Establish AAISA research foundation

docs/ROADMAP.md

@@ -0,0 +1,42 @@
+# Research Roadmap
+
+## Foundation
+
+- [x] Stable artifact, finding, and report models
+- [x] Safe local discovery and SHA-256 evidence
+- [x] Built-in defensive policy rules
+- [x] JSON and SARIF reports
+- [x] Unit tests and contributor guidance
+- [x] Threat model and research brief
+- [ ] Publish schema files for JSON and rule metadata
+- [ ] Add deterministic corpus manifests
+
+## Evaluation harness
+
+- [ ] Define positive, negative, and ambiguous fixture classes
+- [ ] Add per-rule precision and recall measurement
+- [ ] Add runtime and peak-memory benchmarks
+- [ ] Add report reproducibility checks
+- [ ] Establish release-blocking redaction tests
+
+## Artifact expansion
+
+- [ ] SPDX and CycloneDX SBOM parsing
+- [ ] Model card and dataset card schemas
+- [ ] Agent tool-definition and permission analysis
+- [ ] Infrastructure-as-code provenance checks
+- [ ] Signed artifact and attestation verification
+
+## Controlled intelligence research
+
+- [ ] Define isolation requirements for probabilistic analyzers
+- [ ] Represent model identity, confidence, and explanation evidence
+- [ ] Compare deterministic and probabilistic detection performance
+- [ ] Design explicit opt-in and offline behavior
+
+## Pilot validation
+
+- [ ] Review approved non-production pilot scopes
+- [ ] Publish measured limitations and failure cases
+- [ ] Complete privacy and operational readiness reviews
+- [ ] Define production-readiness gaps without overstating assurance