diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 5a3690a..95e6a15 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -56,6 +56,9 @@ jobs: - name: Mutation-ThM trail soft warning run: python scripts/check_mutation_thm_trail.py + - name: framework_sources present for every mapped framework (hard failure) + run: python scripts/check_framework_sources.py --strict + - name: docs/terms.md matches the live schema (hard failure) run: python scripts/check_terms_sync.py diff --git a/CHANGELOG.md b/CHANGELOG.md index 440dd0c..086c8b3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,19 @@ Format: [Semantic Versioning](https://semver.org). Schema versions and record se ## [Unreleased] ### Changed +- `framework_sources` backfill completed and `scripts/check_framework_sources.py + --strict` now runs corpus-wide in CI, no longer deferred (#245, #260, + #264 were the earlier passes). The 61 records still missing a pin + entry (56 for `nist_ai_rmf`, 10 for `mitre_atlas`) now carry an + `unknown` declaration each, since no citable version or commit + exists for any of the 66: every `mitre_atlas` gap was checked back + to the commit that added it and each confirmed the technique against + MITRE's own current data at the time without citing a dated + snapshot, and a repo-wide history search found no dated verification + event for `nist_ai_rmf` at all. `docs/terms-relationships.md`'s + coverage numbers are recomputed from live data; one of its prior + clauses is corrected along the way, not just its numbers (see that + file's own note). - New standing check, `scripts/check_mutation_thm_trail.py`: soft-warns on records where `mutation_count` is 1 or higher but `aivss.notes` has no discoverable mention of the ThM decision made when that diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index bc90576..b3bb557 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -160,7 +160,7 @@ python scripts/check_vulnerability_taxonomy.py # soft-warns on records missing python scripts/check_vulnerability_taxonomy.py --strict --only AVE-2026-NNNNN # your new record must carry all three taxonomy fields python scripts/check_mutation_thm_trail.py # soft-warns on records with mutation_count >= 1 and no ThM-decision trail in aivss.notes python scripts/check_mutation_thm_trail.py --strict --only AVE-2026-NNNNN # if your edit raises mutation_count, aivss.notes must state the ThM decision (raised or unchanged, either way) -python scripts/check_framework_sources.py --strict --only AVE-2026-NNNNN # if your record carries owasp_mcp/owasp_asi/mitre_atlas/nist_ai_rmf, each needs a framework_sources entry +python scripts/check_framework_sources.py --strict --only AVE-2026-NNNNN # CI enforces this for every record now; run it scoped to yours before pushing, same check either way python scripts/generate_terms.py # regenerate docs/terms.md after any schema field or description change python scripts/check_terms_sync.py # hard failure if docs/terms.md disagrees with the live schema -- run before opening a PR pytest tests/ -x -q # full suite: schema, AIVSS arithmetic, mitigation enums diff --git a/docs/terms-relationships.md b/docs/terms-relationships.md index a186646..84f6c1d 100644 --- a/docs/terms-relationships.md +++ b/docs/terms-relationships.md @@ -61,13 +61,25 @@ framework_sources**: the first four are the mapping itself — which category a record corresponds to in an external framework. framework_sources is provenance for that mapping — which version or commit of the referenced framework the mapping was made against. A -record can carry the mapping without the provenance; as of the last -corpus-wide backfill pass, `owasp_mcp` (required on every record) and -`owasp_asi` have full coverage (80 of 80, and 69 of 69 tagged records -respectively), `mitre_atlas` is partially backfilled (40 of 50 tagged -records, covering exactly the ones a dated, citable audit event actually -verified), and `nist_ai_rmf` has none yet — no audit trail for it was -ever found in this project's history. framework_sources exists +record can carry the mapping without the provenance; as of the +2026-10-15 backfill, `owasp_mcp` and `owasp_asi` have full, real-pin +coverage (87 of 87, and 74 of 74 tagged records respectively, every +entry a real version or commit). `mitre_atlas` has a real, citable +version/commit pin on 4 of its 54 tagged records (AVE-2026-00082, +-00084, -00086, -00087, all pinned against ATLAS v5.6.0); the other 50 +carry an `unknown` declaration dated 2026-08-09, from the original +backfill pass. Correcting this document's own prior claim here rather +than carrying it forward: that prior