README overhaul and methodology-page roadmap sections

[dgunter]

Summary

• README.md: rewritten as a public-facing product README. Covers the five deterministic cards and the AI panel; the IR-centred pipeline (YAML → pySigma → normalized IR, built once, walked by every stage); the Pyramid of Pain resolution rules exactly as the methodology page states them (AND-min, OR-max, filters excluded but reported, TTP escalation ≥ tier 4 across ≥ 2 categories, bare NOT as allowlist at medium confidence, routing/outcome fields as context); confidence + provenance labels (deterministic:static, deterministic:metadata, inferred:llm); static-vs-dynamic analysis framing (dynamic explicitly not built); roadmap (dynamic analysis, Suricata/YARA as parallel parsers into the same IR, MCP server for agentic rule development, evaluation history, per-reviewer tokens); a two-paragraph Summiting the Pyramid comparison; local dev, testing, deployment, security notes, attribution, license. 237 lines. No "AST" wording anywhere.
• How this works page: three new sections appended before </main>, existing sections untouched: Static analysis today, dynamic analysis next; Deterministic checks for AI-assisted rule writing; How this relates to Summiting the Pyramid (links to ctid.mitre.org with target="_blank" rel="noreferrer").

Verification

• npx tsc --noEmit -p tsconfig.app.json clean
• npx vite build succeeds

Review focus

The Summiting the Pyramid paragraphs (README "Related work" and the last page section) make factual claims about the CTID methodology; please check them against the source before merging.

🤖 Generated with Claude Code

[github-actions]

SonarCloud analysis · PR #17

Quality gate: ✅ Passed · Open in SonarCloud

Condition	Actual	Required	Status
Reliability rating (new code)	A	≤ A	✅
Security rating (new code)	A	≤ A	✅
Maintainability rating (new code)	A	≤ A	✅
Duplication (new code)	0.0%	≤ 3.0%	✅
Security hotspots reviewed	100.0%	≥ 100.0%	✅

Open issues on new code: 0

No open issues on the changed code. 🎉

Commit 4981b95bfb8e · analysis task · posted by the Build workflow; edited in place on every push.