Phantomatics is a defensive research tool for detecting coordinated inauthentic behaviour. It detects coordination and assigns structural roles. It does not perform attribution to named actors, and it must not be used as if it did.

A cluster is a suspicion of coordination, not proof of intent, inauthenticity, or malice. Coordination is produced by influence operations - and also by newsrooms, activist networks, fan communities, and ad campaigns. Treat output as a lead for human review, never as a verdict.

The system labels every output with provenance (measured vs inference) and never emits attribution automatically. Do not remove or override these guards.

If you run this against real social-media data:

• You are responsible for a lawful basis. In the EU, GDPR applies to personal data even when publicly posted; a narrow research / legitimate-interest basis is typically required, and false-positive attribution of a real person can be a concrete harm and liability.
• Keep a human in the loop before any account is flagged, published, or actioned.
• The detector is itself a target of influence operations (an adversary can inject fake coordination around a real account to get it falsely flagged). The scoring and human-in-the-loop requirements exist partly to resist this; do not disable them.

If you find a security issue in the code (not a detection false-positive), open a private security advisory on the repository rather than a public issue.

No credentials belong in this repository. Vendor API keys and similar secrets should live in the OS keychain (namespaced HBCC_* in the reference setup) and be read at runtime, never committed.