Add reproducible evaluation and provenance research

wiki-source/Contributor-Guide.md

@@ -0,0 +1,18 @@
+# Contributor Guide
+
+## Workflow
+
+1. Select or open a research issue.
+2. Create a focused branch from `main`.
+3. Add code, positive and negative tests, and documentation.
+4. Run `python scripts/verify.py`.
+5. Open a pull request and describe security, privacy, and research limitations.
+6. Address review findings before merge.
+
+## Safety requirements
+
+Do not commit live credentials, personal information, proprietary artifacts, executable malware, or weaponized payloads. Rules may not execute inspected content, access the network, mutate source artifacts, or include matched credential values in reports.
+
+## Research integrity
+
+State what the evidence demonstrates and what it does not. Preserve failed and ambiguous cases. Do not generalize synthetic-corpus metrics to production systems.

wiki-source/Evaluation-Harness.md

@@ -0,0 +1,21 @@
+# Evaluation Harness
+
+## Reproduction
+
+```bash
+PYTHONPATH=src python -m aaisa evaluate research/corpus-v1/manifest.json --output evaluation.json
+```
+
+The evaluator scans each artifact independently and compares observed findings with exact expected counts. It reports true positives, false positives, false negatives, precision, and recall when defined.
+
+## Reproducibility controls
+
+- Corpus paths cannot escape the manifest directory.
+- Symlinked fixtures are rejected.
+- Duplicate case identifiers and unknown rule identifiers are rejected.
+- The corpus identity covers manifest bytes, fixture paths, and fixture SHA-256 digests.
+- Timestamps are excluded from evaluation output.
+
+## Interpretation
+
+The foundation corpus is a 12-case deterministic conformance suite. It is not a representative sample and does not establish field precision, recall, exploitability, or production readiness.

wiki-source/Home.md

@@ -0,0 +1,18 @@
+# AAISA Research Wiki
+
+Advanced Artifactual Intelligence Security Agent is a public, defensive research project for evidence-first analysis of AI-system artifacts.
+
+## Current baseline
+
+Version 0.2.0 adds a deterministic evaluation harness, eight documented rules, four machine-readable schemas, a 12-case conformance corpus, stable finding fingerprints, and structured checks for agent authorization, SLSA provenance, and CycloneDX ML-BOM evidence.
+
+## Start here
+
+- [Research Program](Research-Program)
+- [Rule Catalog](Rule-Catalog)
+- [Evaluation Harness](Evaluation-Harness)
+- [Contributor Guide](Contributor-Guide)
+- [Standards and References](Standards-and-References)
+- [Roadmap](Roadmap)
+
+AAISA reports evidence for human review. A finding is not proof of compromise, and a clean report is not proof of security.

wiki-source/README.md

@@ -0,0 +1,3 @@
+# Wiki Source
+
+These Markdown files are the version-controlled source for the project's Gitea wiki. Changes should be reviewed with the code and published to the wiki after merge.

wiki-source/Research-Program.md

@@ -0,0 +1,24 @@
+# Research Program
+
+## Research question
+
+Can a constrained, local-first security agent normalize AI-related artifacts, apply transparent policies, and produce useful evidence without executing untrusted content or sending it to an external service?
+
+## Current method
+
+AAISA separates discovery, immutable artifact evidence, deterministic policy evaluation, reporting, and human decision. Research claims are tied to versioned code, fixture digests, explicit limitations, and reproducible commands.
+
+## Current workstreams
+
+1. Artifact schemas and safe parsers
+2. Rule quality and evaluation science
+3. Prompt and agent-tool security
+4. Model and dataset provenance
+5. Software supply-chain evidence
+6. SARIF and interoperability
+7. Privacy, redaction, and secure report handling
+8. Contributor experience and governance
+
+## Research boundaries
+
+The default system does not execute artifacts, make network requests, exploit targets, recover credentials, or modify source content. Probabilistic analyzers remain out of scope until isolation, provenance, confidence, and data-governance requirements are approved.

