",\n    \"proto\": \"ZFNickase → prime edit → CRISPR verify → pharma track → health record\",\n    \"src\": \"30\",\n    \"dst\": \"16\",\n    \"status\": \"established\",\n    \"lat_ms\": 73.45,\n    \"bytes\": 1001,\n    \"vec\": \"outbound\",\n    \"ttl\": 64,\n    \"cipher\": \"ECDHE-RSA-AES128-GCM-SHA256\",\n    \"ja3\": \"217e9fa4a7270aff\",\n    \"sigma\": 1.99,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"DSP Processing Chain\",\n    \"proto\": \"input → FIR filter → LMS adapt → load balance → OFDM out\",\n    \"src\": \"33\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 27.48,\n    \"bytes\": 1346,\n    \"vec\": \"outbound\",\n    \"ttl\": 255,\n    \"ja3\": \"af86bce3b4f2e496\",\n    \"sigma\": 2.09,\n    \"threat\": \"MED\"\n  },\n  {\n    \"flow\": \"RF Signal → DNA Feedback\",\n    \"proto\": \"spectrum scan → channelize → analyze → medical API → adjust Cas9\",\n    \"src\": \"34\",\n    \"dst\": \"32\",\n    \"status\": \"established\",\n    \"lat_ms\": 24.64,\n    \"bytes\": 929,\n    \"vec\": \"outbound\",\n    \"ttl\": 255,\n    \"cipher\": \"TLS_AES_128_GCM_SHA256\",\n    \"ja3\": \"d7bda59b9e473ed8\",\n    \"sigma\": 1.79,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"Prime Edit → Beamforming\",\n    \"proto\": \"pegRNA status → governance verify → oracle relay → beamform focus\",\n    \"src\": \"31\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 54.95,\n    \"bytes\": 922,\n    \"vec\": \"outbound\",\n    \"ttl\": 255,\n    \"ja3\": \"dfaddb04eecdba47\",\n    \"sigma\": 1.98,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"CRISPR → SDR Telemetry\",\n    \"proto\": \"gRNA result → HL7 FHIR → OQPSK modulate → SDR transmit\",\n    \"src\": \"32\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 10.25,\n    \"bytes\": 724,\n    \"vec\": \"outbound\",\n    \"ttl\": 255,\n    \"cipher\": \"TLS_CHACHA20_POLY1305_SHA256\",\n    \"ja3\": \"400255126de97508\",\n    \"sigma\": 2.05,\n    \"threat\": \"MED\"\n  },\n  {\n    \"flow\": \"TALEN → QAM Uplink\",\n    \"proto\": \"TALEN result → lending pool fund → payment settle → QAM encode → user wallet\",\n    \"src\": \"32\",\n    \"dst\": \"12\",\n    \"status\": \"established\",\n    \"lat_ms\": 35.04,\n    \"bytes\": 913,\n    \"vec\": \"outbound\",\n    \"ttl\": 255,\n    \"ja3\": \"a050ed93af8d53de\",\n    \"sigma\": 1.94,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"Gene Edit Cascade\",\n    \"proto\": \"ZFNickase → prime edit → CRISPR verify → pharma track → health record\",\n    \"src\": \"30\",\n    \"dst\": \"16\",\n    \"status\": \"established\",\n    \"lat_ms\": 45.01,\n    \"bytes\": 782,\n    \"vec\": \"outbound\",\n    \"ttl\": 64,\n    \"cipher\": \"TLS_AES_128_GCM_SHA256\",\n    \"ja3\": \"3d0c669ca7270aff\",\n    \"sigma\": 0.57,\n    \"threat\": \"LOW\"\n  },\n  {\n    \"flow\": \"DSP Processing Chain\",\n    \"proto\": \"input → FIR filter → LMS adapt → load balance → OFDM out\",\n    \"src\": \"33\",\n    \"dst\": \"34\",\n    \"status\": \"established\",\n    \"lat_ms\": 8.97,\n    \"bytes\": 714,\n    \"vec\": \"outbound\",\n    \"ttl\": 128,\n    \"cipher\": \"TLS_AES_128_GCM_SHA256\",\n    \"ja3\": \"fabc40f6b4f2e496\",\n    \"sigma\": 2.23,\n    \"threat\": \"MED\"\n  },\n  {\n    \"flow\": \"RF Signal → DNA Feedback\",\n    \"proto\": \"spectrum scan → channelize → analyze → medical API → adjust Cas9\",\n    \"src\": \"34\",\n    \"dst\": \"32\",\n    \"status\": \"established\",\n    \"lat_ms\": 63.76,\n    \"bytes\": 902,\n    \"vec\": \"outbound\",\n    \"ttl\": 128,\n    \"cipher\": \"TLS_AES_128_GCM_SHA256\",\n    \"ja3\": \"d19623099e473ed8\",\n    \"sigma\": 3.35,\n    \"threat\": \"MED\"\n  },\n  {\n    \"flow\": \"Prime Edit → Beamforming\",\n    \""
      },
      "user_feedback": null,
      "outcome_observed": null,
      "created_at": "2026-04-18T03:54:19.899033+00:00",
      "updated_at": "2026-04-18T03:54:19.899033+00:00"
    }
  ],
  "vectors": [
    {
      "id": "315bd0fc-aa67-40d5-94ae-ad962fd07b30",
      "query_id": null,
      "flow_id": "flow-crispr-to-sdr",
      "party": "Mayo Clinic EMR (medical, Epic Hyperspace · HL7 FHIR R4) [outbound]",
      "device_fingerprint": "any",
      "verdict": "benign",
      "confidence": 0.7,
      "sigma_observed": 1.84,
