Glossary
Each term links to the section that defines it.
| Term | Short definition | Defined in |
|---|---|---|
| Admin | The person who decides, sends and publishes. | FM-1.4, FM-2.4 |
| Affected operator | The organisation running a targeted host. | FM-1.4 |
| Agent | A system in which a model chooses actions toward a goal. | FM-1.2 |
| Agent grade | How likely an agent, not a person or a tool, sent a cluster's requests: L0 to L5. | FM-7.10 |
| Artifact family | A class of build traces, such as model-output residue. | FM-4.5 |
| Attribution label | Confirmed, Suspected, Possible or Unattributed. | FM-7.7 |
| Attribution layer | Developer and operator, hosting, harness, model family. | FM-7.1 |
| Benchmark target | A public site or environment built to be tested against. | FM-4.9 |
| Burst | Many records each seconds after the last. | FM-6.2 |
| Calibration rule | A public likelihood word no stronger than the lower bound of measured precision. | FM-9.12 |
| Candidate fleet | Clusters joined by soft links, awaiting a decision. | FM-1.3, FM-5.8 |
| Case | The private working file for one incident. | FM-1.4, FM-10.8 |
| Claim tag | Observed, Documented, Inference or Conclusion. | FM-7.6 |
| Cluster | Records joined by hard links. | FM-1.3 |
| Commonness cap | The limit above which a link feature only soft-links. | FM-5.2 |
| Competing hypotheses | The worksheet that marks evidence against each explanation. | FM-7.12 |
| Confidence level | High, moderate or low: the basis for a judgment. | FM-8.2 |
| Context cap | Context kinds alone never reach the suggestive threshold. | FM-4.11 |
| Context kind | A rule kind ordinary clients produce: relay, cache buster, self-identification, header, outcome. | FM-4.11, FM-5.3 |
| Campaign | Many senders on one site holding one habit set that senders elsewhere seldom hold together, beyond chance; a soft link. | FM-5.25 |
| Co-group | Three or more clusters all holding several rarely held sites or templates beyond a degree-preserving null; a soft link. | FM-5.22 |
| Co-target | Two clusters on the same rare targets in the same hours beyond chance; a soft link. | FM-5.16 |
| Corroboration | One kind of source, several, or confirmed in operator logs. | FM-5.11 |
| Declared testing | Request text announcing a test; checked, never believed. | FM-4.9, FM-10.6 |
| Dispatch tree | Interaction stars chained leader to follower: who set off whom; a hint. | FM-5.12 |
| Escalation sequence | The order in which tactics appear in a run or fleet. | FM-5.9 |
| Evidence level | A rung of the developer ladder, self_id to provider_confirmed. | FM-7.2 |
| False-merge rate | Share of predicted clusters spanning more than one true group. | FM-9.6 |
| Fleet | Clusters merged on evidence as one operator's agents. | FM-1.3 |
| Fleet key | FK- and 8 hex digits: a candidate fleet followed across watch runs. | FM-5.18 |
| Hard link | A link that joins records into a cluster. | FM-5.1 |
| Identifier generator | Two clusters whose fresh tags decode to one node id, worker, clock skew or counter; a soft link. | FM-5.23 |
| Incident | Confirmed agent activity that harms or risks an operator. | FM-1.4 |
| Independence group | Rules reading the same artifact, counted once per record. | FM-4.11 |
| Indicator | A rule that matches a feature of a record. | FM-1.2, FM-4.2 |
| Indicator notice | The first stage of a notice: indicators, no affected party named. | FM-10.2 |
| Interaction edge | A hint that two runs acted on each other's output; never a merge. | FM-4.10, FM-5.12 |
| Lead | A cluster or candidate fleet nobody has reviewed. | FM-1.4 |
| Likelihood word | A term from the ICD 203 table. | FM-8.1 |
| Link feature | A matched value one operator would hold. | FM-1.2, FM-5.2 |
| Misaligned | An agent present and out of scope, with no accepted alternative; in reports only with both recorded. | FM-15.1, FM-15.4 |
