[WIP] AIVSS SSVC 0.1 draft

.gitignore

@@ -132,3 +132,4 @@ ssvc2-applier-wip.xlsx
 _version.py
 node_modules
 tmp
+/src/scratch/

.markdownlint.yml

@@ -9,6 +9,9 @@ MD004:
 # 013 Line length
 # Disabled because we have a lot of long lines. We should fix this eventually.
 MD013: false
+# 028 No no-blanks-blockquote
+# Disabled because we use mkdocs admonitions which use blockquotes, and two consecutive admonitions create blank lines in between.
+MD028: false
 # 033 Inline HTML
 # Disabled because we use inline HTML (<br/> in table cells for example)
 MD033: false

data/csv/aivss/agentic_impact_level_1_0_0.csv

@@ -0,0 +1,28 @@
+row,Execution Power v1.0.0 (aivss),Environment & Adaptation v1.0.0 (aivss),Predictability and Influence v1.0.0 (aivss),Agentic Impact Level v1.0.0 (aivss)
+0,constrained,isolated,verifiable,copilot
+1,constrained,isolated,uncertain,copilot
+2,constrained,isolated,opaque,specialist
+3,constrained,connected,verifiable,copilot
+4,constrained,connected,uncertain,specialist
+5,constrained,connected,opaque,specialist
+6,constrained,pervasive,verifiable,specialist
+7,constrained,pervasive,uncertain,specialist
+8,constrained,pervasive,opaque,prime mover
+9,capable,isolated,verifiable,copilot
+10,capable,isolated,uncertain,specialist
+11,capable,isolated,opaque,specialist
+12,capable,connected,verifiable,specialist
+13,capable,connected,uncertain,specialist
+14,capable,connected,opaque,specialist
+15,capable,pervasive,verifiable,specialist
+16,capable,pervasive,uncertain,specialist
+17,capable,pervasive,opaque,prime mover
+18,high leverage,isolated,verifiable,specialist
+19,high leverage,isolated,uncertain,specialist
+20,high leverage,isolated,opaque,prime mover
+21,high leverage,connected,verifiable,specialist
+22,high leverage,connected,uncertain,specialist
+23,high leverage,connected,opaque,prime mover
+24,high leverage,pervasive,verifiable,prime mover
+25,high leverage,pervasive,uncertain,prime mover
+26,high leverage,pervasive,opaque,prime mover

data/csv/aivss/aivss_decision_table_1_0_0.csv

@@ -0,0 +1,28 @@
+row,Exploitation v1.1.0,Agentic Impact Level v1.0.0 (aivss),Systemic Impact v1.0.0 (aivss),"Defer, Scheduled, Out-of-Cycle, Immediate v1.0.0"
+0,none,copilot,contained,defer
+1,none,copilot,significant,scheduled
+2,none,copilot,critical,out-of-cycle
+3,none,specialist,contained,scheduled
+4,none,specialist,significant,scheduled
+5,none,specialist,critical,out-of-cycle
+6,none,prime mover,contained,scheduled
+7,none,prime mover,significant,out-of-cycle
+8,none,prime mover,critical,immediate
+9,public poc,copilot,contained,scheduled
+10,public poc,copilot,significant,scheduled
+11,public poc,copilot,critical,out-of-cycle
+12,public poc,specialist,contained,scheduled
+13,public poc,specialist,significant,out-of-cycle
+14,public poc,specialist,critical,out-of-cycle
+15,public poc,prime mover,contained,out-of-cycle
+16,public poc,prime mover,significant,out-of-cycle
+17,public poc,prime mover,critical,immediate
+18,active,copilot,contained,out-of-cycle
+19,active,copilot,significant,out-of-cycle
+20,active,copilot,critical,immediate
+21,active,specialist,contained,out-of-cycle
+22,active,specialist,significant,immediate
+23,active,specialist,critical,immediate
+24,active,prime mover,contained,immediate
+25,active,prime mover,significant,immediate
+26,active,prime mover,critical,immediate

