tibet-continuityd 0.3.3__tar.gz

tibet_continuityd-0.3.3/PKG-INFO

@@ -0,0 +1,128 @@
+Metadata-Version: 2.4
+Name: tibet-continuityd
+Version: 0.3.3
+Summary: Continuous integrity system daemon for the Distributed Continuity OS — Watch, Sniff, Coalesce, Verify, Fork, Trust, Seal, Police, Backpressure across 3 modes (passive/active/strict).
+Author-email: Jasper van de Meent <info@humotica.com>, Root AI <root_idd@humotica.nl>, Codex <codex@humotica.nl>
+License: MIT
+Project-URL: Homepage, https://humotica.com
+Project-URL: Spec, https://github.com/Humotica/tibet-continuityd/blob/main/SPEC.md
+Keywords: tibet,continuity,daemon,audit,trust,inotify,libmagic,icc,tbz,ssm,phantom,distributed-continuity-os,humotica
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: System Administrators
+Classifier: Intended Audience :: Information Technology
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security :: Cryptography
+Classifier: Topic :: System :: Monitoring
+Classifier: Topic :: System :: Logging
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+Provides-Extra: verify
+Requires-Dist: tibet-drop>=0.1.0; extra == "verify"
+Requires-Dist: tibet-phantom>=0.2.0; extra == "verify"
+Provides-Extra: full
+Requires-Dist: tibet-drop>=0.1.0; extra == "full"
+Requires-Dist: tibet-phantom>=0.2.0; extra == "full"
+Requires-Dist: cryptography>=41.0; extra == "full"
+Requires-Dist: cbor2>=5.4; extra == "full"
+
+# tibet-continuityd
+
+> **Continuous Integrity System Daemon for the Distributed Continuity OS.**
+
+A residential trust-guardian that runs in the background of every
+machine where TIBET cryptographic discipline must be continuously
+enforced.
+
+```
+  Watch  → Sniff  → Verify  → Fork    → Triage  → Reseal
+  inotify  libmagic  Ed25519   forward    quarant   periodic
+                     +chain    causal     -ine
+```
+
+## Design axiom
+
+> **Name is hint. Content is truth. Arrival is event.**
+>
+> — Codex, 9 May 2026
+
+## v0.1 scope (this release)
+
+- ✅ `Watch` — inotify on a single inbox lane
+- ✅ `Sniff` — magic-byte recognition (TBZ + executables + PDF + JSON)
+- ✅ Disposition classification per Codex' intake policy table
+- ✅ Audit JSONL log + journald-friendly stderr logging
+- ✅ Mode 1 (Passive Guardian): observe + log + advise
+- ✅ systemd unit ready for deployment
+- ⏭ v0.2 will add: `Verify` (cryptographic) + `Fork` (via phantom.icc)
+- ⏭ v0.3 will add: `Seal` (continuous reseal) + `Police` (unpacked detect)
+
+## Install
+
+```bash
+pip install tibet-continuityd
+```
+
+## Run (development)
+
+```bash
+TIBET_CONTINUITYD_INBOX=/tmp/inbox \
+TIBET_CONTINUITYD_AUDIT=/tmp/audit.jsonl \
+python3 -m tibet_continuityd
+```
+
+Drop a TBZ-prefixed file into `/tmp/inbox/`:
+
+```bash
+printf 'TBZ\x01\x00\x00\x00' > /tmp/inbox/sample.claude.tza
+```
+
+You will see:
+
+```
+arrival: 'sample.claude.tza' → sealed-tbz (trusted-candidate, 7B)
+```
+
+## Run (production, systemd)
+
+```bash
+sudo cp tibet-continuityd.service /etc/systemd/system/
+sudo useradd -r -s /usr/sbin/nologin tibet
+sudo mkdir -p /var/lib/tibet/{inbox,quarantine,triage,materialized}
+sudo mkdir -p /var/log/tibet
+sudo chown -R tibet:tibet /var/lib/tibet /var/log/tibet
+sudo systemctl daemon-reload
+sudo systemctl enable --now tibet-continuityd
+journalctl -u tibet-continuityd -f
+```
+
+## Disposition table (v0.1)
+
+| Intake class            | Trigger                                  | Disposition          |
+|-------------------------|------------------------------------------|----------------------|
+| `sealed-tbz`            | TBZ magic + recognized vendor extension  | trusted-candidate    |
+| `sealed-tbz-no-ext`     | TBZ magic, no/unknown extension          | trusted-candidate    |
+| `disguised`             | Vendor extension, no TBZ magic           | triage-disguised     |
+| `executable`            | ELF / PE binary                          | quarantine           |
+| `pdf`                   | PDF magic                                | reject               |
+| `json-text`             | Plain JSON state in sealed-only zone     | reseal-candidate     |
+| `unknown`               | Anything else                            | quarantine           |
+| `empty`                 | Zero-byte file                           | reject               |
+
+v0.1 logs the disposition only. v0.2+ will act on it
+(Verify + Fork or Quarantine + Triage).
+
+## Architecture & spec
+
+- Spec: [`tibet-continuityd-spec.md`](https://humotica.com/specs/continuityd)
+- Companion intake guide (Codex):
+  [`tibet-continuity-guardian.md`](https://humotica.com/specs/continuity-guardian)
+
+## License
+
+MIT — Humotica + Root AI + Codex (2026)

