Operators catalog

All operators register under the entry-point group cairn.operators and are addressed by capability name. Risk classes: read_only, external_write, production_mutation, paid_compute. The Default column is deliberately honest: it says when an operator samples, stubs, or no-ops without its optional extra — configure fail-closed where it matters (the production profile does this for the training gates).

Data & datasets

Capability	Purpose	Risk	Default behavior
data/profile	resolve a workflow’s data roles; PASS/DEGRADE/BLOCK verdict	read_only	real, deterministic
data/expectations	declarative data-quality suite (not_null, in_range, unique, regex, row_count)	read_only	real; pandera optional, built-in runner gives identical verdicts
dataset/format	JSONL/chat format readiness	read_only	real
dataset/dedup	exact + near-duplicate detection	read_only	exact always; MinHash near-dup needs the dedup extra
dataset/pii_scan	PII/secret density scan	read_only	samples 1,000 rows by default (sample_size=null scans all); Presidio backend with the pii extra, else regex
dataset/decontam	train/eval contamination overlap	read_only	exact matching by default; minhash/ngram optional
dataset/profile	token/length/field distributions	read_only	real
dataset/provenance	Croissant-style provenance record	read_only	real
dataset/gate	deterministic pass/warn/fail over findings	read_only	real, pure
dataset/prep_gate	post-scrub PII gate (verdict from residual PII + mode)	read_only	real, deterministic
dataset/prep_review	HITL review of a dirty scrub	read_only	requires approval — a durable gate fires before it runs
dataset/sample	deterministic sampler feeding eval/judge	read_only	real
dataset/anonymize	write an anonymized copy	external_write	real
dataset/split	group-aware / stratified splits	external_write	real
dataset/curate	LLM-judge quality selection	paid_compute	real — paid LLM calls through the governed gateway
dataset/synthesize · dataset/augment	generate / augment training rows	paid_compute	real LLM, non-deterministic
dataset/stage (train/stage-dataset)	upload the prepared dataset to S3 for a remote worker	external_write	real

Training

Capability	Purpose	Risk	Default behavior
train/stub	no-spend, no-GPU placeholder	read_only	a stub by design — fabricates a plausible result; the production profile’s model/gate rejects stub results
train/local	real LoRA SFT on CPU/MPS	read_only	real (transformers + peft + trl); needs the local extra
train/modal · train/kaggle · train/runpod · train/vast	GPU jobs on Modal / Kaggle / RunPod / Vast.ai	paid_compute	real remote jobs (each needs its extra); cancellable
remote/exec	run any command/job on an SSH box (the remote-GPU training path)	external_write	real; long-running with pause/poll/resume

Model lifecycle & compression

Capability	Purpose	Risk	Default behavior
model/register	promote a model into the registry	external_write	requires approval; local JSONL registry by default, MLflow when MLFLOW_TRACKING_URI is set
model/baseline	read the last registered version’s scores as the delta baseline	read_only	real
model/card · report/model_card	render a model card (the latter auditor-ready from provenance)	read_only	real, deterministic
model/merge	merge a LoRA adapter into a standalone model	read_only	real with the merge extra, hermetic stub without
lineage/record	content-addressed provenance record (hash-chained downstream)	read_only	real
compress/stub	GPU-free compression placeholder	read_only	stub by design
compress/quantize	real quantization (bitsandbytes)	read_only	real; returns status="error" on missing deps/GPU rather than pretending

Evaluation

Capability	Purpose	Risk	Default behavior
model/gate	deterministic post-training pass/warn/fail	read_only	real, pure — the fail-closed anchor of the training spine
eval/delta	vs-baseline verdict under a regression budget	read_only	real, pure
eval/subset	deterministic golden-subset scorer	read_only	real
model/eval	lm-eval-harness metrics	read_only	needs the harness extra, else no-ops with checked=false; GPU, long-running
eval/benchmark	public benchmarks (IFEval, GSM8K) on base + adapter	read_only	returns a deterministic stub score with checked=false when disabled, without the benchmark extra, or on harness error — gate on checked in production
eval/judge	LLM rubric judge (G-Eval)	read_only	off by default (enabled=false); advisory, never gates
rag/eval	retrieval-quality metrics	read_only	ragas judge metrics with the extra; otherwise deterministic lexical proxies flagged backend_used="lexical"
eval/langfuse	delegated eval in Langfuse	read_only	off by default; bypasses the governed gateway, output always marked governed=false

Serving & inference

Capability	Purpose	Risk	Default behavior
serve/vllm	launch an OpenAI-compatible vLLM endpoint (base + LoRA) on an SSH GPU box	paid_compute	real SSH deploy (needs the ssh extra + vLLM on the box); cancellable
infer/bench	latency/throughput load-test of any OpenAI-compatible endpoint	read_only	real concurrent HTTP measurement

Cost & compute planning

Capability	Purpose	Risk	Default behavior
compute/estimate	pre-flight cost/feasibility plan	read_only	real, deterministic heuristic
compute/quote	live GPU offers across providers (Vast, RunPod)	read_only	real network read; provisions nothing
cost/gate	spend/fit verdict before any GPU is provisioned	read_only	real, pure

Incident & observability

Capability	Purpose	Risk
clickstack/query_logs · query_traces · query_metrics · get_topology	read logs / traces / metrics / service topology from the bound backend	read_only
logs/summarize · traces/analyze	deterministic log/trace aggregation (polars-accelerated with the fast extra)	read_only
blast-radius/compute	impacted services + measured errors across the call graph	read_only
git/correlate	tie error onset to the causing deploy	read_only
postmortem/write_file	persist the post-mortem markdown	external_write

Substrate service providers

These back the engine’s cross-cutting services via profile bindings:

Binding	Builtin default	Official swap-in
storage.put / storage.get	local filesystem	S3/MinIO (s3/put, s3/get)
audit.sink	audit/store — hash-chained JSONL	(richer sinks swap the binding)
memory.search / memory.write	SQLite-vec local memory	—
rag.search / rag.fetch / rag.parse / rag.rerank	SQLite-vec dense retrieval; pypdf parsing; identity rerank	docling/markitdown parsing, cross-encoder/Cohere rerank
redact.text	regex redaction	—
secrets.store	env-var backend	Infisical (secrets/infisical)
notify.sink	—	Slack (notify/slack)
mcp.call	universal MCP tool dispatcher	—