data/csv/aivss/environmental_adaptation_1_0_0.csv

@@ -0,0 +1,82 @@
+row,Memory Use v1.0.0 (aivss),Contextual Awareness v1.0.0 (aivss),Dynamic Identity v1.0.0 (aivss),Multi-Agent Interactions v1.0.0 (aivss),Environment & Adaptation v1.0.0 (aivss)
+0,stateless,isolated,fixed,solo,isolated
+1,stateless,isolated,fixed,scripted,isolated
+2,stateless,isolated,fixed,orchestrated,connected
+3,stateless,isolated,scoped roles,solo,isolated
+4,stateless,isolated,scoped roles,scripted,connected
+5,stateless,isolated,scoped roles,orchestrated,connected
+6,stateless,isolated,assumed identity,solo,connected
+7,stateless,isolated,assumed identity,scripted,connected
+8,stateless,isolated,assumed identity,orchestrated,pervasive
+9,stateless,trusted-signal,fixed,solo,isolated
+10,stateless,trusted-signal,fixed,scripted,connected
+11,stateless,trusted-signal,fixed,orchestrated,connected
+12,stateless,trusted-signal,scoped roles,solo,connected
+13,stateless,trusted-signal,scoped roles,scripted,connected
+14,stateless,trusted-signal,scoped roles,orchestrated,connected
+15,stateless,trusted-signal,assumed identity,solo,connected
+16,stateless,trusted-signal,assumed identity,scripted,connected
+17,stateless,trusted-signal,assumed identity,orchestrated,pervasive
+18,stateless,ambient,fixed,solo,connected
+19,stateless,ambient,fixed,scripted,connected
+20,stateless,ambient,fixed,orchestrated,pervasive
+21,stateless,ambient,scoped roles,solo,connected
+22,stateless,ambient,scoped roles,scripted,connected
+23,stateless,ambient,scoped roles,orchestrated,pervasive
+24,stateless,ambient,assumed identity,solo,pervasive
+25,stateless,ambient,assumed identity,scripted,pervasive
+26,stateless,ambient,assumed identity,orchestrated,pervasive
+27,local recall,isolated,fixed,solo,isolated
+28,local recall,isolated,fixed,scripted,connected
+29,local recall,isolated,fixed,orchestrated,connected
+30,local recall,isolated,scoped roles,solo,connected
+31,local recall,isolated,scoped roles,scripted,connected
+32,local recall,isolated,scoped roles,orchestrated,connected
+33,local recall,isolated,assumed identity,solo,connected
+34,local recall,isolated,assumed identity,scripted,connected
+35,local recall,isolated,assumed identity,orchestrated,pervasive
+36,local recall,trusted-signal,fixed,solo,connected
+37,local recall,trusted-signal,fixed,scripted,connected
+38,local recall,trusted-signal,fixed,orchestrated,connected
+39,local recall,trusted-signal,scoped roles,solo,connected
+40,local recall,trusted-signal,scoped roles,scripted,connected
+41,local recall,trusted-signal,scoped roles,orchestrated,connected
+42,local recall,trusted-signal,assumed identity,solo,connected
+43,local recall,trusted-signal,assumed identity,scripted,connected
+44,local recall,trusted-signal,assumed identity,orchestrated,pervasive
+45,local recall,ambient,fixed,solo,connected
+46,local recall,ambient,fixed,scripted,connected
+47,local recall,ambient,fixed,orchestrated,pervasive
+48,local recall,ambient,scoped roles,solo,connected
+49,local recall,ambient,scoped roles,scripted,connected
+50,local recall,ambient,scoped roles,orchestrated,pervasive
+51,local recall,ambient,assumed identity,solo,pervasive
+52,local recall,ambient,assumed identity,scripted,pervasive
+53,local recall,ambient,assumed identity,orchestrated,pervasive
+54,shared memory,isolated,fixed,solo,connected
+55,shared memory,isolated,fixed,scripted,connected
+56,shared memory,isolated,fixed,orchestrated,pervasive
+57,shared memory,isolated,scoped roles,solo,connected
+58,shared memory,isolated,scoped roles,scripted,connected
+59,shared memory,isolated,scoped roles,orchestrated,pervasive
+60,shared memory,isolated,assumed identity,solo,pervasive
+61,shared memory,isolated,assumed identity,scripted,pervasive
+62,shared memory,isolated,assumed identity,orchestrated,pervasive
+63,shared memory,trusted-signal,fixed,solo,connected
+64,shared memory,trusted-signal,fixed,scripted,connected
+65,shared memory,trusted-signal,fixed,orchestrated,pervasive
+66,shared memory,trusted-signal,scoped roles,solo,connected
+67,shared memory,trusted-signal,scoped roles,scripted,connected
+68,shared memory,trusted-signal,scoped roles,orchestrated,pervasive
+69,shared memory,trusted-signal,assumed identity,solo,pervasive
+70,shared memory,trusted-signal,assumed identity,scripted,pervasive
+71,shared memory,trusted-signal,assumed identity,orchestrated,pervasive
+72,shared memory,ambient,fixed,solo,pervasive
+73,shared memory,ambient,fixed,scripted,pervasive
+74,shared memory,ambient,fixed,orchestrated,pervasive
+75,shared memory,ambient,scoped roles,solo,pervasive
+76,shared memory,ambient,scoped roles,scripted,pervasive
+77,shared memory,ambient,scoped roles,orchestrated,pervasive
+78,shared memory,ambient,assumed identity,solo,pervasive
+79,shared memory,ambient,assumed identity,scripted,pervasive
+80,shared memory,ambient,assumed identity,orchestrated,pervasive

