The cyber_narrator/flink-stream-schedule-platform Flink codebase — the software implementation of Geedge's CyberNarrator (CN) system — contains a Nov 2023 commit 'modify psiphon tags' and a Jan 2024 commit 'add vpn knowledge', confirming Psiphon-specific traffic tagging and a maintained VPN-protocol knowledge base are built directly into CyberNarrator's stream-processing pipeline. This corroborates the taxonomy's description of a Psiphon-IP-harvesting ('vpn-thwarting') component within CN with primary source-repo evidence.

A 2020 MESA Lab progress report on the 'SAT' project describes a 'status2radius' script (Kafka heartbeat tuning), a 'GTP RST' scheme with a 'GTP DECAP' module (mobile-network GTP-tunnel decapsulation) under joint development, and deployment/acceptance-testing of an 'I3S' user-station module with a traffic gatekeeper ('GK') function for an unnamed customer ('甲方').

CyberNarrator's Flink platform gained subscriber-to-app and subscriber-to-location correlation features across 2023-2024: 'add location_subscriber agg' (Feb 2024), 'subscriber-app relation table add entity_tags field' and 'Get subscriber location info from url' (Oct 2024), and 'add metric: the relation of subscriber and app' (Mar 2024). This is concrete, actively-developed engineering evidence of subscriber-identity-to-session correlation, consistent with the subscriber-correlation capability described in the CyberNarrator taxonomy entry.

CyberNarrator's flink-stream-schedule-platform runs its own volumetric-DDoS "sketch" detection consumer (DosSketchEtl, wired in via business.properties' dos.sketch.etl.class) that is architecturally separate from Galaxy's own storm-based DoS pipeline. Each Kafka message is a batched detection window (sketch_start_time, sketch_duration, attack_type) carrying a nested report_ip_list that the ETL explodes into one record per flagged source/destination IP pair with session, packet, and byte counters, each tagged with the originating "sled" appliance IP and data center — i.e. detection happens upstream on distributed sensor appliances that emit periodic aggregate sketches rather than raw flow records, and this stream-schedule platform is a generic reflection-based Flink job runner (one Schedule implementation class instantiated per business.properties entry) reused across CyberNarrator's ETL jobs.

The DOS-SKETCH-RECORD Kafka input topic CyberNarrator's flink-stream-schedule-platform consumes from is SASL-authenticated with a hardcoded, product-branded credential (redacted here — see evidence_quote note) against internal brokers on port 9094 — the password itself embeds the Galaxy product name and an apparent 2019 provisioning year — which, together with cn-web/cn-admin's dedicated (if still-unimplemented) net.geedge.modules.galaxy.controller.GalaxyController class already seen alongside GalaxyProxyController/GalaxyResolveController, corroborates that CyberNarrator's backend infrastructure was bootstrapped under and remains operationally tied to the Galaxy platform rather than being a fully independent product line.

license-admin-api's actual controller/util code shows CyberNarrator's HASP licensing is per-feature, not a single product-wide dongle check — every operation (C2V generation, V2C license upload, status query, verify) is scoped by a caller-supplied vendorCode + featureId pair against the Aladdin/Thales Sentinel HASP SDK, and the query-format XML schemas expose a license object model of hasp/feature/product/vendor plus a license_manager block carrying host_fingerprint, hostname, OS, uptime, and IP — meaning individual CyberNarrator capabilities can be independently entitled/revoked per customer and the license is host-fingerprint-bound (requiring a fresh C2V/V2C exchange to move to different hardware), not a simple boolean unlock.

A MESA Lab monthly report states that adjustments to a VPN-detection module accumulated over 10,000 Psiphon3 server IPs and delayed a Psiphon3 client's ability to get online by at least 3 minutes in the researchers' test environment, an earlier-stage data point consistent with the much larger-scale (~70-73K IP) 'vpn-thwarting'/CyberNarrator Psiphon-harvesting pipeline documented elsewhere in this corpus.