fix: stat block from the claims register, SCAN-3 comparison table

.github/workflows/site-numbers.yml

@@ -0,0 +1,68 @@
+# Site numbers come from the claims register in bawbel/.github (scripts/sync_site_numbers.py).
+# On a pull request: fail if the stat block is stale or a count is typed outside it.
+# Weekly and on demand: regenerate the block and open a pull request against develop.
+name: site numbers
+
+on:
+  pull_request:
+    branches: [develop, main]
+  schedule:
+    - cron: "17 6 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+      - run: python -m pip install -r scripts/requirements.txt
+      - run: python -m pytest tests -q
+      - run: python scripts/sync_site_numbers.py --check
+
+  update:
+    if: github.event_name != 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          ref: develop
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+      - run: python -m pip install -r scripts/requirements.txt
+      - run: python scripts/sync_site_numbers.py
+      - name: Open a pull request when the numbers changed
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          if git diff --quiet; then
+            echo "Stat block already current."
+            exit 0
+          fi
+          if [ -n "$(gh pr list --base develop --state open --search 'head:chore/site-numbers-' --json number --jq '.[].number')" ]; then
+            echo "A site-numbers pull request is already open."
+            exit 0
+          fi
+          branch="chore/site-numbers-$(date -u +%Y%m%d)"
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git switch -c "$branch"
+          git commit -s -am "chore: sync site numbers from the claims register"
+          git push origin "$branch"
+          gh pr create --base develop --head "$branch" \
+            --title "chore: sync site numbers from the claims register" \
+            --body "Generated by scripts/sync_site_numbers.py from claims/register.yaml in bawbel/.github. Review the new values against that register before merging."

.gitignore

@@ -0,0 +1,2 @@
+__pycache__/
+.pytest_cache/

README.md

@@ -11,7 +11,7 @@ before they reach production. Free forever. Apache 2.0.
 
 [![Scanner](https://img.shields.io/pypi/v/bawbel-scanner?label=bawbel-scanner&color=1DB894&style=flat-square)](https://pypi.org/project/bawbel-scanner/)
 [![Downloads](https://img.shields.io/pypi/dm/bawbel-scanner?label=downloads%2Fmonth&color=1DB894&style=flat-square)](https://pepy.tech/project/bawbel-scanner)
-[![AVE Records](https://img.shields.io/badge/AVE_records-51-1DB894?style=flat-square)](https://github.com/bawbel/ave)
+[![AVE Records](https://img.shields.io/badge/AVE-records-1DB894?style=flat-square)](https://github.com/bawbel/ave)
 [![License](https://img.shields.io/badge/license-Apache_2.0-1DB894?style=flat-square)](https://github.com/bawbel/scanner/blob/main/LICENSE)
 
 </div>
@@ -23,7 +23,7 @@ before they reach production. Free forever. Apache 2.0.
 | Repo | What it is |
 |---|---|
 | [bawbel/scanner](https://github.com/bawbel/scanner) | CLI scanner for agentic AI components -- SKILL.md files, MCP servers, system prompts. Confidence and evidence metadata on every finding. |
-| [bawbel/ave](https://github.com/bawbel/ave) | AVE -- the behavioral classification standard for agentic AI components. 51 published records, scored with OWASP AIVSS v0.8, mapped to OWASP MCP Top 10 and MITRE ATLAS. |
+| [bawbel/ave](https://github.com/bawbel/ave) | AVE -- the behavioral classification standard for agentic AI components. Published records scored with OWASP AIVSS v0.8, mapped to OWASP MCP Top 10 and MITRE ATLAS. |
 | [bawbel/piranha-api](https://github.com/bawbel/piranha-api) | Free, no-auth REST API serving the full AVE record set and threat intelligence. |
 | [bawbel/integrations](https://github.com/bawbel/integrations) | GitHub Action, VS Code extension, and pre-commit hooks. |
 
@@ -46,6 +46,17 @@ Your CI pipeline scans dependencies for known package vulnerabilities. It does n
 
