Files
BEHAVE/BEHAVE-SHELL/json/observation.schema.json
anti 41f54cb30b feat(shell): initial decnet_behave_shell spec + tests
Shell-session behavioral observation registry layered on core.
SPDX: GPL-3.0-or-later (code) / CC-BY-SA-4.0 (attribution-recipes.md).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-10 06:17:28 -04:00

145 lines
3.5 KiB
JSON

{
"$defs": {
"Window": {
"description": "Measurement window. For point observations, ``start_ts == end_ts``.\n\nBoth fields are epoch seconds (float). Distinct from ``Observation.ts``\n(the emission time), because a sensor may compute an observation over\na window in the past and emit it later.",
"properties": {
"end_ts": {
"description": "Window end, epoch seconds (>= start_ts)",
"title": "End Ts",
"type": "number"
},
"start_ts": {
"description": "Window start, epoch seconds",
"title": "Start Ts",
"type": "number"
}
},
"required": [
"start_ts",
"end_ts"
],
"title": "Window",
"type": "object"
}
},
"$id": "https://behave.local/schema/observation/v1.json",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"additionalProperties": false,
"description": "Shell-domain Observation: base envelope + BEHAVE-SHELL registry check.",
"properties": {
"confidence": {
"description": "Sensor's confidence in this measurement (not in any downstream verdict)",
"maximum": 1.0,
"minimum": 0.0,
"title": "Confidence",
"type": "number"
},
"evidence_ref": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"default": null,
"description": "Pointer to underlying raw evidence; NEVER the evidence itself",
"title": "Evidence Ref"
},
"id": {
"description": "UUID for dedup",
"title": "Id",
"type": "string"
},
"identity_ref": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"default": null,
"description": "AttackerIdentity UUID if the observation is pre-attributed",
"title": "Identity Ref"
},
"primitive": {
"description": "Fully-qualified primitive path, e.g. 'motor.keystroke_cadence'",
"title": "Primitive",
"type": "string"
},
"source": {
"description": "Canonical sensor identifier, e.g. 'decnet/sniffer/timing.py'",
"minLength": 1,
"title": "Source",
"type": "string"
},
"ts": {
"description": "Emission timestamp, epoch seconds",
"title": "Ts",
"type": "number"
},
"v": {
"default": 1,
"description": "Envelope schema version",
"title": "V",
"type": "integer"
},
"value": {
"anyOf": [
{
"type": "string"
},
{
"type": "integer"
},
{
"type": "number"
},
{
"type": "boolean"
},
{
"items": {
"type": "string"
},
"type": "array"
},
{
"items": {
"type": "integer"
},
"type": "array"
},
{
"items": {
"type": "number"
},
"type": "array"
},
{
"additionalProperties": true,
"type": "object"
}
],
"description": "Value typed by the primitive's registry entry; see spec.primitives",
"title": "Value"
},
"window": {
"$ref": "#/$defs/Window",
"description": "Measurement window"
}
},
"required": [
"primitive",
"value",
"confidence",
"window",
"source"
],
"title": "Observation",
"type": "object"
}