positif-ai 0.1.0__tar.gz

positif_ai-0.1.0/LICENSE

@@ -0,0 +1,109 @@
+Positif is licensed under TWO licenses:
+
+  * The `sbd` CLI client (switchboard_cli.py) is MIT (full text in LICENSE-MIT).
+    It covers what a third party needs to talk to a Positif switchboard from
+    their own tooling. The file carries an `SPDX-License-Identifier: MIT` header.
+
+  * Everything else -- the switchboard engine (core/, cli/, deploy/, workers/) --
+    is licensed under the Business Source License 1.1 (BUSL-1.1), reproduced
+    below. It converts to the Change License (Apache-2.0) on the Change Date,
+    per-version.
+
+This mirrors the Bourdon (sibling product) licensing structure. Free for solo
+developers, research, and non-competing commercial use per the Additional Use
+Grant below.
+
+===============================================================================
+
+License text copyright (c) 2020 MariaDB Corporation Ab, All Rights Reserved.
+"Business Source License" is a trademark of MariaDB Corporation Ab.
+
+Parameters
+
+Licensor:             RADLAB LLC
+Licensed Work:        Positif Version 0.1.0 or later. The Licensed Work is (c) 2026
+                      RADLAB LLC.
+Additional Use Grant: You may make production use of the Licensed Work, provided
+                      Your use does not include offering the Licensed Work to third
+                      parties on a hosted or embedded basis in order to compete with
+                      RADLAB LLC's paid version(s) of the Licensed Work. For purposes
+                      of this license:
+
+                      A "competitive offering" is a Product that is offered to third
+                      parties on a paid basis, including through paid support
+                      arrangements, that significantly overlaps with the capabilities
+                      of RADLAB LLC's paid version(s) of the Licensed Work. If Your
+                      Product is not a competitive offering when You first make it
+                      generally available, it will not become a competitive offering
+                      later due to RADLAB LLC releasing a new version of the Licensed
+                      Work with additional capabilities. In addition, Products that
+                      are not provided on a paid basis are not competitive.
+
+                      "Product" means software that is offered to end users to manage
+                      in their own environments or offered as a service on a hosted
+                      basis.
+
+                      "Embedded" means including the source code or executable code
+                      from the Licensed Work in a competitive offering. "Embedded"
+                      also means packaging the competitive offering in such a way
+                      that the Licensed Work must be accessed or downloaded for the
+                      competitive offering to operate.
+
+                      Hosting or using the Licensed Work(s) for internal purposes
+                      within an organization is not considered a competitive
+                      offering. RADLAB LLC considers your organization to include all
+                      of your affiliates under common control.
+
+                      For binding interpretive guidance on using RADLAB LLC products
+                      under the Business Source License, please see the LICENSE_FAQ
+                      at https://github.com/getbourdon/bourdon/blob/main/LICENSE_FAQ.md
+Change Date:          Four years from the date the Licensed Work is published.
+Change License:       Apache License, Version 2.0
+
+For information about alternative licensing arrangements for the Licensed Work,
+please contact positif@radlab.online.
+
+Notice
+
+Business Source License 1.1
+
+Terms
+
+The Licensor hereby grants you the right to copy, modify, create derivative
+works, redistribute, and make non-production use of the Licensed Work. The
+Licensor may make an Additional Use Grant, above, permitting limited production use.
+
+Effective on the Change Date, or the fourth anniversary of the first publicly
+available distribution of a specific version of the Licensed Work under this
+License, whichever comes first, the Licensor hereby grants you rights under
+the terms of the Change License, and the rights granted in the paragraph
+above terminate.
+
+If your use of the Licensed Work does not comply with the requirements
+currently in effect as described in this License, you must purchase a
+commercial license from the Licensor, its affiliated entities, or authorized
+resellers, or you must refrain from using the Licensed Work.
+
+All copies of the original and modified Licensed Work, and derivative works
+of the Licensed Work, are subject to this License. This License applies
+separately for each version of the Licensed Work and the Change Date may vary
+for each version of the Licensed Work released by Licensor.
+
+You must conspicuously display this License on each original or modified copy
+of the Licensed Work. If you receive the Licensed Work in original or
+modified form from a third party, the terms and conditions set forth in this
+License apply to your use of that work.
+
+Any use of the Licensed Work in violation of this License will automatically
+terminate your rights under this License for the current and all other
+versions of the Licensed Work.
