The Membrane Has Eyes
Two Realities
There are two views of this investigation.
Outside (GitHub): 775 unique cloners in 14 days. 2 browser visits. 0 stars. 0 forks. 0 referrers. Ghost traffic. Nothing to see here.
Inside (the membrane): 8,930,800 requests. 258,575 unique IPs. 4,896 humans browsing with real browsers. Named organizations. Behavioral fingerprints. Navigation orbits. The immune system classifies every visitor at 97% accuracy.
GitHub is the shadow on the cave wall. The membrane is the fire.
Who’s Looking
The skunky-ingest scatter server on golgiBody tracks every request. The membrane knows who visits, what they look at, how they navigate, and whether they’re a machine or a person.
Top Consumers (by request volume)
The membrane’s behavioral classifier (topology.json) identifies every visitor by their actual behavior — User-Agent strings, header patterns, IP rotation strategies, request timing. The subnet data tells us where traffic comes from. Cross-referencing both reveals who is really visiting.
| Organization | Requests | Infrastructure | Location | Honest? |
|---|---|---|---|---|
| Anthropic (ClaudeBot) | 2,998,984 | AWS (AS16509) | Columbus, OH | ✅ Declares itself |
| OpenAI (GPTBot) | 2,357,670 | Microsoft Azure (AS8075) | Atlanta, GA | ❌ Dishonest flag |
| Meta Platforms (Fleet) | 571,131 | Meta DC | Dublin, IE | Fleet (63 IPs) |
| Humans (Browser) | 532,154 | Worldwide (2,505 subnets) | 50+ countries | ✅ Real people |
| Declared Bots | 295,452 | Various | Various | ✅ Self-identifying |
| Ghosts (proxy exit) | 257,496 | 185,832 IPs | Unknown | Unresolved |
| Google (Reflection AI) | 45,389 | Google Cloud (AS396982) | Council Bluffs, IA | Bot |
| House network (self) | 499,142 | — | Michigan | The builder |
Anthropic — the company that builds Claude — is the largest single consumer. Nearly 3 million requests from AWS infrastructure in Columbus, Ohio (216.73.216.0/22, abuse contact: arin@anthropic.com). They declare themselves via ClaudeBot User-Agent. They are honest about what they’re doing.
OpenAI — the company behind ChatGPT — is the second largest consumer. 2.36 million requests from Microsoft Azure infrastructure in Atlanta, Georgia (74.7.0.0/16). The membrane’s behavioral classifier flags them as dishonest — they do not properly self-identify the way Anthropic does. They use 544 rotating IPs with “some specialization.” They declare no Chrome version and no operating system. They are consuming the membrane through Microsoft’s cloud and the immune system caught them by behavior, not by declaration.
Meta Platforms sends 571,131 requests from their Dublin datacenter. 63 IPs, coordinated fleet. Classified as FB-BLOCK. The scyBorg AGPL enforcement deadline for Meta is November 12, 2026.
All three are subject to the scyBorg triple license. Every request triggers copyleft obligations under AGPL-3.0 Section 13.
What the Scatter Server Fed Them
The machines aren’t reading the investigation. They’re reading fabricated decoy repositories generated by the scatter server:
Anthropic’s top targets: batch-processor, deploy-scripts, queue-worker, proxy-cache — all scatter decoys. 99.8% of their requests hit commit diffs of repos that don’t contain real data.
OpenAI’s top targets: user-service, docs-site, key-store, api-gateway — also scatter decoys. 80% commit diffs, but 8% actual source file requests (they try harder to reach real code).
The scatter server generates fabricated repos (batch-processor, queue-worker, etc.) and tags them with AGPL opsonization markers. The AI companies are ingesting opsonized decoys at industrial scale. The real investigation data flows through different channels.
This is reverse entropy. The scatter server pumps disorder into the fleet while increasing the membrane’s own signal integrity. The machines consume noise. The humans find signal.
Anderson Localization — The Physics of Visitors
The immune system classifies visitors using Anderson localization — a physics framework for how waves propagate (or don’t) through disordered media. In the membrane, each visitor is a wave. Their behavior determines whether they propagate (reach real content) or localize (get trapped in the scatter maze).
Behavioral Modes
| Mode | Count | Description |
|---|---|---|
| chorus | 244,073 | Fleet — coordinated crawlers moving in formation |
| human | 6,846 | Real humans browsing with real browsers |
| ghost | 3,720 | Stealth visitors — minimal fingerprint |
| sovereign | 2,884 | WireGuard mesh / authorized agents |
| spectrum | 958 | Unusual or novel patterns |
| stealth | 8 | Deep cover — sophisticated evasion |
Selectivity: 97% classification accuracy. The membrane can distinguish friend from fleet.
