Argus — Detection by Telemetry

The third side: suspicion from data instead of intuition. Argus is a tool for alliance management. One officer installs it. It watches the alliance’s visible activity — chat, dig broadcasts, help events, rally joins, online patterns — as it streams, normalizes everything into an event log, and periodically hands that log to an AI trained to surface outliers and patterns no human reviewer would ever catch. Officers make every final call. Argus only sharpens the question.

Design, at the altitude that gets published

┌──────────┐   ┌────────────┐   ┌──────────────┐   ┌─────────────┐
│ COLLECTOR│──▶│ NORMALIZER │──▶│ PATTERN STORE│──▶│   REVIEWER   │
│ (officer │   │ events →   │   │ per-member   │   │ AI outlier  │
│  machine)│   │ timelines  │   │ statistics   │   │ pass + R4   │
└──────────┘   └────────────┘   └──────────────┘   └─────────────┘
                                                       │
                                                       ▼
                                                 evidence pack

That is deliberately the whole diagram. The internals are not published — not vanity, adversarial hygiene: the tool authors read public docs too, and every design detail published is an evasion hint for their next patch. What I’ll always publish is the signal category list, because rules and management awareness benefit from it more than evaders do.

What it looks at (signal categories)

Status — alpha 0.4

• Running on: my own alliance, full roster, since late October.
• Stability: not good. The collector crashes after ~6 hours under big-event load (SVS fan-out). It restarts itself, but the gaps annoy me more than I can express in a calm wiki.
• Results so far: 7 members flagged as outliers; 6 failed a designed human-check (within 48h of flagging, without knowing they were tested) — sticker salutes missing, callout phrases unanswered, buddy-ledger questions deflected. The seventh was exonerated and I apologized to him personally, which the process is supposed to make possible.
• The headline: the patterns are too obvious — in hindsight. Before the tool, I’d have vouched for at least two of them with my hand on the rulebook. Human interaction generates trust; telemetry generates evidence. They are not the same thing and I will never fully trust my gut around roster decisions again.

Genuinely stuck on (the honest list)

These are open problems, not roadmap items. Each one is technically hard, and I work them in whatever spare time the season leaves me:

1. Shared devices vs. multi-boxing. Legitimate family/shared-PC players produce the same superficial signature as multi-boxers — same network origin, interleaved sessions. The clean discriminator (input cadence interleaving, not IPs) is designed but unproven.
2. Season-reset baselines. Every season re-normalizes what “normal activity” means. Cold-start weeks currently over-flag; carrying baselines across resets without importing last season’s cheaters’ patterns is unsolved.
3. Event-window aliasing. During spend-all events, honest hardcore players look statistically identical to bots for ~48h windows. Right now those windows are excluded from scoring — which also hides bots who only run during events. No principled fix yet.
4. Clock skew. Client clocks drift; cross-member timestamp forensics need a server-time anchor the game doesn’t expose cleanly. Until then, ordering is trustworthy, distances aren’t.
5. The collector crash. Memory growth under high-fanout event push (SVS kickoff is the worst case). Heap profiling is queued behind the two problems above.

Availability

There is no download link, on purpose. Open distribution means tool vendors get a copy on day one, and evasion patches ship within weeks — ask anyone who has watched a public anti-cheat get tuned around. What I will do: help management of top alliances on any server, personally, where the reputation is verifiable (vouched R5s, known officers, leadership networks). If you lead or officer a serious alliance and want Argus eyes on your roster, reach the vault owner through your leadership network or write to [email protected] from an address your alliance can vouch for.