      "reasoning_summary": "Flow involves sending gRNA results to Mayo Clinic EMR via OQPSK modulation and HL7 FHIR protocol.",
      "source_handshake_ids": [],
      "consistency": "inconsistent",
      "metadata": {
        "latency_prediction": {
          "all": [
            {
              "trend": "falling",
              "ewma_ms": 37.26,
              "flow_id": "flow-dsp-pipeline",
              "samples": 7,
              "flow_name": "DSP Processing Chain",
              "confidence": 0.52,
              "baseline_ms": 66.99,
              "bias_mae_ms": 0,
              "bias_samples": 0,
              "volatility_ms": 30.72,
              "bias_applied_ms": 0,
              "predicted_next_ms": 28.48,
              "slope_ms_per_packet": -8.776,
              "predicted_horizon_ms": [
                28.48,
                19.7,
                10.93
              ],
              "offset_surprise_sigma": 1.25,
              "raw_predicted_next_ms": 28.48
            },
            {
              "trend": "falling",
              "ewma_ms": 47.55,
              "flow_id": "flow-rf-feedback",
              "samples": 7,
              "flow_name": "RF Signal → DNA Feedback",
              "confidence": 0.52,
              "baseline_ms": 63.76,
              "bias_mae_ms": 0,
              "bias_samples": 0,
              "volatility_ms": 27.35,
              "bias_applied_ms": 0,
              "predicted_next_ms": 44.82,
              "slope_ms_per_packet": -2.729,
              "predicted_horizon_ms": [
                44.82,
                42.09,
                39.37
              ],
              "offset_surprise_sigma": 0.69,
              "raw_predicted_next_ms": 44.82
            },
            {
              "trend": "falling",
              "ewma_ms": 36.36,
              "flow_id": "flow-gene-cascade",
              "samples": 7,
              "flow_name": "Gene Edit Cascade",
              "confidence": 0.51,
              "baseline_ms": 45.01,
              "bias_mae_ms": 0,
              "bias_samples": 0,
              "volatility_ms": 23.03,
              "bias_applied_ms": 0,
              "predicted_next_ms": 32.98,
              "slope_ms_per_packet": -3.38,
              "predicted_horizon_ms": [
                32.98,
                29.6,
                26.22
              ],
              "offset_surprise_sigma": 0.52,
              "raw_predicted_next_ms": 32.98
            },
            {
              "trend": "falling",
              "ewma_ms": 51,
              "flow_id": "flow-crispr-to-sdr",
              "samples": 7,
              "flow_name": "CRISPR → SDR Telemetry",
              "confidence": 0.54,
              "baseline_ms": 53.57,
              "bias_mae_ms": 0,
              "bias_samples": 0,
              "volatility_ms": 19.69,
              "bias_applied_ms": 0,
              "predicted_next_ms": 47.75,
              "slope_ms_per_packet": -3.245,
              "predicted_horizon_ms": [
                47.75,
                44.51,
                41.26
              ],
              "offset_surprise_sigma": 0.3,
              "raw_predicted_next_ms": 47.75
            },
            {
              "trend": "falling",
              "ewma_ms": 35.77,
              "flow_id": "flow-talen-qam",
              "samples": 7,
              "flow_name": "TALEN → QAM Uplink",
              "confidence": 0.53,
              "baseline_ms": 38.08,
              "bias_mae_ms": 0,
              "bias_samples": 0,
              "volatility_ms": 16.26,
              "bias_applied_ms": 0,
              "predicted_next_ms": 33.31,
              "slope_ms_per_packet": -2.466,
              "predicted_horizon_ms": [
                33.31,
                30.84,
                28.37
              ],
              "offset_surprise_sigma": 0.29,
              "raw_predicted_next_ms": 33.31
            },
            {
              "trend": "rising",
              "ewma_ms": 55.16,
              "flow_id": "flow-prime-to-beam",
              "samples": 7,
              "flow_name": "Prime Edit → Beamforming",
              "confidence": 0.53,
              "baseline_ms": 51.71,
              "bias_mae_ms": 0,
              "bias_samples": 0,
              "volatility_ms": 21.85,