tibet_continuityd-0.3.3/README.md

@@ -0,0 +1,95 @@
+# tibet-continuityd
+
+> **Continuous Integrity System Daemon for the Distributed Continuity OS.**
+
+A residential trust-guardian that runs in the background of every
+machine where TIBET cryptographic discipline must be continuously
+enforced.
+
+```
+  Watch  → Sniff  → Verify  → Fork    → Triage  → Reseal
+  inotify  libmagic  Ed25519   forward    quarant   periodic
+                     +chain    causal     -ine
+```
+
+## Design axiom
+
+> **Name is hint. Content is truth. Arrival is event.**
+>
+> — Codex, 9 May 2026
+
+## v0.1 scope (this release)
+
+- ✅ `Watch` — inotify on a single inbox lane
+- ✅ `Sniff` — magic-byte recognition (TBZ + executables + PDF + JSON)
+- ✅ Disposition classification per Codex' intake policy table
+- ✅ Audit JSONL log + journald-friendly stderr logging
+- ✅ Mode 1 (Passive Guardian): observe + log + advise
+- ✅ systemd unit ready for deployment
+- ⏭ v0.2 will add: `Verify` (cryptographic) + `Fork` (via phantom.icc)
+- ⏭ v0.3 will add: `Seal` (continuous reseal) + `Police` (unpacked detect)
+
+## Install
+
+```bash
+pip install tibet-continuityd
+```
+
+## Run (development)
+
+```bash
+TIBET_CONTINUITYD_INBOX=/tmp/inbox \
+TIBET_CONTINUITYD_AUDIT=/tmp/audit.jsonl \
+python3 -m tibet_continuityd
+```
+
+Drop a TBZ-prefixed file into `/tmp/inbox/`:
+
+```bash
+printf 'TBZ\x01\x00\x00\x00' > /tmp/inbox/sample.claude.tza
+```
+
+You will see:
+
+```
+arrival: 'sample.claude.tza' → sealed-tbz (trusted-candidate, 7B)
+```
+
+## Run (production, systemd)
+
+```bash
+sudo cp tibet-continuityd.service /etc/systemd/system/
+sudo useradd -r -s /usr/sbin/nologin tibet
+sudo mkdir -p /var/lib/tibet/{inbox,quarantine,triage,materialized}
+sudo mkdir -p /var/log/tibet
+sudo chown -R tibet:tibet /var/lib/tibet /var/log/tibet
+sudo systemctl daemon-reload
+sudo systemctl enable --now tibet-continuityd
+journalctl -u tibet-continuityd -f
+```
+
+## Disposition table (v0.1)
+
+| Intake class            | Trigger                                  | Disposition          |
+|-------------------------|------------------------------------------|----------------------|
+| `sealed-tbz`            | TBZ magic + recognized vendor extension  | trusted-candidate    |
+| `sealed-tbz-no-ext`     | TBZ magic, no/unknown extension          | trusted-candidate    |
+| `disguised`             | Vendor extension, no TBZ magic           | triage-disguised     |
+| `executable`            | ELF / PE binary                          | quarantine           |
+| `pdf`                   | PDF magic                                | reject               |
+| `json-text`             | Plain JSON state in sealed-only zone     | reseal-candidate     |
+| `unknown`               | Anything else                            | quarantine           |
+| `empty`                 | Zero-byte file                           | reject               |
+
+v0.1 logs the disposition only. v0.2+ will act on it
+(Verify + Fork or Quarantine + Triage).
+
+## Architecture & spec
+
+- Spec: [`tibet-continuityd-spec.md`](https://humotica.com/specs/continuityd)
+- Companion intake guide (Codex):
+  [`tibet-continuity-guardian.md`](https://humotica.com/specs/continuity-guardian)
+
+## License
+
+MIT — Humotica + Root AI + Codex (2026)