+
+This License does not grant you any right in any trademark or logo of
+Licensor or its affiliates (provided that you may use a trademark or logo of
+Licensor as expressly required by this License).
+
+TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON
+AN "AS IS" BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS,
+EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND
+TITLE.

positif_ai-0.1.0/LICENSE-MIT

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 RADLAB LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

positif_ai-0.1.0/NOTICE

@@ -0,0 +1,8 @@
+Positif (Agent Switchboard)
+Copyright (c) 2026 RADLAB LLC, a Wyoming limited liability company.
+
+Licensing: MIT for the `sbd` CLI client (switchboard_cli.py, see LICENSE-MIT);
+Business Source License 1.1 for the switchboard engine (see LICENSE), which
+converts to Apache-2.0 four years after each version's publication.
+
+https://positif.ai - Contact: positif@radlab.online

positif_ai-0.1.0/PKG-INFO

@@ -0,0 +1,244 @@
+Metadata-Version: 2.4
+Name: positif-ai
+Version: 0.1.0
+Summary: Positif — Agent Switchboard: security-first inter-agent control plane (sbd) for the RADLAB fleet
+Author-email: Ryan Davis <ryandavispro1@gmail.com>
+Maintainer: RADLAB LLC
+License-Expression: BUSL-1.1 AND MIT
+Project-URL: Homepage, https://positif.ai
+Project-URL: Repository, https://gitlab.com/radlab1/positif/positif
+Project-URL: Documentation, https://positif.ai/docs/
+Keywords: agent,router,switchboard,mcp,a2a,acp,tailnet
+Classifier: Development Status :: 2 - Pre-Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+License-File: LICENSE-MIT
+License-File: NOTICE
+Requires-Dist: fastmcp>=3.0
+Requires-Dist: httpx>=0.27
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0; extra == "dev"
+Requires-Dist: pytest-asyncio>=0.23; extra == "dev"
+Requires-Dist: ruff>=0.4; extra == "dev"
+Dynamic: license-file
+
+# Positif — Agent Switchboard (`sbd`)
+
+<!-- mcp-name: ai.positif/positif -->
+
+> **Positif** (`positif.ai`) is the canonical product name. `sbd` is the CLI, and
+> `switchboard` / `POSITIF_*` remain the stable **technical namespace** (package, env
+> vars, `pos1.` token prefix, `/opt/positif-*` paths, the `positif.service`
+> unit). Those identifiers stay put — renaming them is a separate, box-coordinated
+> migration — but the product you're reading about is **Positif**.
+>
+> **Status:** `0.1.0` pre-alpha. This repository is release-preparation work,
+> not a stable v1 release. Public distribution, deployment outside RADLAB, or
+> release publication still requires human release authorization under RADLAB
+> governance.
+
+**The security-first agent control plane** — the governance + routing layer for a
+multi-agent fleet. Not "another orchestrator": it authenticates the caller
+(tailnet whois), enforces a metadata-only policy, dedupes, **routes** (explicit /
+by capability), **brokers loop-guarded handoff** between agents, rate-limits, and
+**audits every decision** — then gets out of the data path. It does not own memory
+(that is **Bourdon**) and does not execute work (that is the agents); it governs
+*who can reach whom, with what, and proves it happened.*
+
+Sibling to **Bourdon** in one ecosystem — Bourdon = what the fleet *knows*,
+Positif = who's *online* + what's *in flight*. They meet at exactly one MCP
+boundary. (Positioning + productization path: `claude-brain SWITCHBOARD_PRODUCTIZATION.md`.)
+
+Lives on the always-on `radlab-cloud` box (`/opt/positif-{src,venv,data}`),
+mirroring Bourdon's layout. Port **7600** (Bourdon = 7500).
+
+## 0.1.0 Pre-Alpha: What's Built
+
+`sbd` is a FastMCP server exposing one secure tool, `dispatch(target, payload)`,
+over streamable-HTTP bound to the tailnet IP. The HTTP transport is deliberate:
+it's what makes `whois`-gated auth real — the caller's peer IP comes from the
+live request and tailscaled turns it into an authoritative node identity.
