Shell Heuristics · application docs

publisher · enricher-v2 · corpus
CIK input 1575659 / 1687025 edgar-cik-cli bun start lookup submissions JSON data.sec.gov UA + 10 req/s Heuristic Catalog (16) postcrime → precrime 1 name_recycling w3 2 shell_reactivation w3 3 reverse_merger_chain w3 4 penny_stock_s1_s8 w2 5 late_filer_cluster w2 6 going_dark_blackout w2 7 filer_agent_overlap w3 8 form_d_only_issuer* w3 9 reg_s_issuance w2 10 reg_a_offering* w2 11 sic_code_drift w2 12 promissory_clauses w2 13 opinion_letter w3 14 form_144_outlier w2 15 sec_staff_action* w3 Score / 38 structural pass RTSL 15 / SGR 5 GP 10 Tiering ≥10 → T1 6-9 → T2 3-5 → T3 else none Tier 1 daily review Tier 2 weekly review Tier 3 quarterly apply classify * heuristics 8, 10, 15 surfaced by 2024-2026 cases; 16 self-filer also new. Body-text heuristics (9, 12, 13, 14) require primary-document scan; not shown in structural pass. Mean precrime lead time across 3 cases: 6.6 years before SEC complaint.

Precrime Analysis — Postcrime Heuristics Applied to Raw EDGAR

Author: tankbottoms.eth Audience: architect Date: 2026-05-29 Source corpus: fraud-heuristics/corpus.db (37,619 DOJ-SDNY + SEC litigation-release docs) and data.sec.gov/submissions/CIK<n>.json pulls via edgar-cik-cli.

Purpose

Cane Enterprise analysis (2001–2010 shell-traffic, name-recycling, dead-name SOX certs, reverse-merger chain, dormant-CIK reactivation, related-party filer-agent overlap, late-filer + 15-12G blackout) produced a postcrime heuristic catalog: signals that — in retrospect — would have flagged the Cane scheme years before any DOJ/SEC charging document landed. This document tests the same catalog against three 2024–2026 SEC public-company enforcement actions to quantify how many years earlier each company would have been flagged purely from EDGAR data.

The goal: convert the Cane postcrime taxonomy into a precrime scoring rubric that operates on raw CIK + submissions JSON, with no narrative input. Each filing is a vote; the score is the sum.

Files in this directory

File What it covers
README.md This overview, the heuristic catalog, and the precrime scoring rubric
case-01-rtsl.md Rapid Therapeutic Science Laboratories (CIK 1575659) — name-recycling × 2, shell pivot, going-dark 15-12G after charge
case-02-sgr-energy.md SGR Energy (CIK 1687025) — Form-D-only issuer raising $21.3M with no S-1, no periodics
case-03-gp-solutions.md GP Solutions (CIK 1424264) — 11-year dormant shell reactivated via Reg-A; SIC pivot from agriculture to cannabis pods
synthesis.md Cross-case scoring table, precrime lead-time analysis, proposed score thresholds

Cane heuristic catalog (postcrime → precrime mapping)

The catalog below is extracted from fraud-heuristics/enrich-worker/src/configs/scheme_classify.ts, fraud-heuristics/src/heuristics/*.ts, fraud-heuristics/docs/application/heuristics.md, and the seed table in fraud-heuristics/docs/superpowers/specs/2026-05-26-scheme-edgar-enrichment-design.md. Each row is a Cane-scheme fingerprint that fires on raw EDGAR data (no body-text reading required for the structural signals; body-text is required for promissory/Reg-S language).

# Heuristic slug Postcrime origin (Cane scheme) Precrime signal (CIK + submissions JSON) Weight
1 name_recycling LATI → Tele-Lawyer → Dynamic Associates → ... → identity churn on a single CIK formerNames[] length ≥ 2; or SIC drift > 1 industry on same CIK 3
2 shell_reactivation Sedona, SDI shells: dormant CIK suddenly active Filing-date gap > 24 months followed by S-1 / 1-A / 8-K Item 5.06 3
3 reverse_merger_chain MW Medical / Davi Skin shell-traffic 8-K Items 5.06 → 2.01 → 5.03 sequence; or 8-K12G3 / S-4 / DEFM14A cluster 3
4 penny_stock_s1_s8 LVGI, LATI S-8 dump-to-consultant pattern S-8 / S-8 POS filed within 12 months of S-1 effectiveness 2
5 late_filer_cluster LATI chronic NT 10-K cluster pre-Form 5 backdating ≥ 3 NT 10-K / NT 10-Q in any 24-month window 2
6 going_dark_blackout LATI 15-12G after SEC interest; SDI 15-12B abandonment 15-12G / 15-12B / 15-15D filed within 12 months of last 10-K 2
7 filer_agent_overlap Cane Clark LLP / O'Neill Taylor LLP serving multiple shells Accession prefix CIK (first 10 digits) matches a known shell-mill agent (closed list, currently edgarizer_fingerprint) 3
8 form_d_only_issuer (NEW — surfaced by SGR Energy case) Lifetime EDGAR footprint = a small number of Form D filings, no S-1, no periodics, but issuer is named in SEC complaint 3
9 reg_s_issuance LATI / Sedona offshore tranches S-1 / 10-K / 10-Q / 8-K body contains Reg(ulation)? S, Rule 904, non-U.S. persons + share-count regex 2
10 reg_a_offering (NEW — surfaced by GP Solutions case) Reg-A on a dormant shell 1-A or 1-A/A filed on a CIK with > 5-year dormancy and ≤ 5 lifetime filings before it 2
11 sic_code_drift (NEW — derived from name_recycling) industry pivot signaling a shell pickup SIC code changes by ≥ 1 major group (e.g., agriculture → pharma) within 24 months 2
12 promissory_note_clauses Cane convertible-debt cycle; toxic financiers 10-K / 10-Q body matches advance-fee / death-spiral language (Cane Clark v1 = inert; pipelines v2 = live) 2
13 opinion_letter_presence Loev Law / Cane Clark Rule 144 opinion letters S-1 exhibit signed by a known shell-network counsel 3
14 form_144_outlier (Cane Form 5 backdating; insider sale timed to material 8-K) Form 144 within 30 days of a material 8-K (Item 1.01 / 2.01 / 5.02 / 8.01) 2
15 sec_staff_action (NEW — surfaced by GP Solutions case) SEC Staff Action footprint SEC STAFF ACTION form-type appears in submissions JSON 3
16 self_filer_for_material_capital (NEW — surfaced by SGR Energy) issuer's CIK equals filer-agent CIK on accession that records material capital raise Accession prefix = issuer CIK on Form D with totalOfferingAmount ≥ $1M 2

