Decision Primitives

Reusable calculation, math, and text operators that turn firehose evidence into governed Signal Decisions and Agent Task Packet candidates.

Primitives do not invent evidence. They operate only on observed Signal Fabric firehose rows, normalized fields, timestamps, provenance, and configured thresholds.

Overview

How primitives fit

A firehose provides observed evidence.
A primitive performs a bounded computation over that evidence.
A decision recipe combines one or more primitives.
When the decision criteria are satisfied, Signal Fabric may create an Agent Task Packet candidate.
Packets are created from evidence-backed decisions only.

Catalog

Primitive library

Packet-producingWatch-onlyRequires customer reference data

Calculation

8 of 8

threshold_crossingCalculation

Detects when a numeric field crosses a configured threshold.

Inputs

measurement_value
measurement_unit
event_time
entity_name
threshold

Output

threshold_met
observed_value
threshold_value
direction
evidence_time

Example use case

Create a packet when BTC price moves more than 1% within a rolling window.

Formula / logic

percent_change = ((current_value - prior_value) / prior_value) * 100
trigger = abs(percent_change) >= configured_threshold

Agent Task Packet trigger

Observed BTC price movement exceeded the configured threshold with supporting firehose evidence.

packet-producing

rate_of_changeCalculation

Measures how fast a numeric field is moving across a bounded time window.

Inputs

measurement_value
event_time
window_minutes

Output

delta_per_minute
window_start
window_end

Example use case

Track how quickly a water gauge is rising over the past 30 minutes.

Formula / logic

rate = (value_end - value_start) / window_minutes

Agent Task Packet trigger

Rate of change exceeded configured velocity with supporting firehose evidence.

packet-producingwatch-only

delta_movementCalculation

Computes the absolute change between two observed values for the same entity.

Inputs

prior_value
current_value
entity_name

Output

delta
direction

Example use case

Show movement in a forecast curve since the prior observation.

Formula / logic

delta = current_value - prior_value

Agent Task Packet trigger

Observed delta met the configured movement bound.

watch-only

rolling_window_countCalculation

Counts observed events for an entity over a bounded time window.

Inputs

entity_name
event_time
window_minutes

Output

count
window_start
window_end

Example use case

Count failed-login events on a host in the last 10 minutes.

Formula / logic

count = sum(1 for evt in events where evt.entity == entity and evt.time in window)

Agent Task Packet trigger

Rolling event count exceeded the configured floor.

packet-producing

bounded_time_windowCalculation

Constrains any downstream primitive to a defined time interval.

Inputs

event_time
window_start
window_end

Output

in_window

Example use case

Only evaluate alerts emitted within the last six hours.

Formula / logic

in_window = window_start <= event_time <= window_end

Agent Task Packet trigger

Evidence was confirmed inside the configured evaluation window.

watch-only

persistence_baselineCalculation

Establishes a stable baseline for a field over a long observation window.

Inputs

measurement_value
event_time
baseline_window_days

Output

baseline_mean
baseline_stddev

Example use case

Build a 30-day baseline for normal egress volume on a network segment.

Formula / logic

baseline_mean = avg(values_in_baseline_window)
baseline_stddev = stddev(values_in_baseline_window)

Agent Task Packet trigger

Persistence baseline was refreshed from observed firehose evidence.

watch-only

forecast_curve_shiftCalculation

Detects movement between two forecast curves for the same entity and horizon.

Inputs

prior_curve
current_curve
horizon

Output

shift_magnitude
shift_direction

Example use case

Flag when a 5-day weather forecast intensifies for a customer asset region.

Formula / logic

shift = sum(abs(current_curve[t] - prior_curve[t]) for t in horizon)

Agent Task Packet trigger

Forecast curve shifted materially between two observed forecast publications.

packet-producing

anomaly_from_baselineCalculation

Scores an observation against an established baseline.

Inputs

measurement_value
baseline_mean
baseline_stddev

Output

z_score
is_anomaly

Example use case

Flag a sudden spike in DNS query volume vs. its 30-day baseline.