+
+**Dispatch state machine** (`core/dispatch.py`):
+
+1. **whois** the caller's peer IP → node + tags + user (unknown ⇒ default-deny)
+2. **provenance** tag — `trusted | tainted` (caller may self-declare tainted)
+3. **target card** lookup (A2A Agent Card + reachability), unknown ⇒ deny
+4. **policy** check — static `(caller, target)` table, **metadata only, never the
+   payload**; `tainted` is forbidden from sensitive targets
+   (`write/spend/prod/privileged`)
+5. **idempotency** — dedup-hit returns the cached result, never re-dispatches
+6. **shadow classifier** — predicts + logs the `(intent → target)` decision but
+   **does not route** (the event log is the training set)
+7. **forward** — over the card's transport (`acp` → drives `hermes acp`; `http` →
+   POSTs to an HTTP worker, ready for Clyde / a `*-automations` worker)
+8. **log + cache** the decision
+
+A per-caller **token-bucket rate limit** runs before forwarding (caps cost/DoS
+from a runaway or compromised caller). Observability: the `health` MCP tool and
+`sbd stats` aggregate the event log over a default 7-day window (per-target
+counts, deny rate, latency p50/p95). Use `--all-time` only when an operator
+intentionally needs the full retained dataset.
+
+Routing is **explicit-target** today. The classifier is scaffolded and learning
+from day one.
+
+### Reaching Hermes (ACP)
+
+Hermes is delegated to over the Zed Agent Client Protocol (newline-delimited
+JSON-RPC over stdio) — the Bourdon-aware path. `core/acp_client.py` spawns
+`hermes acp --accept-hooks`, runs `initialize → session/new → session/prompt`,
+accumulates `agent_message_chunk` text, auto-answers any `session/request_permission`
+(else the turn deadlocks), and returns on `stopReason: end_turn`.
+
+## Layout
+
+```
+core/  db schema.sql whois policy idempotency classifier cards acp_client dispatch server
+      default_data/ packaged policy + card seeds used by installed `sbd init`
+cli/   main.py            (sbd serve | init | whois | events | cards | stats | metrics | training | prune)
+data/  editable mirror/override seeds for source-tree operators
+deploy/ positif.service
+scripts/ smoke_dispatch.py     tests/ test_dispatch.py
+```
+
+## Operator Feature Notes
+
+Draft feature notes live at:
+
+- `docs/features/README.md`
+- `docs/features/policy-simulator.md`
+- `docs/features/dry-run-dispatch.md`
+- `docs/features/agent-registry.md`
+- `docs/features/audit-reporting.md`
+- `docs/features/sandbox-manager.md`
+- `docs/features/release-readiness.md`
+- `docs/features/render-surfaces.md`
+
+`sbd render` emits JSON Render flat specs for those operator surfaces. This is
+the renderer-ready contract for operator clients, not a release authorization
+path:
+
+```bash
+sbd render command-center --db /opt/positif-data/positif.db
+sbd render audit --db /opt/positif-data/positif.db --window-days 7
+sbd render release --root /opt/positif-src
+```
+
+An optional local Ink renderer lives in `tui/` for the same surfaces:
+
+```bash
+npm --prefix tui ci
+npm --prefix tui run build
+node tui/dist/index.js --surface command-center --db /opt/positif-data/positif.db
+node tui/dist/index.js --surface release --root /opt/positif-src --once
+```
+
+## Run
+
+```bash
+# on the box
+/opt/positif-venv/bin/python -m pip install -e /opt/positif-src
+openssl rand -base64 32 > /opt/positif-data/handoff.secret
+chown switchboard:switchboard /opt/positif-data/handoff.secret
+chmod 600 /opt/positif-data/handoff.secret
+sbd init --db /opt/positif-data/positif.db          # schema + seed policy + cards
+sbd serve --transport http --host 100.113.192.59 --port 7600 --db /opt/positif-data/positif.db
+# in another shell (on the box, so whois resolves a real tailnet node):
+/opt/positif-venv/bin/python scripts/smoke_dispatch.py
+# add --yes-live only when you intentionally want to spawn the target agent:
+/opt/positif-venv/bin/python scripts/smoke_dispatch.py --yes-live
+```
+
+Wire a coding agent as an MCP client by pointing it at
+`http://100.113.192.59:7600/mcp/`.
+
+## Audit retention
+
+Positif bounds and redacts operator-facing metadata before storage or export.
