WSQF-AI
Research grounding

WSQF-AI's measurement layer follows Prof. Hironori Washizaki's WSQF/WSQB methodology, and its design pulls from a handful of specific, citable papers and standards below — not a generic "AI code auditor" with a name attached for credibility. If a design choice on this page can't be pointed at a real citation, it doesn't belong here.

Primary sources

WSQF/WSQB

A SQuaRE-based framework (Washizaki et al., ICSE 2019) that measures real products against the standard's characteristics and benchmarks them against each other, instead of producing an abstract score. This is the methodology this project's measurement layer follows.

ICSE 2019 · 21 commercial products

SWEBOK Guide v4.0

The field's Software Engineering Body of Knowledge. v4.0 added Software Architecture, Security, and Operations as knowledge areas. Findings here are organized along the same knowledge-area lines.

IEEE Computer Society, Oct 2024

ML design-pattern catalogue

A multivocal literature review cataloguing 12 ML architecture patterns, 13 design patterns, and 8 anti-patterns (building on Sculley et al.'s "Hidden Technical Debt in Machine Learning Systems", NeurIPS 2015). Source for this project's ML-pattern detectors.

IEEE Computer, Vol. 55 No. 3, 2022

AI Security Continuum

A multi-dimensional model (computing-environment, technical-activity, and architecture-layer continua, plus automation and security-measure levels) for framing AI security risk. Planned as the basis for M4c's severity framing — not yet implemented.

CAIN 2024
Design-decision trace

Quality is measured against a standard's real characteristics, never an invented 0–100 scoreWSQF/WSQB's entire methodology (ICSE 2019)
A dedicated AI/ML quality dimension (not bolted onto generic code quality)ISO/IEC 25059 (SQuaRE's AI extension)
A design-pattern recognition engine for ML codeWashizaki et al.'s ML design-pattern catalogue (Computer 2022; PLoP 2024)
Security findings must be proven (exploited in a real sandbox), never asserted from a static matchReused directly from Project KAGUTSUCHI's engine — independently arrived at, but consonant with the evidence-based rigor WSQF/WSQB itself demands
Security findings will be framed via a multi-dimensional continuum, not flat OWASP-style tags (planned, M4c)AI Security Continuum (Washizaki & Yoshioka, CAIN 2024)
Findings organized by SWEBOK knowledge areaSWEBOK Guide v4.0 (2024)
Evidence has explicit provenance (repo → file → line → analyzer → rule → observation), never a flat "AI said so"SQuaRE's own vocabulary discipline (ISO/IEC 25000-2)
A benchmark corpus, not just a single-repo reportWSQF/WSQB's 21-product comparative benchmark study
The pipeline (target state)

Repository
    |
    v
Ingestion & canonical model        (M1 -- ISO/IEC 25000-2 vocabulary: Finding / Evidence / Observation)
    |
    v
SQuaRE quality measurement          (M2 -- Maintainability, Reliability, Portability, ...)
    |
    v
AI/ML quality extension             (M3 -- ISO/IEC 25059 characteristics + ML design-pattern engine)
    |
    v
Security, proven not asserted       (M4 -- Kagutsuchi's engine, re-platformed,
    |                                       real sandbox verification, one shape so far)
    v
Remediation                         (M7 -- real auto-fix diffs + GitHub PR delivery)
    |
    v
Evidence & benchmark engine         (M5 -- WSQF/WSQB-style corpus benchmarking)
    |
    v
Dashboard, report, CI/PR gate       (M6 / M7c -- this website)
What this project is not

Not "paste a repo into an LLM and get a report." The AI layer (wherever it appears — pattern recognition assistance, finding explanation, hypothesis generation for the security layer) sits inside a pipeline whose ground truth comes from standards-grounded measurement and, for security claims, actual sandboxed proof — exactly the "AI proposes, something deterministic and reviewed disposes" principle Project KAGUTSUCHI was already built on, now extended to the full SQuaRE/SWEBOK-grounded scope described above.