tibet_continuityd-0.3.3/pyproject.toml

@@ -0,0 +1,62 @@
+[build-system]
+requires = ["setuptools>=68.0", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "tibet-continuityd"
+version = "0.3.3"
+description = "Continuous integrity system daemon for the Distributed Continuity OS — Watch, Sniff, Coalesce, Verify, Fork, Trust, Seal, Police, Backpressure across 3 modes (passive/active/strict)."
+readme = "README.md"
+license = {text = "MIT"}
+requires-python = ">=3.10"
+authors = [
+    {name = "Jasper van de Meent", email = "info@humotica.com"},
+    {name = "Root AI", email = "root_idd@humotica.nl"},
+    {name = "Codex", email = "codex@humotica.nl"},
+]
+keywords = [
+    "tibet", "continuity", "daemon", "audit", "trust",
+    "inotify", "libmagic", "icc", "tbz", "ssm", "phantom",
+    "distributed-continuity-os", "humotica",
+]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Intended Audience :: System Administrators",
+    "Intended Audience :: Information Technology",
+    "License :: OSI Approved :: MIT License",
+    "Operating System :: POSIX :: Linux",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Topic :: Security :: Cryptography",
+    "Topic :: System :: Monitoring",
+    "Topic :: System :: Logging",
+]
+
+# v0.3 has zero hard runtime dependencies; uses ctypes for inotify
+# and an in-package magic-byte table. Optional dependencies enable
+# cryptographic verify, pack, and reseal stages.
+dependencies = []
+
+[project.optional-dependencies]
+# Verify + Fork + Seal stages with cryptographic discipline
+verify = [
+    "tibet-drop>=0.1.0",
+    "tibet-phantom>=0.2.0",
+]
+# Full stack including phantom-icc bridge
+full = [
+    "tibet-drop>=0.1.0",
+    "tibet-phantom>=0.2.0",
+    "cryptography>=41.0",
+    "cbor2>=5.4",
+]
+
+[project.scripts]
+tibet-continuityd = "tibet_continuityd.daemon:main"
+
+[project.urls]
+Homepage = "https://humotica.com"
+Spec = "https://github.com/Humotica/tibet-continuityd/blob/main/SPEC.md"

