AegisGraph: graph-based application-layer assessment evidence platform for Secure Messaging Applications (SMAs). DARPA ASEMA HR0011SB20254-12 Tier 3 research. ReproChain CVE-2023-4863 reachability + PolyDiff differential parser fuzzing + claim-state governance + reproducible benchmark surface.
Graph-driven automated vulnerability discovery for secure messaging applications. 577 Industries' engineering implementation for DARPA SBIR Direct-to-Phase-II topic HR0011SB20254-12 (ASEMA).
-blue){kind=icon}
Looking for evaluator-facing artifacts? The sanitized public feasibility release lives at at tag . Start there if you're verifying claims in the ASEMA proposal.
577Industries/asema-feasibility-artifactsv1.0.0-asema-dp2-feasibilityThe engineering platform — the actual implementation behind AegisGraph:
| Subsystem | Path | What it does |
|---|---|---|
| PolyDiff Extended | aegisgraph/polydiff/ | Multi-format differential parsing across 6 parser families (url, image, opengraph, deeplink, qr, proto) with normalized fact vectors |
| HarnessGen | aegisgraph/harnessgen/ | Graph-driven polyglot fuzz-harness generation (Jazzer for JVM, libFuzzer+HWASAN for native, cargo-fuzz for Rust) |
| InvariantCheck | aegisgraph/invariants/ | 15 SMA-specific security invariants with publicly-auditable ground-truth fixtures; MASTG/SSDF mapping |
| CrossSMA | aegisgraph/crosssma/ | Cross-application propagation matrix (4 SMA targets × 6 patterns) with structural canonicalization |
| DynamicProbe (option period) | aegisgraph/dynamicprobe/ | Frida-instrumented AOSP+HWASAN emulator with structurally-enforced signed authorization gate |
| Coordinated Disclosure | aegisgraph/disclosure/ | Hash-chained disclosure ledger + 7-vendor routing + day-7/14/30/60/90 embargo timer + CERT/CC fallback |
| ReproChain | reprochain/ | Pre-disclosure simulation against CVE-2023-4863 (libwebp); vendored vuln+fix commits + ASAN harness |
| Extraction | extraction/ | Static extraction over pinned public SMAs (Signal Android, Element X Android); 8 CodeQL queries + 4 Semgrep rules + MobSF integration |
git clone https://github.com/577Industries/aegisgraph
cd aegisgraph
git checkout v1.0.0-tier3-research
# Recommended: use the pinned devcontainer
devcontainer up
make tooling-strict # verify pinned toolchain
python3 -m pytest -q # expect 1030 passed, 19 skipped
# Per-engine smoke tests
make reprochain-map # ReproChain reachability mapping
make polydiff-regression # PolyDiff differential parser regression (8 historical CVE rediscoveries)
make extract # static extraction over pinned SMAs
make smabench # SMABench benchmark generation
make validate # evidence + CETM validation
make reproduce # full reproduction pipeline
The CLI entrypoint is aegisgraph after installation, or python3 -m aegisgraph.cli from this checkout.
make export-public-sanitized and explicit human approval before publication.v1.0.0-tier3-research tag, commit d91c1df6).github/workflows/ci.yml runs on push; reproduce.yml is if: false until self-hosted runner is provisionedvalidator/sanitize_check.py enforces 9 rules across every public-export candidate before any artifact leaves this repoThe 14 ADRs in docs/decision-log/ document every architectural decision:
| ADR | Topic |
|---|---|
| 0001 | Repo split: engineering vs public-release boundary |
| 0002 | Private ReproChain handling |
| 0003 | libwebp selection for ReproChain target |
| 0004 | PolyDiff parser selection (initial url family + extension to 6 families) |
| 0005 | Validator migration |
| 0006 | Disclosure ownership (PI named owner; counsel review gate) |
| 0007–0012 | Engine architecture (HarnessGen, InvariantCheck, CrossSMA, DynamicProbe scaffolds) |
| 0013 | Schema v2 (additive extension for engine output) |
| 0014 | Coordinated disclosure ledger format (hash-chained JSONL) |
| 0020 | PolyDiff multi-family extension |
| 0021 | Validator export discipline |
The matching public feasibility release lives at 577Industries/asema-feasibility-artifacts:
Apache-2.0. See LICENSE.
SPEC.md is the working technical specification. If implementation and spec diverge, update the spec deliberately.
| SMABench | smabench/ | Three-ring benchmark design: synthetic (Ring 1), public-source static + reachability (Ring 2), authorized dynamic (Ring 3) |
| Validator + safety | validator/, aegisgraph/safety.py | Schema validation, sanitize-check (Rules 1–9), falsifiability via deliberate-corruption test |
| Schema | schema/ | 6 JSON schemas + Schema v2 additive extension (discovery_run, crash, disagreement, invariant_violation, cross_target_candidate, disclosure_event) |
| Decision log | docs/decision-log/ | 14 ADRs covering all architectural decisions |