Live catalog of the operators Signal Fabric uses to turn firehose evidence into governed Signal Decisions and Agent Task Packet candidates. This list refreshes from the runtime registry — newly promoted primitives appear automatically.
Primitives do not invent evidence. They operate only on observed Signal Fabric firehose rows, normalized fields, timestamps, provenance, and configured thresholds.
Detects private OT/ICS or industrial protocol endpoints communicating with public IP space.
Runtime executor
sfOtPublicExposurePacketCandidates
Packet task type
investigate_ot_public_exposure
Dispatch behavior
eligible_packet_candidate
Runtime bindings
24 firehoses
Semantic capabilities
network_boundary_exposure
ot_protocol_context
public_private_ip_classification
network_relationship_context
Evidence roles
network_relationship_evidence
application_protocol_context
asset_exposure_evidence
asset_proximity_risk
Asset / Weather / Disaster Proximity
staticproductionruntime_available
Correlates customer reference assets or locations with nearby weather, disaster, seismic, water, wildfire, climate, emergency, or other geo-coded operational events.
Runtime executor
sfAssetProximityRiskPacketCandidates
Packet task type
investigate_asset_proximity_risk
Dispatch behavior
eligible_packet_candidate
Runtime bindings
115 firehoses
Semantic capabilities
geo_proximity_context
customer_reference_context
environmental_hazard_context
asset_location_context
Evidence roles
customer_asset_context
external_event_context
geo_proximity_evidence
boundary_exposure_repeated
Repeated Boundary Exposure
staticproductionruntime_available
Detects repeated relationships crossing private/public network boundaries, including repeated exposure of the same private asset.
Runtime executor
sfUniversalSemanticPacketCandidates
Packet task type
investigate_boundary_exposure
Dispatch behavior
eligible_packet_candidate
Runtime bindings
32 firehoses
Semantic capabilities
relationship_recurrence
boundary_exposure_context
asset_exposure_ranking
public_private_ip_classification
Evidence roles
relationship_evidence
boundary_classification
recurrence_context
rare_relationship_observed
Rare Or First-Seen Relationship
staticproductionruntime_available
Detects low-occurrence or first-seen relationships suitable for novelty, emergence, and route discovery workflows.
Runtime executor
sfUniversalSemanticPacketCandidates
Packet task type
investigate_rare_relationship
Dispatch behavior
eligible_packet_candidate
Runtime bindings
37 firehoses
Semantic capabilities
novelty_detection
relationship_rarity
route_emergence
first_seen_context
Evidence roles
relationship_evidence
rarity_context
first_seen_relationship_operator
First-Seen Relationship Operator
staticproductionruntime_available
Detects the first observed relationship, route, counterparty, location, entity pairing, or categorical relationship in any typed event stream.
Runtime executor
sfUniversalSemanticPacketCandidates
Packet task type
investigate_first_seen_relationship
Dispatch behavior
eligible_packet_candidate
Runtime bindings
22 firehoses
Semantic capabilities
first_seen_context
relationship_rarity
route_emergence
novelty_detection
Evidence roles
relationship_evidence
first_seen_context
rarity_context
numeric_delta_movement_operator
Numeric Delta / Movement Operator
staticproductionruntime_available
Computes movement, delta, rate, or threshold crossing over a numeric measure in a typed event stream.
Runtime executor
sfUniversalSemanticPacketCandidates
Packet task type
investigate_numeric_delta_movement
Dispatch behavior
eligible_packet_candidate
Runtime bindings
88 firehoses
Semantic capabilities
network_movement_context
numeric_movement
delta_movement
threshold_crossing
rate_of_change
Evidence roles
numeric_measurement_context
movement_evidence
threshold_context
forecast_curve_material_shift
Forecast Curve Material Shift
staticproductionruntime_available
Detects a material change in a forecast curve horizon or tenor, expressed in basis points, and emits a governed packet candidate when the configured threshold is crossed.