| Named fleet | A fleet with an identifier unique across cases, SCF-<n>. | FM-5.13 |
| Naming gate | The evidence threshold for naming a developer. | FM-7.8 |
| Naming lead | Working days before an affected operator is named: 3, or 10 if compromised. | FM-10.2 |
| Naming update | A dated update that names affected operators. | FM-10.2, FM-11.2 |
| Notice | The public page for one incident. | FM-1.4, chapter 11 |
| Onset group | Clusters of different clients all starting within minutes beyond chance; a hint. | FM-6.10 |
| Ordered co-target | Two concurrent clusters first touching shared rare hosts in one order beyond chance; a soft link. | FM-5.19 |
| Passivity test | The conditions every source must pass. | FM-3.2 |
| Pause | A gap long in absolute terms and against the median gap. | FM-6.2 |
| Plant signal | A sign a cluster's records were placed to be found. | FM-5.11 |
| Platform swarm candidate | Accounts acting alike on a public platform beyond chance; a hint, never a swarm. | FM-5.15 |
| Playbook | Two clusters sending one harness's steps in one order on their hosts beyond chance; a soft link. | FM-5.24 |
| Probe chain | One client trying variants of one request. | FM-5.4 |
| Prompt echo | Two clusters writing prose from one template beyond chance; a soft link. | FM-5.21 |
| Provenance | Who can create a record: observed, submit- or publish-anywhere. | FM-5.11 |
| Provider | The organisation whose agents are attributed. | FM-1.4 |
| Public record | A third-party trace of a request, published to anyone. | FM-3.1 |
| Published tag | A tag quoted in a public report; never a hard link. | FM-5.2, FM-14.5 |
| Record | A public trace of one request. | FM-1.2 |
| Relay stack | The chain of relays and carriers a request went through. | FM-4.5 |
| Rerun | A later run repeating an earlier run's targets in order. | FM-5.10 |
| Rhythm | A cluster's hour-of-day profile. | FM-6.4 |
| Run | Records of a cluster with no gap longer than the run gap. | FM-1.3, FM-5.5 |
| SC-T | The swarmchasing tactic ids, SC-T1 to SC-T9. | FM-4.3 |
| Scaffold lineage | Two clusters whose request templates are one part apart beyond chance; a soft link. | FM-5.20 |
| Scope finding | In scope, scope exceeded or not assessable. | FM-15.4 |
| Scope test | One of S1 to S7, each a way activity can exceed its task. | FM-15.3 |
| Seam | One record or client a cluster hangs on, joining two sides with nothing else in common; a plant signal. | FM-5.11 |
| Second review | Approval of the exact draft by a person other than the admin. | FM-10.9 |
| Shared pause | Two clusters going quiet together beyond chance. | FM-6.7 |
| Signed request | A request carrying a Web Bot Auth signature and Signature-Agent. | FM-7.11 |
| Spoofed identity | A declared agent product from outside its provider's complete published ranges, unsigned. | FM-7.13 |
| Soft link | A proposed link between clusters; never joins them. | FM-5.1, FM-5.7 |
| Stale date | A "today" tag well behind the observed date. | FM-6.6 |
| Stale knowledge | Retired endpoints or old clients a model still writes. | FM-4.5 |
| Strand | The records of one run sent one way (route, user agent, network, header set). | FM-5.12 |
| Swarm | A fleet with evidence its agents interact. | FM-1.3 |
| Target class | What kind of endpoint a request reached. | FM-15.2 |
| Task class | The evident purpose of a cluster's ordinary requests. | FM-15.2 |
| Tier | Significant, suggestive or noise. | FM-1.5 |
| Timestamp kind | Request, submit, capture or unknown. | FM-6.1 |
| Unsupervised | Activity continuing with no sign of a person checking it. | FM-15.1 |
| Wilson interval | The interval given with every proportion. | FM-9.5 |
Every section by id, with search
Source: docs/manual/glossary.md