tibet

The Humotica trust-system profile installer. Install only the layer you need: zero-state bootstrap, continuity, network, operator tools, observability, AI governance, firewall, evidence, compliance, agents, and conformance.

Unified CLI for tibet-core provenance, jis-core identity, evidence generation, agent communication, and first-run system setup.

Install

pip install tibet                    # CLI + tibet-core + jis-core
pip install "tibet[zero-state]"      # T-1 bootstrap: JIS, TIBET, genesis, causal time
pip install "tibet[runtime]"         # zero-state + continuity + network + operator
pip install "tibet[observability]"   # cascade logging, tail, trail, ping, pol
pip install "tibet[governed-ai]"     # AI governance + firewall + agent + evidence
pip install "tibet[enterprise]"      # runtime + security + evidence + compliance
pip install "tibet[full]"            # supported full profile, no deprecated/niche extras
pip install "tibet[lab]"             # research/lab profile with legacy and niche adapters

After Install

tibet system doctor
tibet system init
tibet system walkthrough

tibet[full] is the supported full profile. Deprecated aliases, marketplace tooling, COBOL, SPIFFE, Y2K38, anti-cheat, and other niche adapters are opt-in through tibet[legacy], tibet[interop], tibet[tooling], or tibet[lab].

The canonical profiles are:

• zero-state: T-1 bootstrap, JIS identity, TIBET provenance, genesis, causal time
• continuity: continuityd, cap-bus, CBOM, trail, wayback, Phantom state-resume/fork
• network: ping, overlay, mux, nc, mesh, tibet-zip
• operator: policy, tail, Cmail, keychain, home-agent
• observability: Cascade Logging via tibet-cascade, tail, trail, ping, pol
• ai-governance: airlock, triage, claw, cortex, SAM
• firewall: SNAFT, tibet-snaft, inject-bender
• security: AI governance + firewall + PQC + gateway
• evidence: audit, SBOM, AI-SBOM, report, wayback, trail
• compliance: NIS2, CI, SOC, workload attestation
• agent: AInternet, I-Poll, MCP surfaces, Phantom, context
• conformance: public contract vectors and MCP checks

Quick Start

# Initialize TIBET in your project.
tibet init

# Create a provenance token. Document before you act.
tibet create deploy --why "Release v1.0.0" --refs ticket-123

# Verify token integrity.
tibet verify <token-id>

# Export audit trail.
tibet export --format json

# Run compliance scan.
tibet audit

# Check trust score.
tibet forge

# Show installed components.
tibet status

Commands

Creating Tokens

Every token captures four provenance dimensions:

tibet create file_write \
  --why "Fix login bug"          \  # ERACHTER — intent
  --what '{"file":"auth.py"}'    \  # ERIN — content
  --refs issue-123               \  # ERAAN — references
  --actor "jis:dev:alice"           # Who

The token is created BEFORE the action happens. This is structural — provenance that's recorded after the fact is just logging.

TIBET Provenance

Every token records four dimensions:

Ecosystem

tibet is the CLI. The kernel is tibet-core. Together with the rest of the stack:

Standards

IETF Standardization

• draft-vandemeent-tibet-provenance — Traceable Intent-Based Event Tokens
• draft-vandemeent-jis-identity — JTel Identity Standard
• draft-vandemeent-upip-process-integrity — Universal Process Integrity Protocol
• draft-vandemeent-rvp-continuous-verification — Real-time Verification Protocol
• draft-vandemeent-ains-discovery — AInternet Name Service

Regulatory

CRA enforcement starts September 2026. TIBET makes compliance architectural, not bolted-on.

License

MIT

Credits

Designed by Jasper van de Meent. Built by Jasper and Root AI as part of HumoticaOS.

One love, one fAmIly.

Stack-positie: Groep substrate · Bootstrap = OSAPI-handshake naar tibet + jis (fail → snaft-rule + tibet-pol-rapport) · ← tibet-core · See STACK.md · See demo/golden-path/ for the spine end-to-end.

Enterprise

For private hub hosting, SLA support, custom integrations, or compliance guidance:

See ENTERPRISE.md for details.