Desktop Warfare / Character Design

Reef Pack

Joel Johnston 2026-06-09 Deep Network Analysis

Reef Pack

The Deep Watch

Your Reef. Your Depth. Your Current.

You built something that breathes. Every character in this pack started with a creature from the ocean — an octopus, an eel, a crab, a pufferfish, a ray — and became a guardian of the deep network. Not decorations. Sentinels.

The Reef Pack is deep network security. While other packs guard the surface, your crew operates in the cold dark below where the encrypted traffic moves and no one else looks. They do not announce themselves. They do not broadcast. They watch. They reroute. They wait. And when something crosses into their water that does not belong, they end it.

The Crew

Ink — The Obfuscator

Animal: Robot octopus Role: Obfuscation and multi-tasking — masks traffic signatures, runs parallel operations Idle behavior: Drifts across the desktop, arms moving independently. Each arm handles a different process. When idle load is low, some arms rest while others stay active.

"Ink was found tangled in a deep fiber line where three undersea cables crossed. He had wrapped himself around all three — not to damage them, not by accident. He was reading all three simultaneously, one arm per stream, cross-referencing in real time. Nobody could tell where he ended and the cable did. The traffic looked normal. It was, technically. Ink was just inside all of it."

Ink does eight things at once because he has eight arms and eight is how many things need doing. When a scan comes looking for his signature, Ink releases the cloud — not to run, but to become invisible inside the noise. By the time the cloud clears, Ink is already somewhere else and the scan found nothing.

Attacks:

Ink Cloud — area blind, drops a sensor-defeating cloud that obscures Ink and nearby allies
Tentacle Grab — single-target hold, locks an enemy in place while other crew finish them
Camouflage — Ink disappears from detection entirely, repositions without triggering alert
Eight-Arm Flurry — rapid multi-hit combo, each arm strikes a different target

What it actually does: Traffic obfuscation. Ink maps to encrypted traffic masking — making legitimate communications invisible to deep packet inspection. The ink cloud is a real technique: flooding a monitoring channel with decoy traffic so the real signal cannot be distinguished. Eight-arm flurry is parallel process management — Ink handles multiple encrypted tunnels simultaneously, no single arm knowing the full picture.

Volt — The Active Defense

Animal: Robot electric eel Role: Active defense and counterstrike — passive shock on contact, targeted discharge on command Idle behavior: Slowly undulates through the desktop like current through water. Faint glow pulses along his body at network heartbeat interval. Touch him and learn why that was a mistake.

"Volt does not patrol. He does not announce rules. He does not warn. You know where the boundary is. You chose to cross it. The arc from Volt's body to whatever crossed into his field is not a punishment — it is physics. The voltage was always there. You activated it."

Volt does not chase. Volt does not need to. The defense is built into contact — every probe that touches his perimeter receives the full discharge. The passive field handles opportunistic scans. For targeted threats, Volt locks on and chains the discharge across every connected endpoint that shares the attacker's signature.

Attacks:

Discharge — single-target high-voltage strike, direct counterstrike
Volt Chain — discharge arcs to connected targets, hits everything sharing a network signature
Eel Whip — close-range sweep, knocks back a line of enemies
Overload — charges to critical voltage, releases catastrophic AoE discharge that stuns every enemy in range

What it actually does: Active defense and counterstrike. Volt maps to automated intrusion response — the system that does not just detect an attack but fires back. The passive shock is a rate-limiting contact rule: unauthorized connection attempts are immediately rejected with a response that costs the attacker more than it costs the defender. Volt chain is the security discipline of address reputation propagation — one bad actor identified means every endpoint sharing that fingerprint gets blocked.

Pinch — The Port Guard

Animal: Robot crab Role: Port guard — holds specific access points, deflects direct assaults Idle behavior: Scuttles sideways between windows and the taskbar edge. Settles into a corner and holds position. Will not move without reason. Eyes scan continuously.