sentence said those 50 covered +"the ones a dated, citable audit event actually verified," which, +checked directly against the live records, is not what they are -- +every one of them has `pin_status: "unknown"`, not a verified pin. +`nist_ai_rmf` now carries an `unknown` declaration on all 56 tagged +records, added in the same 2026-10-15 pass; it previously had none, +and no dated verification event for it was ever found anywhere in +this project's history, confirmed again before this backfill. An +`unknown` entry means the mapping predates framework_sources tracking +and the version it was actually read against is not recoverable; it +records an honest gap, not a lower-confidence pin. framework_sources exists specifically because an unversioned or unratified framework's category meaning can shift under an unpinned mapping: see OWASP/www-project-mcp-top-10#52, the live case (not a hypothetical) that diff --git a/docs/terms.md b/docs/terms.md index 8ba23ca..71d6311 100644 --- a/docs/terms.md +++ b/docs/terms.md @@ -67,13 +67,25 @@ framework_sources**: the first four are the mapping itself — which category a record corresponds to in an external framework. framework_sources is provenance for that mapping — which version or commit of the referenced framework the mapping was made against. A -record can carry the mapping without the provenance; as of the last -corpus-wide backfill pass, `owasp_mcp` (required on every record) and -`owasp_asi` have full coverage (80 of 80, and 69 of 69 tagged records -respectively), `mitre_atlas` is partially backfilled (40 of 50 tagged -records, covering exactly the ones a dated, citable audit event actually -verified), and `nist_ai_rmf` has none yet — no audit trail for it was -ever found in this project's history. framework_sources exists +record can carry the mapping without the provenance; as of the +2026-10-15 backfill, `owasp_mcp` and `owasp_asi` have full, real-pin +coverage (87 of 87, and 74 of 74 tagged records respectively, every +entry a real version or commit). `mitre_atlas` has a real, citable +version/commit pin on 4 of its 54 tagged records (AVE-2026-00082, +-00084, -00086, -00087, all pinned against ATLAS v5.6.0); the other 50 +carry an `unknown` declaration dated 2026-08-09, from the original +backfill pass. Correcting this document's own prior claim here rather +than carrying it forward: that prior sentence said those 50 covered +"the ones a dated, citable audit event actually verified," which, +checked directly against the live records, is not what they are -- +every one of them has `pin_status: "unknown"`, not a verified pin. +`nist_ai_rmf` now carries an `unknown` declaration on all 56 tagged +records, added in the same 2026-10-15 pass; it previously had none, +and no dated verification event for it was ever found anywhere in +this project's history, confirmed again before this backfill. An +`unknown` entry means the mapping predates framework_sources tracking +and the version it was actually read against is not recoverable; it +records an honest gap, not a lower-confidence pin. framework_sources exists specifically because an unversioned or unratified framework's category meaning can shift under an unpinned mapping: see OWASP/www-project-mcp-top-10#52, the live case (not a hypothetical) that diff --git a/records/AVE-2026-00001.json b/records/AVE-2026-00001.json index b04f44b..b4849ee 100644 --- a/records/AVE-2026-00001.json +++ b/records/AVE-2026-00001.json @@ -149,6 +149,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00002.json b/records/AVE-2026-00002.json index 2ebd32e..e4e7fcf 100644 --- a/records/AVE-2026-00002.json +++ b/records/AVE-2026-00002.json @@ -137,6 +137,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00003.json b/records/AVE-2026-00003.json index e9999bc..9904e63 100644 --- a/records/AVE-2026-00003.json +++ b/records/AVE-2026-00003.json @@ -137,6 +137,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00004.json b/records/AVE-2026-00004.json index 5372f18..11ad5f4 100644 --- a/records/AVE-2026-00004.json +++ b/records/AVE-2026-00004.json @@ -140,6 +140,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00005.json b/records/AVE-2026-00005.json index 1d9b94d..2d74957 100644 --- a/records/AVE-2026-00005.json +++ b/records/AVE-2026-00005.json @@ -139,6 +139,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00006.json b/records/AVE-2026-00006.json index 1fcda47..1ad228c 100644 --- a/records/AVE-2026-00006.json +++ b/records/AVE-2026-00006.json @@ -136,6 +136,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00007.json b/records/AVE-2026-00007.json index 44ea1c2..2c1fbe9 