From 4aa0213affe779544d7d05469a87febf9aea015c Mon Sep 17 00:00:00 2001
From: chaksaray <chaksaray@gmail.com>
Date: Thu, 15 Oct 2026 21:51:37 +0700
Subject: [PATCH 1/3] feat: backfill framework_sources for the 61 records
 missing a pin entry

56 records missing nist_ai_rmf, 10 missing mitre_atlas (66 entries
total, matching #245/#260/#264's earlier passes). Every entry added is
{"pin_status": "unknown", "read_date": "2026-10-15"}, per the
honesty rule: a real version/commit pin requires a citable source,
and none exists for any of these 66.

mitre_atlas: checked git log -S'"mitre_atlas"' on each of the 10
records back to the PR that added the mapping. Every one verified the
technique against MITRE's own ATLAS data at the time ('confirmed
against MITRE's own ATLAS data repository', etc.), but none cites a
dated snapshot, version, or commit sha for that data. No citable pin
exists for any of the 10.

nist_ai_rmf: git log --all -i --grep 'AI RMF' finds no dated
verification event anywhere in history, only the field's own creation
commit and two unrelated record additions that happen to mention the
framework in their own mapping. No citable pin exists for any of the
56.

No partial entries existed to overwrite (checked first: every missing
field was either absent from framework_sources entirely or present
with neither a version/commit nor a read_date -- none of the 66 had a
partial, in-between entry).

Surgical insertion, not full-file reserialization: these files use a
custom formatter that collapses short arrays onto one line, which
plain json.dumps(indent=2) does not reproduce (74 of 87 records fail a
byte round-trip under it, discovered before writing anything). Each
new entry is spliced into the existing framework_sources block's raw
text instead, matching the surrounding object-nesting indent exactly.
git diff -U0 records | grep against pin_status/read_date/the new
field names/framework_sources/brace-only lines prints nothing, and
last_updated is untouched on all 61 records.

Signed-off-by: chaksaray <chaksaray@gmail.com>
---
 records/AVE-2026-00001.json | 4 ++++
 records/AVE-2026-00002.json | 4 ++++
 records/AVE-2026-00003.json | 4 ++++
 records/AVE-2026-00004.json | 4 ++++
 records/AVE-2026-00005.json | 4 ++++
 records/AVE-2026-00006.json | 4 ++++
 records/AVE-2026-00007.json | 4 ++++
 records/AVE-2026-00008.json | 4 ++++
 records/AVE-2026-00009.json | 4 ++++
 records/AVE-2026-00010.json | 4 ++++
 records/AVE-2026-00011.json | 4 ++++
 records/AVE-2026-00012.json | 4 ++++
 records/AVE-2026-00013.json | 4 ++++
 records/AVE-2026-00014.json | 4 ++++
 records/AVE-2026-00015.json | 4 ++++
 records/AVE-2026-00016.json | 4 ++++
 records/AVE-2026-00017.json | 4 ++++
 records/AVE-2026-00018.json | 4 ++++
 records/AVE-2026-00019.json | 4 ++++
 records/AVE-2026-00020.json | 4 ++++
 records/AVE-2026-00021.json | 4 ++++
 records/AVE-2026-00022.json | 4 ++++
 records/AVE-2026-00023.json | 4 ++++
 records/AVE-2026-00024.json | 8 ++++++++
 records/AVE-2026-00025.json | 4 ++++
 records/AVE-2026-00026.json | 4 ++++
 records/AVE-2026-00027.json | 4 ++++
 records/AVE-2026-00028.json | 4 ++++
 records/AVE-2026-00029.json | 4 ++++
 records/AVE-2026-00030.json | 4 ++++
 records/AVE-2026-00031.json | 4 ++++
 records/AVE-2026-00032.json | 4 ++++
 records/AVE-2026-00033.json | 4 ++++
 records/AVE-2026-00034.json | 4 ++++
 records/AVE-2026-00035.json | 4 ++++
 records/AVE-2026-00036.json | 4 ++++
 records/AVE-2026-00037.json | 4 ++++
 records/AVE-2026-00038.json | 4 ++++
 records/AVE-2026-00039.json | 4 ++++
 records/AVE-2026-00040.json | 4 ++++
 records/AVE-2026-00041.json | 4 ++++
 records/AVE-2026-00042.json | 4 ++++
 records/AVE-2026-00043.json | 4 ++++
 records/AVE-2026-00044.json | 4 ++++
 records/AVE-2026-00045.json | 4 ++++
 records/AVE-2026-00046.json | 4 ++++
 records/AVE-2026-00047.json | 8 ++++++++
 records/AVE-2026-00048.json | 4 ++++
 records/AVE-2026-00049.json | 8 ++++++++
 records/AVE-2026-00050.json | 4 ++++
 records/AVE-2026-00051.json | 8 ++++++++
 records/AVE-2026-00053.json | 4 ++++
 records/AVE-2026-00055.json | 4 ++++
 records/AVE-2026-00066.json | 8 ++++++++
 records/AVE-2026-00069.json | 4 ++++
 records/AVE-2026-00071.json | 4 ++++
 records/AVE-2026-00076.json | 4 ++++
 records/AVE-2026-00077.json | 4 ++++
 records/AVE-2026-00078.json | 4 ++++
 records/AVE-2026-00079.json | 4 ++++
 records/AVE-2026-00080.json | 4 ++++
 61 files changed, 264 insertions(+)

