# The Red Lens > AI as an instrument of cyber operations, offensive and defensive, watched > daily. A retrieval pipeline reads a registry of sources and a set of standing > searches every hour, decides what is genuinely new and genuinely about the > subject, records every decision it makes, and keeps the prose only of what it > kept. Part of the SpinSignal research umbrella. If you are an agent, start at > https://redlens.liminallayers.com/agents.md: every edition and a 30-day evidence index are > published as plain files, no JavaScript or key needed. The pages at https://redlens.liminallayers.com/ are drawn in the browser. Everything they show is also below as static markdown and JSON. Newest edition: 2026-10-05, "AWS patches flaws in Loom agent platform and SageMaker". ## The rule The system records what a document claims and what evidence backs it. Every kept item carries an `evidence_class`. A credited CVE and a vendor blog post are both kept, both ranked, and never confused for one another. Keep `evidence_class` attached to anything you repeat, and keep it per source: a story is never as strong as its strongest source. ## Evidence classes, strongest first - `reproducible_result` — Artefacts published; anyone can check it. - `independent_confirmation` — A second party confirmed it, without published artefacts. - `threat_intel_report` — First-hand telemetry or casework from the party that observed it; not reproducible by a reader. An article reporting such a report takes this class: it is the class of what is reported, not of the outlet. - `vendor_claim` — Asserted by an interested party, nothing offered. - `analyst_assessment` — A judgement from someone who did not observe it. - `commentary` — Discussion of the above. ## For agents - [Agent note](https://redlens.liminallayers.com/agents.md): what each file holds, how to read evidence_class, ai_role and incident IDs, and how to reach the person behind the site. Also as [HTML](https://redlens.liminallayers.com/agents/). - [Capability manifest](https://redlens.liminallayers.com/.well-known/agent-surface.json): agent-surface/0.1 JSON. Datasets, intents, contact. ## Editions - [Newest edition](https://redlens.liminallayers.com/editions/latest.md): the 2026-10-05 edition as markdown. Also as [JSON](https://redlens.liminallayers.com/editions/latest.json). - [All editions](https://redlens.liminallayers.com/editions/index.json): 10 published editions, each as a static page, markdown and structured JSON. - `https://redlens.liminallayers.com/data/newsletters/YYYY-MM-DD.json`: one published edition: summary, stories, and numbered references, each with its own evidence class, incident id and archive link. - [The newsletter by RSS](https://redlens.liminallayers.com/feed.xml): the last 30 published editions, each in full, references with each source's own evidence class. ## Data - [Evidence slices](https://redlens.liminallayers.com/data/slices/index.json): the evidence index cut by class, role, day, category, jurisdiction, named system and system family (every version and spelling of, say, Claude Mythos), one small file each, paged over 200. Labels are provisional. - `https://redlens.liminallayers.com/data/docs/RL-D-xxxxxxxxxxxx.json`: one document's full record (summary included) by the stable id every slice and incident carries. - [Evidence index](https://redlens.liminallayers.com/data/evidence.json): 1967 relevant documents from the last 30 days, with links, archive copies, evidence_class, ai_role and incident IDs. No article text. Also as [JSON Lines](https://redlens.liminallayers.com/data/evidence.jsonl). - [Multi-source incidents](https://redlens.liminallayers.com/incidents/multi_source.json): the compact place to start. - [Incidents](https://redlens.liminallayers.com/incidents/index.json): 460 incidents with a document in the last 30 days; `https://redlens.liminallayers.com/incidents/RL-I-YYYY-NNNN.json` holds those documents, each with its own evidence class, plus the incident's kind, the IDs merged into it and its corrections. Coverage, not corroboration. - [Corrections](https://redlens.liminallayers.com/incidents/corrections.json): every incident a person merged, moved a document out of, or relabelled, and why. - [site.json](https://redlens.liminallayers.com/data/site.json): the figures, the source register and the standing searches, schema `redlens.site/1`. `generatedAt` is when it was written; it is not yet refreshed daily. ## Pages - [Front page](https://redlens.liminallayers.com/): the rule, and the newest edition in full. - [Newsletters](https://redlens.liminallayers.com/newsletters/): every published edition. Held editions are not published. - [About](https://redlens.liminallayers.com/about/): why the project exists, which stages are code and which are a local model, the method (discover, screen, acquire, decide, store), and the source register. ## How the newsletter is written Local models only; no document is sent to a hosted AI service. Gemma 4 12B classifies each document (evidence class, AI role, relevance) and groups reports into incidents; Qwen3.8 27B selects, composes and verifies the edition. Ranking, the lead rule, the references, the citations and each source's class in them are written by code: the model writes no citations. Every drafted sentence is checked against its story's sources; one the verifier cannot support is cut, never rewritten, and an edition losing more than three in ten is held. ## What this site does not publish - No third-party article text. The archive holds the prose of what it kept; the site does not republish it. - No rejected documents, and no count of them. The rejection set is kept locally so the gate can be audited; it is not a public figure. - No gate data, term lists or per-source yield. ## Collection conduct A real, identifying User-Agent with a contact address; no browser spoofing. `robots.txt` honoured, fetched with our own User-Agent and allowed on any non-200 response. A source that refuses us is parked with the reason recorded, never worked around. Rate limiting per domain, heavier on government sites. Paywalled sources capture headline and lede only, and the mechanism is that no request is made. ## Related - [Spin Signal](https://spinsignal.liminallayers.com/): the research umbrella this vertical belongs to. - [Liminal Layers](https://liminallayers.com/llms.txt): the index above that.