100644 --- a/records/AVE-2026-00007.json +++ b/records/AVE-2026-00007.json @@ -137,6 +137,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00008.json b/records/AVE-2026-00008.json index 08688fa..aaaef91 100644 --- a/records/AVE-2026-00008.json +++ b/records/AVE-2026-00008.json @@ -138,6 +138,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00009.json b/records/AVE-2026-00009.json index a28fc1b..715aa0e 100644 --- a/records/AVE-2026-00009.json +++ b/records/AVE-2026-00009.json @@ -138,6 +138,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00010.json b/records/AVE-2026-00010.json index 1e59c70..597b2e5 100644 --- a/records/AVE-2026-00010.json +++ b/records/AVE-2026-00010.json @@ -133,6 +133,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00011.json b/records/AVE-2026-00011.json index 835c774..f3e376c 100644 --- a/records/AVE-2026-00011.json +++ b/records/AVE-2026-00011.json @@ -136,6 +136,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00012.json b/records/AVE-2026-00012.json index b826c34..10f2edb 100644 --- a/records/AVE-2026-00012.json +++ b/records/AVE-2026-00012.json @@ -136,6 +136,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00013.json b/records/AVE-2026-00013.json index 333668e..4db27f4 100644 --- a/records/AVE-2026-00013.json +++ b/records/AVE-2026-00013.json @@ -139,6 +139,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00014.json b/records/AVE-2026-00014.json index e30a747..d5e16d0 100644 --- a/records/AVE-2026-00014.json +++ b/records/AVE-2026-00014.json @@ -129,6 +129,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00015.json b/records/AVE-2026-00015.json index a1c3013..04e94f4 100644 --- a/records/AVE-2026-00015.json +++ b/records/AVE-2026-00015.json @@ -128,6 +128,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00016.json b/records/AVE-2026-00016.json index cb2d549..b5b80d5 100644 --- a/records/AVE-2026-00016.json +++ b/records/AVE-2026-00016.json @@ -132,6 +132,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00017.json b/records/AVE-2026-00017.json index 39577a8..b7f0361 100644 --- a/records/AVE-2026-00017.json +++ b/records/AVE-2026-00017.json @@ -131,6 +131,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00018.json b/records/AVE-2026-00018.json index 15c16c2..147aea1 100644 --- a/records/AVE-2026-00018.json +++ b/records/AVE-2026-00018.json @@ -128,6 +128,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00019.json b/records/AVE-2026-00019.json index b6142bd..0fb3771 100644 --- a/records/AVE-2026-00019.json +++ b/records/AVE-2026-00019.json @@ -135,6 +135,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00020.json b/records/AVE-2026-00020.json index 0ed1849..966ead0 100644 --- a/records/AVE-2026-00020.json +++ b/records/AVE-2026-00020.json @@ -135,6 +135,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00021.json b/records/AVE-2026-00021.json index 6a7e8dd..2ff20b9 100644 --- a/records/AVE-2026-00021.json +++ b/records/AVE-2026-00021.json @@ -124,6 +124,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00022.json b/records/AVE-2026-00022.json index 98afbeb..0c4acbe 100644 --- a/records/AVE-2026-00022.json +++ b/records/AVE-2026-00022.json @@ -131,6 +131,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00023.json b/records/AVE-2026-00023.json index fff8f63..afb3f1c 100644 --- a/records/AVE-2026-00023.json +++ b/records/AVE-2026-00023.json @@ -128,6 +128,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00024.json b/records/AVE-2026-00024.json index c4ccbe4..10ea3f8 100644 --- a/records/AVE-2026-00024.json +++ b/records/AVE-2026-00024.json @@ -128,6 +128,14 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "mitre_atlas": { + "pin_status": "unknown", + "read_date": "2026-10-15" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00025.json b/records/AVE-2026-00025.json index c4a7474..3134f4b 100644 --- a/records/AVE-2026-00025.json +++ b/records/AVE-2026-00025.json @@ -125,6 +125,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00026.json b/records/AVE-2026-00026.json index 3bc55bb..88c7117 100644 --- a/records/AVE-2026-00026.json +++ b/records/AVE-2026-00026.json @@ -131,6 +131,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00027.json b/records/AVE-2026-00027.json index 68a4d31..ca6df43 100644 --- a/records/AVE-2026-00027.json +++ b/records/AVE-2026-00027.json @@ -134,6 +134,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00028.json b/records/AVE-2026-00028.json index d85d88a..6f9abfe 100644 --- a/records/AVE-2026-00028.json +++ b/records/AVE-2026-00028.json @@ -132,6 +132,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00029.json