behave-core

← repo

The shared observation envelope for BEHAVE. Defines the wire format that behave-shell and behave-text serialize all behavioral observations into. Every sensor in the BEHAVE ecosystem emits the same Observation structure — the domain-specific meaning lives in primitive and value; the envelope provides identity, provenance, time window, and schema versioning.

What it provides

Observation fields

PII discipline (non-negotiable)

BEHAVE observations carry categorical labels, timing aggregates, and hashes only. They must never carry:

• Raw keystroke content or command arguments
• Passwords, tokens, session keys, or any authentication material
• File contents or payload bytes
• Raw message text (especially in behave-text)

evidence_ref is a pointer to underlying evidence held elsewhere. Never the evidence itself.

Install

pip install -e .
# or, as a dependency of behave-shell / behave-text:
pip install -e ../core/

Quickstart

from behave_core.spec import Observation, Window, OBSERVATION_SCHEMA_VERSION

obs = Observation(
    primitive="motor.keystroke_cadence",
    value="bursty",
    confidence=0.82,
    window=Window(start_ts=1714000000.0, end_ts=1714003600.0),
    source="behave/shell-sensor/timing.py",
)
print(obs.model_dump_json())

Tests

pytest tests/

License

Code: GPL-3.0-or-later