anti b182e2fe3b feat(text): add meta.* corpus-footprint layer and 4 language-aware primitives (v0.1.3)
Adds 12 new primitives across two waves of spec work this session.

meta.* layer (8 primitives) — corpus-snapshot footprint:
  total_messages, corpus_span_days, msg_per_day, active_days,
  activity_density, first_seen_ts, last_seen_ts, fingerprint_confidence.
  Motivated by two actors with identical message counts (53 each) producing
  indistinguishable profiles despite radically different presence shapes
  (0.3-day burst vs 47-day long tail).

Language-aware characterization primitives (4 primitives):
  stylometric.pos_ngram_signature — SimHash over POS bigram frequency vector;
    syntactic skeleton fingerprint that survives full vocabulary paraphrase.
  lexical.dialect_region — BCP-47 free_string (es-CL, es-AR, es-MX, …);
    designed for EYENET integration with INGEOTEC regional-spanish-models.
  lexical.evaluative_morphology_density — diminutive/augmentative/pejorative
    suffix density; stable per-author trait baked into language acquisition.
  lexical.optional_grammar_signature — SimHash over optional-grammar choice
    points (compound/simple past, subjunctive, leísmo, relative pronoun);
    high-reliability Spain vs LatAm discriminator.

Also fixes stale scratchpad.md references throughout (README.md is now the
authority), bumps behave-text to 0.1.3, and updates CHANGELOG.
2026-05-23 01:54:12 -04:00

BEHAVE

Behavioral observation spec for adversarial network attribution. BEHAVE defines a structured observation envelope (core) and two domain registries — shell-session (BEHAVE-SHELL) and text/messaging (BEHAVE-TEXT) — used to build behavioral signatures over collected operator activity.

Packages

Package Description Path
behave-core Shared observation envelope — schema contract used by all registries core/
behave-shell Shell-session behavioral observation registry BEHAVE-SHELL/
behave-text Text/messaging-domain behavioral observation registry BEHAVE-TEXT/

Install

All packages are available on PyPI:

pip install behave-core
pip install behave-shell
pip install behave-text

behave-core is pulled in automatically as a dependency of the registries.

For local development (includes pytest + ruff):

pip install -e "core/[dev]"
pip install -e "BEHAVE-SHELL/[dev]"
pip install -e "BEHAVE-TEXT/[dev]"

Test

pytest core/
pytest BEHAVE-SHELL/
pytest BEHAVE-TEXT/

Licensing

This repository uses a dual license:

Content License
Code, JSON schemas, tests (*.py, *.json, pyproject.toml) GNU GPL v3.0 or later
Spec prose and attribution recipes (*.md files) CC-BY-SA-4.0

SPDX identifiers are present in individual files.

Description
BEHAVE: The behavioral threat-actor profiling specification
Readme GPL-3.0 266 KiB
Languages
Python 100%