Skip to content

ROADMAP.adoc

Latest commit

 

History

History
84 lines (61 loc) · 3.2 KB

ROADMAP.adoc

File metadata and controls

84 lines (61 loc) · 3.2 KB
Raw

cookie-rebound Roadmap

Table of Contents

Overview

cookie-rebound verifies that website cookie consent banners actually do what they claim. It scans cookie behaviour before and after consent interaction, detecting dark patterns such as pre-ticked boxes, ignored rejections, and tracking cookies set before consent is granted. Built with Idris2 ABI proofs, Zig FFI, and JSONL storage.

Current State (2026-03-29)

Status: v1.0 COMPLETE (completed 2026-03-28)

What Works

  • Idris2 ABI definitions with dependent type proofs (src/interface/abi/Types.idr, Layout.idr, Foreign.idr)

  • Zig FFI implementation (src/interface/ffi/src/main.zig) with build system and integration tests

  • Cookie consent verification logic

  • JSONL storage backend for scan results

  • 35 tests passing

  • Full RSR compliance (17 workflows, contractiles, AI manifest)

  • Dual-track architecture (human-readable root + machine-readable .machine_readable/)

Milestones

v1.0.0 — Core Verification (COMPLETE)

  • ✓ Idris2 ABI definitions with dependent type proofs

  • ✓ Zig FFI bridge (C-compatible, zero runtime dependencies)

  • ✓ Cookie consent verification logic

  • ✓ JSONL storage for scan results

  • ✓ 35 tests passing

  • ✓ Generated C headers from ABI

  • ✓ RSR template compliance (17 workflows)

  • ✓ AI Gatekeeper Protocol (0-AI-MANIFEST.a2ml)

  • ✓ Contractile system (Mustfile, Trustfile, Dustfile, Intentfile)

  • ✓ Stapeln container ecosystem files (selur-compose, vordr, rokur)

  • ✓ CI/CD pipeline

  • ✓ Documentation

v1.1.0 — Browser Integration (PLANNED)

  • ❏ Groove browser extension integration (localhost bridge, MPL-2.0)

  • ❏ FireFlag cross-reference (flag consent databases)

  • ❏ Real-time consent monitoring (watch cookies change as user navigates)

  • ❏ GDPR/ePrivacy compliance scoring

  • ❏ Dark pattern taxonomy (pre-ticked, ignored rejection, stealth tracking, confusing UI)

v1.2.0 — Reporting (PLANNED)

  • ❏ HTML report generation (visual summary of consent violations)

  • ❏ SARIF output for CI/CD integration

  • ❏ VeriSimDB persistence (scan history, temporal tracking)

  • ❏ PanLL Panel-W module (consent scan results as event chains)

  • ❏ claim-forge timestamping (GPG + OpenTimestamps for evidence)

v2.0.0 — Scale (PLANNED)

  • ❏ Batch scanning (crawl entire domains, sitemap-aware)

  • ❏ Historical consent tracking via VeriSimDB (temporal modality)

  • ❏ Public reporting API (JSON-RPC or REST)

  • ❏ BoJ server cartridge (MCP protocol access)

  • ❏ Comparative analysis (track consent compliance changes over time)

  • ❏ Multi-jurisdiction support (GDPR, CCPA, LGPD, POPIA)

Post-v2.0

  • Academic contribution — Dataset of consent banner compliance across top sites

  • Regulatory integration — Export evidence packages for DPA complaints

  • Community scanning — Shared consent compliance database (opt-in)

License & Governance

License: MPL-2.0 (MPL-2.0)

Author: Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>

Last Updated: 2026-03-29