+`event_log.intent` and `event_log.error` are stored as short redacted strings, and
+`sbd events` / `sbd training` re-apply the same bounds when reading older rows.
+Stats, metrics, classifier accuracy, and training export default to the last 7
+days; pass `--all-time` for an explicit full retained read.
+
+Retention is manual, not automatic during dispatch:
+
+```bash
+sbd prune --db /opt/positif-data/positif.db --events-days 30 --idempotency-hours 24 --batch-size 1000
+```
+
+The default policy keeps audit events for 30 days and idempotency cache rows for
+24 hours. Prune deletes in bounded batches so operators can run it from cron or
+systemd timers without putting cleanup work on the request path.
+
+## Security Stance (0.1.0 Pre-Alpha)
+
+* Routes on **metadata, never payload**; **no token minting or forwarding** for
+  caller identity (Hermes uses its own key). Positif mints only short-lived
+  signed handoff bearers for trace/depth/path continuity.
+* **Caller identity is asserted on the tailnet** — the peer IP must be in the
+  Tailscale CGNAT range (`100.64.0.0/10`) before whois is even consulted, so a
+  loopback/proxy/public peer can't be mistaken for a fleet node. Default-deny on
+  unknown caller / unknown target / no policy row (a targeted `deny` overrides a
+  broader `allow`).
+* `tainted` (untrusted-origin) dispatches are denied from privileged targets at
+  ingress, and are additionally bounded to non-destructive tools.
+* **Fully unprivileged: no root, no sudo.** `sbd` runs as the
+  `switchboard` user, and the Hermes it drives runs as that *same* unprivileged
+  user with its own private `HERMES_HOME` (`/opt/positif-data/hermes-home` —
+  config + Anthropic key, **no Slack tokens**). A compromise of `sbd` or its Hermes
+  yields only the `switchboard` user: it **cannot read `/root`, touch system files,
+  or escalate**. The gateway's separate root Hermes instance is untouched.
+  `deploy/preflight.sh` refuses to start unless the `HERMES_HOME` is present,
+  private, and switchboard-owned (and `hermes` is root-owned); an in-code argv
+  allowlist in `acp_client` is the second barrier on the spawn.
+* **Per-dispatch tool bound + audit (allowlist, fail-closed).** Every tool the
+  target routes through the ACP permission gate is logged (`event_log.tool_audit`,
+  preserved even on error/timeout turns). `compute` (the **default** for Hermes;
+  forced for `tainted`; can be narrowed-to via `max_capability`) is an *allowlist*
+  — only `read/search/fetch/think` pass; `edit/delete/move/execute` and any
+  absent/unknown kind are **denied**. **Verified:** under `compute`, Hermes was
+  denied a file edit *and* a dangerous `rm` at the gate, while Bourdon MCP tools +
+  Q&A still work. Truly benign commands (e.g. `whoami`) auto-run in Hermes and skip
+  the gate — but since Hermes now runs **unprivileged**, even those can't read
+  `/root`, touch system files, or escalate, so the residual is contained.
+* **Security selectors fail closed** — `provenance` and `max_capability` normalize
+  and resolve any typo/casing to the *more restrictive* branch, never the privileged
+  one. A cap can only narrow.
+* **Idempotency keys are namespaced** by caller+target — a caller-supplied key
+  can't read another caller's or another target's cached result.
+* **Spawn cleanup is process-group aware.** ACP and CLI agent launches create a
+  subprocess group/session where the platform supports it. On timeout,
+  Positif terminates the group, then kills it if it does not exit; non-POSIX
+  platforms fall back to best-effort direct child cleanup.
+* **CLI review runners must not hide write capability.** The Codex card runs
+  `codex exec --skip-git-repo-check` without
+  `--dangerously-bypass-approvals-and-sandbox`, is marked `compute`, and is a
+  review/reasoning node rather than an autonomous writer. A future write-capable
+  Codex runner must be a separate, explicitly named card.
+* **Per-agent Unix users are a deploy design, not a hidden runtime shortcut.**
+  Future `sbd-hermes`, `sbd-coder`, and `sbd-codex` execution must go through
+  exact root-owned wrapper commands before code enables it. Broad sudo is not
+  acceptable. Until that runner exists, preflight enforces private
+  switchboard-owned homes/workspaces for the seeded agents.