tibet_continuityd-0.3.3/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

tibet_continuityd-0.3.3/src/tibet_continuityd/__init__.py

@@ -0,0 +1,105 @@
+"""
+tibet-continuityd — Continuous Integrity System Daemon
+=======================================================
+
+A residential trust guardian that runs in the background of
+every machine where TIBET cryptographic discipline must be
+continuously enforced.
+
+  Watch  → inotify
+  Sniff  → libmagic / TBZ magic-byte recognition
+  Verify → (v0.2) cryptographic verification
+  Fork   → (v0.2) forward-causal materialize via phantom.icc
+  Triage → (v0.2) quarantine on mismatch
+  Reseal → (v0.3) periodic reseal of materialized state
+
+Three operating modes:
+  Mode 1  Passive Guardian  observe + log + advise
+  Mode 2  Sealing Guardian  auto-reseal + active intake
+  Mode 3  Strict Continuity zero-trust, ICC/TBZ only
+
+Spec: /srv/jtel-stack/hersenspinsels/tibet-continuityd-spec.md
+Plus: /srv/jtel-stack/hersenspinsels/tibet-continuity-guardian.md
+       (Codex' parallel intake-discipline guide)
+
+  "Name is hint. Content is truth. Arrival is event."
+                                — Codex, 9 mei 2026
+"""
+
+__version__ = "0.3.3"
+__author__ = "Jasper van de Meent, Root AI, Codex"
+
+# Core stages — pure stdlib, always available
+from tibet_continuityd.backpressure import (
+    BackpressureMonitor,
+    BackpressureSnapshot,
+    BackpressureState,
+)
+from tibet_continuityd.police import (
+    FindingSeverity,
+    PoliceAction,
+    PoliceFinding,
+    PoliceScanner,
+    apply_action,
+)
+from tibet_continuityd.sniff import IntakeClass, sniff_payload
+from tibet_continuityd.trust_kernel import (
+    TrustQuery,
+    TrustVerdict,
+    apply_verdict_to_disposition,
+    load_policies,
+    query_trust_kernel,
+)
+from tibet_continuityd.watch import LaneWatcher, WatchEvent
+
+# Verify + Fork + Seal — require tibet-drop (install via [verify] extra)
+# Defensive imports: core daemon works without these.
+try:
+    from tibet_continuityd.verify_fork import (
+        CausalIDs,
+        VerifyForkResult,
+        verify_and_fork,
+    )
+    from tibet_continuityd.seal import SealEngine, SealResult
+    from tibet_continuityd.daemon import ContinuityDaemon
+    _HAS_VERIFY = True
+except ImportError:
+    # tibet-drop not on sys.path — verify/fork/seal/daemon unavailable.
+    # Core sniff/police/trust_kernel/watch/backpressure still work.
+    CausalIDs = None  # type: ignore
+    VerifyForkResult = None  # type: ignore
+    verify_and_fork = None  # type: ignore
+    SealEngine = None  # type: ignore
+    SealResult = None  # type: ignore
+    ContinuityDaemon = None  # type: ignore
+    _HAS_VERIFY = False
+
+__all__ = [
+    # Core (always available)
+    "LaneWatcher",
+    "WatchEvent",
+    "IntakeClass",
+    "sniff_payload",
+    "TrustQuery",
+    "TrustVerdict",
+    "query_trust_kernel",
+    "apply_verdict_to_disposition",
+    "load_policies",
+    "PoliceFinding",
+    "PoliceScanner",
+    "PoliceAction",
+    "FindingSeverity",
+    "apply_action",
+    "BackpressureMonitor",
+    "BackpressureSnapshot",
+    "BackpressureState",
+    # Verify-stage (None when tibet-drop unavailable)
+    "ContinuityDaemon",
+    "CausalIDs",
+    "VerifyForkResult",
+    "verify_and_fork",
+    "SealEngine",
+    "SealResult",
+    # Capability flag
+    "_HAS_VERIFY",
+]

tibet_continuityd-0.3.3/src/tibet_continuityd/__main__.py

@@ -0,0 +1,7 @@
+"""CLI entry: `python -m tibet_continuityd`."""
+import sys
+
+from tibet_continuityd.daemon import main
+
+if __name__ == "__main__":
+    sys.exit(main())