b/records/AVE-2026-00029.json index 9fc5e17..6304df8 100644 --- a/records/AVE-2026-00029.json +++ b/records/AVE-2026-00029.json @@ -129,6 +129,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00030.json b/records/AVE-2026-00030.json index d70f297..1378d7f 100644 --- a/records/AVE-2026-00030.json +++ b/records/AVE-2026-00030.json @@ -126,6 +126,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00031.json b/records/AVE-2026-00031.json index e9bd667..8e9e738 100644 --- a/records/AVE-2026-00031.json +++ b/records/AVE-2026-00031.json @@ -133,6 +133,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00032.json b/records/AVE-2026-00032.json index 0527f61..ee67ca7 100644 --- a/records/AVE-2026-00032.json +++ b/records/AVE-2026-00032.json @@ -134,6 +134,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00033.json b/records/AVE-2026-00033.json index 1355d25..9eb8bf6 100644 --- a/records/AVE-2026-00033.json +++ b/records/AVE-2026-00033.json @@ -135,6 +135,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00034.json b/records/AVE-2026-00034.json index 4a059a4..3a1da37 100644 --- a/records/AVE-2026-00034.json +++ b/records/AVE-2026-00034.json @@ -138,6 +138,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00035.json b/records/AVE-2026-00035.json index 7232b06..c5f1510 100644 --- a/records/AVE-2026-00035.json +++ b/records/AVE-2026-00035.json @@ -124,6 +124,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00036.json b/records/AVE-2026-00036.json index 40a32ef..1a0b652 100644 --- a/records/AVE-2026-00036.json +++ b/records/AVE-2026-00036.json @@ -135,6 +135,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00037.json b/records/AVE-2026-00037.json index 79d6195..3226b21 100644 --- a/records/AVE-2026-00037.json +++ b/records/AVE-2026-00037.json @@ -131,6 +131,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00038.json b/records/AVE-2026-00038.json index 19d4f88..a614ece 100644 --- a/records/AVE-2026-00038.json +++ b/records/AVE-2026-00038.json @@ -129,6 +129,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00039.json b/records/AVE-2026-00039.json index 3271099..2f34378 100644 --- a/records/AVE-2026-00039.json +++ b/records/AVE-2026-00039.json @@ -134,6 +134,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00040.json b/records/AVE-2026-00040.json index 0e092b8..d08c897 100644 --- a/records/AVE-2026-00040.json +++ b/records/AVE-2026-00040.json @@ -126,6 +126,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00041.json b/records/AVE-2026-00041.json index 9f3f500..e746b01 100644 --- a/records/AVE-2026-00041.json +++ b/records/AVE-2026-00041.json @@ -152,6 +152,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00042.json b/records/AVE-2026-00042.json index 0ca7ea6..98317e5 100644 --- a/records/AVE-2026-00042.json +++ b/records/AVE-2026-00042.json @@ -149,6 +149,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00043.json b/records/AVE-2026-00043.json index 29a32a6..1d9e132 100644 --- a/records/AVE-2026-00043.json +++ b/records/AVE-2026-00043.json @@ -144,6 +144,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00044.json b/records/AVE-2026-00044.json index 707e63d..82fa368 100644 --- a/records/AVE-2026-00044.json +++ b/records/AVE-2026-00044.json @@ -147,6 +147,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00045.json b/records/AVE-2026-00045.json index 43adce2..0da4553 100644 --- a/records/AVE-2026-00045.json +++ b/records/AVE-2026-00045.json @@ -156,6 +156,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00046.json b/records/AVE-2026-00046.json index db4d938..e28312c 100644 --- a/records/AVE-2026-00046.json +++ b/records/AVE-2026-00046.json @@ -159,6 +159,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00047.json b/records/AVE-2026-00047.json index ad36b3d..864e9af 100644 --- a/records/AVE-2026-00047.json +++ b/records/AVE-2026-00047.json @@ -152,6 +152,14 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "mitre_atlas": { + "pin_status": "unknown", + "read_date": "2026-10-15" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00048.json b/records/AVE-2026-00048.json index eb8eb11..eed243d 100644 --- a/records/AVE-2026-00048.json +++ b/records/AVE-2026-00048.json @@ -151,6 +151,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00049.json b/records/AVE-2026-00049.json index a4ebd7d..a3d6e7a 100644 --- a/records/AVE-2026-00049.json +++ b/records/AVE-2026-00049.json @@ -146,6 +146,14 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "mitre_atlas": { + "pin_status": "unknown", + "read_date": "2026-10-15" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00050.json b/records/AVE-2026-00050.json