Runtime executor
sfForecastCurveMaterialShiftPacketCandidates
Packet task type
investigate_forecast_curve_shift
Dispatch behavior
eligible_packet_candidate
Runtime bindings
23 firehoses
Semantic capabilities
forecast_curve_context
prediction_context
delta_movement
threshold_crossing
rate_forecast_validation_context
Evidence roles
forecast_curve_context
prediction_state_context
threshold_context
rate_forecast_validation_context
time_of_use_load_shift_window_operator
Time-of-Use Load Shift Window Operator
staticproductionruntime_available
Scores candidate operating windows from demand forecast, actual demand feedback, power price, and weather pressure so a backend watch can recommend when to shift load before a high-cost or high-stress period.
Runtime executor
sfUniversalSemanticPacketCandidates
Packet task type
investigate_time_of_use_load_shift_window
Dispatch behavior
eligible_packet_candidate
Runtime bindings
0 firehoses
Semantic capabilities
time_of_use_load_shift
price_load_weather_window_scoring
demand_forecast_context
actual_load_feedback
power_price_context
weather_load_correlation
packet_dispatch_gating
Evidence roles
day_ahead_demand_forecast
actual_grid_load
real_time_energy_price
outside_temperature_forecast
weather_pressure_context
packet_dispatch_economics
micro_neural_temperature_forecast_v2
Micro Neural Temperature Forecast V2
staticproductionruntime_available
Learns tenant-, facility-, zone-key-, and horizon-specific temperature forecasts from governed sensor observations, current weather conditions, outside forecast pressure, and scored residual feedback, then emits immutable forecast and score rows for pre-cooling decisions.
Runtime executor
sfBackendGovernedForecastRows
Packet task type
investigate_micro_neural_temperature_forecast_v2
Dispatch behavior
eligible_packet_candidate
Runtime bindings
0 firehoses
Semantic capabilities
micro_neural_forecast
thermal_forecast_context
prediction_validation_context
zone_key_residual_learning
facility_specific_learning
horizon_specific_learning
weather_context_correlation
current_conditions_correlation
threshold_crossing
Evidence roles
time_field
entity_field
numeric_measurement_context
forecast_context
model_output_context
prediction_score_context
recurrence_dedupe_window_operator
Recurrence / Dedupe Window Operator
staticproductionruntime_available
Detects repeated occurrences of a signal inside a bounded time window and emits a stable dedupe key for governed decisions.
Runtime executor
sfUniversalSemanticPacketCandidates
Packet task type
investigate_recurring_signal
Dispatch behavior
eligible_packet_candidate
Runtime bindings
64 firehoses
Semantic capabilities
relationship_recurrence
dedupe_context
signal_repetition
bounded_window_state
Evidence roles
recurrence_context
dedupe_context
signal_object_context
fanout_expansion_operator
Fan-Out / Expansion Operator
staticproductionruntime_available
Detects one entity expanding across many counterparties, resources, ports, facilities, regions, prefixes, or other distinct targets.
Runtime executor
sfUniversalSemanticPacketCandidates
Packet task type
investigate_fanout_expansion
Dispatch behavior
eligible_packet_candidate
Runtime bindings
51 firehoses
Semantic capabilities
fanout_expansion
distinct_counterparty_count
cluster_context
entity_ranking
Evidence roles
cluster_context
relationship_evidence
entity_ranking_context
sequence_correlation_operator
Ordered / Unordered Sequence Correlation Operator
staticproductionruntime_available
Correlates ordered or unordered event steps for the same entity, region, route, or asset inside a bounded time window.
Runtime executor
sfUniversalSemanticPacketCandidates
Packet task type
investigate_sequence_correlation
Dispatch behavior
eligible_packet_candidate
Runtime bindings
83 firehoses
Semantic capabilities
sequence_correlation
time_window_correlation
multi_signal_correlation
entity_context
Evidence roles
time_window_correlation
sequence_context
entity_context
registry_indicator_match_operator
Registry / Indicator Match Operator
staticproductionruntime_available
Matches event values against an external registry, reference dataset, threat list, asset list, watchlist, or domain-specific catalog with provenance and confidence.
Runtime executor
sfUniversalSemanticPacketCandidates
Packet task type
investigate_registry_indicator_match
Dispatch behavior
eligible_packet_candidate
Runtime bindings
2 firehoses
Semantic capabilities
registry_match
reference_dataset_match
indicator_context
provenance_context
Evidence roles
reference_context
indicator_context
provenance_context
spatial_proximity_operator
Spatial Proximity Operator
staticproductionruntime_available
Correlates entities, assets, facilities, regions, or observations by distance, radius, containment, or shared geographic context.