 ---
 
+### Site numbers
+
+Every count on bawbel.io comes from the claims register in
+[bawbel/.github](https://github.com/bawbel/.github/blob/main/claims/register.yaml), which that
+repository's verifier checks against the code. `scripts/sync_site_numbers.py` writes the values
+into the stat block in `index.html`. A pull request fails when the block is stale or a count is
+typed anywhere else, and a weekly workflow opens a pull request when the register changes. To
+change a number, change the register.
+
+---
+
 ### Links
 
 [bawbel.io](https://bawbel.io) &nbsp;·&nbsp;

docs/index.html

@@ -434,12 +434,12 @@ <h2>What is covered</h2>
     <div class="cards">
       <div class="card">
         <div class="card-icon"><svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75"><path d="M9 11l3 3L22 4"/><path d="M21 12v7a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h11"/></svg></div>
-        <h3>121 detection rules</h3>
-        <p>Pattern, YARA, and Semgrep rules mapped to all 51 AVE records. Every finding now carries confidence and evidence metadata.</p>
+        <h3>Detection rules</h3>
+        <p>Pattern, YARA, and Semgrep rules, each tied to the AVE record it detects. Every finding now carries confidence and evidence metadata.</p>
       </div>
       <div class="card">
         <div class="card-icon"><svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75"><circle cx="12" cy="12" r="3"/><path d="M12 2v3M12 19v3M4.22 4.22l2.12 2.12M17.66 17.66l2.12 2.12M2 12h3M19 12h3M4.22 19.78l2.12-2.12M17.66 6.34l2.12-2.12"/></svg></div>
-        <h3>6 detection engines</h3>
+        <h3>Detection engines</h3>
         <p>Pattern, YARA, Semgrep, LLM semantic analysis, Magika file-type verification, Docker behavioral sandbox.</p>
       </div>
       <div class="card">
@@ -788,7 +788,7 @@ <h1>AVE record reference</h1>
         </tr>
       </tbody>
     </table>
-    <p>Full registry of all 51 records: <a href="https://ave.bawbel.io/registry.html">ave.bawbel.io/registry.html</a></p>
+    <p>Full registry of published records: <a href="https://aveproject.org/registry.html">aveproject.org/registry.html</a></p>
   </div>
 
   <div class="doc-section" id="engines">
@@ -847,7 +847,7 @@ <h4>Sandbox -- Docker + <code>BAWBEL_SANDBOX_ENABLED=true</code></h4>
       Detection
     </div>
     <h1>Toxic flows</h1>
-    <p>Individual findings that are each only MEDIUM severity can combine into a CRITICAL attack chain. 12 built-in chains detect exactly this -- for example, a credential-read finding plus a data-exfiltration finding in the same component becomes a single Credential Exfiltration Chain at CRITICAL 9.8, rather than two separate MEDIUM findings a reviewer might triage as low priority individually.</p>
+    <p>Individual findings that are each only MEDIUM severity can combine into a CRITICAL attack chain. Built-in chains detect exactly this -- for example, a credential-read finding plus a data-exfiltration finding in the same component becomes a single Credential Exfiltration Chain at CRITICAL 9.8, rather than two separate MEDIUM findings a reviewer might triage as low priority individually.</p>
 
     <div class="pre-wrap"><pre><code>$ bawbel scan ./skills/ --recursive
 CRIT  AVE-2026-00003  line 4   AIVSS 6.8  confidence 0.75
@@ -857,7 +857,7 @@ <h1>Toxic flows</h1>
 
     <p>Chain confidence is the minimum confidence across all contributing findings -- the weakest link in the chain, not the average. This is deliberate: a chain is only as trustworthy as its least certain component.</p>
 
-    <p>Use <code>bawbel chain</code> to filter specifically to delegation-chain findings (AVE-2026-00048), or run a full <code>bawbel scan</code> to see all 12 toxic flow chains evaluated together.</p>
+    <p>Use <code>bawbel chain</code> to filter specifically to delegation-chain findings (AVE-2026-00048), or run a full <code>bawbel scan</code> to see every toxic flow chain evaluated together.</p>
   </div>
 
   <div class="doc-section" id="suppression">