[predictor2718]

Type of change

• New AVE record submission
• Update to existing AVE record
• Schema change (v1.0.0)
• New detection rule (YARA / Semgrep / pattern)
• Crosswalk addition or update
• Documentation improvement
• Other:

---

Description

Refreshes the cfgaudit crosswalk from v1.13.0 to v1.16.0, against the record set at 7d32d20 (87 records, 61 static_detection). This spans three cfgaudit releases (v1.14.0, v1.15.0, v1.16.0), which added eight rules, CFG107 through CFG114.

64 rules onto 27 classes → 66 onto 28. Two new rule-to-class pairs:

Rule	Class
CFG113	AVE-2026-00001 metamorphic payload via external config fetch (an instruction file telling the agent to fetch remote text and follow it). New class for this crosswalk.
CFG114	AVE-2026-00064 zero-click project-load auto-run (committed OpenCode plugin and tool code). Measured on opencode 1.18.18: plugins run when OpenCode starts in the repository, tools when it loads an agent, both with no prompt.

CFG114 also reports committed Copilot CLI project extensions, at info only, because those load after folder trust and behind an experimental flag. The rule emits one id, so the note says so rather than claiming zero-click for that half.

Six rules left unmapped on purpose, under config_surfaces_beyond_ave:

• A configuration-declared environment that loads code into every shell (CFG107 Codex shell_environment_policy.set, CFG110 Claude Code settings env). Same mechanism as AVE-2026-00055, but that record is bound to an MCP launch config.
• A committed scheduler that fires prompts on a timer (CFG108, .claude/scheduled_tasks.json). It bypasses no gate, so AVE-2026-00063 does not fit.
• A declared configuration that never loads (CFG109, and the discarded-file case of CFG012). Measured: Codex falls back to defaults, and Claude Code silently discards a whole settings file on a top-level type error or one unloadable PreToolUse/PermissionRequest hook entry.
• A committed credential source sent to a committed endpoint (CFG112, MCP bearer_token_file).
• CFG111 (an invisible character inside a permission rule or hook matcher) joins CFG101 on the existing "guardrail that does not hold" row.

Three new static records listed under gaps:

• AVE-2026-00082 narrows the CFG102 surface without closing it. The record asserts silent shadowing across roots of differing trust, which a repository-scoped scan does not establish.
• 00084 needs a diff against the last-reviewed plugin version.
• 00085 needs cross-skill correlation.

Stale "new" labels on entries from earlier revisions are dropped.

The status change for AVE-2026-00052, 00053 and 00060 discussed in #234 is deliberately not part of this PR. I will mark those rows once that change has landed, as agreed there.

python3 scripts/validate_crosswalks.py passes (11/11).

---

AVE record(s)

Mapped for the first time: AVE-2026-00001 (CFG113). Added to an existing mapping: AVE-2026-00064 (CFG114). New entries under gaps: AVE-2026-00082, AVE-2026-00084, AVE-2026-00085. No record file is changed.

---

Checklist

For all PRs

• I have read CONTRIBUTING.md
• ave_id values are immutable — no renumbering
• Schema version string is 1.0.0 (the crosswalk validates against schema/crosswalk-1.0.0.schema.json)
• No references to SPEC.md (removed), template.json (removed), or bawbel/bawbel-ave (wrong path)
• I agree my contribution is licensed under Apache 2.0

[chaksaray]

Thanks. Reviewed against the source: all 66 rule-to-id pairs match cfgaudit v1.16.0's avemap.go with none missing either way, every mapped record is active and static_detection, and the coverage block is consistent (114 rules, 66 mapped, 28 classes, 61 static records matches the corpus). The two additions check out against the fingerprints: CFG113 to 00001 directly, and CFG114 to 00064 with the opencode measurement documented. Validators and tests pass. Merging.