Runtime executor
sfUniversalSemanticPacketCandidates
Packet task type
investigate_spatial_proximity
Dispatch behavior
eligible_packet_candidate
Runtime bindings
66 firehoses
Semantic capabilities
spatial_proximity
geo_proximity_context
asset_location_context
regional_correlation
Evidence roles
geo_proximity_evidence
location_context
asset_location_context
geospatial_containment_filter_operator
Geospatial Containment Filter Operator
staticproductionruntime_available
Resolves and filters point observations against versioned country, administrative-region, operational-region, customer polygon, bounding-box, or radius geometry without confusing source nationality metadata with current location.
Runtime executor
sfUniversalSemanticPacketCandidates
Packet task type
investigate_geospatial_containment_match
Dispatch behavior
eligible_packet_candidate
Runtime bindings
0 firehoses
Semantic capabilities
point_in_polygon
country_containment
administrative_region_containment
operational_region_containment
bounding_box_filter
radius_filter
versioned_boundary_lineage
Evidence roles
geospatial_scope_evidence
country_context
regional_context
boundary_reference_context
categorical_attribute_filter_operator
Categorical Attribute Filter Operator
staticproductionruntime_available
Applies governed exact, allow-list, deny-list, prefix, and normalized category filters to typed stream attributes.
Runtime executor
sfUniversalSemanticPacketCandidates
Packet task type
investigate_categorical_attribute_match
Dispatch behavior
eligible_packet_candidate
Runtime bindings
0 firehoses
Semantic capabilities
categorical_filter
enum_filter
allowlist_filter
denylist_filter
identity_filter
Evidence roles
categorical_attribute_context
entity_identity_context
filter_policy_context
numeric_range_filter_operator
Numeric Range Filter Operator
staticproductionruntime_available
Filters typed numeric observations by governed minimum, maximum, inclusive/exclusive bounds, units, and missing-value policy.
Runtime executor
sfUniversalSemanticPacketCandidates
Packet task type
investigate_numeric_range_match
Dispatch behavior
eligible_packet_candidate
Runtime bindings
0 firehoses
Semantic capabilities
numeric_range_filter
unit_aware_threshold
bounded_measurement_filter
circular_heading_range
Evidence roles
numeric_measurement_context
range_policy_context
unit_context
trajectory_change_operator
Trajectory Change Operator
staticproductionruntime_available
Detects governed changes in position, altitude, heading, speed, or vertical rate for the same entity across ordered observations.
Runtime executor
sfUniversalSemanticPacketCandidates
Packet task type
investigate_trajectory_change
Dispatch behavior
eligible_packet_candidate
Runtime bindings
0 firehoses
Semantic capabilities
trajectory_change
heading_delta
altitude_delta
speed_delta
vertical_rate_change
region_entry_exit
Evidence roles
trajectory_context
movement_change_context
ordered_entity_state
observation_freshness_operator
Observation Freshness Operator
staticproductionruntime_available
Evaluates event, contact, position, and ingest timestamps against a governed freshness threshold and distinguishes stale evidence from absent evidence.
Runtime executor
sfUniversalSemanticPacketCandidates
Packet task type
investigate_stale_observation
Dispatch behavior
eligible_packet_candidate
Runtime bindings
0 firehoses
Semantic capabilities
observation_freshness
position_freshness
ingest_latency
stale_evidence_detection
missing_evidence_classification
Evidence roles
freshness_context
data_quality_context
runtime_health_context
baseline_deviation_operator
Baseline Deviation Operator
staticproductionruntime_available
Detects a numeric, categorical, or count signal departing from historical, rolling, seasonal, peer, or configured baseline expectations.