Total weight if every signal fires: 38. (See synthesis.md for the scoring rubric and threshold proposals.)

Precrime scoring model

A single firing heuristic is never sufficient to flag an entity — a lone signal (even a weight-3 one) is treated as noise. Promotion requires both two or more distinct signals firing and a cumulative weighted score above a threshold. Let H be the catalog and e an entity (a CIK):

score(e) = Σh∈H  wh · 𝟙[ h fires on e ]
nsig(e) = | { h∈H : h fires on e } |
flag(e) = 1 ⇔ nsig(e) ≥ 2 ∧ score(e) ≥ τ
where wh ∈ {2, 3} is the heuristic weight, 𝟙[·] the indicator (1 if the heuristic fires, else 0), τ the minimum-score threshold (τ = 3, the lowest tier cutoff), and nsig the count of distinct firing heuristics. The ∧ is the single-signal suppressor: a lone heuristic yields nsig = 1 and fails the ≥ 2 branch, so it is never flagged regardless of its own weight — even a single weight-3 signal that clears τ on its own.

Tier assignment then partitions flagged entities by score: T1 score ≥ 10 (daily review), T2 6 ≤ score ≤ 9 (weekly), T3 3 ≤ score ≤ 5 (quarterly). Entities with n_sig < 2 and score < τ are not surfaced.

Method

For each of the three cases:

  1. Locate the SEC litigation release / complaint in corpus.db (scheme_slug IN (pump-and-dump, unregistered-securities)).
  2. Extract the company name + named individual + dollar amount + case number + investigation/charging date.
  3. Run bun start lookup "<company>" in *********/edgar-cik-cli/ to resolve the CIK.
  4. Pull https://data.sec.gov/submissions/CIK<10-digit>.json to extract: name, formerNames, sic, tickers, exchanges, stateOfIncorporation, and the full filings.recent arrays (form, date, accession, primaryDocument).
  5. Apply each heuristic from the catalog above. Score 0–3 per heuristic; record the earliest accession that would have tripped it.
  6. Compute precrime lead time = (earliest-trip accession date) → (SEC complaint filing date), in years.
  7. Tabulate per-case in the case files; cross-case synthesis in synthesis.md.

Headline finding (preview)

Case Total score (of 38) Earliest trip date SEC complaint date Lead time
RTSL 17 2017-06-07 (1st name change) 2023-09-18 6.3 yr
SGR Energy 11 2017-07-05 (sole Form D filed) 2024-07-29 7.1 yr
GP Solutions 13 2019-09-20 (1-A on 11-yr dormant shell) 2026-01-08 6.3 yr

The Cane catalog — designed against 2001–2010 facts — flags 100% of these 2024–2026 cases purely from structural EDGAR signals (no body-text reading required for any of the headline signals). Mean precrime lead time across the three: 6.6 years before the SEC filed.

Reading the lead time by signal strength

The ~6.3-year lead time is not one event — it is a sequence that strengthens as more signals accrue. Decomposing it by signal strength turns a single "flagged years early" number into an action ladder, where the action escalates only as the evidence does:

Phase Signal strength Example heuristics Lead-time position ACTION
Early indicator structural, low weight (w2) shell_reactivation, late_filer_cluster, sic_code_drift, going_dark_blackout earliest — years out FLAG monitor only; no external action
Strong signal high weight (w3), ≥ 2 firing filer_agent_overlap, reverse_merger_chain, opinion_letter_presence, sec_staff_action mid LABEL refer to law enforcement; basis for subpoena / records demand
Confirmation event has transpired change of control (8-K Item 5.02) and abnormal stock volume / price move latest — near the charge CONFIRMED the predicted event occurred
  • Early indicators are for flagging — cheap, structural, high-recall, intentionally noisy. They begin the clock but trigger nothing externally.
  • Strong signals are for labelling — when ≥ 2 weight-3 heuristics co-fire, the entity crosses from "watch" to "refer," the threshold at which subpoena / records-demand powers become proportionate.
  • Confirmation requires the predicted event to have actually occurred — a leadership change recorded in an 8-K Item 5.02 together with a volume/price dislocation in the stock. This is the dimension that closes the loop, and it depends on a market-data feed (price + volume per ticker) that the structural EDGAR pass does not yet carry — see the enrichment roadmap for the stock-dimension addition (RTSL / SGR / GP).

See synthesis.md for the full scoring matrix and proposed precrime alert thresholds.

rendered from docs/precrime-analysis/README.md  ·  v0 reference: gpumon-writer hand-coded catalog ↗ (the layout that inspired this style guide)