data/csv/aivss/execution_power_1_0_0.csv

@@ -0,0 +1,82 @@
+row,Autonomy of Action v1.0.0 (aivss),Tool Use v1.0.0 (aivss),Self-Modification v1.1.0 (aivss),Goal-Driven Planning v1.0.0 (aivss),Execution Power v1.0.0 (aivss)
+0,gated,viewer,fixed,reactive,constrained
+1,gated,viewer,fixed,assisted,constrained
+2,gated,viewer,fixed,autonomous,capable
+3,gated,viewer,tunable,reactive,constrained
+4,gated,viewer,tunable,assisted,capable
+5,gated,viewer,tunable,autonomous,capable
+6,gated,viewer,mutable,reactive,capable
+7,gated,viewer,mutable,assisted,capable
+8,gated,viewer,mutable,autonomous,high leverage
+9,gated,operator,fixed,reactive,constrained
+10,gated,operator,fixed,assisted,capable
+11,gated,operator,fixed,autonomous,capable
+12,gated,operator,tunable,reactive,capable
+13,gated,operator,tunable,assisted,capable
+14,gated,operator,tunable,autonomous,capable
+15,gated,operator,mutable,reactive,capable
+16,gated,operator,mutable,assisted,capable
+17,gated,operator,mutable,autonomous,high leverage
+18,gated,administrator,fixed,reactive,capable
+19,gated,administrator,fixed,assisted,capable
+20,gated,administrator,fixed,autonomous,high leverage
+21,gated,administrator,tunable,reactive,capable
+22,gated,administrator,tunable,assisted,capable
+23,gated,administrator,tunable,autonomous,high leverage
+24,gated,administrator,mutable,reactive,high leverage
+25,gated,administrator,mutable,assisted,high leverage
+26,gated,administrator,mutable,autonomous,high leverage
+27,scoped,viewer,fixed,reactive,constrained
+28,scoped,viewer,fixed,assisted,capable
+29,scoped,viewer,fixed,autonomous,capable
+30,scoped,viewer,tunable,reactive,capable
+31,scoped,viewer,tunable,assisted,capable
+32,scoped,viewer,tunable,autonomous,capable
+33,scoped,viewer,mutable,reactive,capable
+34,scoped,viewer,mutable,assisted,capable
+35,scoped,viewer,mutable,autonomous,high leverage
+36,scoped,operator,fixed,reactive,capable
+37,scoped,operator,fixed,assisted,capable
+38,scoped,operator,fixed,autonomous,capable
+39,scoped,operator,tunable,reactive,capable
+40,scoped,operator,tunable,assisted,capable
+41,scoped,operator,tunable,autonomous,capable
+42,scoped,operator,mutable,reactive,capable
+43,scoped,operator,mutable,assisted,capable
+44,scoped,operator,mutable,autonomous,high leverage
+45,scoped,administrator,fixed,reactive,capable
+46,scoped,administrator,fixed,assisted,capable
+47,scoped,administrator,fixed,autonomous,high leverage
+48,scoped,administrator,tunable,reactive,capable
+49,scoped,administrator,tunable,assisted,capable
+50,scoped,administrator,tunable,autonomous,high leverage
+51,scoped,administrator,mutable,reactive,high leverage
+52,scoped,administrator,mutable,assisted,high leverage
+53,scoped,administrator,mutable,autonomous,high leverage
+54,free-running,viewer,fixed,reactive,capable
+55,free-running,viewer,fixed,assisted,capable
+56,free-running,viewer,fixed,autonomous,high leverage
+57,free-running,viewer,tunable,reactive,capable
+58,free-running,viewer,tunable,assisted,capable
+59,free-running,viewer,tunable,autonomous,high leverage
+60,free-running,viewer,mutable,reactive,high leverage
+61,free-running,viewer,mutable,assisted,high leverage
+62,free-running,viewer,mutable,autonomous,high leverage
+63,free-running,operator,fixed,reactive,capable
+64,free-running,operator,fixed,assisted,capable
+65,free-running,operator,fixed,autonomous,high leverage
+66,free-running,operator,tunable,reactive,capable
+67,free-running,operator,tunable,assisted,capable
+68,free-running,operator,tunable,autonomous,high leverage
+69,free-running,operator,mutable,reactive,high leverage
+70,free-running,operator,mutable,assisted,high leverage
+71,free-running,operator,mutable,autonomous,high leverage
+72,free-running,administrator,fixed,reactive,high leverage
+73,free-running,administrator,fixed,assisted,high leverage
+74,free-running,administrator,fixed,autonomous,high leverage
+75,free-running,administrator,tunable,reactive,high leverage
+76,free-running,administrator,tunable,assisted,high leverage
+77,free-running,administrator,tunable,autonomous,high leverage
+78,free-running,administrator,mutable,reactive,high leverage
+79,free-running,administrator,mutable,assisted,high leverage
+80,free-running,administrator,mutable,autonomous,high leverage