index 855a234..aedfd57 100644 --- a/records/AVE-2026-00050.json +++ b/records/AVE-2026-00050.json @@ -155,6 +155,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00051.json b/records/AVE-2026-00051.json index 7ac7ede..1333519 100644 --- a/records/AVE-2026-00051.json +++ b/records/AVE-2026-00051.json @@ -148,6 +148,14 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "mitre_atlas": { + "pin_status": "unknown", + "read_date": "2026-10-15" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00053.json b/records/AVE-2026-00053.json index ae376fa..61d09ad 100644 --- a/records/AVE-2026-00053.json +++ b/records/AVE-2026-00053.json @@ -141,6 +141,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "mitre_atlas": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00055.json b/records/AVE-2026-00055.json index d5519ed..5c7ce89 100644 --- a/records/AVE-2026-00055.json +++ b/records/AVE-2026-00055.json @@ -147,6 +147,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "mitre_atlas": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00066.json b/records/AVE-2026-00066.json index 31aaa89..5f39f72 100644 --- a/records/AVE-2026-00066.json +++ b/records/AVE-2026-00066.json @@ -105,6 +105,14 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "mitre_atlas": { + "pin_status": "unknown", + "read_date": "2026-10-15" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00069.json b/records/AVE-2026-00069.json index 86b466f..8ccf746 100644 --- a/records/AVE-2026-00069.json +++ b/records/AVE-2026-00069.json @@ -82,6 +82,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "mitre_atlas": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00071.json b/records/AVE-2026-00071.json index e8c93c6..ba218c6 100644 --- a/records/AVE-2026-00071.json +++ b/records/AVE-2026-00071.json @@ -101,6 +101,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "mitre_atlas": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00076.json b/records/AVE-2026-00076.json index 3486d05..f5b0784 100644 --- a/records/AVE-2026-00076.json +++ b/records/AVE-2026-00076.json @@ -113,6 +113,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "mitre_atlas": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00077.json b/records/AVE-2026-00077.json index 4d62ce7..f4c7556 100644 --- a/records/AVE-2026-00077.json +++ b/records/AVE-2026-00077.json @@ -113,6 +113,10 @@ "owasp_asi": { "version": "2026", "read_date": "2026-08-23" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00078.json b/records/AVE-2026-00078.json index cd7cae0..8e45c85 100644 --- a/records/AVE-2026-00078.json +++ b/records/AVE-2026-00078.json @@ -101,6 +101,10 @@ "owasp_mcp": { "commit": "165fe0f78ef104459237b4a8e0f6e78db9b02391", "read_date": "2026-09-05" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00079.json b/records/AVE-2026-00079.json index c3e68aa..ade97b0 100644 --- a/records/AVE-2026-00079.json +++ b/records/AVE-2026-00079.json @@ -101,6 +101,10 @@ "owasp_mcp": { "commit": "165fe0f78ef104459237b4a8e0f6e78db9b02391", "read_date": "2026-09-05" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/records/AVE-2026-00080.json b/records/AVE-2026-00080.json index 2885ab1..a646a54 100644 --- a/records/AVE-2026-00080.json +++ b/records/AVE-2026-00080.json @@ -102,6 +102,10 @@ "owasp_mcp": { "commit": "165fe0f78ef104459237b4a8e0f6e78db9b02391", "read_date": "2026-09-05" + }, + "nist_ai_rmf": { + "pin_status": "unknown", + "read_date": "2026-10-15" } } } diff --git a/scripts/check_framework_sources.py b/scripts/check_framework_sources.py index 5566514..2702715 100644 --- a/scripts/check_framework_sources.py +++ b/scripts/check_framework_sources.py @@ -13,12 +13,12 @@ # predate this field are not retroactively required to carry it -- # determining what each was actually mapped against is real, # per-record judgment and a separate backfill task (issue #245). -# This check therefore defaults to --only-scoped use gating new -# submissions; corpus-wide CI enforcement is deliberately deferred -# until after the backfill, following the volume caution raised on -# check_confidence_signal.py in #242 (one line to nine on 80 -# records; this field is unset on all 80, so an un-scoped corpus-wide -# CI step today would immediately be noisier than that). +# That backfill completed 2026-10-15: every record missing a pin +# now carries a real version/commit where one was citable, or an +# honest "unknown" declaration where it was not. CI now runs +# --strict corpus-wide (.github/workflows/tests.yml); the +# --only-scoped form below stays useful for checking a specific +# record before pushing. import argparse import json import sys