MoridainDefense — Operator-Endpoint Alert Triage

Each of the 12 raw signal dimensions contributes a bounded amount to the alert score — by construction, no single signal can elevate an alert into the operator's top-of-queue on its own. A spoofed watchlist match, a stuck geofence sensor, or a noisy SIGINT channel cannot dominate the rank. Promotion to the operator's review list requires multi-signal corroboration. The score-vs-input function is provably bounded; the certification analysis for the prioritizer is one paragraph rather than a labeled-data ML audit.

Signals enter log-space normalized so a 10× watchlist match and a 10× SIGINT spike are comparable on the same axis. The consequence band of the candidate observation is a built-in integer field — the order-of-magnitude bin — used directly as the top-level rank. The priority queue is consequence × probability, not a learned weighting that drifts when the operating environment changes. There is no model to retrain when the AO shifts.

The handoff to the operator's device is a 17-byte bounded packet per alert (alert_id 4 B · score 2 B · consequence 1 B · n_contributing 1 B · top-3 provenance 9 B). 5.6× smaller than the raw float64 feature vector. When the per-role projection layer is enabled, the same packet ships with an optional 2-byte AO tag side-band (cell_id), bringing the wire footprint to 19 B; non-projection endpoints still get the 17 B base packet unchanged. The device runs a streaming top-K heap on the score field — 13 ops per alert, 891 bytes of memory at K = 10, no model weights, no calibration tables, no floating-point math. Heavy lifting on the mainframe; the device is just a renderer.

The mainframe broadcasts the same global packet stream. Each operator endpoint carries a tiny static role/AO profile — a 32-byte integer table (4 B header · 12 i8 signal-affinity weights in {-1, 0, +1} · 64-bit AO bitmap matching the alert's coarse cell_id · 8 B reserved). The device decodes the 19-byte (packet + AO tag) stream and applies a bounded local re-rank: each profile entry contributes at most one consequence-band of shift and the total shift is clipped to ±1 cons-band, so the consequence band itself remains the dominant axis. The strike pilot's queue downranks the city ground-pattern alert that's #1 for the SOF team in that block; the SOF team's queue downranks the high-altitude SIGINT pattern that drives the pilot's #1; the ship CIC sees the maritime contact the pilot and SOF team don't need. Severe-band (consequence 5) alerts — a SAM activation in the strike pilot's ingress corridor, a high-consequence ground threat in the SOF team's exfil route, a missile-launch warning the ship and the air-ops cell both need — are pinned at effective cons-5 in every role's local view by structural construction, and a 3-key sort (effective cons · original cons · score) guarantees a true cons-5 outranks any cons-≤4 alert that profile-bumps to effective cons-5. The 8-seed sweep across all four roles gives a cons-5 cross-cuing rate of 1.000 (every wire-band-5 alert surfaced in every role's top-K) and a deterministic 16-of-16 PASS on the cons-5 injection test. No model, no learned weights, no per-AO retraining; the profile is a static integer config set at provisioning, 32 bytes per endpoint.