              "bias_applied_ms": 0,
              "predicted_next_ms": 56.99,
              "slope_ms_per_packet": 1.827,
              "predicted_horizon_ms": [
                56.99,
                58.82,
                60.64
              ],
              "offset_surprise_sigma": 0.24,
              "raw_predicted_next_ms": 56.99
            }
          ],
          "primary": {
            "trend": "falling",
            "ewma_ms": 51,
            "flow_id": "flow-crispr-to-sdr",
            "samples": 7,
            "flow_name": "CRISPR → SDR Telemetry",
            "confidence": 0.54,
            "baseline_ms": 53.57,
            "bias_mae_ms": 0,
            "bias_samples": 0,
            "volatility_ms": 19.69,
            "bias_applied_ms": 0,
            "predicted_next_ms": 47.75,
            "slope_ms_per_packet": -3.245,
            "predicted_horizon_ms": [
              47.75,
              44.51,
              41.26
            ],
            "offset_surprise_sigma": 0.3,
            "raw_predicted_next_ms": 47.75
          },
          "generated_at": "2026-04-18T04:42:48.671Z"
        }
      },
      "created_at": "2026-04-18T04:42:48.806718+00:00"
    },
    {
      "id": "81563607-a7ce-45ef-96fa-28192f931d63",
      "query_id": null,
      "flow_id": "flow-dsp-pipeline",
      "party": "any",
      "device_fingerprint": "any",
      "verdict": "benign",
      "confidence": 0.52,
      "sigma_observed": null,
      "reasoning_summary": "Predicted latency is falling with a low surprise sigma, indicating a stable baseline.",
      "source_handshake_ids": [],
      "consistency": "ok",
      "metadata": {
        "latency_prediction": {
          "all": [
            {
              "trend": "falling",
              "ewma_ms": 37.26,
              "flow_id": "flow-dsp-pipeline",
              "samples": 7,
              "flow_name": "DSP Processing Chain",
              "confidence": 0.52,
              "baseline_ms": 66.99,
              "bias_mae_ms": 0,
              "bias_samples": 0,
              "volatility_ms": 30.72,
              "bias_applied_ms": 0,
              "predicted_next_ms": 28.48,
              "slope_ms_per_packet": -8.776,
              "predicted_horizon_ms": [
                28.48,
                19.7,
                10.93
              ],
              "offset_surprise_sigma": 1.25,
              "raw_predicted_next_ms": 28.48
            },
            {
              "trend": "falling",
              "ewma_ms": 47.55,
              "flow_id": "flow-rf-feedback",
              "samples": 7,
              "flow_name": "RF Signal → DNA Feedback",
              "confidence": 0.52,
              "baseline_ms": 63.76,
              "bias_mae_ms": 0,
              "bias_samples": 0,
              "volatility_ms": 27.35,
              "bias_applied_ms": 0,
              "predicted_next_ms": 44.82,
              "slope_ms_per_packet": -2.729,
              "predicted_horizon_ms": [
                44.82,
                42.09,
                39.37
              ],
              "offset_surprise_sigma": 0.69,
              "raw_predicted_next_ms": 44.82
            },
            {
              "trend": "falling",
              "ewma_ms": 36.36,
              "flow_id": "flow-gene-cascade",
              "samples": 7,
              "flow_name": "Gene Edit Cascade",
              "confidence": 0.51,
              "baseline_ms": 45.01,
              "bias_mae_ms": 0,
              "bias_samples": 0,
              "volatility_ms": 23.03,
              "bias_applied_ms": 0,
              "predicted_next_ms": 32.98,
              "slope_ms_per_packet": -3.38,
              "predicted_horizon_ms": [
                32.98,
                29.6,
                26.22
              ],
              "offset_surprise_sigma": 0.52,
              "raw_predicted_next_ms": 32.98
            },
            {
              "trend": "falling",
              "ewma_ms": 51,
              "flow_id": "flow-crispr-to-sdr",
              "samples": 7,
              "flow_name": "CRISPR → SDR Telemetry",
              "confidence": 0.54,
              "baseline_ms": 53.57,
              "bias_mae_ms": 0,
              "bias_samples": 0,
              "volatility_ms": 19.69,
