anti 8161c67ec5 feat(profiler/behave_shell): emit motor.command_chunking ...

BEHAVE-EXTRACTOR.md Phase B Step B.4. First implementation —
prototype doesn't ship this primitive.

* SessionContext gains intra_command_iats: per-command tuple of
  IATs between consecutive input events whose timestamps fall
  inside [cmd.start_ts, cmd.end_ts). Excludes the terminator IAT.
  Built by _per_command_iats.
* _features/motor.py:command_chunking(ctx) emits one Observation
  in {fluent, fragmented, single_command}.
  - 0 commands → skip emit
  - 1 command → single_command (registry-allowed point)
  - ≥2 commands → median CV across per-command typed-IATs;
    < CMD_CHUNKING_FLUENT_CV_MAX (0.50) → fluent, else fragmented
  - paste-only sessions (no command has ≥3 typed IATs) → skip emit
    (no honest within-command rhythm to measure)
  Confidence 0.80 / 0.65 / 0.60.
* Calibration grid widened to include motor.command_chunking;
  green across all five shards. Phase B primitive set complete.

Tests: no commands → skip, 1 command → single_command, uniform
typing → fluent, alternating fast/slow → fragmented, paste-only
multi-command → skip emit.

2026-05-03 21:29:31 -04:00

..

agent

fix(types): T7 — eliminate all remaining 38 mypy errors; fix DeckyRow subscript in engine tests

2026-05-01 02:07:53 -04:00

artifacts

refactor(artifacts): extract resolve_artifact_path to shared module

2026-05-02 20:02:47 -04:00

asn

fix(types): P1 — annotate ranges: list[Range] in geoip/rir and asn/iptoasn providers

2026-05-01 00:21:44 -04:00

bus

feat(web/db): observations table + repo + bus prefix (BEHAVE-INTEGRATION Phase 1)

2026-05-03 07:25:10 -04:00

canary

fix(types): T7 — eliminate all remaining 38 mypy errors; fix DeckyRow subscript in engine tests

2026-05-01 02:07:53 -04:00

cli

feat(cli): allow decnet ttp on agents (DEBT-047)

2026-05-02 20:07:03 -04:00

clustering

feat(ttp): E.3.15 UKC bridge — production phase-handoff edge fires

2026-05-01 21:01:58 -04:00

collector

feat(ttp): split bash CMD evidence into structured uid/user/src/pwd/cmd rows

2026-05-02 03:20:53 -04:00

correlation

feat(prober,correlation): attacker fingerprint rotation detection (DEBT-032)

2026-05-03 05:12:51 -04:00

decky_io

feat(deckies): generic file drops on fleet + MazeNET deckies

2026-04-28 22:43:34 -04:00

engine

fix(types): T7 — eliminate all remaining 38 mypy errors; fix DeckyRow subscript in engine tests

2026-05-01 02:07:53 -04:00

fleet

fix(types): T3 — narrow str|None at 12 sites; fix LANRow/DeckyRow subscript in mutator tests

2026-05-01 02:18:53 -04:00

geoip

fix(types): P1 — annotate ranges: list[Range] in geoip/rir and asn/iptoasn providers

2026-05-01 00:21:44 -04:00

intel

feat(intel,ingester): mal_hash feed + observed_attachments table (DEBT-046)

2026-05-03 05:56:46 -04:00

logging

fix(types): P2 — wire _MixinBase + col() across sqlmodel_repo; suppress pydantic/SQLModel column typing false positives

2026-05-01 00:49:18 -04:00

mutator

fix(types): T7 — eliminate all remaining 38 mypy errors; fix DeckyRow subscript in engine tests

2026-05-01 02:07:53 -04:00

net

feat(net): stealth-egress httpx client factory

2026-04-26 04:59:34 -04:00

orchestrator

fix(types): T7 — eliminate all remaining 38 mypy errors; fix DeckyRow subscript in engine tests

