cyber-narrator/cn-web (1183 commits) is CyberNarrator's Java Spring admin web application ("cn-admin", package net.geedge), containing a "galaxy" module (GalaxyProxyController/GalaxyResolveController) used to proxy/resolve queries, a BI-style "panel" visualization subsystem, and license-gated access control (LicenseInterceptor/LicenseService) — indicating each CyberNarrator deployment is licensed per-site/customer and depends on a "galaxy" service also seen backing other MESA web tools.

A MESA Lab monthly report states that adjustments to a VPN-detection module accumulated over 10,000 Psiphon3 server IPs and delayed a Psiphon3 client's ability to get online by at least 3 minutes in the researchers' test environment, an earlier-stage data point consistent with the much larger-scale (~70-73K IP) 'vpn-thwarting'/CyberNarrator Psiphon-harvesting pipeline documented elsewhere in this corpus.

MESA Lab group-meeting notes record parallel R&D on a whitelist-filtering module and a project to fingerprint cloud-hosted circumvention/proxy infrastructure at the IP-block (not single-IP) level, explicitly modeled on 2017/2019 academic 'Bulletproof-hosting IP block' research; the notes also mention local packet captures that found Psiphon IPs, the domain types/ratios Psiphon uses, and active-probing behavior with candidate detection countermeasures.

A MAAT/AppSketch signature literally named "Psiphon-Server-IP" blocks by destination IP against a list of 1,300+ IPs (the extracted text is truncated at ~200KB so the true list is likely larger, consistent with the taxonomy's cybernarrator/vpn-thwarting note of ~70-73K harvested Psiphon IPs), directly corroborating that the CyberNarrator/vpn-thwarting Psiphon3 IP-harvesting pipeline feeds its output straight into a production MAAT/AppSketch blocking signature.

'fj-transform-api' (CyberNarrator, ticket prefix CN-) implements CallingStationID-to-IP correlation via ClickHouse (CN-927), resolving monitored network sessions to a RADIUS Calling-Station-ID (subscriber phone number) -- direct source-level confirmation of the subscriber-identity correlation capability described in the leak's CyberNarrator sales materials.

A GitLab-group repo literally named "cyber-narrator" (license-admin-api) implements a dedicated license-administration API for the CyberNarrator product using HASP hardware-dongle licensing (HaspUtil.java, HaspStatusEnum.java, C2V generation), confirming CyberNarrator is packaged/licensed as a distinct commercial component with its own entitlement-check service separate from core TSG licensing.

The same GEEDGE employee handbook dates the launch of 网络叙事者 (CyberNarrator) to April 2021, and separately states the company's products serve 18 data centers and carriers worldwide processing over 20 Tbps of traffic — the first primary-source confirmation of CyberNarrator's launch date and a company-stated global deployment-scale figure.