Add reproducible evaluation and provenance research

2026-09-17 10:40:29 -05:00
parent d9fc3ca18b
commit 68f02d035f
53 changed files with 1432 additions and 14 deletions
@@ -0,0 +1,24 @@
+# Research Program
+
+## Research question
+
+Can a constrained, local-first security agent normalize AI-related artifacts, apply transparent policies, and produce useful evidence without executing untrusted content or sending it to an external service?
+
+## Current method
+
+AAISA separates discovery, immutable artifact evidence, deterministic policy evaluation, reporting, and human decision. Research claims are tied to versioned code, fixture digests, explicit limitations, and reproducible commands.
+
+## Current workstreams
+
+1. Artifact schemas and safe parsers
+2. Rule quality and evaluation science
+3. Prompt and agent-tool security
+4. Model and dataset provenance
+5. Software supply-chain evidence
+6. SARIF and interoperability
+7. Privacy, redaction, and secure report handling
+8. Contributor experience and governance
+
+## Research boundaries
+
+The default system does not execute artifacts, make network requests, exploit targets, recover credentials, or modify source content. Probabilistic analyzers remain out of scope until isolation, provenance, confidence, and data-governance requirements are approved.