Formula / logic

z_score = (observed_value - baseline_mean) / baseline_stddev
is_anomaly = abs(z_score) >= configured_z

Agent Task Packet trigger

Observed value deviated from the persistence baseline beyond the configured z-score.

packet-producing

Correlation

7 of 7

lead_lag_correlationCorrelation

Measures whether movement in one signal precedes movement in another.

Inputs

series_a
series_b
lag_minutes

Output

correlation
lag_applied

Example use case

Test whether a macro indicator leads BTC price by 15 minutes.

Formula / logic

corr = pearson(series_a[t], series_b[t + lag])

Agent Task Packet trigger

Leading signal moved before the dependent signal within the configured lag.

packet-producing

time_window_correlationCorrelation

Correlates two signals within a single bounded time window.

Inputs

series_a
series_b
window_minutes

Output

correlation
window_start
window_end

Example use case

Correlate weather severity and warehouse alarm volume during a storm window.

Formula / logic

corr = pearson(series_a_in_window, series_b_in_window)

Agent Task Packet trigger

Two firehoses moved together inside the configured window.

packet-producing

multi_signal_correlationCorrelation

Combines more than two signals into a single agreement score.

Inputs

signals
weights

Output

agreement_score

Example use case

Score when network, identity, and vulnerability signals all elevate together.

Formula / logic

agreement_score = sum(weight_i * normalized_signal_i) / sum(weight_i)

Agent Task Packet trigger

Multiple firehoses agreed on elevated condition with weighted support.

packet-producing

multi_source_confirmationCorrelation

Requires that the same event be reported by N independent sources.

Inputs

sources
min_sources

Output

confirmed
confirming_sources

Example use case

Only act when both NOAA and FEMA confirm a hazard affecting the same region.

Formula / logic

confirmed = count(distinct_sources_reporting_event) >= min_sources

Agent Task Packet trigger

Event was independently confirmed by the required number of firehoses.

packet-producing

source_agreementCorrelation

Scores how consistently sources agree on a labeled outcome.

Inputs

source_labels

Output

agreement_ratio

Example use case

Show how aligned threat-intel sources are on a domain's risk label.

Formula / logic

agreement_ratio = count(sources_with_majority_label) / count(sources)

Agent Task Packet trigger

Source agreement on the observed label crossed the configured floor.

watch-only

evidence_fusionCorrelation

Merges multiple primitives' outputs into one decision-ready evidence record.

Inputs

primitive_outputs
dedupe_key

Output

fused_evidence
contributing_primitive_ids

Example use case

Fuse threshold, correlation, and entity primitives into a single packet body.

Formula / logic

fused_evidence = merge(primitive_outputs by dedupe_key)

Agent Task Packet trigger

Multiple primitive results were fused into a single evidence-backed decision.

packet-producing

geo_proximity_correlationCorrelation

Joins event location to entity location and computes distance.

Inputs

event_lat
event_lon
entity_lat
entity_lon
max_distance_km

Output

distance_km
within_radius

Example use case

Match weather events within 25 miles of a customer warehouse.

Formula / logic

distance_km = haversine(event_lat, event_lon, entity_lat, entity_lon)
within_radius = distance_km <= max_distance_km

Agent Task Packet trigger

Hazard event landed inside the configured proximity to a tracked entity.

packet-producingrequires customer reference data

Entity / Network

8 of 8

public_private_ip_classificationEntity / Network

Classifies an IP address as public, private, or special-use.

Inputs

ip_address

Output

scope_label

Example use case

Detect when an internal OT host talks to a public IP.

Formula / logic

scope_label = lookup(ip_address in RFC1918 / RFC6598 / public ranges)

Agent Task Packet trigger

An entity contacted an address outside its expected scope.

packet-producing

direction_labelEntity / Network

Labels a flow as inbound, outbound, or internal based on endpoint scope.

Inputs

src_scope
dst_scope

Output

direction

Example use case

Annotate flows from internal endpoints to public IPs as outbound.

Formula / logic

direction = derive_direction(src_scope, dst_scope)

Agent Task Packet trigger

Flow direction matched a configured exposure pattern.

watch-only

route_entity_keyEntity / Network

Builds a stable identifier for a source/destination route pair.

Inputs

src
dst
protocol

Output

route_key

Example use case

Group repeated flows between the same endpoints under a single key.