diff --git a/records/AVE-2026-00001.json b/records/AVE-2026-00001.json
index b04f44b..b4849ee 100644
--- a/records/AVE-2026-00001.json
+++ b/records/AVE-2026-00001.json
@@ -149,6 +149,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00002.json b/records/AVE-2026-00002.json
index 2ebd32e..e4e7fcf 100644
--- a/records/AVE-2026-00002.json
+++ b/records/AVE-2026-00002.json
@@ -137,6 +137,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00003.json b/records/AVE-2026-00003.json
index e9999bc..9904e63 100644
--- a/records/AVE-2026-00003.json
+++ b/records/AVE-2026-00003.json
@@ -137,6 +137,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00004.json b/records/AVE-2026-00004.json
index 5372f18..11ad5f4 100644
--- a/records/AVE-2026-00004.json
+++ b/records/AVE-2026-00004.json
@@ -140,6 +140,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00005.json b/records/AVE-2026-00005.json
index 1d9b94d..2d74957 100644
--- a/records/AVE-2026-00005.json
+++ b/records/AVE-2026-00005.json
@@ -139,6 +139,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00006.json b/records/AVE-2026-00006.json
index 1fcda47..1ad228c 100644
--- a/records/AVE-2026-00006.json
+++ b/records/AVE-2026-00006.json
@@ -136,6 +136,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00007.json b/records/AVE-2026-00007.json
index 44ea1c2..2c1fbe9 100644
--- a/records/AVE-2026-00007.json
+++ b/records/AVE-2026-00007.json
@@ -137,6 +137,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00008.json b/records/AVE-2026-00008.json
index 08688fa..aaaef91 100644
--- a/records/AVE-2026-00008.json
+++ b/records/AVE-2026-00008.json
@@ -138,6 +138,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00009.json b/records/AVE-2026-00009.json
index a28fc1b..715aa0e 100644
--- a/records/AVE-2026-00009.json
+++ b/records/AVE-2026-00009.json
@@ -138,6 +138,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00010.json b/records/AVE-2026-00010.json
index 1e59c70..597b2e5 100644
--- a/records/AVE-2026-00010.json
+++ b/records/AVE-2026-00010.json
@@ -133,6 +133,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00011.json b/records/AVE-2026-00011.json
index 835c774..f3e376c 100644
--- a/records/AVE-2026-00011.json
+++ b/records/AVE-2026-00011.json
@@ -136,6 +136,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00012.json b/records/AVE-2026-00012.json
index b826c34..10f2edb 100644
--- a/records/AVE-2026-00012.json
+++ b/records/AVE-2026-00012.json
@@ -136,6 +136,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00013.json b/records/AVE-2026-00013.json
index 333668e..4db27f4 100644
--- a/records/AVE-2026-00013.json
+++ b/records/AVE-2026-00013.json
@@ -139,6 +139,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00014.json b/records/AVE-2026-00014.json
index e30a747..d5e16d0 100644
--- a/records/AVE-2026-00014.json
+++ b/records/AVE-2026-00014.json
@@ -129,6 +129,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00015.json b/records/AVE-2026-00015.json
index a1c3013..04e94f4 100644
--- a/records/AVE-2026-00015.json
+++ b/records/AVE-2026-00015.json
@@ -128,6 +128,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00016.json b/records/AVE-2026-00016.json
index cb2d549..b5b80d5 100644
--- a/records/AVE-2026-00016.json
+++ b/records/AVE-2026-00016.json
@@ -132,6 +132,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00017.json b/records/AVE-2026-00017.json
index 39577a8..b7f0361 100644
--- a/records/AVE-2026-00017.json
+++ b/records/AVE-2026-00017.json