+* **Signed handoff metadata.** Brokered handoff trace IDs, depths, and paths are
+  carried as `Authorization: Bearer pos1.<payload>.<hmac>` tokens signed with
+  `POSITIF_HANDOFF_SECRET_FILE` (default deploy path:
+  `/opt/positif-data/handoff.secret`). Unsigned `X-SBD-*` headers are ignored
+  by default; set `POSITIF_ALLOW_LEGACY_HANDOFF=1` only for a temporary compatibility
+  window. Handoff tokens authenticate metadata only; payload bodies are never used
+  to derive or validate handoff identity.
+
+## Roadmap (Not Yet Built)
+
+Litestream/B2 durability, presence/heartbeat, capability-match + semantic routing
+as primary, NATS, brokered agent↔agent handoff, a second `sbd` to kill the SPOF.
+See `claude-brain/PROJECTS/RADLAB-CLOUD/SWITCHBOARD.md`.
+
+---
+RADLAB LLC, a Wyoming limited liability company · BUSL-1.1

positif_ai-0.1.0/README.md

@@ -0,0 +1,215 @@
+# Positif — Agent Switchboard (`sbd`)
+
+<!-- mcp-name: ai.positif/positif -->
+
+> **Positif** (`positif.ai`) is the canonical product name. `sbd` is the CLI, and
+> `switchboard` / `POSITIF_*` remain the stable **technical namespace** (package, env
+> vars, `pos1.` token prefix, `/opt/positif-*` paths, the `positif.service`
+> unit). Those identifiers stay put — renaming them is a separate, box-coordinated
+> migration — but the product you're reading about is **Positif**.
+>
+> **Status:** `0.1.0` pre-alpha. This repository is release-preparation work,
+> not a stable v1 release. Public distribution, deployment outside RADLAB, or
+> release publication still requires human release authorization under RADLAB
+> governance.
+
+**The security-first agent control plane** — the governance + routing layer for a
+multi-agent fleet. Not "another orchestrator": it authenticates the caller
+(tailnet whois), enforces a metadata-only policy, dedupes, **routes** (explicit /
+by capability), **brokers loop-guarded handoff** between agents, rate-limits, and
+**audits every decision** — then gets out of the data path. It does not own memory
+(that is **Bourdon**) and does not execute work (that is the agents); it governs
+*who can reach whom, with what, and proves it happened.*
+
+Sibling to **Bourdon** in one ecosystem — Bourdon = what the fleet *knows*,
+Positif = who's *online* + what's *in flight*. They meet at exactly one MCP
+boundary. (Positioning + productization path: `claude-brain SWITCHBOARD_PRODUCTIZATION.md`.)
+
+Lives on the always-on `radlab-cloud` box (`/opt/positif-{src,venv,data}`),
+mirroring Bourdon's layout. Port **7600** (Bourdon = 7500).
+
+## 0.1.0 Pre-Alpha: What's Built
+
+`sbd` is a FastMCP server exposing one secure tool, `dispatch(target, payload)`,
+over streamable-HTTP bound to the tailnet IP. The HTTP transport is deliberate:
+it's what makes `whois`-gated auth real — the caller's peer IP comes from the
+live request and tailscaled turns it into an authoritative node identity.
+
+**Dispatch state machine** (`core/dispatch.py`):
+
+1. **whois** the caller's peer IP → node + tags + user (unknown ⇒ default-deny)
+2. **provenance** tag — `trusted | tainted` (caller may self-declare tainted)
+3. **target card** lookup (A2A Agent Card + reachability), unknown ⇒ deny
+4. **policy** check — static `(caller, target)` table, **metadata only, never the
+   payload**; `tainted` is forbidden from sensitive targets
+   (`write/spend/prod/privileged`)
+5. **idempotency** — dedup-hit returns the cached result, never re-dispatches
+6. **shadow classifier** — predicts + logs the `(intent → target)` decision but
+   **does not route** (the event log is the training set)
+7. **forward** — over the card's transport (`acp` → drives `hermes acp`; `http` →
+   POSTs to an HTTP worker, ready for Clyde / a `*-automations` worker)
+8. **log + cache** the decision
+
+A per-caller **token-bucket rate limit** runs before forwarding (caps cost/DoS
+from a runaway or compromised caller). Observability: the `health` MCP tool and
+`sbd stats` aggregate the event log over a default 7-day window (per-target
+counts, deny rate, latency p50/p95). Use `--all-time` only when an operator
+intentionally needs the full retained dataset.
