Research: the investigation graph

The idea

You give it one entity. Every source that accepts that type of entity runs against it. Everything they return becomes an entity, and the process repeats outward. That is the fan-out, and it is the whole engine.

Three things bound it, so it terminates instead of eating the internet: a node cap, a task cap and a depth cap. A fourth bound is you — see Stop researching this.

Seeds: what you can type

Type anything and the badge under the box tells you what the platform thinks it is. It recognises 27 entity types; these are the ones worth seeding with:

Write phone numbers in full international form. A bare eight-digit number gets +45 assumed, which is right for a Danish investigation and both wrong and expensive for a Norwegian one — Norway issues eight-digit numbers too, so you would be interrogating a real stranger's handset and paying for it. The graph does raise a finding naming the number it actually queried, but it is easier to type the country code.

Source groups: choose before you search

Next to the Investigate button is a picker with eleven curated groups and a custom option. It matters more than it looks.

Running every source against everything is the right default at thirty sources and the wrong one at a hundred. A wide fan-out spends your paid quota on questions you did not ask, hammers third parties who never volunteered for it, and buries the answer you wanted in noise.

The selection is enforced on every ring, not just the first. The fan-out schedules far more work than your seed does, so a selection that only applied to the seed would be decorative.

A narrow group is not a lesser investigation. But it does mean the sources you left out returned neither a finding nor an absence of one, and the report says so. If you need to widen, you do not have to start again — see Scan with source.

Your choice is remembered in the browser and applies to the next investigation. Opening a saved one shows the group that investigation actually ran with, which is not necessarily the one you would pick today.

Reading the graph

• Colour is the entity type. The legend is in the Sources pane on the right.
• A dashed cyan halo means you supplied it, not a source. Permanently.
• A node that stops expanding may have been stopped on purpose. The platform recognises CDNs, WAFs and hyperscale hosting and records them without walking them — one Cloudflare address fronts millions of unrelated sites, and following it floods your graph with strangers' estates. Measured on one domain at depth 2: 547 nodes with it off, 156 with it on. There is a toggle in the search bar if you genuinely want the flood.
• A same-name-as edge is an inference, not a source claim. When a handle folds to the same string as a person or org name in the same investigation, the platform draws it — no source published that relation, because each half arrived from somewhere different. It only grades as serious when three or more sources reference the identifier independently, and the finding names them.

Layouts

force is the live simulation. clusters, circle, concentric, fan, horizontal and vertical are computed once and pinned, and re-applied when new data lands. Press g to cycle, or use the picker on the stage. Your choice is remembered, and ?layout= in the URL wins over it — so a link you share carries the arrangement you read it in.

Keyboard

Auto-fit stops the moment you pan, zoom or drag anything. The graph will not yank itself out from under you while you are reading it.

The right-click menu — this is the tool

Right-click any node (long-press on a touch screen). Everything that turns a picture into an investigation is in here, and the menu changes with the type of node you clicked.

Add relation…

Automated fan-out can only walk what a source published. When you already know something — this account also uses that handle, this domain belongs to that company — you assert it. The form attaches a new entity to the node you clicked, with a relation you name and an optional note, and then runs the full source set against it.

An asserted entity is researched one step and no further. Every source that accepts it runs, and everything they return is recorded — but the ring after that is refused. This used to be a full fresh fan-out to the investigation's whole depth, which reads well in the abstract and is wrong in practice: writing down one fact you already know should not start a search the size of the original one. If something in that step is interesting, push it further by hand.

A stopped investigation still accepts a relation. Cancelling ends the fan-out and keeps the data, so the graph is still workable. The assertion is always recorded; only the scheduling is skipped. Pressing Stop cannot be undone by writing something down.

With nothing selected, the form in the entity panel attaches to the seed.

Add note…

Your annotation on a node. It shows in the inspector, marks the node on the canvas, and prints under that entity in the PDF inventory. Use it for the reasoning — why you think this node matters is the thing that is impossible to reconstruct in three weeks.

Scan with source ▸

The submenu that makes narrow source groups safe to choose. It runs one named source against this one entity, and it deliberately ignores the investigation's source selection.

The reasoning: you pick a group before you have seen the graph. By the time you are staring at a particular node you often know exactly which source answers the question — and frequently it is one the group left out. Whatever it discovers still fans out under the group, so the named source is a probe rather than a change of plan.