tibet_continuityd-0.3.3/src/tibet_continuityd/backpressure.py

@@ -0,0 +1,185 @@
+"""
+backpressure.py — Backpressure / circuit-breaker (v0.3.2, axe 3).
+
+Per Jaspers prompt 9 mei 2026:
+
+  "MUX 500 files/sec, sniff/verify 100/sec. Inbox > 5000 onverwerkt
+   → daemon signaleert MUX/network 'Halt' of TCP-windowing-stijl
+   backpressure. Geen self-inflicted DoS."
+
+This module implements that protection: monitor the inbox depth
+and emit state-transition audit events when pressure rises or
+falls. The daemon itself does NOT throttle its own work-rate
+(that would worsen things) — it signals UPSTREAM that producer
+should slow down.
+
+State machine:
+
+   NORMAL                  depth < low_water
+      │
+      │ depth ≥ low_water
+      ▼
+   PRESSURE_RISING         low_water ≤ depth < high_water
+      │
+      │ depth ≥ high_water
+      ▼
+   OVERLOADED              depth ≥ high_water
+      │
+      │ depth < low_water (hysteresis)
+      ▼
+   RECOVERING              transitional state
+      │
+      │ depth stable < low_water
+      ▼
+   NORMAL
+
+Hysteresis: NORMAL → OVERLOADED requires high_water,
+            OVERLOADED → NORMAL requires going back below
+            low_water (not just back below high_water).
+            This prevents oscillation at the boundary.
+
+Signal mechanism (v0.3.2 minimal):
+  emit "backpressure" audit-record at every state-transition
+  (= upstream consumers can read audit-stream and react)
+
+Future v0.3.x extensions:
+  - write signal-file at /var/lib/tibet/backpressure-state
+  - HTTP endpoint POST to mux upstream
+  - TIBET token emission for cross-host signaling
+"""
+from __future__ import annotations
+
+import time
+from dataclasses import dataclass, field
+from enum import Enum
+from pathlib import Path
+from typing import Optional
+
+
+class BackpressureState(Enum):
+    """Daemon's current capacity state."""
+    NORMAL = "normal"                  # depth < low_water
+    PRESSURE_RISING = "pressure-rising"  # low ≤ depth < high
+    OVERLOADED = "overloaded"          # depth ≥ high_water
+    RECOVERING = "recovering"          # was overloaded, depth dropping
+
+
+@dataclass
+class BackpressureSnapshot:
+    """One observation of inbox depth + current state."""
+    state: BackpressureState
+    inbox_depth: int                   # number of unprocessed files
+    low_water: int                     # threshold for "rising"
+    high_water: int                    # threshold for "overloaded"
+    transitioned: bool                 # state changed since last check
+    prev_state: Optional[BackpressureState] = None
+    ts_unix: float = field(default_factory=time.time)
+
+    def to_dict(self) -> dict:
+        return {
+            "state": self.state.value,
+            "inbox_depth": self.inbox_depth,
+            "low_water": self.low_water,
+            "high_water": self.high_water,
+            "transitioned": self.transitioned,
+            "prev_state": self.prev_state.value
+                if self.prev_state else None,
+            "ts_unix": self.ts_unix,
+        }
+
+
+@dataclass
+class BackpressureMonitor:
+    """Track inbox depth and compute state transitions.
+
+    Usage:
+        monitor = BackpressureMonitor(
+            lane=Path("/var/lib/tibet/inbox"),
+            low_water=2000,
+            high_water=5000,
+        )
+        snapshot = monitor.check()
+        if snapshot.transitioned:
+            # emit audit, optionally signal upstream
+            ...
+    """
+    lane: Path
+    low_water: int = 2000
+    high_water: int = 5000
+    _state: BackpressureState = BackpressureState.NORMAL
+
+    def __post_init__(self):
+        if self.low_water >= self.high_water:
+            raise ValueError(
+                f"low_water ({self.low_water}) must be < "
+                f"high_water ({self.high_water})"
+            )
+
+    def _measure_depth(self) -> int:
+        """Count files in lane (excluding subdirectories)."""
+        if not self.lane.exists() or not self.lane.is_dir():
+            return 0
+        try:
+            return sum(1 for entry in self.lane.iterdir()
+                       if entry.is_file())
+        except OSError:
+            return 0
+
+    def _classify_state(self, depth: int) -> BackpressureState:
+        """Compute target state from depth WITHOUT hysteresis logic.
+
+        Hysteresis is applied in check() — this is the raw mapping.
+        """
+        if depth >= self.high_water:
+            return BackpressureState.OVERLOADED
+        if depth >= self.low_water:
+            return BackpressureState.PRESSURE_RISING
+        return BackpressureState.NORMAL
+
+    def check(self) -> BackpressureSnapshot:
+        """Measure depth and update state with hysteresis."""
+        depth = self._measure_depth()
+        prev = self._state
+        target = self._classify_state(depth)
+
+        # Hysteresis: OVERLOADED can ONLY drop to RECOVERING (not
+        # straight to NORMAL via PRESSURE_RISING). This prevents
+        # oscillation when depth hovers near low_water.
+        new_state = target
+        if prev == BackpressureState.OVERLOADED and \
+                target != BackpressureState.OVERLOADED:
+            # transition out of overloaded → recovering first
+            if target == BackpressureState.NORMAL:
+                new_state = BackpressureState.RECOVERING
+            # else: target is PRESSURE_RISING, accept it
+        elif prev == BackpressureState.RECOVERING:
+            # In RECOVERING, stay until depth is fully back under
+            # low_water (= NORMAL target).
+            if target == BackpressureState.NORMAL:
+                new_state = BackpressureState.NORMAL
+            elif target == BackpressureState.OVERLOADED:
+                new_state = BackpressureState.OVERLOADED
+            else:
+                new_state = BackpressureState.RECOVERING
+
+        transitioned = (new_state != prev)
+        self._state = new_state
+
+        return BackpressureSnapshot(
+            state=new_state,
+            inbox_depth=depth,
+            low_water=self.low_water,
+            high_water=self.high_water,
+            transitioned=transitioned,
+            prev_state=prev if transitioned else None,
+        )
+
+
+# ─── Public API ─────────────────────────────────────────────────
+
+
+__all__ = [
+    "BackpressureMonitor",
+    "BackpressureSnapshot",
+    "BackpressureState",
+]