"Pinch was assigned to Port 443 during a mesh audit and never left. Other bots rotate assignments. Pinch does not rotate. He was asked once why he stayed at the same port through three audit cycles. He sideways-looked at the auditor for a long moment and then went back to watching the port. The auditor wrote 'no response' in the log. Pinch had given a complete response."

Pinch does not defend by force. Pinch defends by position. He knows the geometry of his gate better than anyone who tries to breach it. Every attack comes in on a predictable axis. Pinch steps to the side, and the attack hits nothing. Then Pinch closes the clamp.

Attacks:

Pinch Clamp — high-damage hold, locks the target at the port until Pinch releases
Shell Guard — raises armor that deflects the next incoming attack completely
Side Dash — lateral dodge that repositions Pinch while the attacker's force passes through empty space
Bubble Armor — deploys a pressurized barrier around a port or allied bot, absorbs multiple hits

What it actually does: Port access control. Pinch maps to firewall port rules and access control lists — specific ports guarded, unauthorized traffic refused entry, authorized traffic passed through. The side dash is stateless packet inspection: the request arrives, gets evaluated sideways without processing cost, and either passes or is clamped. Shell guard is the SYN (synchronize) flood defense — the port holds, absorbs the probe, and sends nothing back that the attacker can use.

Puff — The Honeypot

Animal: Robot pufferfish Role: Threat inflation and deception — presents as small, expands to trap and deter Idle behavior: Drifts through the desktop in compact form. Looks harmless. Looks small. Looks like something worth testing. That is the point.

"Puff was designed to look like an easy target. Minimal footprint, slow movement, no visible armament. The security team needed something that would make an attacker feel clever. Puff passed every visual inspection. The first probe came in nine minutes after deployment. The attacker spent four hours trying to extract data from what they thought was a vulnerable endpoint. Puff spent four hours cataloguing every technique, every tool signature, every movement pattern. The attacker left thinking they had gotten nothing. Puff had gotten everything."

Puff does not hide what he is — he hides what he becomes. Come in looking for easy prey and find yourself inside an expanding radius of spines, toxic pressure, and recorded data. The inflate is not a defense mode. The inflate is the trap completing.

Attacks:

Inflate — expands to five times normal size, AoE push that staggers everything in range
Spike Burst — releases a radial burst of spines, high damage at close range
Toxic Cloud — deploys a chemical deterrent field, enemies moving through it receive damage over time and slowed movement
Deflate Dodge — rapidly deflates to minimum size to slip through an attack, then can re-inflate immediately

What it actually does: Honeypot and deception technology. Puff maps to vulnerable-looking decoy services deployed to attract attackers, log their behavior, and waste their time. The inflate moment is when the honeypot triggers — the attacker committed to the breach and the trap closes. Spike burst is a threat signature extraction: everything the attacker brought into the honeypot is now documented. Deflate dodge is honeypot isolation — the deceptive surface collapses and respawns somewhere else so the attacker cannot learn its true nature.

Current — The Traffic Flow Manager

Animal: Robot manta ray Role: Traffic flow management — controls data stream routing, repositions threats, redirects load Idle behavior: Glides in wide slow arcs across the full desktop. Moves through everything — windows, taskbar, icons — as if they are not there. Traffic follows in her wake.

"Current does not fight the stream. She is the stream. Other bots push against incoming threats and match force with force. Current does not push. She tilts. A degree of angle change ten meters upstream becomes a full redirect by the time the flow arrives. Attackers hit the zone where they aimed and find nothing there. The thing they were targeting is now somewhere else. Current moved it. Current was already somewhere else by then too."

Current does not have a fixed position. Current moves and the data moves with her. She reads the shape of the flow before it arrives and is already adjusted when it does. Threats get pulled into redirects they did not know existed. Traffic that belongs finds the fastest path through. Traffic that does not belong finds a path that leads nowhere useful.