The list is built per node from that node's type. Sources that need a key you do not hold are shown disabled with a key pill rather than hidden, because a source that quietly is not there and a source that found nothing look identical, and only one of them is worth doing something about. A source that does not accept the type is refused outright — it would create a task that can only fail.

Re-run every selected source

The whole group against this one node. Useful after adding an API key: the source lights up and this is how you get the answer you were missing without starting the investigation again.

Stop researching this

Freezes the fan-out at that node. It sits directly under the two expand actions on purpose: it is their opposite, and the moment you want it is the moment you have just watched one of them go somewhere useless.

The platform already refuses recognised CDNs and mass hosting, but it only knows its own lists, and at a hundred sources a wide branch spends real money before anyone can react. This is the manual version, and it is the most under-used control in the tool.

Import directory page…

Danish-specific and worth knowing about. Krak and De Gule Sider hold what you actually want for a named person — home address, landline, mobile, map position — and both sit behind a Cloudflare challenge. This platform will not build a bypass for that: it is an explicit access control over a commercially licensed dataset of private individuals' home addresses, and defeating it is the one thing the challenge exists to stop.

So instead: the dk_person_leads source builds the exact lookup URL in each site's own slug scheme, you open it in your own browser as an ordinary visitor, and you paste the page back here. The parser reads the name, Danish phone numbers, the address and map coordinates, enters them as analyst-sourced, and then runs the official registers over them — DAWA for the address, the operator register and 180.dk for the numbers.

Parsing a page you lawfully obtained is a different act from bypassing the control guarding it, and it keeps a human in the loop on personal data. That is the whole design.

Delete this and everything under it / Delete just this entity

Noise removal. "Everything under it" means only reachable through it: the node goes, then whatever the seed can no longer reach without it. A neighbour that also links straight to the seed is not "under" anything and survives — which is worth knowing, because otherwise a one-node result looks like a bug.

Pending tasks for removed entities are dropped too, or the fan-out would simply put them back. The seed itself cannot be deleted.

Centre, pin, copy, hide type

• Centre on this — pan the view to it.
• Pin in place — nail it down so the simulation stops moving it. u unpins everything.
• Copy value — the entity's value to your clipboard.
• Hide this entity type — a display filter, not a deletion. Nothing is removed and nothing stops being researched; forty certificate nodes just stop being in the way.

The inspector

Four tabs on the right:

• Entity — the selected node: its value, type, source, confidence, notes and raw data.
• Findings — the narrative. Read this before the graph. A finding says what was concluded, how strongly, and which source said so.
• Entities — the whole inventory as a sortable table, which is often faster than hunting on the canvas.
• Sources — every source, whether it ran, and if not, why. This is where you find out a source was skipped for a missing key rather than having found nothing.

Exports and sharing

PNG, PDF, JSON and CSV, from the masthead. They are GETs under the investigation's own URL, which means they are links: paste one into a ticket and it still works, with the investigation's own access rules.

The PDF is the real deliverable — a branded report with the method, the source group and its count, the entity inventory with your notes, the findings, and the canvas exactly as you arranged it.

Sharing has three settings: private (you and admins), organisation (your members), public (anyone with the link). Public investigations get a social preview card; private ones deliberately do not, because a preview card is fetched by Slack and Discord with nobody's session and prints the seed value on it.

Investigation pages are unlisted but shareable — server-rendered previews so links unfurl, plus noindex and a robots disallow so crawlers stay out. Treat the URL as the secret, because it is.

AI assistance

Optional, off unless you put a provider key on your own account, and then billed to that key. Four providers. Opening the dialog never spends money — it shows what is already cached, labelled stale if the graph has grown since. The button press is the consent for anything new.

Everything a model produced is labelled everywhere it appears: a pill in the interface, a named model in the PDF. A model's reading of a paragraph is the softest lead on this platform, and it is marked accordingly.

A workflow that actually works

1. Seed narrow. Starter group. See the shape before you spend anything.
2. Read the Findings tab, not the canvas. The graph shows you structure; the findings tell you what happened.
3. Prune hard and early. Delete the noise while there is little of it. A hundred junk nodes are much harder to clear than ten.
4. Freeze the boring branches. Shared hosting, CDN edges, the registrar's own infrastructure.
5. Probe with named sources. One question, one source, one node. This is the cheap, precise part.
6. Assert what you know. Relations from your own knowledge, with notes saying why.
7. Annotate as you go. Future you cannot reconstruct present you's reasoning.
8. Export the PDF. It carries the caveats. A screenshot does not.