43 lines
1.4 KiB
Markdown
43 lines
1.4 KiB
Markdown
# Research Roadmap
|
|
|
|
## Foundation
|
|
|
|
- [x] Stable artifact, finding, and report models
|
|
- [x] Safe local discovery and SHA-256 evidence
|
|
- [x] Built-in defensive policy rules
|
|
- [x] JSON and SARIF reports
|
|
- [x] Unit tests and contributor guidance
|
|
- [x] Threat model and research brief
|
|
- [ ] Publish schema files for JSON and rule metadata
|
|
- [ ] Add deterministic corpus manifests
|
|
|
|
## Evaluation harness
|
|
|
|
- [ ] Define positive, negative, and ambiguous fixture classes
|
|
- [ ] Add per-rule precision and recall measurement
|
|
- [ ] Add runtime and peak-memory benchmarks
|
|
- [ ] Add report reproducibility checks
|
|
- [ ] Establish release-blocking redaction tests
|
|
|
|
## Artifact expansion
|
|
|
|
- [ ] SPDX and CycloneDX SBOM parsing
|
|
- [ ] Model card and dataset card schemas
|
|
- [ ] Agent tool-definition and permission analysis
|
|
- [ ] Infrastructure-as-code provenance checks
|
|
- [ ] Signed artifact and attestation verification
|
|
|
|
## Controlled intelligence research
|
|
|
|
- [ ] Define isolation requirements for probabilistic analyzers
|
|
- [ ] Represent model identity, confidence, and explanation evidence
|
|
- [ ] Compare deterministic and probabilistic detection performance
|
|
- [ ] Design explicit opt-in and offline behavior
|
|
|
|
## Pilot validation
|
|
|
|
- [ ] Review approved non-production pilot scopes
|
|
- [ ] Publish measured limitations and failure cases
|
|
- [ ] Complete privacy and operational readiness reviews
|
|
- [ ] Define production-readiness gaps without overstating assurance
|