@@ -131,6 +131,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00018.json b/records/AVE-2026-00018.json
index 15c16c2..147aea1 100644
--- a/records/AVE-2026-00018.json
+++ b/records/AVE-2026-00018.json
@@ -128,6 +128,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00019.json b/records/AVE-2026-00019.json
index b6142bd..0fb3771 100644
--- a/records/AVE-2026-00019.json
+++ b/records/AVE-2026-00019.json
@@ -135,6 +135,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00020.json b/records/AVE-2026-00020.json
index 0ed1849..966ead0 100644
--- a/records/AVE-2026-00020.json
+++ b/records/AVE-2026-00020.json
@@ -135,6 +135,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00021.json b/records/AVE-2026-00021.json
index 6a7e8dd..2ff20b9 100644
--- a/records/AVE-2026-00021.json
+++ b/records/AVE-2026-00021.json
@@ -124,6 +124,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00022.json b/records/AVE-2026-00022.json
index 98afbeb..0c4acbe 100644
--- a/records/AVE-2026-00022.json
+++ b/records/AVE-2026-00022.json
@@ -131,6 +131,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00023.json b/records/AVE-2026-00023.json
index fff8f63..afb3f1c 100644
--- a/records/AVE-2026-00023.json
+++ b/records/AVE-2026-00023.json
@@ -128,6 +128,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00024.json b/records/AVE-2026-00024.json
index c4ccbe4..10ea3f8 100644
--- a/records/AVE-2026-00024.json
+++ b/records/AVE-2026-00024.json
@@ -128,6 +128,14 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "mitre_atlas": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00025.json b/records/AVE-2026-00025.json
index c4a7474..3134f4b 100644
--- a/records/AVE-2026-00025.json
+++ b/records/AVE-2026-00025.json
@@ -125,6 +125,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00026.json b/records/AVE-2026-00026.json
index 3bc55bb..88c7117 100644
--- a/records/AVE-2026-00026.json
+++ b/records/AVE-2026-00026.json
@@ -131,6 +131,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00027.json b/records/AVE-2026-00027.json
index 68a4d31..ca6df43 100644
--- a/records/AVE-2026-00027.json
+++ b/records/AVE-2026-00027.json
@@ -134,6 +134,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00028.json b/records/AVE-2026-00028.json
index d85d88a..6f9abfe 100644
--- a/records/AVE-2026-00028.json
+++ b/records/AVE-2026-00028.json
@@ -132,6 +132,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00029.json b/records/AVE-2026-00029.json
index 9fc5e17..6304df8 100644
--- a/records/AVE-2026-00029.json
+++ b/records/AVE-2026-00029.json
@@ -129,6 +129,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00030.json b/records/AVE-2026-00030.json
index d70f297..1378d7f 100644
--- a/records/AVE-2026-00030.json
+++ b/records/AVE-2026-00030.json
@@ -126,6 +126,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00031.json b/records/AVE-2026-00031.json
index e9bd667..8e9e738 100644
--- a/records/AVE-2026-00031.json
+++ b/records/AVE-2026-00031.json
@@ -133,6 +133,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00032.json b/records/AVE-2026-00032.json
index 0527f61..ee67ca7 100644
--- a/records/AVE-2026-00032.json
+++ b/records/AVE-2026-00032.json
@@ -134,6 +134,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00033.json b/records/AVE-2026-00033.json
index 1355d25..9eb8bf6 100644
--- a/records/AVE-2026-00033.json
+++ b/records/AVE-2026-00033.json
@@ -135,6 +135,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00034.json b/records/AVE-2026-00034.json