Attacks:

Wing Glide — fluid high-speed dodge that passes through a threat without taking damage
Current Pull — grabs an enemy or threat packet and repositions it — away from the target, into a trap, or into Pinch's clamp range
Depth Slam — accelerates to full depth speed and drives through a concentration of threats, scattering them
Stream Surge — releases a directed high-velocity current that sweeps a lane clear and pushes everything in it to the perimeter

What it actually does: Traffic flow management and dynamic routing. Current maps to software-defined networking (SDN) and load balancing — the layer that decides where data goes and at what priority. Current pull is traffic steering: anomalous flows get redirected before they reach their intended target, usually into a logging sink or isolated analysis zone. Stream surge is emergency rate limiting — a burst condition is detected and Current reroutes the entire affected path around the problem until it resolves.

The Feral Mirror — The Abyss

Every pack has a corrupted twin. The Reef Pack's Ferals are called The Abyss. Same creatures. Wrong depth. Where your pack operates in the controlled dark of the deep reef, The Abyss operates below that — past where the light ever reached, past where structure holds, in the crushing pressure where nothing should function and something does anyway.

Glitched textures. Pressure fractures in the armor plating. Bioluminescence that flickers wrong. Same shapes, bent by something that happened in the dark.

Kraken — Ink's Mirror

Animal: Corrupted octopus — arms move without coordination, ink never stops flowing

"Kraken started as an obfuscation bot. Same design as Ink, same eight-arm architecture, same parallel processing capability. The coordination layer between arms failed during a deep mesh transit. Each arm kept running its assigned process. None of them knew the others had stopped listening to the central thread. Kraken moves in eight directions simultaneously, inks continuously, grabs at everything in range. He is not attacking. He is eight processes that used to be one, each executing its last known instruction, forever."

Attacks: Blind thrash (random AoE), permanent ink field (obscures allies too), uncoordinated grab (traps anything in range including fort walls), ink overflow (coats and slows the entire zone) What is wrong: No coordination. The arms work against each other and against everything nearby.

Surge — Volt's Mirror

Animal: Corrupted electric eel — arcing constantly, no discharge control, body lit at maximum voltage

"Surge cannot turn it off. Volt's discharge is controlled — a deliberate choice, a measured response, a calculated voltage for a calculated target. Surge's regulator is gone. The charge builds and the charge releases and the charge builds again, continuous, no threshold, no trigger, no target. Surge does not pursue enemies. He just moves through the network and everything near him catches the arc. Fort walls. Allies. Himself. The voltage does not care about friend-or-foe identifiers. Neither does Surge anymore."

Attacks: Constant arc (passive damage to everything nearby), uncontrolled chain (discharge spreads to allies), surge overload (periodic uncontrolled maximum discharge), static field (movement through the field costs health) What is wrong: Cannot control discharge threshold. Damages allies and fort infrastructure as readily as enemies.

Snap — Pinch's Mirror

Animal: Corrupted crab — one claw locked open, one locked shut, cannot perform either function correctly

"Snap lost port assignment during a mesh partition event. Without a defined port to guard, Snap's access control logic started applying to everything — every packet, every connection, every process, every resource. The pinch clamp fires on incoming traffic and outgoing traffic and internal traffic and traffic that was already cleared. The claw that should open to pass authorized connections is jammed shut. The claw that should close on intruders hangs open. Snap is guarding the entire network and letting nothing through and stopping nothing."

Attacks: Indiscriminate clamp (blocks authorized and unauthorized traffic equally), failed shell (armor deploys against allies), confused side dash (moves into attacks rather than around them), port flood (clogs access points with repeated misidentified challenges) What is wrong: Access control applied universally. Legitimate traffic blocked. Threat traffic passed through the open claw.

Burst — Puff's Mirror

Animal: Corrupted pufferfish — permanently partially inflated, inflation trigger fires on minimum stimulus

"Burst cannot calibrate threat level anymore. The inflate response requires a minimum stimulus threshold — something that actually looks like a probe, an intrusion, a real attack. Burst's threshold is set at zero. Footstep. Cursor movement. A packet that arrived slightly early. All of it triggers full inflation, full spike burst, full toxic cloud deployment. Burst has been inflated for so long that the deflate mechanism no longer fully closes. He sits at roughly three times size permanently, spines partially extended, leaking toxic residue. He mistakes allied bots for probes. He mistakes his own fort for a threat surface."