Runtime executor
sfUniversalSemanticPacketCandidates
Packet task type
investigate_baseline_deviation
Dispatch behavior
eligible_packet_candidate
Runtime bindings
87 firehoses
Semantic capabilities
baseline_deviation
anomaly_context
threshold_crossing
rate_of_change
Evidence roles
baseline_context
numeric_measurement_context
threshold_context
lead_lag_correlation_operator
Lead / Lag Correlation Operator
staticproductionruntime_available
Detects when one signal leads, follows, predicts, or reacts to another signal across a defined lag window and shared entity, region, asset, or relationship key.
Runtime executor
sfUniversalSemanticPacketCandidates
Packet task type
investigate_lead_lag_correlation
Dispatch behavior
eligible_packet_candidate
Runtime bindings
89 firehoses
Semantic capabilities
lead_lag_correlation
time_window_correlation
multi_signal_correlation
prediction_context
Evidence roles
time_window_correlation
multi_signal_context
prediction_context
multi_source_confirmation_operator
Multi-Source Confirmation Operator
staticproductionruntime_available
Requires two or more independent firehoses, sources, providers, or evidence classes to confirm the same entity, region, event, or risk condition.
Runtime executor
sfUniversalSemanticPacketCandidates
Packet task type
investigate_multi_source_confirmation
Dispatch behavior
eligible_packet_candidate
Runtime bindings
85 firehoses
Semantic capabilities
multi_source_confirmation
source_agreement
evidence_fusion
provenance_context
Evidence roles
source_confirmation_context
provenance_context
multi_signal_context
global_conflict_escalation_probability_v1
Global Conflict Escalation Probability Primitive
staticproductionruntime_available
Estimates the probability that a governed region will enter a materially elevated military-conflict state within 24 hours, requiring corroboration from at least two independent evidence families before a review packet is eligible.
Runtime executor
sfPrimitiveRuntimeEvaluateWatchPredictions
Packet task type
review_regional_conflict_escalation
Dispatch behavior
eligible_packet_candidate
Runtime bindings
0 firehoses
Semantic capabilities
regional_conflict_probability
multi_family_corroboration
commercial_aviation_change
military_support_aviation_change
commercial_airspace_volume_anomaly
media_convergence
communications_disruption
maritime_activity_change
Evidence roles
aviation_activity_context
commercial_airspace_volume_context
media_conflict_context
communications_disruption_context
maritime_activity_context
regional_escalation_context
source_disagreement_operator
Source Disagreement Operator
staticproductionruntime_available
Detects when two or more sources disagree, diverge, conflict, or materially differ for the same entity, region, measurement, or assertion.
Runtime executor
sfUniversalSemanticPacketCandidates
Packet task type
investigate_source_disagreement
Dispatch behavior
eligible_packet_candidate
Runtime bindings
55 firehoses
Semantic capabilities
source_disagreement
evidence_conflict
provenance_context
quality_control_context
Evidence roles
source_disagreement_context
provenance_context
quality_control_context
confidence_weighted_evidence_fusion_operator
Confidence-Weighted Evidence Fusion Operator
staticproductionruntime_available
Combines multiple pieces of evidence using confidence, severity, provenance, recency, and source weighting to produce a ranked decision strength.
Runtime executor
sfUniversalSemanticPacketCandidates
Packet task type
investigate_confidence_weighted_evidence
Dispatch behavior
eligible_packet_candidate
Runtime bindings
53 firehoses
Semantic capabilities
confidence_weighted_evidence_fusion
confidence_context
severity_context
provenance_context
decision_strength
Evidence roles
confidence_context
severity_context
provenance_context
decision_strength_context
suppression_allowlist_operator
Suppression / Allowlist Operator
staticproductionruntime_available
Applies governed suppressions, allowlists, known-benign references, maintenance windows, or policy exclusions before automation dispatch.
Runtime executor
sfUniversalSemanticPacketCandidates
Packet task type
apply_suppression_allowlist
Dispatch behavior
eligible_packet_candidate
Runtime bindings
69 firehoses
Semantic capabilities
suppression_context
allowlist_context
governance_override
policy_exclusion
Evidence roles
suppression_context
governance_context
policy_context
severity_escalation_operator
Severity Escalation Operator
staticproductionruntime_available
Detects worsening severity, score, confidence, risk level, or impact class over time and projects when escalation should occur.