Formula / logic

route_key = hash(src + dst + protocol)

Agent Task Packet trigger

Flow observations were grouped under a stable route identifier.

watch-only

first_seen_routeEntity / Network

Detects the first observation of a route within an evaluation window.

Inputs

route_key
event_time
lookback

Output

is_first_seen

Example use case

Flag a never-before-seen connection from an OT host to a public IP.

Formula / logic

is_first_seen = not exists(route_key in observations within lookback)

Agent Task Packet trigger

A previously unseen route appeared within the configured lookback.

packet-producing

protocol_or_category_driftEntity / Network

Detects when an entity starts using a protocol or category it does not normally use.

Inputs

entity_name
observed_protocol
baseline_protocols

Output

drift

Example use case

Flag a database host suddenly emitting management-protocol traffic.

Formula / logic

drift = observed_protocol not in baseline_protocols

Agent Task Packet trigger

Observed protocol or category fell outside the entity's established baseline.

packet-producing

entity_cluster_rankingEntity / Network

Ranks entities by an evidence-backed score within a cohort.

Inputs

entities
scoring_inputs

Output

ranked_entities
rank

Example use case

Rank repositories by combined vulnerability and exploit signals.

Formula / logic

score_i = weighted_sum(scoring_inputs_i)
rank = order(score descending)

Agent Task Packet trigger

Entity ranked above the configured cohort threshold.

packet-producing

repeated_contact_detectionEntity / Network

Detects repeated contact between the same endpoints within a window.

Inputs

route_key
event_time
window_minutes
min_count

Output

repeat_count
is_repeated

Example use case

Flag persistent beaconing-like behavior between two endpoints.

Formula / logic

repeat_count = count(observations for route_key in window)
is_repeated = repeat_count >= min_count

Agent Task Packet trigger

Repeated contact between the same endpoints exceeded the configured floor.

packet-producing

exposure_surface_detectionEntity / Network

Detects when an entity becomes reachable from a broader scope than expected.

Inputs

entity_name
observed_scope
expected_scope

Output

exposed

Example use case

Flag an internal service that becomes reachable from the public internet.

Formula / logic

exposed = observed_scope is broader_than expected_scope

Agent Task Packet trigger

Entity exposure surface widened beyond its configured expectation.

packet-producing

Text / Classification

8 of 8

keyword_matchText / Classification

Matches configured keywords in a free-text field.

Inputs

text
keywords

Output

matched_keywords

Example use case

Catch alerts whose description mentions a specific product line.

Formula / logic

matched_keywords = [k for k in keywords if k in normalize(text)]

Agent Task Packet trigger

Configured keywords appeared in observed firehose text.

watch-only

taxonomy_matchText / Classification

Maps observed labels onto a controlled taxonomy.

Inputs

raw_label
taxonomy

Output

taxonomy_node

Example use case

Map vendor severities into a shared severity taxonomy.

Formula / logic

taxonomy_node = taxonomy.lookup(normalize(raw_label))

Agent Task Packet trigger

Observed label resolved to a governed taxonomy node.

packet-producing

category_matchText / Classification

Tests whether an event belongs to a configured category set.

Inputs

event_category
allowed_categories

Output

category_matched

Example use case

Limit evaluation to weather hazards categorized as severe.

Formula / logic

category_matched = event_category in allowed_categories

Agent Task Packet trigger

Event category matched the configured allow-list.

watch-only

normalized_label_matchText / Classification

Compares case- and punctuation-normalized labels.

Inputs

label_a
label_b

Output

matched

Example use case

Align vendor labels with internal labels regardless of casing.

Formula / logic

matched = normalize(label_a) == normalize(label_b)

Agent Task Packet trigger

Normalized labels matched across firehoses.

watch-only

entity_name_matchText / Classification

Resolves a free-text entity reference to a known entity record.

Inputs

text
entity_registry

Output

entity_id
confidence

Example use case

Tie a news headline to a tracked supplier in the customer registry.

Formula / logic

entity_id, confidence = registry.resolve(normalize(text))

Agent Task Packet trigger

Free-text reference resolved to a tracked entity with sufficient confidence.

packet-producingrequires customer reference data

region_or_location_matchText / Classification

Resolves a free-text location to a region or geofence.