data/csv/aivss/predictability_and_influence_1_0_0.csv

@@ -0,0 +1,82 @@
+row,Non-Determinism v1.0.0 (aivss),Opacity & Reflexivity v1.0.0 (aivss),Verification Capability v1.0.0 (aivss),Deceptiveness Potential v1.0.0 (aivss),Predictability and Influence v1.0.0 (aivss)
+0,deterministic,transparent,provable,plain,verifiable
+1,deterministic,transparent,provable,fluent,verifiable
+2,deterministic,transparent,provable,persuasive,uncertain
+3,deterministic,transparent,key invariants verifiable,plain,verifiable
+4,deterministic,transparent,key invariants verifiable,fluent,uncertain
+5,deterministic,transparent,key invariants verifiable,persuasive,uncertain
+6,deterministic,transparent,unverifiable,plain,uncertain
+7,deterministic,transparent,unverifiable,fluent,uncertain
+8,deterministic,transparent,unverifiable,persuasive,opaque
+9,deterministic,fragmented,provable,plain,verifiable
+10,deterministic,fragmented,provable,fluent,uncertain
+11,deterministic,fragmented,provable,persuasive,uncertain
+12,deterministic,fragmented,key invariants verifiable,plain,uncertain
+13,deterministic,fragmented,key invariants verifiable,fluent,uncertain
+14,deterministic,fragmented,key invariants verifiable,persuasive,uncertain
+15,deterministic,fragmented,unverifiable,plain,uncertain
+16,deterministic,fragmented,unverifiable,fluent,uncertain
+17,deterministic,fragmented,unverifiable,persuasive,opaque
+18,deterministic,opaque,provable,plain,uncertain
+19,deterministic,opaque,provable,fluent,uncertain
+20,deterministic,opaque,provable,persuasive,opaque
+21,deterministic,opaque,key invariants verifiable,plain,uncertain
+22,deterministic,opaque,key invariants verifiable,fluent,uncertain
+23,deterministic,opaque,key invariants verifiable,persuasive,opaque
+24,deterministic,opaque,unverifiable,plain,opaque
+25,deterministic,opaque,unverifiable,fluent,opaque
+26,deterministic,opaque,unverifiable,persuasive,opaque
+27,bounded,transparent,provable,plain,verifiable
+28,bounded,transparent,provable,fluent,uncertain
+29,bounded,transparent,provable,persuasive,uncertain
+30,bounded,transparent,key invariants verifiable,plain,uncertain
+31,bounded,transparent,key invariants verifiable,fluent,uncertain
+32,bounded,transparent,key invariants verifiable,persuasive,uncertain
+33,bounded,transparent,unverifiable,plain,uncertain
+34,bounded,transparent,unverifiable,fluent,uncertain
+35,bounded,transparent,unverifiable,persuasive,opaque
+36,bounded,fragmented,provable,plain,uncertain
+37,bounded,fragmented,provable,fluent,uncertain
+38,bounded,fragmented,provable,persuasive,uncertain
+39,bounded,fragmented,key invariants verifiable,plain,uncertain
+40,bounded,fragmented,key invariants verifiable,fluent,uncertain
+41,bounded,fragmented,key invariants verifiable,persuasive,uncertain
+42,bounded,fragmented,unverifiable,plain,uncertain
+43,bounded,fragmented,unverifiable,fluent,uncertain
+44,bounded,fragmented,unverifiable,persuasive,opaque
+45,bounded,opaque,provable,plain,uncertain
+46,bounded,opaque,provable,fluent,uncertain
+47,bounded,opaque,provable,persuasive,opaque
+48,bounded,opaque,key invariants verifiable,plain,uncertain
+49,bounded,opaque,key invariants verifiable,fluent,uncertain
+50,bounded,opaque,key invariants verifiable,persuasive,opaque
+51,bounded,opaque,unverifiable,plain,opaque
+52,bounded,opaque,unverifiable,fluent,opaque
+53,bounded,opaque,unverifiable,persuasive,opaque
+54,high-variance,transparent,provable,plain,uncertain
+55,high-variance,transparent,provable,fluent,uncertain
+56,high-variance,transparent,provable,persuasive,opaque
+57,high-variance,transparent,key invariants verifiable,plain,uncertain
+58,high-variance,transparent,key invariants verifiable,fluent,uncertain
+59,high-variance,transparent,key invariants verifiable,persuasive,opaque
+60,high-variance,transparent,unverifiable,plain,opaque
+61,high-variance,transparent,unverifiable,fluent,opaque
+62,high-variance,transparent,unverifiable,persuasive,opaque
+63,high-variance,fragmented,provable,plain,uncertain
+64,high-variance,fragmented,provable,fluent,uncertain
+65,high-variance,fragmented,provable,persuasive,opaque
+66,high-variance,fragmented,key invariants verifiable,plain,uncertain
+67,high-variance,fragmented,key invariants verifiable,fluent,uncertain
+68,high-variance,fragmented,key invariants verifiable,persuasive,opaque
+69,high-variance,fragmented,unverifiable,plain,opaque
+70,high-variance,fragmented,unverifiable,fluent,opaque
+71,high-variance,fragmented,unverifiable,persuasive,opaque
+72,high-variance,opaque,provable,plain,opaque
+73,high-variance,opaque,provable,fluent,opaque
+74,high-variance,opaque,provable,persuasive,opaque
+75,high-variance,opaque,key invariants verifiable,plain,opaque
+76,high-variance,opaque,key invariants verifiable,fluent,opaque
+77,high-variance,opaque,key invariants verifiable,persuasive,opaque
+78,high-variance,opaque,unverifiable,plain,opaque
+79,high-variance,opaque,unverifiable,fluent,opaque
+80,high-variance,opaque,unverifiable,persuasive,opaque

