feat(shell): initial decnet_behave_shell spec + tests

Shell-session behavioral observation registry layered on core.
SPDX: GPL-3.0-or-later (code) / CC-BY-SA-4.0 (attribution-recipes.md).

BEHAVE-SHELL/json/observation.schema.json

@@ -0,0 +1,144 @@
+{
+  "$defs": {
+    "Window": {
+      "description": "Measurement window. For point observations, ``start_ts == end_ts``.\n\nBoth fields are epoch seconds (float). Distinct from ``Observation.ts``\n(the emission time), because a sensor may compute an observation over\na window in the past and emit it later.",
+      "properties": {
+        "end_ts": {
+          "description": "Window end, epoch seconds (>= start_ts)",
+          "title": "End Ts",
+          "type": "number"
+        },
+        "start_ts": {
+          "description": "Window start, epoch seconds",
+          "title": "Start Ts",
+          "type": "number"
+        }
+      },
+      "required": [
+        "start_ts",
+        "end_ts"
+      ],
+      "title": "Window",
+      "type": "object"
+    }
+  },
+  "$id": "https://behave.local/schema/observation/v1.json",
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "additionalProperties": false,
+  "description": "Shell-domain Observation: base envelope + BEHAVE-SHELL registry check.",
+  "properties": {
+    "confidence": {
+      "description": "Sensor's confidence in this measurement (not in any downstream verdict)",
+      "maximum": 1.0,
+      "minimum": 0.0,
+      "title": "Confidence",
+      "type": "number"
+    },
+    "evidence_ref": {
+      "anyOf": [
+        {
+          "type": "string"
+        },
+        {
+          "type": "null"
+        }
+      ],
+      "default": null,
+      "description": "Pointer to underlying raw evidence; NEVER the evidence itself",
+      "title": "Evidence Ref"
+    },
+    "id": {
+      "description": "UUID for dedup",
+      "title": "Id",
+      "type": "string"
+    },
+    "identity_ref": {
+      "anyOf": [
+        {
+          "type": "string"
+        },
+        {
+          "type": "null"
+        }
+      ],
+      "default": null,
+      "description": "AttackerIdentity UUID if the observation is pre-attributed",
+      "title": "Identity Ref"
+    },
+    "primitive": {
+      "description": "Fully-qualified primitive path, e.g. 'motor.keystroke_cadence'",
+      "title": "Primitive",
+      "type": "string"
+    },
+    "source": {
+      "description": "Canonical sensor identifier, e.g. 'decnet/sniffer/timing.py'",
+      "minLength": 1,
+      "title": "Source",
+      "type": "string"
+    },
+    "ts": {
+      "description": "Emission timestamp, epoch seconds",
+      "title": "Ts",
+      "type": "number"
+    },
+    "v": {
+      "default": 1,
+      "description": "Envelope schema version",
+      "title": "V",
+      "type": "integer"
+    },
+    "value": {
+      "anyOf": [
+        {
+          "type": "string"
+        },
+        {
+          "type": "integer"
+        },
+        {
+          "type": "number"
+        },
+        {
+          "type": "boolean"
+        },
+        {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        {
+          "items": {
+            "type": "integer"
+          },
+          "type": "array"
+        },
+        {
+          "items": {
+            "type": "number"
+          },
+          "type": "array"
+        },
+        {
+          "additionalProperties": true,
+          "type": "object"
+        }
+      ],
+      "description": "Value typed by the primitive's registry entry; see spec.primitives",
+      "title": "Value"
+    },
+    "window": {
+      "$ref": "#/$defs/Window",
+      "description": "Measurement window"
+    }
+  },
+  "required": [
+    "primitive",
+    "value",
+    "confidence",
+    "window",
+    "source"
+  ],
+  "title": "Observation",
+  "type": "object"
+}