> ## Documentation Index
> Fetch the complete documentation index at: https://docs.heretic.quest/llms.txt
> Use this file to discover all available pages before exploring further.

# Heretic Signal Reference: IDs, Evidence Families, and Tiers

> Complete reference for Heretic signal IDs. Each signal belongs to an evidence family and carries a tier that determines how it contributes to a verdict.

Signals are the atomic unit of evidence in Heretic. Every signal has a stable ID, an evidence family, a tier that determines how much weight it carries, and a human-readable headline that surfaces in the `explain` endpoint response. When Heretic evaluates a session, it collects signals across up to six families and combines them into a single verdict.

## Signal ID format

Signal IDs follow the pattern `family-prefix.descriptor` — for example, `geo.rtt-below-vacuum`. The prefix maps to the evidence family that produced the signal, and the descriptor names the specific contradiction or observation. Because signal IDs are stable, you can safely key policy rules on them without worrying about renaming between releases.

## Signal catalogue

The table below lists every signal currently in the catalogue. The **Tier** column tells you how the signal contributes to a verdict: an `absolute` signal is sufficient on its own; `composite` signals are strong but benefit from corroboration; `conditional` signals apply only when supporting context is present; `weak` signals contribute but never dominate.

| Signal ID                      | Family             | Tier        | Description                                                    |
| ------------------------------ | ------------------ | ----------- | -------------------------------------------------------------- |
| `geo.rtt-below-vacuum`         | `network-geometry` | composite   | RTT is below the speed-of-light floor for the claimed location |
| `stack.os-contradiction`       | `transport-stack`  | composite   | TCP SYN fingerprint contradicts the claimed OS                 |
| `reach.no-quic-attempt`        | `transport-stack`  | composite   | UDP is blocked or absent despite claimed browser QUIC support  |
| `compute.cores-exceed-claim`   | `compute`          | composite   | Measured parallelism exceeds the declared core count           |
| `identity.same-origin-cluster` | `render`           | conditional | Device fingerprint clusters with a known same-origin group     |
| `tls.group-disagreement`       | `tls-construction` | composite   | TLS group negotiation contradicts the claimed browser          |

## Evidence families

Each signal belongs to one of six evidence families. Heretic reads families independently so that a spoofed value in one family cannot suppress a contradiction detected in another.

| Family             | What it measures                                                           |
| ------------------ | -------------------------------------------------------------------------- |
| `network-geometry` | Round-trip timing versus physical distance constraints                     |
| `transport-stack`  | TCP SYN options, OS fingerprint, and QUIC reachability                     |
| `tls-construction` | TLS ClientHello structure and group negotiation                            |
| `compute`          | CPU parallelism, microarchitecture, and GPU output                         |
| `render`           | Canvas, audio, and device clustering via the collector                     |
| `declared`         | Navigator, screen, locale, and `userAgentData` — read as claims, not facts |

## Signal tiers

| Tier          | Behaviour                                                                           |
| ------------- | ----------------------------------------------------------------------------------- |
| `absolute`    | Sufficient alone to produce a `contradicted` verdict                                |
| `composite`   | Strong; two composite signals from different families can make a verdict conclusive |
| `conditional` | Applies only when supporting context is present in the session                      |
| `weak`        | Contributes to the overall picture but never drives a verdict alone                 |

<Info>
  The `tier` field in every API response tells you the tier for each signal present in that session. You can read it at `session.signals[n].tier`.
</Info>

<Tip>
  Two composite signals from **different** families carry more weight than two composite signals from the same family. Cross-family corroboration is the fastest path to a conclusive verdict.
</Tip>

<Note>
  The signal catalogue may expand as new measurement techniques are added. Signal IDs are stable and safe to key policy rules on — existing IDs will not be renamed or removed.
</Note>


## Related topics

- [Heretic Pricing: Apostate, Heretic, and Inquisition Tiers](/reference/pricing.md)
- [Enforce Traffic Policy Using Heretic Verdicts and Signals](/integration/policy-enforcement.md)
- [Read and Interpret Heretic Explain Endpoint Responses](/integration/reading-verdicts.md)
- [Heretic FAQ: Integration, Verdicts, Privacy, and Access](/reference/faq.md)
- [GET /e Explain Endpoint: Full Request and Response Reference](/api/explain-endpoint.md)