anti
7f585027b3
- core/README.md: envelope contract, field table, PII discipline, quickstart - BEHAVE-SHELL/README.md: all 76 primitives documented across 9 categories; TLS/SSH/C2 fingerprint sections with [DRAFT — verify] markers on uncertain entries - BEHAVE-TEXT/README.md: all 35 primitives across 6 categories; Rutify calibration notes inline; content.* layer marked EXPERIMENTAL throughout - primitives.py (SHELL): backfilled notes for all previously undocumented primitives - primitives.py (TEXT): backfilled notes for capitalization_habit, emoji_*, length, linebreak_style, sentence_complexity_class, question_formation_style, imperative_style, response_latency_class, message_burst_rate License: CC-BY-SA-4.0 (prose) / GPL-3.0-or-later (code)
BEHAVE
Behavioral observation spec for adversarial network attribution.
BEHAVE defines a structured observation envelope (core) and two domain registries — shell-session (BEHAVE-SHELL) and text/messaging (BEHAVE-TEXT) — used to build behavioral signatures over collected operator activity.
Packages
| Package | Description | Path |
|---|---|---|
behave-core |
Shared observation envelope — schema contract used by all registries | core/ |
behave-shell |
Shell-session behavioral observation registry | BEHAVE-SHELL/ |
behave-text |
Text/messaging-domain behavioral observation registry | BEHAVE-TEXT/ |
Install
Each package is independently installable. Install core first as both registries depend on it.
pip install -e core/
pip install -e BEHAVE-SHELL/
pip install -e BEHAVE-TEXT/
For development (includes pytest + ruff):
pip install -e "core/[dev]"
pip install -e "BEHAVE-SHELL/[dev]"
pip install -e "BEHAVE-TEXT/[dev]"
Test
pytest core/
pytest BEHAVE-SHELL/
pytest BEHAVE-TEXT/
Licensing
This repository uses a dual license:
| Content | License |
|---|---|
Code, JSON schemas, tests (*.py, *.json, pyproject.toml) |
GNU GPL v3.0 or later |
Spec prose and attribution recipes (*.md files) |
CC-BY-SA-4.0 |
SPDX identifiers are present in individual files.