He called it an integrity layer.
It was not, technically, within the scope of what he had been contracted to build for the Depth project. It was also not something he was going to ask permission to build, because asking permission would require explaining why he was building it, which would require naming the leak hypothesis in a channel that might itself be compromised.
So he built it quietly, during three early-morning sessions at the facility, interleaved with legitimate maintenance work on the semantic layer that gave him plausible reason to be in the system's codebase.
The design was elegant because it had to be invisible. A monitoring layer inserted beneath the semantic layer's query interface — not logging what analysts queried, which was already logged, but logging the access patterns in the underlying data structures in a way that would distinguish legitimate analytical access from systematic reconnaissance. An analyst doing their job produced a certain pattern of data access: query-driven, following chains of evidence, moving through the relationship graph in ways that were shaped by what they were investigating. Reconnaissance produced a different pattern: broader, more systematic, sampling rather than following.
He designed the integrity layer to detect the reconnaissance pattern.
He ran it passively for six days before it generated a signal.
The signal was subtle. A cluster of access events in the semantic layer's test environment — the version that had been used during integration testing before the production deployment — that showed a sampling pattern across entity types that didn't correspond to any active investigation thread. Not a continuous access. Distributed over three weeks, in sessions that were each short enough to look like routine maintenance.
He looked at the access logs carefully. The sessions were authenticated under a service account that was supposed to be used for automated testing only.
He ran the session timestamps against the facility's physical access logs — a cross-reference he was not authorized to do, but that was possible because the facility's access control system used the same database schema as the semantic layer's logging infrastructure, and Marcus had designed the schema.
The physical access logs showed a person present in the facility during three of the seven flagged sessions. The service account was supposed to be automated — it shouldn't have required a human to be physically present.
The person present during those sessions, according to the logs, was a member of Dr. Chen's integration team named Callum Davies.
Marcus looked at this for a long time.
He could be wrong. The physical access correlation could be coincidental — Davies might have been in the facility for other reasons during those sessions and the service account activity could have been legitimately automated. But the combination — the sampling pattern, the service account misuse, the physical presence correlation — was not a coincidence he was willing to assume.
He saved the integrity layer output. He encrypted it. He did not write Davies's name in any digital document.
He called Elaine from his car, parked outside the facility, engine running.
"I have a name," he said.
A silence. "Through your analysis?"
"Through a monitoring approach I built into the semantic layer. The approach identified anomalous access patterns in the test environment. The patterns cross-correlate with physical access logs in a way that is not definitive but is strongly suggestive."
"Name."
"Callum Davies. Chen's integration team."
The silence this time was longer than any previous one. When Elaine spoke again, her voice was careful in a way that told him the name was not entirely unknown.
"How certain are you?" she said.
"Seventy percent. The remaining thirty percent is the possibility that the physical presence correlation is coincidental and the service account misuse has a legitimate explanation I'm not seeing."
"What would move you to eighty?"
"A second observation window. If the pattern repeats during a period when Davies has no legitimate reason to be in the test environment, the coincidence explanation collapses."
"How long to establish a second observation window?"
"Two weeks if the pattern holds to its historical cadence."
"Run it," she said. "Don't tell Pemberton. Don't tell Chen. Don't tell anyone except Marsh, and only enough for her to understand what you're doing."
"And if the second window confirms it?"
"Bring it to me. I'll take it from there." A pause. "Marcus. You built a counterintelligence monitoring system inside a classified government facility without authorization."
"I built a monitoring system inside infrastructure I designed and am responsible for maintaining," Marcus said. "The distinction is meaningful."
Another pause. "Yes," she said. "It is." A beat. "It was also exactly the right thing to do. Don't let anyone tell you otherwise."
The call ended. Marcus sat in the parking lot for a moment, watching the February sky do its gray and uncommitted thing.
In his peripheral vision, the System updated:
---
**Exploit Intuition Lv. 5 → Lv. 6** *(counterintelligence architecture deployed; internal threat surface mapped)*
**Real-World Integration Lv. 3 → Lv. 4** *(classified infrastructure actively secured through novel monitoring approach)*
**Fourth Gate: 61% complete.**
---
He looked at the numbers. Sixty-one percent. The gate was moving fast now, driven by the collision of all the tracks he had been running — the Depth project, the Welch approach, the Sorokin mapping, the team disclosure. The architecture of trust was not being built in quiet deliberate moments. It was being built under pressure, which was, he supposed, the only way it was ever really built.
He drove back to the Threadline office and spent the rest of the day reviewing pull requests.
---
---
*Arc Two continues in **Chapter 38 — Davies***