47 lines
1.7 KiB
Markdown
47 lines
1.7 KiB
Markdown
# Research Roadmap
|
|
|
|
## Foundation
|
|
|
|
- [x] Stable artifact, finding, and report models
|
|
- [x] Safe local discovery and SHA-256 evidence
|
|
- [x] Built-in defensive policy rules
|
|
- [x] JSON and SARIF reports
|
|
- [x] Unit tests and contributor guidance
|
|
- [x] Threat model and research brief
|
|
- [x] Publish schema files for scan reports, corpus manifests, and evaluation results
|
|
- [x] Add deterministic corpus manifests and content-derived corpus identity
|
|
- [x] Publish a versioned rule catalog with standards references
|
|
- [x] Add stable finding fingerprints across JSON and SARIF
|
|
|
|
## Evaluation harness
|
|
|
|
- [x] Define initial positive and negative fixture classes
|
|
- [x] Add per-rule precision and recall measurement
|
|
- [ ] Add runtime and peak-memory benchmarks
|
|
- [x] Add report reproducibility checks
|
|
- [ ] Establish release-blocking redaction tests
|
|
|
|
## Artifact expansion
|
|
|
|
- [ ] SPDX and CycloneDX SBOM parsing
|
|
- [x] Initial CycloneDX ML-BOM model-card and digest checks
|
|
- [x] Initial agent tool-definition and permission analysis
|
|
- [x] Initial SLSA provenance v1 binding checks
|
|
- [ ] Model card and dataset card validation profiles
|
|
- [ ] Infrastructure-as-code provenance checks
|
|
- [ ] Signed artifact and attestation verification
|
|
|
|
## Controlled intelligence research
|
|
|
|
- [ ] Define isolation requirements for probabilistic analyzers
|
|
- [ ] Represent model identity, confidence, and explanation evidence
|
|
- [ ] Compare deterministic and probabilistic detection performance
|
|
- [ ] Design explicit opt-in and offline behavior
|
|
|
|
## Pilot validation
|
|
|
|
- [ ] Review approved non-production pilot scopes
|
|
- [ ] Publish measured limitations and failure cases
|
|
- [ ] Complete privacy and operational readiness reviews
|
|
- [ ] Define production-readiness gaps without overstating assurance
|