Runtime executor
sfUniversalSemanticPacketCandidates
Packet task type
investigate_severity_escalation
Dispatch behavior
eligible_packet_candidate
Runtime bindings
58 firehoses
Semantic capabilities
severity_escalation
risk_level_change
score_trend
impact_worsening
Evidence roles
severity_context
score_context
escalation_context
entity_cluster_ranking_operator
Entity Cluster Ranking Operator
staticproductionruntime_available
Ranks top entities, regions, assets, routes, principals, prefixes, or counterparties by count, score, movement, exposure, severity, or grouped evidence strength.
Runtime executor
sfUniversalSemanticPacketCandidates
Packet task type
investigate_entity_cluster_ranking
Dispatch behavior
eligible_packet_candidate
Runtime bindings
72 firehoses
Semantic capabilities
entity_cluster_ranking
top_n_ranking
cluster_context
entity_aggregation
Evidence roles
entity_ranking_context
cluster_context
aggregation_context
lateral_escalation_pressure
Lateral Escalation Pressure
staticproductionruntime_available
Ranks internal entities by investigator escalation pressure using escalation outcomes, severity, recurrence, and detection volume.
Runtime executor
sfUniversalSemanticPacketCandidates
Packet task type
investigate_lateral_escalation_pressure
Dispatch behavior
eligible_packet_candidate
Runtime bindings
5 firehoses
Semantic capabilities
cyber_network_detection_response
investigator_outcome_context
severity_escalation
entity_ranking
Evidence roles
investigator_outcome_context
detection_context
escalation_context
investigator_detection_cluster
Investigator Detection Cluster
staticproductionruntime_available
Groups investigator detections by internal entity, route, category, or risk type and ranks the strongest clusters for charts and packet candidates.
Runtime executor
sfUniversalSemanticPacketCandidates
Packet task type
investigate_detection_cluster
Dispatch behavior
eligible_packet_candidate
Runtime bindings
5 firehoses
Semantic capabilities
cyber_network_detection_response
investigator_outcome_context
entity_cluster_ranking
detection_context
Evidence roles
investigator_outcome_context
detection_context
entity_ranking_context
missing_evidence_to_adapter_request_operator
Missing Evidence To Adapter Request Operator
staticproductionruntime_available
Turns an unsatisfied capability or missing source into a governed adapter/source-integration request with provenance, field contract, and readiness state.
Runtime executor
sfRecordPrimitiveGap
Packet task type
prepare_adapter_request
Dispatch behavior
eligible_packet_candidate
Runtime bindings
0 firehoses
Semantic capabilities
missing_evidence_detection
adapter_request_context
firehose_acquisition_context
governance_context
Evidence roles
missing_evidence_context
adapter_request_context
governance_context
attribute_drift_observed
Entity Attribute Drift
staticproductionruntime_available
Detects an entity or relationship changing important contextual attributes such as protocol, category, severity, family, or event type.
Runtime executor
sfUniversalSemanticPacketCandidates
Packet task type
investigate_attribute_drift
Dispatch behavior
eligible_packet_candidate
Runtime bindings
37 firehoses
Semantic capabilities
entity_attribute_change
protocol_drift
category_drift
contextual_identity_change
Evidence roles
entity_context
attribute_history
drift_context
gdelt_country_cyber_volume_tone_anomaly
Country Cyber Media Volume / Tone Anomaly
staticpromotedruntime_available
Aggregates GDELT cyber-topic articles into complete country time buckets, scores robust article-volume deviation from each country's recent baseline, and uses tone only when a genuine provider tone field is present. The result is media-attention context for human review, not proof of a cyber incident.
Runtime executor
fabrico_gdelt_country_cyber_anomaly_v1
Packet task type
review_country_cyber_media_anomaly
Dispatch behavior
eligible_packet_candidate
Runtime bindings
0 firehoses
Semantic capabilities
country_time_bucket_aggregation
robust_baseline_deviation
lineage_preservation
optional_provider_tone
cyber_media_context
media_attention_context
provenance_context
Evidence roles
cyber_media_context
media_attention_context
provenance_context
network_first_seen_route
Network First SEEN Route
staticpromotedruntime_available
Promoted Signal Fabric primitive contract for Network First SEEN Route.