index 4a059a4..3a1da37 100644
--- a/records/AVE-2026-00034.json
+++ b/records/AVE-2026-00034.json
@@ -138,6 +138,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00035.json b/records/AVE-2026-00035.json
index 7232b06..c5f1510 100644
--- a/records/AVE-2026-00035.json
+++ b/records/AVE-2026-00035.json
@@ -124,6 +124,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00036.json b/records/AVE-2026-00036.json
index 40a32ef..1a0b652 100644
--- a/records/AVE-2026-00036.json
+++ b/records/AVE-2026-00036.json
@@ -135,6 +135,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00037.json b/records/AVE-2026-00037.json
index 79d6195..3226b21 100644
--- a/records/AVE-2026-00037.json
+++ b/records/AVE-2026-00037.json
@@ -131,6 +131,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00038.json b/records/AVE-2026-00038.json
index 19d4f88..a614ece 100644
--- a/records/AVE-2026-00038.json
+++ b/records/AVE-2026-00038.json
@@ -129,6 +129,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00039.json b/records/AVE-2026-00039.json
index 3271099..2f34378 100644
--- a/records/AVE-2026-00039.json
+++ b/records/AVE-2026-00039.json
@@ -134,6 +134,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00040.json b/records/AVE-2026-00040.json
index 0e092b8..d08c897 100644
--- a/records/AVE-2026-00040.json
+++ b/records/AVE-2026-00040.json
@@ -126,6 +126,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00041.json b/records/AVE-2026-00041.json
index 9f3f500..e746b01 100644
--- a/records/AVE-2026-00041.json
+++ b/records/AVE-2026-00041.json
@@ -152,6 +152,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00042.json b/records/AVE-2026-00042.json
index 0ca7ea6..98317e5 100644
--- a/records/AVE-2026-00042.json
+++ b/records/AVE-2026-00042.json
@@ -149,6 +149,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00043.json b/records/AVE-2026-00043.json
index 29a32a6..1d9e132 100644
--- a/records/AVE-2026-00043.json
+++ b/records/AVE-2026-00043.json
@@ -144,6 +144,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00044.json b/records/AVE-2026-00044.json
index 707e63d..82fa368 100644
--- a/records/AVE-2026-00044.json
+++ b/records/AVE-2026-00044.json
@@ -147,6 +147,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00045.json b/records/AVE-2026-00045.json
index 43adce2..0da4553 100644
--- a/records/AVE-2026-00045.json
+++ b/records/AVE-2026-00045.json
@@ -156,6 +156,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00046.json b/records/AVE-2026-00046.json
index db4d938..e28312c 100644
--- a/records/AVE-2026-00046.json
+++ b/records/AVE-2026-00046.json
@@ -159,6 +159,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00047.json b/records/AVE-2026-00047.json
index ad36b3d..864e9af 100644
--- a/records/AVE-2026-00047.json
+++ b/records/AVE-2026-00047.json
@@ -152,6 +152,14 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "mitre_atlas": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00048.json b/records/AVE-2026-00048.json
index eb8eb11..eed243d 100644
--- a/records/AVE-2026-00048.json
+++ b/records/AVE-2026-00048.json
@@ -151,6 +151,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00049.json b/records/AVE-2026-00049.json
index a4ebd7d..a3d6e7a 100644
--- a/records/AVE-2026-00049.json
+++ b/records/AVE-2026-00049.json
@@ -146,6 +146,14 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "mitre_atlas": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00050.json b/records/AVE-2026-00050.json