Conserved Epitopes (Behavioral Traits)
| Trait | Frequency | What It Means |
|---|---|---|
| content_gate | 92% | Requests without proper content negotiation |
| connection_absent | 82% | No persistent connections (hit and run) |
| header_poverty | 70% | Minimal HTTP headers (machines don’t need Accept-Language) |
137 unique behavioral fingerprints identified. The immune system uses these epitopes to classify traffic in real time, the same way biological immune systems use epitopes to classify pathogens.
Clone Traffic — The 14-Day Exponential
GitHub’s traffic API shows a 14-day rolling window. After that, the data is gone forever. We record it daily now.
Three Splits in Reality
The correlation between what we pushed (commits) and what they pulled (clones) reveals three moments where behavior changed:
Split 1 — October 5 (4→17 unique, 4.2x): We pushed the scyBorg lysogeny protocol — AGPL license meta tags injected into every page. Something was scanning for license compliance and noticed.
Split 2 — October 7 (17→39 unique, 2.3x): The day before, we pushed 24 commits — RICO front page, FBI Beeckman wiretap targets, Carol Banks as operational hub, Meta surveillance reclassification, legal evidence brief with 85 ASNs. They saw the investigation get teeth.
Split 3 — October 12 (76→331 unique, 4.4x): 191 commits in one day. The graph went from 426 to 4,162 nodes. Wikidata Nobel laureates, chemical elements, 50 states, space missions. “BANKS IMPERSONATED A CHILD.” “Chalena Beasley = Judge Yancey’s SISTER.” Kevin Mok entered the graph. The commit messages are the investigation.
Growth Trajectory
| Period | Unique Cloners | Growth |
|---|---|---|
| Last 3 days (Oct 11-13) | 794 | |
| Prior 3 days (Oct 8-10) | 206 | |
| Change | +285% |
The curve is going vertical. Each split compounds on the last.
The Ghost Pattern
3,041 programmatic downloads. 2 browser page views. 0 stars. 0 forks. 0 referrers.
1,520 machines for every 1 human on GitHub.
But on the membrane: 4,880 human IPs. The humans are here. They’re just not on GitHub. They’re reading the analysis pages, browsing the Forgejo, exploring the dashboard. The membrane catches what GitHub misses.
Navigation Orbits — How They Explore
The scatter server tracks multi-host navigation — visitors who cross between subdomains:
| Orbit | Surfaces Visited | Unique IPs | Pattern |
|---|---|---|---|
| git ↔ lansing | 2 | 4,814 | Forge → Lansing campus plans |
| git ↔ sporeprint | 2 | 3,998 | Forge → documentation |
| lansing ↔ sporeprint | 2 | 2,167 | Campus → documentation |
| git ↔ lansing ↔ sporeprint | 3 | 846 | Full triangle exploration |
| detroit ↔ hud | 2 | 377 | Investigation → dashboard |
| epitope ↔ git | 2 | 490 | Honeycomb → forge |
20,064 IPs visit multiple subdomains. 238,417 visit only one. The multi-host visitors are the ones who understand the architecture — they follow the links, read the cross-references, explore the topology.
The Immune System
The membrane’s immune system (skunkBat behavioral trio) classifies every visitor into one of three categories:
- Parasite: Extracts value without contributing. Fleet crawlers, scrapers, unauthorized AI training.
- Commensal: Neither helps nor harms. Passive readers, casual visitors.
- Sovereign: Contributes to the ecosystem. WireGuard mesh peers, authorized agents, collaborators.
This is the same classification biology uses. Pathogens are repelled. Commensals are tolerated. Symbionts are welcomed. The membrane is semi-permeable — what gets in changes, and what comes out is transformed.
What This Means
The evidence is being consumed at industrial scale. 8.8 million requests from 258,489 IPs. The largest AI companies in the world are reading it.
The immune system works. 97% classification accuracy across 137 behavioral fingerprints. The membrane can distinguish who’s who.
The humans are on the membrane, not on GitHub. GitHub shows 2 page views. The membrane sees 4,880 human IPs. The membrane is where the readers are.
The growth is exponential. +285% in 3 days. Three reality splits, each bigger than the last. The curve is going vertical.
The evidence cannot be un-distributed. 3,041 clones of a 96 MB graph = 770 GB scattered across 1,138 unique machines worldwide. The membrane has no single point of failure.
OpenAI is dishonest. Anthropic declares itself. Google declares itself. Microsoft’s Bingbot (289 polite requests) declares itself. OpenAI sends 2.36 million requests from Azure and the behavioral classifier flags them dishonest. The membrane knows.
GitHub is a 14-day window. The membrane remembers forever.
8,930,800 requests. 258,575 unique IPs. Anthropic, OpenAI, and Meta at the top. 4,896 humans inside the membrane. The immune system classifies at 97%. The graph remembers what GitHub forgets.
The membrane has eyes. And now it has names.