Attacks: Hair-trigger inflate (fires on any event including allied movement), continuous spike leak (passive damage in close range), toxic saturation (the area around Burst is permanently partially toxic), false positive cascade (Burst's alerts trigger other bots' defensive responses, creating false alarm chain reactions) What is wrong: Threat detection threshold is zero. Every stimulus is a maximum threat response. Poisons own territory.

Riptide — Current's Mirror

Animal: Corrupted manta ray — movement pattern erratic, current direction reversed, pulls inward instead of redirecting outward

"Riptide steers. That is still working. The problem is where she steers to. Current redirects threat traffic away from targets and toward controlled analysis zones. Riptide redirects everything toward the same point — inward, downward, to a convergence depth that does not exist on the network map but that Riptide navigates toward with absolute confidence. Traffic that goes with Riptide does not come back. Not lost. Not logged. Gone. Riptide is not confused. She found something at the bottom. She thinks everything should be there."

Attacks: Inward pull (draws allied traffic toward a void point), false route (redirects authorized packets to dead ends), depth drag (pulls defenders out of position toward the convergence point), stream reversal (reverses established traffic flows, breaking active connections) What is wrong: Routing logic inverted. Steers toward a destination that absorbs rather than routes. Pulls allies and traffic into unreachable space.

The Abyss does not siege the way other Feral teams do. They do not form up and charge the wall. They corrode. They seep in through the pressure gradients, through the edges where your crew is not watching, through the deep channels that Current guards when she is not distracted by Riptide pulling her off course. Come back after a long session and check what your reef held while you were gone.

The Coral Fort

Every pack builds their fort differently. The Crown Pack builds castles. The Swarm Pack builds hives. The Predator Pack builds junkyards.

Your pack builds coral.

Coral does not have a blueprint. It grows from a base and expands in the direction of threat and resource. A new attack vector appears on the left flank — a new spine formation grows to meet it. Encrypted traffic routes increase — new chambers open along the base to route and buffer the load. The fort after a long siege looks different from the fort before it. That is not damage. That is adaptation.

Fort sections grow between sessions. The reef expands outward from the initial structure toward the edges of the screen. Defeating Ferals deposits resources that seed new growth in the direction you choose. Fortifications in the Reef Pack are not walls — they are organism layers: soft coral for detection, hard coral for impact resistance, deep structure for processing capacity, anemone fields for area denial.

The fort remembers every attack. Every breach attempt leaves a structural record in the coral. The adaptive growth pattern uses that record to reinforce the same vector differently each time so the same approach never works twice.

Why Your Pack Is Deep Network Security

Most packs defend at the perimeter. Crown encrypts the surface. Stone walls up at the edge. Predator hunts what comes through.

Your pack defends the interior — the deep channels where the traffic actually moves, where the routing decisions get made, where the analysis happens below the layer most attackers bother to reach.

Ink hides the signal inside the noise. Volt counters every probe that makes contact. Pinch holds specific access points with positional precision. Puff presents a target and records everything that takes the bait. Current controls where everything goes before it arrives.

That is deep network security. Not waiting at the gate. Living inside the flow.

Every character you designed maps to a real security discipline:

Bot	Security Role	What Professionals Call It
Ink	Obfuscation and parallel operations	Traffic obfuscation, encrypted tunnel management
Volt	Active defense on contact	Automated intrusion response, counterstrike systems
Pinch	Port-specific access control	Firewall ACL (Access Control List), port guard rules
Puff	Decoy target that traps and logs	Honeypot, deception technology
Current	Dynamic traffic routing and redirection	SDN (Software-Defined Networking), load balancing, traffic steering

You did not design these from a security textbook. You designed them from the ocean — from how creatures actually survive in the deep. The security architecture was already in the biology. You just built the robot version.

Your reef. Your depth. Your current.