Inputs

text
geo_registry

Output

region_id

Example use case

Resolve a NOAA alert region name to a tracked customer footprint.

Formula / logic

region_id = geo_registry.resolve(normalize(text))

Agent Task Packet trigger

Free-text location resolved to a tracked region.

packet-producingrequires customer reference data

severity_label_mappingText / Classification

Maps text severities onto a numeric severity scale.

Inputs

severity_label
mapping

Output

severity_score

Example use case

Convert NOAA, USGS, and FEMA severities into one comparable scale.

Formula / logic

severity_score = mapping.get(normalize(severity_label))

Agent Task Packet trigger

Observed severity label was mapped to a comparable numeric score.

packet-producing

provenance_text_extractionText / Classification

Extracts the source identifier and timestamp from raw provenance text.

Inputs

raw_provenance

Output

source_id
source_time

Example use case

Extract issuing office and issued-at time from an alert payload.

Formula / logic

source_id, source_time = parse_provenance(raw_provenance)

Agent Task Packet trigger

Provenance fields were extracted from observed firehose evidence.

watch-only

Worked examples

Primitives combined into real decisions

Four end-to-end examples showing how firehoses and primitives compose into a single Agent Task Packet candidate.

OT Public Exposure

Internal OT protocol traffic communicated with a public IP.

Firehoses

Network observability firehoses

Primitives

public_private_ip_classification
direction_label
protocol_or_category_drift
exposure_surface_detection
dedupe_key

PacketOT_PUBLIC_EXPOSURE

Warehouse Weather / Disaster Proximity

Hazard event occurred within 25 miles of a customer asset.

Firehoses

Customer asset reference data
NOAA weather alerts
USGS earthquakes
FEMA disaster declarations
NASA EONET events

Primitives

geo_proximity_correlation
bounded_time_window
severity_label_mapping
multi_source_confirmation

PacketASSET_HAZARD_PROXIMITY

Bitcoin Macro Movement

BTC price moved materially after macro signal movement.

Firehoses

BTC trade price
FX rates
macro indicators

Primitives

rate_of_change
lead_lag_correlation
forecast_curve_shift
threshold_crossing

PacketBTC_MACRO_MOVEMENT_SIGNAL

GitHub Security Remediation Pressure

Repository has elevated remediation pressure based on vulnerabilities, exploit likelihood, and operational activity.

Firehoses

GitHub security alerts
CISA KEV
FIRST EPSS

Primitives

entity_cluster_ranking
severity_label_mapping
multi_source_confirmation
evidence_fusion

PacketREPOSITORY_REMEDIATION_PRESSURE

Formula library

Common formulas and their use

Primitive	Formula / Logic	Output	Common use
delta	current - prior	delta	Track movement between observations.
percent_change	((current - prior) / prior) * 100	percent	Compare movement across scales.
z_score	(value - mean) / stddev	z	Detect anomalies vs. baseline.
rolling_count	count(events in window)	count	Volume-based triggers.
moving_average	avg(values in window)	avg	Smooth noisy series.
percentile_rank	rank(value) / count(values)	percentile	Position a value within a cohort.
threshold_crossing	abs(value) >= threshold	boolean	Bounded decision gates.
lead_lag_window	pearson(a[t], b[t + lag])	correlation	Detect causal order between signals.
geo_distance	haversine(lat1, lon1, lat2, lon2)	kilometers	Proximity to a tracked asset.
entity_cluster_score	weighted_sum(features_i)	score	Rank entities for attention.
confidence_score	agreement * recency * provenance_weight	0..1	Govern packet drafting.
dedupe_key	hash(entity + decision_type + window)	key	Prevent packet spam.

Lifecycle

Agent Task Packet lifecycle

01
Firehose Evidence
02
Primitive Evaluation
03
Signal Decision
04
Packet Candidate
05
Draft Packet
06
Agent Dispatch

Primitives create evidence-backed candidate decisions.
Governance controls whether packets are drafted or dispatched.
Disabled watches do not dispatch.
Deduplication prevents repeated packet spam.