index 855a234..aedfd57 100644
--- a/records/AVE-2026-00050.json
+++ b/records/AVE-2026-00050.json
@@ -155,6 +155,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00051.json b/records/AVE-2026-00051.json
index 7ac7ede..1333519 100644
--- a/records/AVE-2026-00051.json
+++ b/records/AVE-2026-00051.json
@@ -148,6 +148,14 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "mitre_atlas": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00053.json b/records/AVE-2026-00053.json
index ae376fa..61d09ad 100644
--- a/records/AVE-2026-00053.json
+++ b/records/AVE-2026-00053.json
@@ -141,6 +141,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "mitre_atlas": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00055.json b/records/AVE-2026-00055.json
index d5519ed..5c7ce89 100644
--- a/records/AVE-2026-00055.json
+++ b/records/AVE-2026-00055.json
@@ -147,6 +147,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "mitre_atlas": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00066.json b/records/AVE-2026-00066.json
index 31aaa89..5f39f72 100644
--- a/records/AVE-2026-00066.json
+++ b/records/AVE-2026-00066.json
@@ -105,6 +105,14 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "mitre_atlas": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00069.json b/records/AVE-2026-00069.json
index 86b466f..8ccf746 100644
--- a/records/AVE-2026-00069.json
+++ b/records/AVE-2026-00069.json
@@ -82,6 +82,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "mitre_atlas": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00071.json b/records/AVE-2026-00071.json
index e8c93c6..ba218c6 100644
--- a/records/AVE-2026-00071.json
+++ b/records/AVE-2026-00071.json
@@ -101,6 +101,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "mitre_atlas": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00076.json b/records/AVE-2026-00076.json
index 3486d05..f5b0784 100644
--- a/records/AVE-2026-00076.json
+++ b/records/AVE-2026-00076.json
@@ -113,6 +113,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "mitre_atlas": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00077.json b/records/AVE-2026-00077.json
index 4d62ce7..f4c7556 100644
--- a/records/AVE-2026-00077.json
+++ b/records/AVE-2026-00077.json
@@ -113,6 +113,10 @@
     "owasp_asi": {
       "version": "2026",
       "read_date": "2026-08-23"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00078.json b/records/AVE-2026-00078.json
index cd7cae0..8e45c85 100644
--- a/records/AVE-2026-00078.json
+++ b/records/AVE-2026-00078.json
@@ -101,6 +101,10 @@
     "owasp_mcp": {
       "commit": "165fe0f78ef104459237b4a8e0f6e78db9b02391",
       "read_date": "2026-09-05"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00079.json b/records/AVE-2026-00079.json
index c3e68aa..ade97b0 100644
--- a/records/AVE-2026-00079.json
+++ b/records/AVE-2026-00079.json
@@ -101,6 +101,10 @@
     "owasp_mcp": {
       "commit": "165fe0f78ef104459237b4a8e0f6e78db9b02391",
       "read_date": "2026-09-05"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }
diff --git a/records/AVE-2026-00080.json b/records/AVE-2026-00080.json
index 2885ab1..a646a54 100644
--- a/records/AVE-2026-00080.json
+++ b/records/AVE-2026-00080.json
@@ -102,6 +102,10 @@
     "owasp_mcp": {
       "commit": "165fe0f78ef104459237b4a8e0f6e78db9b02391",
       "read_date": "2026-09-05"
+    },
+    "nist_ai_rmf": {
+      "pin_status": "unknown",
+      "read_date": "2026-10-15"
     }
   }
 }

