What makes a claim inspectable?
Source location, provenance, deterministic signals, threat context, integrity data, and the limits of the observation remain attached to the claim.
Inspectable evidenceResearch
Make trust measurable.
“Safe,” “fixed,” and “verified” are claims. Aegis research asks what observable evidence is sufficient to support them, what must remain independent, and what should happen when proof is incomplete.
Explore active questions ↓Research criteria
Three questions before a security claim becomes a decision.
What counts as independent checking?
A verifier remains distinct from the system that proposed the security-sensitive action. Deterministic checks do not disappear into model agreement.
Independent rolesDid the patch close the path?
Patch acceptance is not the target metric. The stronger question is whether the original failure stops reproducing without creating a new one.
Post-change proofMethodology
Separate observation from conclusion.
Aegis represents different evidence types as different records. A scanner result is not model review. Model review is not independent verification. Reproduction is not authorization. Applying a patch is not proof that the patch held.
Fail closed when evidence is missing.
If a required check cannot run, the result should not silently become success. Aegis distinguishes VERIFIED, PARTIAL, and FAILED states.
Reproduce the behavior that matters.
Where practical, verify the original security-sensitive behavior against bounded, explicit targets rather than trusting a clean-looking diff.
Prefer reproducibility over leaderboard theater.
Future benchmark work should state versions, environments, prompts where relevant, deterministic fixtures, repetition strategy, and uncertainty. No public benchmark or leaderboard is claimed on this website today.
Active questions
Questions worth proving.
These are research directions, not claims that every part is already shipped. The distinction is part of the methodology.
Secure-remediation correctness
How often does an automatically proposed security patch truly remove vulnerable behavior rather than move it, hide it, over-restrict the feature, or introduce a regression?
Evidence sufficiency
Which combinations of static evidence, project tests, threat context, controlled reproduction, and independent review are sufficient for different classes of security claim?
Action boundaries
As software agents gain broader tool access, how should a trust layer decide whether an action is necessary, within authorized scope, and reversible if it fails?
Durable trust records
How can a system retain useful project security history without turning uncertain or superseded conclusions into permanent facts?
Decision sufficiency
What evidence should be required before a security-sensitive change is allowed, sent to review, or blocked, and how should the requirement vary by risk and context?
Open scrutiny
Research should survive inspection.
The current implementation, fixtures, security model, and release gate are available in the public repository.