01
Local-first case integrity
Sensitive investigation material remains under operator control with encryption appropriate to the case, not cloud-by-default storage.
Investigation systems research
SIGCAN
Signal Canvas
Field release · Open evaluation
A Stratir research program developing a native macOS investigation environment where encrypted cases, live signal monitoring, relationship graphs, and bounded agent assistance operate under a single review discipline.
Signal Canvas addresses a recurring gap in investigation tooling: analysts on Apple hardware need local-first case management, integrated signal collection, and export paths that cloud-default products treat as secondary concerns.
Background
Investigation work fails when context fragments across tools.
Modern investigation teams collect across Telegram channels, entity registries, open sources, and analyst notes. Most environments force that material into browser tabs, spreadsheets, and cloud drives with no durable case object, no graph view, and no consistent path from collection to reviewable brief.
Signal Canvas treats the investigation case as the unit of record: encrypted on disk, structured for relationship analysis, and designed so agent assistance accelerates work inside scoped sessions rather than replacing human sign-off on material findings.
The program evaluates whether a native macOS surface can deliver investigation-grade control, Hermes agent integration, and export discipline without surrendering the local-first posture sensitive work requires.
Program objectives
What the program must demonstrate.
02
Integrated signal and graph analysis
Telegram monitoring, entity records, and relationship graphs converge in one environment so structure emerges before narrative.
03
Bounded agent assistance
Hermes session agents operate inside investigation scope with inspectable outputs and review gates before findings enter formal briefs.
04
Export under review discipline
Briefs and exports preserve provenance and support human review before material leaves the team.
Technical approach
A native investigation stack built for review, not chat.
Signal Canvas organizes work around encrypted case files, a graph layer for relationship reasoning, and agent sessions scoped to the active investigation. Collection, enrichment, and synthesis remain visible to the operator throughout.
The architecture prioritizes inspectability: what was collected, when it entered the case, how it links to other records, and who approved it for export. That lineage is structural, not an afterthought in a log file.
Case and encryption layer
Design case objects that travel with the analyst device, support multi-session work, and archive with export paths aligned to handling requirements.
Signal ingestion and monitoring
Integrate Telegram and related channels into the case timeline so live collection does not require parallel tooling.
Graph-native investigation
Expose clusters, repeat contacts, and pivot points through relationship views that reward structural thinking over linear note-taking.
Research areas
System components under active development.
Each component is evaluated against operational investigation scenarios, not demo workflows alone.
01
Encrypted case management
Local case storage, entity attachment, timeline assembly, and archive paths designed for investigators who cannot default to shared cloud repositories.
02
Telegram signal monitoring
Channel monitoring integrated into case workflow with activity attached to the investigation record as it develops.
03
Investigation graphs
Visual relationship mapping across identifiers, communications, and entities to surface structure analysts might miss in tabular review.
04
Hermes session agent
Scoped agent assistance inside investigation sessions with boundaries appropriate to high-trust collection and enrichment work.
05
Brief and export pipeline
Structured outputs formatted for human review, handoff, and downstream reporting without rebuilding narrative from scattered notes.
Test and evaluation
Field evaluation against live investigation work.
Signal Canvas is assessed through operational scenarios: case building from live signals, graph pivots under time pressure, agent-assisted enrichment with review gates, and brief production with lineage intact.
- 01Case material remains encrypted and locally controlled throughout typical investigation cycles
- 02Graph and monitoring outputs support pivot decisions reviewers can reconstruct
- 03Agent sessions produce inspectable artifacts tied to the active case
- 04Exports survive scrutiny from reviewers who were not present during collection
Transition and access
Open release for inspection and extension.
Signal Canvas transitions as an open release so operators, researchers, and transition partners can inspect architecture, challenge methods, and extend the system under Stratir's review discipline.
Investigation software should treat cases as evidence objects, not content feeds. Signal Canvas is Stratir's research into what that requires on macOS when graphs, signals, and agents must share one review discipline.
Signal Canvas is intended for lawful investigation and research use. Operators are responsible for authorization, handling requirements, and compliance with applicable law in their jurisdiction.