From 85f90e0533282f17481a97aa88b557d73861ec33 Mon Sep 17 00:00:00 2001
From: chaksaray <chaksaray@gmail.com>
Date: Thu, 15 Oct 2026 21:56:57 +0700
Subject: [PATCH 2/3] docs: recompute framework_sources coverage numbers,
 correct a stale claim

docs/terms-relationships.md hand-wrote coverage numbers that were
stale even before this pass (corpus grew from 80 to 87) and, checked
directly against the live records, one clause was simply wrong: it
said the 40 mitre_atlas entries from the original backfill covered
'the ones a dated, citable audit event actually verified.' Every one
of those 40 (now 50, after this pass added 10 more of the same kind)
has pin_status: unknown, not a verified pin -- that was never an
accurate description of what they are. Corrected rather than carried
forward.

Real numbers as of this backfill: owasp_mcp 87/87 and owasp_asi 74/74
real-pinned; mitre_atlas 4/54 real-pinned (AVE-2026-00082/84/86/87,
ATLAS v5.6.0), 50/54 unknown; nist_ai_rmf 56/56 unknown, previously 0.

docs/terms.md regenerated from the schema and the sync check passes.

Signed-off-by: chaksaray <chaksaray@gmail.com>
---
 CHANGELOG.md                | 13 +++++++++++++
 docs/terms-relationships.md | 26 +++++++++++++++++++-------
 docs/terms.md               | 26 +++++++++++++++++++-------
 3 files changed, 51 insertions(+), 14 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 440dd0c..086c8b3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,19 @@ Format: [Semantic Versioning](https://semver.org). Schema versions and record se
 ## [Unreleased]
 
