Async demo pipeline Model-backed signals Review-first rollout

XGuardian Learning Pipeline

XGuardian adds demo-backed behavioral analysis to ImpactGuard. It improves operator context and future model quality, while enforcement still runs through the confidence gate and configured policy.

Pipeline stages Signals Confidence usage Troubleshooting Commands

Pipeline stages

Capture

AutoDemoRecorder starts recording from threat score and module-diversity thresholds, or staff can record manually during review.

Submit

Demos and metadata are uploaded to the XGuardian endpoint when the panel route, folder permissions, size limits, and cooldowns allow it.

Analyze

The service scores behavior asynchronously. A verdict may arrive after live module detections and should be reviewed with the original evidence.

A queued demo is not an immediate punishment. Treat it as model evidence and review material unless your policy explicitly allows action at high confidence.

Signal sources

Live heuristic context

AimbotSilentAimTriggerbotRecoilAnalysisRecoilControlMovementAnomalyWallhackEvasionTracker

XGuardian context

MLBehaviorXGuardian scoreDemo verdictFeature windowsRetraining samplePipeline health

XGuardian can strengthen review confidence when it agrees with live signals. It can also expose cases where a noisy live signal should stay log-only until more corroboration exists.

How XGuardian feeds confidence-gated enforcement

XGuardian scores can contribute to behavioral context and threat scoring.
Strict false-positive protection can still prevent punitive action if module diversity or threat score is too low.
Auto-kick and auto-ban settings should remain off during initial rollout unless your team has validated local evidence quality.
Use manual review and labeled samples to improve future model quality instead of assuming instant certainty.

Good rollout pattern: log first, review demos, label high-quality examples, then tune thresholds gradually.

Troubleshooting

No demo files

Check AutoDemoRecorder thresholds, folder path, server write permissions, idle stop timing, and whether the suspect reached recording criteria.

No upload

Check API endpoint URL, panel connectivity, file size, outbound HTTPS, retry logs, and cooldown settings.

No verdict

Check queue health, timeout seconds, service readiness, analysis worker logs, and whether the demo was malformed or too short.

Unexpected action

Review XGuardian auto-action flags, General.json confidence policy, module action intent, and admin-system routing.

Useful commands

igac_demo_start
igac_demo_stop
igac_xguardian <demo.dem>

igac_status
igac_metrics
igac_reload

pm2 reload impactguard-panel --update-env
curl -sS http://127.0.0.1:3000/ready
pm2 list

Pair this page with configuration reference for exact keys and client operations for moderator workflow.