+
+Routing is **explicit-target** today. The classifier is scaffolded and learning
+from day one.
+
+### Reaching Hermes (ACP)
+
+Hermes is delegated to over the Zed Agent Client Protocol (newline-delimited
+JSON-RPC over stdio) — the Bourdon-aware path. `core/acp_client.py` spawns
+`hermes acp --accept-hooks`, runs `initialize → session/new → session/prompt`,
+accumulates `agent_message_chunk` text, auto-answers any `session/request_permission`
+(else the turn deadlocks), and returns on `stopReason: end_turn`.
+
+## Layout
+
+```
+core/  db schema.sql whois policy idempotency classifier cards acp_client dispatch server
+      default_data/ packaged policy + card seeds used by installed `sbd init`
+cli/   main.py            (sbd serve | init | whois | events | cards | stats | metrics | training | prune)
+data/  editable mirror/override seeds for source-tree operators
+deploy/ positif.service
+scripts/ smoke_dispatch.py     tests/ test_dispatch.py
+```
+
+## Operator Feature Notes
+
+Draft feature notes live at:
+
+- `docs/features/README.md`
+- `docs/features/policy-simulator.md`
+- `docs/features/dry-run-dispatch.md`
+- `docs/features/agent-registry.md`
+- `docs/features/audit-reporting.md`
+- `docs/features/sandbox-manager.md`
+- `docs/features/release-readiness.md`
+- `docs/features/render-surfaces.md`
+
+`sbd render` emits JSON Render flat specs for those operator surfaces. This is
+the renderer-ready contract for operator clients, not a release authorization
+path:
+
+```bash
+sbd render command-center --db /opt/positif-data/positif.db
+sbd render audit --db /opt/positif-data/positif.db --window-days 7
+sbd render release --root /opt/positif-src
+```
+
+An optional local Ink renderer lives in `tui/` for the same surfaces:
+
+```bash
+npm --prefix tui ci
+npm --prefix tui run build
+node tui/dist/index.js --surface command-center --db /opt/positif-data/positif.db
+node tui/dist/index.js --surface release --root /opt/positif-src --once
+```
+
+## Run
+
+```bash
+# on the box
+/opt/positif-venv/bin/python -m pip install -e /opt/positif-src
+openssl rand -base64 32 > /opt/positif-data/handoff.secret
+chown switchboard:switchboard /opt/positif-data/handoff.secret
+chmod 600 /opt/positif-data/handoff.secret
+sbd init --db /opt/positif-data/positif.db          # schema + seed policy + cards
+sbd serve --transport http --host 100.113.192.59 --port 7600 --db /opt/positif-data/positif.db
+# in another shell (on the box, so whois resolves a real tailnet node):
+/opt/positif-venv/bin/python scripts/smoke_dispatch.py
+# add --yes-live only when you intentionally want to spawn the target agent:
+/opt/positif-venv/bin/python scripts/smoke_dispatch.py --yes-live
+```
+
+Wire a coding agent as an MCP client by pointing it at
+`http://100.113.192.59:7600/mcp/`.
+
+## Audit retention
+
+Positif bounds and redacts operator-facing metadata before storage or export.
+`event_log.intent` and `event_log.error` are stored as short redacted strings, and
+`sbd events` / `sbd training` re-apply the same bounds when reading older rows.
+Stats, metrics, classifier accuracy, and training export default to the last 7
+days; pass `--all-time` for an explicit full retained read.
+
+Retention is manual, not automatic during dispatch:
+
+```bash
+sbd prune --db /opt/positif-data/positif.db --events-days 30 --idempotency-hours 24 --batch-size 1000
+```
+
+The default policy keeps audit events for 30 days and idempotency cache rows for
+24 hours. Prune deletes in bounded batches so operators can run it from cron or
+systemd timers without putting cleanup work on the request path.
+
+## Security Stance (0.1.0 Pre-Alpha)
+
+* Routes on **metadata, never payload**; **no token minting or forwarding** for
+  caller identity (Hermes uses its own key). Positif mints only short-lived
+  signed handoff bearers for trace/depth/path continuity.