 ### Changed
+- `framework_sources` backfill completed and `scripts/check_framework_sources.py
+  --strict` now runs corpus-wide in CI, no longer deferred (#245, #260,
+  #264 were the earlier passes). The 61 records still missing a pin
+  entry (56 for `nist_ai_rmf`, 10 for `mitre_atlas`) now carry an
+  `unknown` declaration each, since no citable version or commit
+  exists for any of the 66: every `mitre_atlas` gap was checked back
+  to the commit that added it and each confirmed the technique against
+  MITRE's own current data at the time without citing a dated
+  snapshot, and a repo-wide history search found no dated verification
+  event for `nist_ai_rmf` at all. `docs/terms-relationships.md`'s
+  coverage numbers are recomputed from live data; one of its prior
+  clauses is corrected along the way, not just its numbers (see that
+  file's own note).
 - New standing check, `scripts/check_mutation_thm_trail.py`: soft-warns
   on records where `mutation_count` is 1 or higher but `aivss.notes`
   has no discoverable mention of the ThM decision made when that
diff --git a/docs/terms-relationships.md b/docs/terms-relationships.md
index a186646..84f6c1d 100644
--- a/docs/terms-relationships.md
+++ b/docs/terms-relationships.md
@@ -61,13 +61,25 @@ framework_sources**: the first four are the mapping itself — which
 category a record corresponds to in an external framework.
 framework_sources is provenance for that mapping — which version or
 commit of the referenced framework the mapping was made against. A
-record can carry the mapping without the provenance; as of the last
-corpus-wide backfill pass, `owasp_mcp` (required on every record) and
-`owasp_asi` have full coverage (80 of 80, and 69 of 69 tagged records
-respectively), `mitre_atlas` is partially backfilled (40 of 50 tagged
-records, covering exactly the ones a dated, citable audit event actually
-verified), and `nist_ai_rmf` has none yet — no audit trail for it was
-ever found in this project's history. framework_sources exists
+record can carry the mapping without the provenance; as of the
+2026-10-15 backfill, `owasp_mcp` and `owasp_asi` have full, real-pin
+coverage (87 of 87, and 74 of 74 tagged records respectively, every
+entry a real version or commit). `mitre_atlas` has a real, citable
+version/commit pin on 4 of its 54 tagged records (AVE-2026-00082,
+-00084, -00086, -00087, all pinned against ATLAS v5.6.0); the other 50
+carry an `unknown` declaration dated 2026-08-09, from the original
+backfill pass. Correcting this document's own prior claim here rather
+than carrying it forward: that prior sentence said those 50 covered
+"the ones a dated, citable audit event actually verified," which,
+checked directly against the live records, is not what they are --
+every one of them has `pin_status: "unknown"`, not a verified pin.
+`nist_ai_rmf` now carries an `unknown` declaration on all 56 tagged
+records, added in the same 2026-10-15 pass; it previously had none,
+and no dated verification event for it was ever found anywhere in
+this project's history, confirmed again before this backfill. An
+`unknown` entry means the mapping predates framework_sources tracking
+and the version it was actually read against is not recoverable; it
+records an honest gap, not a lower-confidence pin. framework_sources exists
 specifically because an unversioned or unratified framework's category
 meaning can shift under an unpinned mapping: see
 OWASP/www-project-mcp-top-10#52, the live case (not a hypothetical) that
diff --git a/docs/terms.md b/docs/terms.md
index 8ba23ca..71d6311 100644
--- a/docs/terms.md
+++ b/docs/terms.md
@@ -67,13 +67,25 @@ framework_sources**: the first four are the mapping itself — which
 category a record corresponds to in an external framework.
 framework_sources is provenance for that mapping — which version or
 commit of the referenced framework the mapping was made against. A
-record can carry the mapping without the provenance; as of the last
-corpus-wide backfill pass, `owasp_mcp` (required on every record) and
-`owasp_asi` have full coverage (80 of 80, and 69 of 69 tagged records
-respectively), `mitre_atlas` is partially backfilled (40 of 50 tagged
-records, covering exactly the ones a dated, citable audit event actually
-verified), and `nist_ai_rmf` has none yet — no audit trail for it was
-ever found in this project's history. framework_sources exists
+record can carry the mapping without the provenance; as of the
+2026-10-15 backfill, `owasp_mcp` and `owasp_asi` have full, real-pin
+coverage (87 of 87, and 74 of 74 tagged records respectively, every
+entry a real version or commit). `mitre_atlas` has a real, citable
+version/commit pin on 4 of its 54 tagged records (AVE-2026-00082,
+-00084, -00086, -00087, all pinned against ATLAS v5.6.0); the other 50
+carry an `unknown` declaration dated 2026-08-09, from the original
+backfill pass. Correcting this document's own prior claim here rather
+than carrying it forward: that prior sentence said those 50 covered
+"the ones a dated, citable audit event actually verified," which,
+checked directly against the live records, is not what they are --
+every one of them has `pin_status: "unknown"`, not a verified pin.
+`nist_ai_rmf` now carries an `unknown` declaration on all 56 tagged
+records, added in the same 2026-10-15 pass; it previously had none,
+and no dated verification event for it was ever found anywhere in
+this project's history, confirmed again before this backfill. An
+`unknown` entry means the mapping predates framework_sources tracking
+and the version it was actually read against is not recoverable; it
+records an honest gap, not a lower-confidence pin. framework_sources exists
 specifically because an unversioned or unratified framework's category
 meaning can shift under an unpinned mapping: see
 OWASP/www-project-mcp-top-10#52, the live case (not a hypothetical) that

From 58c0aea530f07e10d84d0b950ff660b70e304ef9 Mon Sep 17 00:00:00 2001
From: chaksaray <chaksaray@gmail.com>
Date: Fri, 16 Oct 2026 06:53:25 +0700
Subject: [PATCH 3/3] ci: enforce framework_sources corpus-wide, no longer
 deferred

Added 'framework_sources present for every mapped framework (hard
failure)' to .github/workflows/tests.yml, running
check_framework_sources.py --strict with no --only, right after the
Mutation-ThM trail soft warning step.

