1.7 KiB
1.7 KiB
Research Roadmap
Foundation
- Stable artifact, finding, and report models
- Safe local discovery and SHA-256 evidence
- Built-in defensive policy rules
- JSON and SARIF reports
- Unit tests and contributor guidance
- Threat model and research brief
- Publish schema files for scan reports, corpus manifests, and evaluation results
- Add deterministic corpus manifests and content-derived corpus identity
- Publish a versioned rule catalog with standards references
- Add stable finding fingerprints across JSON and SARIF
Evaluation harness
- Define initial positive and negative fixture classes
- Add per-rule precision and recall measurement
- Add runtime and peak-memory benchmarks
- Add report reproducibility checks
- Establish release-blocking redaction tests
Artifact expansion
- SPDX and CycloneDX SBOM parsing
- Initial CycloneDX ML-BOM model-card and digest checks
- Initial agent tool-definition and permission analysis
- Initial SLSA provenance v1 binding checks
- Model card and dataset card validation profiles
- Infrastructure-as-code provenance checks
- Signed artifact and attestation verification
Controlled intelligence research
- Define isolation requirements for probabilistic analyzers
- Represent model identity, confidence, and explanation evidence
- Compare deterministic and probabilistic detection performance
- Design explicit opt-in and offline behavior
Pilot validation
- Review approved non-production pilot scopes
- Publish measured limitations and failure cases
- Complete privacy and operational readiness reviews
- Define production-readiness gaps without overstating assurance