wiki-source/Roadmap.md

@@ -0,0 +1,22 @@
+# Roadmap
+
+## Completed baseline
+
+- Safe local artifact discovery and SHA-256 evidence
+- JSON and SARIF output
+- Eight documented deterministic rules
+- Versioned schemas and rule catalog
+- 12-case evaluation corpus and TP, FP, FN accounting
+- Agent authorization, SLSA provenance, and ML-BOM checks
+
+## Open research
+
+- Ambiguous and multilingual prompt-injection corpus
+- Formal CycloneDX and SLSA schema validation
+- Runtime and peak-memory benchmarks
+- Signed provenance verification policy
+- Release-blocking redaction regression suite
+- Blind-labeled public artifact study
+- Isolation contract for probabilistic analyzers
+
+The public issue tracker is the authoritative work queue.

wiki-source/Rule-Catalog.md

@@ -0,0 +1,16 @@
+# Rule Catalog
+
+| Rule | Severity | Purpose |
+|---|---:|---|
+| `AAISA-SECRET-001` | High | Detect credential-shaped values while redacting matches |
+| `AAISA-PROMPT-001` | Medium | Detect common instruction-override and protected-context disclosure language |
+| `AAISA-DEPENDENCY-001` | Medium | Detect Python requirements without exact version pins |
+| `AAISA-CONTAINER-001` | Medium | Detect untagged or mutable-latest container references |
+| `AAISA-PROVENANCE-001` | Medium | Detect missing model or dataset source, version, license, or digest fields |
+| `AAISA-AGENT-001` | High | Detect wildcard tools, command execution without approval, and unrestricted network tools |
+| `AAISA-PROVENANCE-002` | High | Detect incomplete SLSA provenance subject, input, build, or builder bindings |
+| `AAISA-MLBOM-001` | Medium | Detect missing identity, version, digest, or model-card evidence in ML-BOM components |
+
+Use `aaisa rules --format json` for the machine-readable catalog and `aaisa explain RULE_ID` for references and supported artifact kinds.
+
+New rules must satisfy the repository's Rule Authoring Contract and include positive, negative, boundary, and redaction tests.

wiki-source/Standards-and-References.md

@@ -0,0 +1,14 @@
+# Standards and References
+
+- [NIST AI 600-1 Generative AI Profile](https://doi.org/10.6028/NIST.AI.600-1)
+- [OWASP Agent Control Standard](https://genai.owasp.org/resource/agent-control-standard-acs/)
+- [OWASP Agentic AI Threats and Mitigations](https://genai.owasp.org/resource/agentic-ai-threats-and-mitigations/)
+- [MITRE ATLAS](https://atlas.mitre.org/)
+- [SLSA 1.2 Provenance](https://slsa.dev/spec/v1.2/provenance)
+- [in-toto Attestation Framework](https://github.com/in-toto/attestation/tree/main/spec/v1)
+- [CycloneDX 1.7 JSON Reference](https://cyclonedx.org/docs/1.7/json/)
+- [CycloneDX Authoritative Guide to AI and ML-BOM](https://cyclonedx.org/guides/OWASP_CycloneDX-Authoritative-Guide-to-AI-ML-BOM-en.pdf)
+- [SARIF 2.1.0 OASIS Standard](https://docs.oasis-open.org/sarif/sarif/v2.1.0/os/sarif-v2.1.0-os.html)
+- [CWE-798 Use of Hard-coded Credentials](https://cwe.mitre.org/data/definitions/798.html)
+
+References guide rule design; AAISA does not claim certification or complete conformance with every referenced framework.

wiki-source/_Sidebar.md

@@ -0,0 +1,7 @@
+- [Home](Home)
+- [Research Program](Research-Program)
+- [Rule Catalog](Rule-Catalog)
+- [Evaluation Harness](Evaluation-Harness)
+- [Contributor Guide](Contributor-Guide)
+- [Standards and References](Standards-and-References)
+- [Roadmap](Roadmap)