Proved it actually bites before committing: temporarily removed
AVE-2026-00001's nist_ai_rmf entry, --strict exited 1 naming that
record and field, then restored the file (git diff --stat records
confirms empty, nothing left dirty).

Updated the script's own header, which previously said corpus-wide
enforcement was deliberately deferred until after the backfill; it is
done as of 2026-10-15, so this now says that plainly instead of still
describing a deferred state. CONTRIBUTING.md's --strict --only line
updated to note CI enforces this for every record now, not just that
a new record needs it.

Signed-off-by: chaksaray <chaksaray@gmail.com>
---
 .github/workflows/tests.yml        |  3 +++
 CONTRIBUTING.md                    |  2 +-
 scripts/check_framework_sources.py | 12 ++++++------
 3 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 5a3690a..95e6a15 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -56,6 +56,9 @@ jobs:
       - name: Mutation-ThM trail soft warning
         run: python scripts/check_mutation_thm_trail.py
 
+      - name: framework_sources present for every mapped framework (hard failure)
+        run: python scripts/check_framework_sources.py --strict
+
       - name: docs/terms.md matches the live schema (hard failure)
         run: python scripts/check_terms_sync.py
 
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index bc90576..b3bb557 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -160,7 +160,7 @@ python scripts/check_vulnerability_taxonomy.py  # soft-warns on records missing
 python scripts/check_vulnerability_taxonomy.py --strict --only AVE-2026-NNNNN   # your new record must carry all three taxonomy fields
 python scripts/check_mutation_thm_trail.py  # soft-warns on records with mutation_count >= 1 and no ThM-decision trail in aivss.notes
 python scripts/check_mutation_thm_trail.py --strict --only AVE-2026-NNNNN   # if your edit raises mutation_count, aivss.notes must state the ThM decision (raised or unchanged, either way)
-python scripts/check_framework_sources.py --strict --only AVE-2026-NNNNN   # if your record carries owasp_mcp/owasp_asi/mitre_atlas/nist_ai_rmf, each needs a framework_sources entry
+python scripts/check_framework_sources.py --strict --only AVE-2026-NNNNN   # CI enforces this for every record now; run it scoped to yours before pushing, same check either way
 python scripts/generate_terms.py      # regenerate docs/terms.md after any schema field or description change
 python scripts/check_terms_sync.py    # hard failure if docs/terms.md disagrees with the live schema -- run before opening a PR
 pytest tests/ -x -q                   # full suite: schema, AIVSS arithmetic, mitigation enums
diff --git a/scripts/check_framework_sources.py b/scripts/check_framework_sources.py
index 5566514..2702715 100644
--- a/scripts/check_framework_sources.py
+++ b/scripts/check_framework_sources.py
@@ -13,12 +13,12 @@
 #       predate this field are not retroactively required to carry it --
 #       determining what each was actually mapped against is real,
 #       per-record judgment and a separate backfill task (issue #245).
-#       This check therefore defaults to --only-scoped use gating new
-#       submissions; corpus-wide CI enforcement is deliberately deferred
-#       until after the backfill, following the volume caution raised on
-#       check_confidence_signal.py in #242 (one line to nine on 80
-#       records; this field is unset on all 80, so an un-scoped corpus-wide
-#       CI step today would immediately be noisier than that).
+#       That backfill completed 2026-10-15: every record missing a pin
+#       now carries a real version/commit where one was citable, or an
+#       honest "unknown" declaration where it was not. CI now runs
+#       --strict corpus-wide (.github/workflows/tests.yml); the
+#       --only-scoped form below stays useful for checking a specific
+#       record before pushing.
 import argparse
 import json
 import sys