# DECNET BEHAVE

Behavioral observation spec for adversarial network attribution.
BEHAVE defines a structured observation envelope (`core`) and two domain registries — shell-session (`BEHAVE-SHELL`) and text/messaging (`BEHAVE-TEXT`) — used to build behavioral signatures over collected operator activity.

## Packages

| Package | Description | Path |
|---|---|---|
| `decnet-behave-core` | Shared observation envelope — schema contract used by all registries | [`core/`](core/) |
| `decnet-behave-shell` | Shell-session behavioral observation registry | [`BEHAVE-SHELL/`](BEHAVE-SHELL/) |
| `decnet-behave-text` | Text/messaging-domain behavioral observation registry | [`BEHAVE-TEXT/`](BEHAVE-TEXT/) |

## Install

Each package is independently installable. Install `core` first as both registries depend on it.

```bash
pip install -e core/
pip install -e BEHAVE-SHELL/
pip install -e BEHAVE-TEXT/
```

For development (includes pytest + ruff):

```bash
pip install -e "core/[dev]"
pip install -e "BEHAVE-SHELL/[dev]"
pip install -e "BEHAVE-TEXT/[dev]"
```

## Test

```bash
pytest core/
pytest BEHAVE-SHELL/
pytest BEHAVE-TEXT/
```

## Licensing

This repository uses a dual license:

| Content | License |
|---|---|
| Code, JSON schemas, tests (`*.py`, `*.json`, `pyproject.toml`) | [GNU GPL v3.0 or later](LICENSE) |
| Spec prose and attribution recipes (`*.md` files) | [CC-BY-SA-4.0](LICENSE.docs) |

SPDX identifiers are present in individual files.