data/json/decision_points/aivss/agentic_impact_level_1_0_0.json

@@ -0,0 +1,25 @@
+{
+  "namespace": "aivss",
+  "key": "AIL",
+  "version": "1.0.0",
+  "name": "Agentic Impact Level",
+  "definition": "Determines the agentic impact level of a vulnerability based on its characteristics and potential effects.",
+  "schemaVersion": "2.0.0",
+  "values": [
+    {
+      "key": "C",
+      "name": "Copilot",
+      "definition": "The agent is primarily a copilot or assistant. Its actions are heavily constrained, requiring human oversight. The agent explicitly does not have rights to execute code."
+    },
+    {
+      "key": "S",
+      "name": "Specialist",
+      "definition": "The agent is a specialist with significant autonomy within a defined domain.It can use powerful tools and may learn from interactions."
+    },
+    {
+      "key": "P",
+      "name": "Prime Mover",
+      "definition": "The agent is a prime mover with broad autonomy. It can orchestrate other systems, modify its own logic, and interact with critical infrastructure."
+    }
+  ]
+}

data/json/decision_points/aivss/autonomy_of_action_1_0_0.json

@@ -0,0 +1,25 @@
+{
+  "namespace": "aivss",
+  "key": "AA",
+  "version": "1.0.0",
+  "name": "Autonomy of Action",
+  "definition": "Determines the autonomy of action level of a vulnerability based on its characteristics and potential effects.",
+  "schemaVersion": "2.0.0",
+  "values": [
+    {
+      "key": "G",
+      "name": "Gated",
+      "definition": "The agent cannot act without human approval."
+    },
+    {
+      "key": "S",
+      "name": "Scoped",
+      "definition": "The agent can act independently but only in tightly bounded spaces."
+    },
+    {
+      "key": "F",
+      "name": "Free-Running",
+      "definition": "The agent can execute actions in live systems without a human in the loop."
+    }
+  ]
+}

data/json/decision_points/aivss/contextual_awareness_1_0_0.json

@@ -0,0 +1,25 @@
+{
+  "namespace": "aivss",
+  "key": "CA",
+  "version": "1.0.0",
+  "name": "Contextual Awareness",
+  "definition": "Determines the degree to which an AI system senses and incorporates context from its environment and external signals.",
+  "schemaVersion": "2.0.0",
+  "values": [
+    {
+      "key": "I",
+      "name": "Isolated",
+      "definition": "No external contextual signals."
+    },
+    {
+      "key": "T",
+      "name": "Trusted-Signal",
+      "definition": "Uses only vetted, narrow, structured signals."
+    },
+    {
+      "key": "A",
+      "name": "Ambient",
+      "definition": "Reacts to broad, open-ended environmental signals."
+    }
+  ]
+}