Research data model

• Research question: one of the five programme questions (RQ-001 to RQ-005), with status, priority, and linked experiments.
• Experiment: a hypothesis with configuration, datasets, models, and runs.
• Dataset: a versioned collection of specimens or features with collection method, class balance, and known bias.
• Model: a trained artefact with version, training dataset, and evaluation metrics.
• Sample: a malware specimen identified by hash, with access level and analysis state.
• Result: an evaluated outcome linked back to the experiment that produced it.
• Agent and mitigation action: agentic proposals and their human approval state.
• Audit and governance records: who did what, and under which policy.

Workspace records use prefixed identifiers such as `DEMO-EXP-0001` during development so demonstration data is always distinguishable. Public malware records use a `TB-` identifier alongside their SHA-256 hash; the hash is the canonical key for a specimen.

Every sample, dataset, and governance record carries one of five access levels:

• PUBLIC: safe for the public site.
• RESTRICTED: signed-in researchers only.
• PRIVATE: owner and administrators.
• SENSITIVE: named reviewers under governance policy.
• QUARANTINED: specimen held for review; never displayed beyond its hash.

Results and publications carry a provenance chain: an ordered list of links from research question to experiment, dataset, model, sample, and processing steps. The workspace renders this chain on result and reproducibility pages so any figure can be traced back to its inputs.

The Supabase project defines tables for profiles, samples, analysis jobs and reports, indicators, behavioural logs, engine status and logs, training datasets and commands, sample labels, experiments and runs, baseline runs, mitigation actions, and VirusShare import state, all with row-level security. The web app will map these tables onto the TypeScript contracts above when the backend is reconnected.