Skip to content

Sprint 5: Analyzer Contract and First Plugin Conversion #28

@USTungsten

Description

@USTungsten

Sprint 5 Goal

Turn plugins into formal analyzers with trust-aware metadata. Plugins currently emit thin Finding objects via a lifting layer. Sprint 5 converts them to emit ForensicFinding directly under a formal plugin contract.

Deliverables

  • Analyzer contract (plugins emit ForensicFinding directly)
  • Plugin manifest schema (plugin_id, version, category, required_streams, trust metadata)
  • Plugin diagnostics model
  • Trust-state representation (built-in-trusted, local-unsigned, community, blocked)
  • Conversion of first built-in analyzers to new contract
  • GUI plugin inventory basics (list, trust state, version, which ran)

Acceptance Criteria

  • Plugins have formal metadata
  • Findings record plugin version and trust state
  • GUI shows plugin inventory and trust state
  • Converted plugins emit evidence-backed ForensicFindings directly (no lifting layer needed)

Spec Reference

Sprint Plan doc §7, Plugin Trust and Tuning Spec §2–6

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions