Technical Documentation
CLI Reference
Everything is automatic. The CLI is for visibility and the one manual control: turning live mode on.
Quick Start
# Install curl -sSL install.ternaryphysics.com | sh # Check status ternaryphysics status # After shadow period, enable live mode ternaryphysics live on Commands
status
Show system status including model version, accuracy, and sample counts.
ternaryphysics status TernaryPhysics AI at the kernel boundary System Status ---------------------------------------- System: running Mode: live Active model: v5 (Threat-Response: Blocker) Accuracy: 99.2% Total models: 5 Samples: 112,797 Auto-trains: 4 Auto-deploys: 4 The domain (e.g., "Threat-Response: Blocker") is automatically discovered based on observed behavior — not configured.
models
List all model versions with accuracy and training sample counts.
ternaryphysics models Model Versions ---------------------------------------------------------------------- Ver Type Accuracy Samples ----- ------------------------ -------- ---------- *v5 Threat-Response: Blocker 99.2% 112,797 v4 Threat-Response: Blocker 98.7% 89,421 v3 Traffic-Steering: Balancer 97.1% 54,892 * = active model models show <version>
Show detailed information for a specific model including architecture and data provenance.
ternaryphysics models show 5 Model v5 ---------------------------------------- Created: 2026-03-01T14:22:08 Domain: Threat-Response: Blocker Accuracy: 99.21% Samples: 112,797 Train time: 2.4s Architecture: Features: 6 Hidden: 8 Outputs: 4 Validation: Shadow acc: 99.15% Improved: True live
Show current live/shadow state.
ternaryphysics live Live Mode ---------------------------------------- State: shadow Model is observing only (logging what it would do) Since: 2026-02-26T10:00:00 To change: ./ternaryphysics live on # Enable live actions live on / live off
Enable or disable live mode. This is the only manual control.
# Enable live actions ternaryphysics live on # Return to shadow mode ternaryphysics live off Shadow mode — Model observes and learns but takes no actions on traffic.
Live mode — Model actively routes, filters, or blocks based on its decisions.
Live mode — Model actively routes, filters, or blocks based on its decisions.
audit
Show audit summary with event counts by type.
ternaryphysics audit Audit Summary -------------------------------------------------- Total events: 847 First event: 2026-02-26T10:00:00 Last event: 2026-03-01T18:46:17 Events by type: model_deployed 4 training_complete 4 live_mode_enabled 1 live_mode_disabled 2 audit log
Show detailed audit log with filtering options.
# Last 50 events ternaryphysics audit log # Filter by type ternaryphysics audit log --type rollback # Last 7 days ternaryphysics audit log --since 7d # With details ternaryphysics audit log -v audit export
Export audit log for compliance tools (SOC2, etc.).
# Export as JSON ternaryphysics audit export -o audit_report.json # Export as CSV ternaryphysics audit export --format csv -o audit.csv # Last 30 days only ternaryphysics audit export --since 30d -o monthly.json config
Show current configuration including retention policies.
ternaryphysics config Configuration -------------------------------------------------- Paths: Data directory: /var/lib/ternary-physics BPF maps: /sys/fs/bpf/ternary-physics Training: Auto-train: enabled Min samples: 1,000 Train interval: 1h Safety: Shadow period: 30d Performance gate: enabled Min accuracy: 90% Data Retention: Samples: 30d Audit log: 1y Model versions: last 10 rollback
Manual rollback to a previous model version.
# Rollback to previous version ternaryphysics rollback # Rollback to specific version ternaryphysics rollback --version 3
Rollback is available if needed. The performance gate normally prevents bad models from deploying. The last 10 model versions are kept for rollback.
What's Automatic
Everything below happens without intervention:
- Telemetry collection — Continuous ingestion from kernel ringbuf
- Model training — Triggered when enough new samples accumulate
- Shadow validation — New models validated before deployment
- Performance gate — Blocks regressing models before deployment
- Hot-swap deployment — Atomic model updates, zero downtime
- Domain discovery — Determines what domain the model operates in
Domain Discovery
The system automatically discovers what domain it's operating in based on observed behavior:
| Threat-Response | Blocker, Mitigator, Throttler, Rejector, ... |
| Traffic-Steering | Balancer, Router, Distributor, Forwarder, ... |
| Data-Collection | Filter, Sampler, Collector, Logger, ... |
| Traffic-Marking | Tagger, Marker, Labeler, ... |
| Passthrough | Handler, Allower, Passer, ... |
The domain emerges from behavior — different environments produce different specializations. New roles emerge from observed traffic patterns. You don't configure this; you observe it.
Global Options
--data-dir | Data directory (default: /var/lib/ternary-physics) |
--map-path | BPF map path (default: /sys/fs/bpf/ternary-physics) |
-v, --verbose | Verbose output with additional details |
Troubleshooting
Status shows "not running"
# Check if systemd service is running systemctl status ternary-physics # Restart if needed sudo systemctl restart ternary-physics # Check logs for errors journalctl -u ternary-physics -n 50 Model not training
Training requires minimum samples. Check if enough data has been collected:
ternaryphysics status # If samples < 1000, wait for more traffic # Training triggers automatically when threshold is met BPF programs not loaded
# Check if BPF filesystem is mounted mount | grep bpf # List loaded BPF programs bpftool prog list | grep ternary # Check kernel version (requires 5.10+) uname -r Permission denied errors
BPF operations require CAP_BPF and CAP_NET_ADMIN capabilities:
# Run with sudo sudo ternaryphysics status # Or grant capabilities to your user sudo setcap cap_bpf,cap_net_admin=eip /usr/local/bin/ternaryphysics High memory usage
Check retention settings and sample counts:
ternaryphysics config # If samples are unbounded, check data retention # Default: 30 days sample retention, 1 year audit log # Manual cleanup if needed sudo systemctl restart ternary-physics Accuracy not improving
Accuracy depends on traffic diversity:
- Not enough traffic: Wait for more samples to accumulate
- Mixed workload: System may need more time to converge on pattern
- Changing patterns: The model adapts, but rapid changes may slow convergence
# Check model history ternaryphysics models # Review audit log for training events ternaryphysics audit log --type training_complete Need to uninstall
# Stop and disable service sudo systemctl stop ternary-physics sudo systemctl disable ternary-physics # Remove BPF programs sudo rm -rf /sys/fs/bpf/ternary-physics # Remove data (optional) sudo rm -rf /var/lib/ternary-physics # Remove binary sudo rm /usr/local/bin/ternaryphysics Still having issues? Check logs with
journalctl -u ternary-physics --since today or reach out at support@ternaryphysics.com