Training mode

This walkthrough gives the answer away on purpose. Read it once to learn how the evidence works, then play a fresh case for real.

The Silent Airframe Ghost in the Bid Telemetry Drift The Quiet Rotation Change Order Echo Signing Key Shadow

Telemetry Drift

Halcyon Aerospace Test Range

Flight-test failure telemetry left the network two weeks before a regulator audit.

The cast

Dr. Amara Nwosu — Flight test lead. Pushed back hard on the audit scope.
Colin Vance — Data platform engineer. Uses a personal VPN from a lab jump box.
Sofia Grigorescu — Regulatory affairs. Job hunting openly.
Terrence Boyd — Field service technician. Shares a password with a contractor.
Mei-Lin Zhao — ML research engineer. Pastes work into an outside AI assistant.
Gareth Pryce — Facilities supervisor. Hiding a medical situation from HR.
Ines Duarte — Help desk analyst. Resets her own colleagues' MFA.

Clue by clue

CLUE 1

A second Git remote in the CI configuration history

How you surface it: Review pipeline config history and repository reflogs.

Why it points at the insider: Developer tooling is an exfiltration channel. Version history remembers what config forgets.

CLUE 2

Build artifacts far larger than their baseline

How you surface it: Compare artifact sizes across builds.

Why it points at the insider: Volume anomalies find hidden payloads even when the file type looks normal.

CLUE 3

Jump-box VPN session overlapping every push

How you surface it: Pull VPN and jump-box session logs and align them to push times.

Why it points at the insider: Overlapping sessions tie a human to an automated action.

CLUE 4

An anonymous transparency post drafted on a work device

How you surface it: Endpoint forensics with legal approval and full chain of custody.

Why it points at the insider: Ideological insiders leave intent artifacts. Handle them carefully — motive is sensitive, and process matters.

Innocent explanations you must rule out

Mei-Lin's AI pasting is careless but involved no test data.
Amara's audit pushback is scientific disagreement, documented in email.
Terrence's shared password was used only for a hangar terminal.

The answer

Colin Vance is the insider. Motive: Ideology — he believes the failure data was being buried and should be public. Method: Data hidden in build artifacts pushed to an external Git remote from a lab jump box.

Timeline: Day -30 adds a second Git remote to the pipeline repo; Day -21 first artifact push with an oversized binary; Day -14 and -7 further pushes; Day -3 deletes the remote from the config but not from the reflog.

Lessons to carry into the game

Treat CI/CD as a monitored egress path.
Baseline artifact sizes and alert on drift.
Ideological insiders need a different response plan than financial ones.

Play a fresh case Play this case