It came on a Thursday, at 3:14 AM.
Marcus was asleep. The monitoring alert that Yuki had configured woke his phone at 3:16 AM — two minutes after the first malicious commit was pushed to the validation library's repository, accepted by the compromised contributor account, and automatically pulled into Threadline's dependency resolution system.
He was at his laptop by 3:19 AM.
The attack was, he had to admit, technically sophisticated. The malicious code was embedded in a dependency update that was otherwise legitimate — a genuine bug fix for a real vulnerability, which any responsible systems administrator would have applied. The malicious component was a data transformation function that introduced a subtle statistical bias into numerical validation outputs: not a dramatic corruption, not missing data, but a systematic skew that would, over time, shift confidence scores in the entity disambiguation engine downward by approximately 15%.
A 15% downward shift in confidence scores would push a significant number of findings below the reporting threshold. Findings that currently appeared in Threadline's output as high-confidence anomalies would disappear. The Monitor's investigations, the compliance customers' findings, the working group's actionable intelligence — all of it would quietly degrade without any obvious sign of system failure.
It was not a brute-force attack. It was a precision instrument.
Marcus read the malicious code with something that was not quite admiration but was in the neighborhood of technical respect. Whoever had written this was good.
He was better.
He looked at the shadow validation layer's comparison log. The primary pipeline was showing the biased outputs. The shadow layer was showing the correct outputs. The discrepancy was logged, timestamped, and already in Elaine's inbox.
He spent the next two hours doing three things in parallel.
First: he documented the malicious code precisely — the specific function, the transformation logic, the statistical bias it introduced. He built a forensic record that would be usable in a legal proceeding.
Second: he designed a patch. Not for immediate deployment — Elaine wanted the attack to proceed under controlled conditions, which he was honoring — but a complete, tested patch that could be deployed in sixty seconds when the time came.
Third: he began building a trace. The malicious commit had originated from the compromised contributor account, which was a dead end. But the commit had been built using a specific development environment — detectable from the build metadata embedded in the compiled code — and that environment had certain characteristics: software versions, timezone-consistent compilation timestamps, a code style that was individually distinctive in three subtle ways.
He ran these characteristics against the forensic databases he had access to through the Depth project. It took four hours and produced a partial match — not a name, but a technical fingerprint that connected to two previous malicious commits in unrelated projects over the past three years. Same developer environment, same code style tells, same timezone-consistent patterns.
He sent the fingerprint to Elaine with a note: *Same actor, at least three operations. Pattern consistent with Varela technical team. Suggest signals query against this fingerprint.*
He deployed the shadow layer's outputs to a protected read-only mirror that customers could be routed to if needed, so that if the primary pipeline's bias were to somehow reach customer-facing outputs, there was a clean version available.
Then he made coffee and waited for the sun to come up.
---
Yuki arrived at 7 AM. She looked at the monitoring console, looked at Marcus, and looked at the console again.
"It came," she said.
"At 3:14."
She sat down and reviewed the logs with the focused silence of someone reading a very interesting book. After ten minutes she looked up.
"The bias function," she said. "The statistical skew in the transformation step — it's designed to be undetectable under standard data quality checks because it operates at the confidence calibration layer rather than the raw data layer." She paused. "The only way to catch it is a shadow validation layer that recalculates confidence from scratch using independent inputs."
"Which is what we built," Marcus said.
"Which is what we built." She looked at him. "You knew they would target the confidence calibration layer specifically."
"I modeled what a sophisticated attacker who understood our architecture would target," he said. "The confidence calibration is the component that translates raw relationship-graph output into actionable findings. It's the highest-leverage attack surface."
"So you built the shadow layer to protect the confidence calibration specifically."
"The whole layer, but yes — the calibration step was the design priority."
Yuki looked at her screen. "The attacker knew the architecture too."
"Yes."
"Which means—"
"Which means they had access to the architecture documentation at some point." He looked at her. "The Davies channel was closed. But before it was closed, they had visibility into the integration testing environment. They saw enough to know where to hit."
Yuki was quiet for a moment. "They built their attack around knowledge that's now eight months old. Our architecture has evolved since then."
"Yes," Marcus said. "They optimized their attack against an earlier version of the system."
"So the attack is sophisticated, but it's also slightly wrong. The calibration layer they targeted was restructured in January."
Marcus looked at her. He had known this. He had not said it because he wanted her to find it herself, which she had, in approximately twelve minutes.
"The bias is partly absorbed by the restructured calibration," he said. "The actual impact on our outputs is about 6%, not 15%. Still significant, still detectable by the shadow layer, but not the precision strike they designed."
"They're operating on stale intelligence," Yuki said.
"Yes." He thought about Elaine's instruction to leave the library in place. "Which gives us a window. They think the attack is working at full effectiveness. They'll be watching our outputs for the degradation signature." He paused. "If our outputs don't show the expected degradation—"
"They'll suspect the attack failed and try to investigate," Yuki said. "Or escalate."
"Or they'll assume it worked and start acting on the assumption that we've been compromised." He thought about the eleven entities in the classified layer, the legal processes, the ongoing analysis. "If they think the working group's primary analytical tool is producing biased outputs, they may move on some of their exposed positions before the legal processes complete."
He called Elaine.
"The attack is live," he said. "We're logging everything. There's an additional dimension — the architecture evolution since January means the actual bias impact is approximately 6%, not the 15% they designed for. They're operating on stale intelligence."
"What are the implications?" Elaine said.
"If they're monitoring our outputs for the degradation signature and don't see 15%, they'll know something is off. That gives us potentially twelve to twenty-four hours before they realize the attack didn't fully land."
"Then we need to move faster than I'd planned." A pause. "Can you make your outputs show a 15% degradation in confidence scores — artificially, just in the customer-facing and monitoring surfaces — while keeping the actual analysis accurate?"
Marcus thought about this for four seconds. "Yes. Shadow layer outputs stay correct. Primary pipeline gets a cosmetic filter that mimics the expected 15% bias. Anyone watching our public-facing numbers sees what they expect to see."
"How long to build the filter?"
"It's already built," he said. "I designed it as part of the shadow layer contingency options."
A silence. "Of course you did." She paused. "Deploy the filter. Give us forty-eight hours."
"You have forty-eight hours."
He deployed the filter at 8:47 AM. By 9 AM, Threadline's customer-facing outputs showed a subtle, systematic degradation that matched exactly what a successful 15% confidence bias would produce. Customers on the shadow layer mirror saw correct outputs. Everyone else — including anyone monitoring Threadline's outputs on behalf of the Varela network — saw what they expected to see from a successful attack.
He told the team at the 9:30 standup. He told them what the filter was doing and why.
Amir looked at the architecture diagram Yuki had put on the secondary monitor. "We're feeding them false confirmation that their attack worked."
"Yes," Marcus said.
"While we keep our actual outputs clean."
"Yes."
Amir looked at the diagram for another moment. "That's—" He stopped. "That's good."
Marcus thought it was good too. But the forty-eight hours that Elaine had asked for would determine what good actually meant.