+* **Caller identity is asserted on the tailnet** — the peer IP must be in the
+  Tailscale CGNAT range (`100.64.0.0/10`) before whois is even consulted, so a
+  loopback/proxy/public peer can't be mistaken for a fleet node. Default-deny on
+  unknown caller / unknown target / no policy row (a targeted `deny` overrides a
+  broader `allow`).
+* `tainted` (untrusted-origin) dispatches are denied from privileged targets at
+  ingress, and are additionally bounded to non-destructive tools.
+* **Fully unprivileged: no root, no sudo.** `sbd` runs as the
+  `switchboard` user, and the Hermes it drives runs as that *same* unprivileged
+  user with its own private `HERMES_HOME` (`/opt/positif-data/hermes-home` —
+  config + Anthropic key, **no Slack tokens**). A compromise of `sbd` or its Hermes
+  yields only the `switchboard` user: it **cannot read `/root`, touch system files,
+  or escalate**. The gateway's separate root Hermes instance is untouched.
+  `deploy/preflight.sh` refuses to start unless the `HERMES_HOME` is present,
+  private, and switchboard-owned (and `hermes` is root-owned); an in-code argv
+  allowlist in `acp_client` is the second barrier on the spawn.
+* **Per-dispatch tool bound + audit (allowlist, fail-closed).** Every tool the
+  target routes through the ACP permission gate is logged (`event_log.tool_audit`,
+  preserved even on error/timeout turns). `compute` (the **default** for Hermes;
+  forced for `tainted`; can be narrowed-to via `max_capability`) is an *allowlist*
+  — only `read/search/fetch/think` pass; `edit/delete/move/execute` and any
+  absent/unknown kind are **denied**. **Verified:** under `compute`, Hermes was
+  denied a file edit *and* a dangerous `rm` at the gate, while Bourdon MCP tools +
+  Q&A still work. Truly benign commands (e.g. `whoami`) auto-run in Hermes and skip
+  the gate — but since Hermes now runs **unprivileged**, even those can't read
+  `/root`, touch system files, or escalate, so the residual is contained.
+* **Security selectors fail closed** — `provenance` and `max_capability` normalize
+  and resolve any typo/casing to the *more restrictive* branch, never the privileged
+  one. A cap can only narrow.
+* **Idempotency keys are namespaced** by caller+target — a caller-supplied key
+  can't read another caller's or another target's cached result.
+* **Spawn cleanup is process-group aware.** ACP and CLI agent launches create a
+  subprocess group/session where the platform supports it. On timeout,
+  Positif terminates the group, then kills it if it does not exit; non-POSIX
+  platforms fall back to best-effort direct child cleanup.
+* **CLI review runners must not hide write capability.** The Codex card runs
+  `codex exec --skip-git-repo-check` without
+  `--dangerously-bypass-approvals-and-sandbox`, is marked `compute`, and is a
+  review/reasoning node rather than an autonomous writer. A future write-capable
+  Codex runner must be a separate, explicitly named card.
+* **Per-agent Unix users are a deploy design, not a hidden runtime shortcut.**
+  Future `sbd-hermes`, `sbd-coder`, and `sbd-codex` execution must go through
+  exact root-owned wrapper commands before code enables it. Broad sudo is not
+  acceptable. Until that runner exists, preflight enforces private
+  switchboard-owned homes/workspaces for the seeded agents.
+* **Signed handoff metadata.** Brokered handoff trace IDs, depths, and paths are
+  carried as `Authorization: Bearer pos1.<payload>.<hmac>` tokens signed with
+  `POSITIF_HANDOFF_SECRET_FILE` (default deploy path:
+  `/opt/positif-data/handoff.secret`). Unsigned `X-SBD-*` headers are ignored
+  by default; set `POSITIF_ALLOW_LEGACY_HANDOFF=1` only for a temporary compatibility
+  window. Handoff tokens authenticate metadata only; payload bodies are never used
+  to derive or validate handoff identity.
+
+## Roadmap (Not Yet Built)
+
+Litestream/B2 durability, presence/heartbeat, capability-match + semantic routing
+as primary, NATS, brokered agent↔agent handoff, a second `sbd` to kill the SPOF.
+See `claude-brain/PROJECTS/RADLAB-CLOUD/SWITCHBOARD.md`.
+
+---
+RADLAB LLC, a Wyoming limited liability company · BUSL-1.1

positif_ai-0.1.0/cli/__init__.py

@@ -0,0 +1 @@
+"""sbd command-line interface."""