577 Industries · AegisGraph · DARPA SBIR HR0011SB20254-12

AegisGraph for ASEMA

Graph-driven automated vulnerability discovery for secure messaging applications. Six engines coordinated by an evidence graph as planner. Public feasibility release for DARPA SBIR Direct-to-Phase-II.

README + Reviewer Start Here Evaluator Quickstart 6-Engine Architecture GitHub Repo Engineering Platform

What This Proves

Six discovery engines, coordinatedPolyDiff Extended, HarnessGen, InvariantCheck, CrossSMA, DynamicProbe, Coordinated Disclosure — the graph plans, engines hunt, output cycles back as new evidence.
Real public-source targets, anchoredSignal Android and Element X Android are commit-pinned; no target source redistributed; static observations stay bounded as reachability evidence.
Honest claim discipline, falsifiable82-claim CETM with status-typed (A / E / P) entries; 0 forbidden-I. A deliberate-corruption test confirms validators reject malformed input.
End-to-end reproducibleOne-command verification under 5 minutes; full engineering reproduction in under 1 hour cold via pinned devcontainer.

Six-Engine Architecture

AegisGraph 6-engine architecture: PolyDiff Extended, HarnessGen, InvariantCheck, CrossSMA, DynamicProbe, Coordinated Disclosure

The Discovery Loop

The discovery loop: graph plans, engine hunts, evidence cycles back

Claim-State Lifecycle

Claim-state machine: observed through disclosed-public, with structurally-enforced gates

State-of-the-Art Comparison

SOTA capability matrix: AegisGraph against Semgrep, CodeQL, MobSF, FlowDroid, AFL++/libFuzzer, ProVerif/Tamarin, and skilled manual review

Reproduce in 5 Minutes

git clone https://github.com/577-Industries/asema-feasibility-artifacts
cd asema-feasibility-artifacts
git checkout v1.0.0-asema-dp2-feasibility
node evidence/validate-evidence.mjs                   # safety_scan: passed
node evidence/validate-cetm.mjs evidence/cetm.json    # issues_count: 0
sha256sum -c evidence/checksums.sha256                # all OK

Pointers

Detailed docsAll docs/ — quickstart, claim discipline, release boundaries, architecture, graph schema, SMABench methodology, SOTA comparison, responsible disclosure
What's NOT here (by design)EXCLUSIONS.md — crash bytes, raw source, embargoed disclosures, engineering-private artifacts