> ## Documentation Index
> Fetch the complete documentation index at: https://docs.heretic.quest/llms.txt
> Use this file to discover all available pages before exploring further.

# Signal Tiers, Ruling Algebra, and Enforcement Policy

> Heretic signals belong to one of four tiers controlling verdict weight. Learn the ruling algebra and write proportionate enforcement policy.

Every signal Heretic emits belongs to one of four tiers — absolute, composite, conditional, or weak. The tier system exists for a single purpose: to prevent weak evidence from convicting. A signal that merely looks suspicious should never reach the same enforcement outcome as a signal that has no benign explanation. Before you write any enforcement policy against Heretic verdicts, you need to understand what each tier can and cannot prove, and why corroboration across different evidence families is the key to a conclusive ruling.

## The Four Tiers

### Absolute

An absolute signal has **no plausible benign explanation**. The observation it reports is physically or mathematically impossible if the client's claims are true. A single absolute signal is sufficient to set `conclusive: true` on its own — no corroboration from another family is required.

Absolute signals are rare by design. Heretic only promotes a signal to absolute tier after confirming that the observation cannot occur in any legitimate browser configuration, including unusual but valid hardware, network, or OS setups.

**Verdict contribution:** `contradicted` + `conclusive: true`, alone.

***

### Composite

A composite signal is strong evidence — it reflects a real contradiction that has no common innocent cause — but it acknowledges that any single measurement could theoretically be wrong due to an exotic configuration, a measurement artifact, or an edge case in the signal's model.

A composite signal is conclusive **only when corroborated by at least one other composite signal from a different evidence family**. Two composite signals from the same family do not corroborate each other.

**Verdict contribution:** `contradicted` + `conclusive: true`, only with cross-family corroboration. Alone, it produces `disputed`.

***

### Conditional

A conditional signal is worth acting on — it is the right basis for a CAPTCHA challenge, a rate-limit, or step-up authentication — but it **never contributes to a conclusive ruling**, regardless of how many conditional signals fire.

Common sources of conditional signals include network conditions that are anomalous but not physically impossible, browser configurations that are rare but legitimate, and behaviors that correlate strongly with automation without being definitive proof.

**Verdict contribution:** `disputed`. Never `conclusive: true`.

***

### Weak

A weak signal provides context only. It may raise your prior slightly in a manual review, but it should never drive an automated enforcement decision. Weak signals appear in the response under `signals` with `tier: "weak"` and are excluded from the verdict calculation entirely.

**Verdict contribution:** none. Context only.

***

## The Ruling Algebra at a Glance

| Tier        | Conclusive alone? | Conclusive with corroboration?    | Verdict without corroboration      |
| ----------- | ----------------- | --------------------------------- | ---------------------------------- |
| Absolute    | ✅ Yes             | —                                 | `contradicted`, `conclusive: true` |
| Composite   | ❌ No              | ✅ Yes (different family required) | `disputed`                         |
| Conditional | ❌ No              | ❌ No                              | `disputed`                         |
| Weak        | ❌ No              | ❌ No                              | Context only                       |

## Why the "Different Family" Corroboration Rule Matters

Requiring corroboration from a *different* evidence family is not an arbitrary strictness requirement — it closes a specific attack vector.

If two composite signals from the same family could combine to produce a conclusive verdict, a single exploit that compromises one layer of the stack (say, a TCP spoofing technique) could trigger multiple signals within `transport-stack` that all appear independent but share a common cause. The verdict would look corroborated when it is not.

By requiring signals from *different* families — for example, `network-geometry` and `transport-stack` — Heretic ensures that a conclusive ruling reflects independent evidence from independent measurement layers. An attacker would need to simultaneously manipulate the network physics layer *and* the kernel TCP fingerprint layer *and* produce consistent declared values across all three. That is a substantially harder constraint to satisfy.

<Note>
  This is the same principle that underlies multi-factor authentication. Two factors from the same category (two passwords) are not two factors. Two signals from the same family are not two independent pieces of evidence.
</Note>

## Recommended Actions by Tier

The following table maps each tier to the enforcement actions that are proportionate to its certainty level:

| Tier                     | `conclusive` | Recommended action                                        |
| ------------------------ | ------------ | --------------------------------------------------------- |
| Absolute                 | `true`       | **Block** — terminate the session, reject the request     |
| Composite (corroborated) | `true`       | **Block** — as above                                      |
| Composite (alone)        | `false`      | **Challenge** — CAPTCHA, step-up auth, friction           |
| Conditional              | `false`      | **Challenge or rate-limit** — monitor for escalation      |
| Weak                     | `false`      | **Monitor** — log for analyst review; no automated action |

<Warning>
  Blocking on `conclusive: false` is almost always wrong. A disputed verdict means the evidence points in one direction but has not crossed the proof threshold. Acting on it as if it had produces false positives at a rate that will frustrate legitimate users.
</Warning>

## The Five Heresies

Heretic's measurement design is governed by five core principles. **Principle iv** is directly relevant to tier policy:

> *Weak evidence never convicts.*

No accumulation of weak signals — no matter how many fire in a single session — can produce a `conclusive: true` verdict. This constraint is enforced in the ruling algebra, not left to policy configuration. You cannot override it.

The other four principles govern measurement independence, clock assumptions, declared-value trust, and refusal interpretation. They are reflected throughout the evidence family design.

## Reading Tiers in the API Response

Every signal in the `signals` array exposes its tier under the `tier` field:

```json theme={null}
{
  "signals": [
    {
      "id": "geo.rtt-below-vacuum",
      "tier": "composite",
      "headline": "RTT 2.1ms; light needs 27.4ms"
    },
    {
      "id": "stack.os-contradiction",
      "tier": "composite",
      "headline": "SYN by Linux 5.x; UA claims macOS 15"
    }
  ]
}
```

<Tip>
  Use the `tier` field in your logging pipeline to build dashboards that distinguish conclusive blocks from speculative challenges. Tracking the tier distribution of signals over time helps you calibrate your policy and spot shifts in attack patterns.
</Tip>

For the full list of signals and their tiers, see [Evidence Families](/concepts/evidence-families). For how tiers combine into verdicts, see [Understanding Heretic Verdicts](/concepts/verdicts).


## Related topics

- [Heretic Verdicts: Five Outcomes and the Conclusive Flag](/concepts/verdicts.md)
- [Enforce Traffic Policy Using Heretic Verdicts and Signals](/integration/policy-enforcement.md)
- [How Heretic Measures Browser Integrity with Physics](/how-it-works.md)
- [Heretic: Physics-Based Browser Intelligence Platform](/introduction.md)
- [Heretic Signal Reference: IDs, Evidence Families, and Tiers](/reference/signals.md)