# Research Roadmap

## Foundation

- [x] Stable artifact, finding, and report models
- [x] Safe local discovery and SHA-256 evidence
- [x] Built-in defensive policy rules
- [x] JSON and SARIF reports
- [x] Unit tests and contributor guidance
- [x] Threat model and research brief
- [ ] Publish schema files for JSON and rule metadata
- [ ] Add deterministic corpus manifests

## Evaluation harness

- [ ] Define positive, negative, and ambiguous fixture classes
- [ ] Add per-rule precision and recall measurement
- [ ] Add runtime and peak-memory benchmarks
- [ ] Add report reproducibility checks
- [ ] Establish release-blocking redaction tests

## Artifact expansion

- [ ] SPDX and CycloneDX SBOM parsing
- [ ] Model card and dataset card schemas
- [ ] Agent tool-definition and permission analysis
- [ ] Infrastructure-as-code provenance checks
- [ ] Signed artifact and attestation verification

## Controlled intelligence research

- [ ] Define isolation requirements for probabilistic analyzers
- [ ] Represent model identity, confidence, and explanation evidence
- [ ] Compare deterministic and probabilistic detection performance
- [ ] Design explicit opt-in and offline behavior

## Pilot validation

- [ ] Review approved non-production pilot scopes
- [ ] Publish measured limitations and failure cases
- [ ] Complete privacy and operational readiness reviews
- [ ] Define production-readiness gaps without overstating assurance