An internal 2019 MESA coding-standards talk ("编程的艺术", presented by a named MESA engineer (name redacted)) uses real internal project codenames as its worked examples of "good naming," directly corroborating "Cyber Narrator (网络叙述者)" and "App Sketch (App速写)" as MESA development codenames, and additionally naming two codenames not otherwise documented in this corpus's taxonomy — "IP Discovery" (renamed to "Web Focus") and "Sanity Directory (心智目录)" — as further instances of the same internal project-naming convention.

A MAAT/AppSketch signature literally named "Psiphon-Server-IP" blocks by destination IP against a list of 1,300+ IPs (the extracted text is truncated at ~200KB so the true list is likely larger, consistent with the taxonomy's cybernarrator/vpn-thwarting note of ~70-73K harvested Psiphon IPs), directly corroborating that the CyberNarrator/vpn-thwarting Psiphon3 IP-harvesting pipeline feeds its output straight into a production MAAT/AppSketch blocking signature.

Across dozens of individual signature-rule JSON files in this batch, at least 40 distinct named commercial VPN products carry dedicated detection signatures (by IP src/dst, FQDN, JA3 hash, or protocol-specific payload): BeePassVPN, BetternetVPN (separate isakmp/ja3/WireGuard sub- signatures), BigMamaVPN, BravePrivateVPN, ExpressVPN (JA3 + UDP-payload variants), FlyVPN, hidemevpn (OpenVPN UDP payload), JourneyVPN, JumpjumpVPN, LetsVPN (JA3), Psiphon3 ("psiphon3vpn_serverip"), QuarkVPN, SecureVPN, SuperUnlimitedVPN, TurboVPN, VPNHero, VPNTurkey, and others, each dated/versioned (e.g. "_20240812") indicating an ongoing signature-maintenance pipeline rather than a one-off ruleset.

An internal methodology memo for the '新疆省口项目' (Xinjiang provincial-gateway project) and '联通IDC项目' (Unicom IDC project) states both rely on 现有的系统（TSG与CN） (the existing TSG and CN [CyberNarrator] systems) to Block/Monitor/identify mainstream apps, and describes a largely manual signature-engineering workflow -- download the target app, capture traffic with 科莱(Colasoft Capsa)/Wireshark, extract fingerprint fields (http.host, http.user_agent, quic.sni, ssl.handshake.extensions_server_name) by hand, and register a per-app signature -- extending CyberNarrator's documented role beyond Psiphon-IP-harvesting/Pakistan subscriber correlation into general domestic app-blocking alongside TSG.

CyberNarrator's flink-stream-schedule-platform runs its own volumetric-DDoS "sketch" detection consumer (DosSketchEtl, wired in via business.properties' dos.sketch.etl.class) that is architecturally separate from Galaxy's own storm-based DoS pipeline. Each Kafka message is a batched detection window (sketch_start_time, sketch_duration, attack_type) carrying a nested report_ip_list that the ETL explodes into one record per flagged source/destination IP pair with session, packet, and byte counters, each tagged with the originating "sled" appliance IP and data center — i.e. detection happens upstream on distributed sensor appliances that emit periodic aggregate sketches rather than raw flow records, and this stream-schedule platform is a generic reflection-based Flink job runner (one Schedule implementation class instantiated per business.properties entry) reused across CyberNarrator's ETL jobs.

The DOS-SKETCH-RECORD Kafka input topic CyberNarrator's flink-stream-schedule-platform consumes from is SASL-authenticated with a hardcoded, product-branded credential (redacted here — see evidence_quote note) against internal brokers on port 9094 — the password itself embeds the Galaxy product name and an apparent 2019 provisioning year — which, together with cn-web/cn-admin's dedicated (if still-unimplemented) net.geedge.modules.galaxy.controller.GalaxyController class already seen alongside GalaxyProxyController/GalaxyResolveController, corroborates that CyberNarrator's backend infrastructure was bootstrapped under and remains operationally tied to the Galaxy platform rather than being a fully independent product line.

license-admin-api's actual controller/util code shows CyberNarrator's HASP licensing is per-feature, not a single product-wide dongle check — every operation (C2V generation, V2C license upload, status query, verify) is scoped by a caller-supplied vendorCode + featureId pair against the Aladdin/Thales Sentinel HASP SDK, and the query-format XML schemas expose a license object model of hasp/feature/product/vendor plus a license_manager block carrying host_fingerprint, hostname, OS, uptime, and IP — meaning individual CyberNarrator capabilities can be independently entitled/revoked per customer and the license is host-fingerprint-bound (requiring a fresh C2V/V2C exchange to move to different hardware), not a simple boolean unlock.