Platform documentation

THREATBYTES™ is the research platform for a doctoral programme on agentic, cognitive SI for predictive malware intelligence. It has two faces: a public site that documents the research openly, and an authenticated workspace where researchers manage specimens, experiments, datasets, models, and governed mitigation.

A separate Python analysis engine performs ingestion, sandbox execution, feature extraction, and model training. The engine never touches the database directly; it talks to the platform only through the REST API described in the shared contract.

• Researchers and collaborators who will use the authenticated workspace.
• Reviewers and examiners checking how results, datasets, and models are traced.
• Integrators building clients against the platform API.
• Security teams consuming public outputs such as the IP blacklist.

The platform is in a frontend-first stage. Public pages are live. The authenticated workspace runs on a typed DEMO repository and mock sign-in so that screens, permissions, and provenance panels can be validated before the backend is rebuilt.

The platform API (`/api/v1`), Supabase persistence, and live engine integration are reintroduced in the next stage. Pages that show DEMO data say so, and identifiers use a `DEMO-` prefix so they can never be mistaken for real records.

• Web architecture: how the site, workspace, engine, and contract fit together.
• Research data model: entities, identifiers, access levels, and provenance.
• Engine integration: how the analysis engine exchanges jobs and results with the platform.
• Public datasets: how the malware database, live map, and IP blacklist are built and should be used.
• Accounts and roles: who can do what in the workspace.
• API reference: every operation in the shared OpenAPI contract.