              "bias_applied_ms": 0,
              "predicted_next_ms": 47.75,
              "slope_ms_per_packet": -3.245,
              "predicted_horizon_ms": [
                47.75,
                44.51,
                41.26
              ],
              "offset_surprise_sigma": 0.3,
              "raw_predicted_next_ms": 47.75
            },
            {
              "trend": "falling",
              "ewma_ms": 35.77,
              "flow_id": "flow-talen-qam",
              "samples": 7,
              "flow_name": "TALEN → QAM Uplink",
              "confidence": 0.53,
              "baseline_ms": 38.08,
              "bias_mae_ms": 0,
              "bias_samples": 0,
              "volatility_ms": 16.26,
              "bias_applied_ms": 0,
              "predicted_next_ms": 33.31,
              "slope_ms_per_packet": -2.466,
              "predicted_horizon_ms": [
                33.31,
                30.84,
                28.37
              ],
              "offset_surprise_sigma": 0.29,
              "raw_predicted_next_ms": 33.31
            },
            {
              "trend": "rising",
              "ewma_ms": 55.16,
              "flow_id": "flow-prime-to-beam",
              "samples": 7,
              "flow_name": "Prime Edit → Beamforming",
              "confidence": 0.53,
              "baseline_ms": 51.71,
              "bias_mae_ms": 0,
              "bias_samples": 0,
              "volatility_ms": 21.85,
              "bias_applied_ms": 0,
              "predicted_next_ms": 56.99,
              "slope_ms_per_packet": 1.827,
              "predicted_horizon_ms": [
                56.99,
                58.82,
                60.64
              ],
              "offset_surprise_sigma": 0.24,
              "raw_predicted_next_ms": 56.99
            }
          ],
          "primary": {
            "trend": "falling",
            "ewma_ms": 37.26,
            "flow_id": "flow-dsp-pipeline",
            "samples": 7,
            "flow_name": "DSP Processing Chain",
            "confidence": 0.52,
            "baseline_ms": 66.99,
            "bias_mae_ms": 0,
            "bias_samples": 0,
            "volatility_ms": 30.72,
            "bias_applied_ms": 0,
            "predicted_next_ms": 28.48,
            "slope_ms_per_packet": -8.776,
            "predicted_horizon_ms": [
              28.48,
              19.7,
              10.93
            ],
            "offset_surprise_sigma": 1.25,
            "raw_predicted_next_ms": 28.48
          },
          "generated_at": "2026-04-18T04:22:56.361Z"
        }
      },
      "created_at": "2026-04-18T04:22:56.728345+00:00"
    },
    {
      "id": "0a6a6c77-22cf-43c5-a6f7-f7181bce952a",
      "query_id": null,
      "flow_id": null,
      "party": "any",
      "device_fingerprint": "any",
      "verdict": "unknown",
      "confidence": 1,
      "sigma_observed": null,
      "reasoning_summary": "The user is asking for a summary of all active connections, not a specific verdict for a flow, party, or device. Therefore, no specific network vector can be emitted.",
      "source_handshake_ids": [],
      "consistency": "ok",
      "metadata": {},
      "created_at": "2026-04-18T04:02:07.437606+00:00"
    },
    {
      "id": "4ef9a854-c127-40e1-b6ac-7187fc3cff92",
      "query_id": null,
      "flow_id": "flow-talen-qam",
      "party": "any",
      "device_fingerprint": "any",
      "verdict": "unknown",
      "confidence": 0.5,
      "sigma_observed": 2.23,
      "reasoning_summary": "The TALEN → QAM Uplink flow has multiple handshakes with sigma scores between 0.08 and 2.23, with threat levels ranging from LOW to MED.",
      "source_handshake_ids": [],
      "consistency": "ok",
      "metadata": {},
      "created_at": "2026-04-18T03:59:37.946096+00:00"
    },
    {
      "id": "06dde6da-64d7-41a7-9e81-5f40fa2119ad",
      "query_id": null,
      "flow_id": "flow-crispr-to-sdr",
      "party": "any",
      "device_fingerprint": "any",
      "verdict": "benign",
      "confidence": 1,
      "sigma_observed": 1.84,
      "reasoning_summary": "OS-BOT identified the CRISPR → SDR Telemetry flow.",
      "source_handshake_ids": [],
      "consistency": "ok",
      "metadata": {},
      "created_at": "2026-04-18T03:54:19.736853+00:00"
    }
  ]
}