2026-05-01 02:07:53 -04:00

prober

feat(prober,correlation): attacker fingerprint rotation detection (DEBT-032)

2026-05-03 05:12:51 -04:00

profiler

feat(profiler/behave_shell): emit motor.command_chunking

2026-05-03 21:29:31 -04:00

realism

fix(types): T3 — narrow str|None at 12 sites; fix LANRow/DeckyRow subscript in mutator tests

2026-05-01 01:47:04 -04:00

services

chore(infra): pin Docker base images by digest (DEBT-023)

2026-05-03 04:38:39 -04:00

sniffer

feat(sniffer): ISN sequence classifier (reuses seq_class helper)

2026-04-26 20:30:24 -04:00

swarm

fix(types): T7 — eliminate all remaining 38 mypy errors; fix DeckyRow subscript in engine tests

2026-05-01 02:07:53 -04:00

tarpit

fix(types): T7 — eliminate all remaining 38 mypy errors; fix DeckyRow subscript in engine tests

2026-05-01 02:07:53 -04:00

templates

chore(infra): pin Docker base images by digest (DEBT-023)

2026-05-03 04:38:39 -04:00

topology

chore(infra): pin Docker base images by digest (DEBT-023)

2026-05-03 04:38:39 -04:00

ttp

feat(ttp): EmailLifter disk-reach for body-aware predicates (DEBT-047)

2026-05-02 20:05:54 -04:00

updater

sec(updater): harden tarball extraction and verify sha256 before extract

2026-04-27 21:14:48 -04:00

vectorstore

fix(types): T1 — remove 15 stale type: ignore comments confirmed unused by mypy

2026-05-01 02:18:40 -04:00

web

feat(web): drop SessionProfile, wire observations into AttackerDetail (DEBT-050 / DEBT-036 closure)

2026-05-03 07:33:37 -04:00

webhook

fix(types): T5 — narrow AsyncClient|None with inline if; rename loop variable t→task to avoid no-redef

2026-05-01 02:18:57 -04:00

__init__.py

merge: testing → main (reconcile 2-week divergence)

2026-04-28 18:36:00 -04:00

archetypes.py

refactor(ssh): consolidate real_ssh into ssh, remove duplication

2026-04-11 19:51:41 -04:00

composer.py

merge: testing → main (reconcile 2-week divergence)

2026-04-28 18:36:00 -04:00

config_ini.py

feat(config): add swarmctl-host to INI, env, CLI; drop hardcoded bind from systemd unit

2026-04-30 22:16:00 -04:00

config.py

merge: testing → main (reconcile 2-week divergence)

2026-04-28 18:36:00 -04:00

custom_service.py

Add per-service customization, stealth hardening, and BYOS support

2026-04-04 04:08:27 -03:00

distros.py

chore(infra): pin Docker base images by digest (DEBT-023)

2026-05-03 04:38:39 -04:00

env.py

fix(types): T3 — narrow str|None at 12 sites; fix LANRow/DeckyRow subscript in mutator tests

2026-05-01 02:18:53 -04:00

ini_loader.py

fix: align tests with model validation and API error reporting

2026-04-13 01:43:52 -04:00

models.py

chore(infra): pin Docker base images by digest (DEBT-023)

2026-05-03 04:38:39 -04:00

network.py

Merge branch 'merge-rehearsal' into dev

2026-05-01 02:27:20 -04:00

os_fingerprint.py

feat(os_fingerprint): Phase 2 — add icmp_ratelimit + icmp_ratemask sysctls

2026-04-10 16:41:23 -04:00

privdrop.py

merge: testing → main (reconcile 2-week divergence)

2026-04-28 18:36:00 -04:00

telemetry.py

fix(types): P2 — wire _MixinBase + col() across sqlmodel_repo; suppress pydantic/SQLModel column typing false positives

2026-05-01 00:49:18 -04:00