Promoted Signal Fabric primitive contract for Threat IOC Network Correlation.
Runtime executor
sfUniversalSemanticPacketCandidates
Packet task type
investigate_threat_ioc_network_correlation
Dispatch behavior
eligible_packet_candidate
Runtime bindings
12 firehoses
Semantic capabilities
cyber_ioc_indicator_context
cyber_network_detection_response
cyber_ioc_indicator_context
cyber_network_detection_response
Evidence roles
cyber_ioc_indicator_context
cyber_network_detection_response
Decision Lifecycle Only
7 primitives
adaptive_micro_forecast_primitive_blueprint
Adaptive Micro Forecast Primitive Blueprint
staticproductionruntime_available
Design blueprint for new governed micro-forecast primitives when a thesis asks for prediction in a domain that does not already have a production primitive. Builders should use it to propose backend primitive work, runtime ledgers, scoring rows, and semantic bindings rather than inventing predictions in app code.
Aircraft Identity and Operator Classification Operator
staticproductionruntime_available
Resolves human-readable aircraft make, model, role, operator name, and governed operator class from aircraft type, callsign designator, registration context, and documented provider database flags.
Runtime executor
sfEnrichAircraftIdentity
Packet task type
inspect_aircraft_identity_classification
Dispatch behavior
decision_lifecycle_only
Runtime bindings
0 firehoses
Semantic capabilities
aircraft_type_registry_resolution
aircraft_role_resolution
icao_operator_designator_resolution
operator_type_classification
classification_confidence_and_basis
Evidence roles
aircraft_identity_context
aircraft_type_context
aircraft_operator_context
operator_classification_context
leaflet_geospatial_artifact_repair_operator
Leaflet Geospatial Artifact Repair and Verification Operator
staticproductionruntime_available
Applies the governed Leaflet asset, tile-grid, responsive sizing, resize invalidation, and zoom-control contract to Signal Fabric application artifacts before browser acceptance and publication.
Runtime executor
repairLeafletArtifact
Packet task type
verify_leaflet_geospatial_artifact
Dispatch behavior
decision_lifecycle_only
Runtime bindings
0 firehoses
Semantic capabilities
leaflet_asset_integrity
leaflet_tile_grid_normalization
leaflet_resize_invalidation
leaflet_zoom_control_assurance
geospatial_artifact_browser_verification
Evidence roles
application_artifact_context
geospatial_rendering_context
browser_acceptance_context
prediction_deduped
Prediction Deduped
staticproductionruntime_available
Lifecycle decision emitted when Fabric recognizes an already-seen eligible detection or prediction inside the dedupe window.
Runtime executor
sfIntentEvaluateWatch
Packet task type
none
Dispatch behavior
decision_lifecycle_only
Runtime bindings
115 firehoses
Semantic capabilities
decision_lifecycle
dedupe_context
Evidence roles
dedupe_context
signal_object_context
agent_packet_created
Agent Task Packet Created
staticproductionruntime_available
Lifecycle event emitted when Fabric creates a governed Agent Task Packet from an eligible primitive candidate.
Runtime executor
sfIntentWatchMaybeCreatePacket
Packet task type
lifecycle
Dispatch behavior
decision_lifecycle_only
Runtime bindings
115 firehoses
Semantic capabilities
packet_lifecycle
governed_agent_task_packet
Evidence roles
packet_context
signal_object_context
governed_semantic_binding_compiler
Governed Semantic Binding Compiler
staticpromotedruntime_available
Reads a live firehose manifest and bounded observations, infers evidence-backed semantic field roles, persists a schema-versioned binding receipt without raw values, and resumes the compatible governed capability compiler.
Runtime executor
fabrico_governed_semantic_binding_v1
Packet task type
investigate_governed_semantic_binding_compiler
Dispatch behavior
decision_lifecycle_only
Runtime bindings
177 firehoses
Semantic capabilities
manifest_inspection
bounded_observation_profiling
semantic_field_role_inference
schema_versioned_binding_persistence
capability_build_resume
public_private_direction_classification
Public Private Direction Classification
staticpromotedruntime_available
Promoted Signal Fabric primitive contract for Public Private Direction Classification.