Skip to content

Sprint 4: Canonical Model Completion #27

@Goose-Flight

Description

@Goose-Flight

Sprint 4: Canonical Model Completion

Goal

Make the data model truly forensic-ready — evidence-linked findings, hypotheses, signal quality, and full provenance linkage.

Deliverables

  • SignalQuality model
  • EvidenceReference model (links a finding back to evidence item + stream + time range)
  • Expanded Finding model (finding_id, plugin_id, evidence_references[], confidence, supporting/contradicting metrics)
  • Hypothesis model (supporting_findings[], contradicting_findings[], confidence, unresolved_questions[])
  • Provenance linkage across parsed and analyzed artifacts
  • Serialization support for exports
  • Plugins emit findings with evidence references (at least evidence_id + stream name)
  • findings.json enriched with full forensic fields

Acceptance criteria

  • Findings can cite evidence clearly (evidence_id, stream, time range)
  • Hypotheses can link supporting and contradicting findings
  • Parsed and analyzed artifacts are traceable back to evidence
  • All models serialize/deserialize cleanly

Metadata

Metadata

Assignees

No one assigned

    Projects

    No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions