research: AVE → OpenCRE pilot mapping (Batch 1 submitted, issue open) - #185
Merged
Merged
Conversation
Step 0 (entry point verification): TRUST_STRATEGY.md contains zero mentions of OpenCRE, Otto Sulin, or AISVS anywhere (grepped full repo + history) -- the named premise doesn't exist in its cited source. Independently verified the underlying real-world claim anyway: Otto Sulin is real (GitHub since 2014, Finland), opened OWASP/OpenCRE#1016 "Add AISVS 1.0 mappings" yesterday, a genuinely rigorous proposal -- but author_association is NONE, he's an external contributor awaiting review, not an OpenCRE maintainer. Found the real official contact independently too: rob.vanderveer@owasp.org, confirmed via CONTRIBUTING.md and the CREmappingtemplate.xls file's own metadata (Author: Rob van der Veer). Step 1: confirmed live, via the production API, that CWE is modeled in OpenCRE at individual-weakness-ID granularity (Standard nodes), many-to-many linked to CRE hub nodes -- the propagation mechanism named in the task's own framing, observed directly rather than assumed. Step 2: 5 pilot mappings across AVE-2026-00047/00061/00053/00034/00033, each checked at the mechanism level against real OpenCRE content. Caught and corrected a real methodology error mid-draft: the first pass discovered CREs by relaying through AVE's own existing CWE citations, which CONTRIBUTING.md explicitly warns against ("details get lost that way"). Independently re-derived all 5 via OpenCRE's own text_search; 4 held up unchanged, 1 (AVE-2026-00034) did not -- the independent method found CRE 307-507 (linked via CWE-353, a different CWE than the record cites) as a more precise primary match than the CWE-829-routed candidates, a real instance of the exact risk CONTRIBUTING.md names, not a hypothetical. Step 3: built the actual submission artifacts from the verified mappings -- ave-to-opencre-pilot-mapping.csv (OpenCRE's own CRE 0-4 + AVE|name/id/hyperlink/description template column format, full CRE hierarchy paths walked live) and a readable companion table. Step 4: confirmed the real contribution process (docs/CONTRIBUTING.md) is issue-attachment or direct email, not a PR against a file in OpenCRE's own repo -- different from every other crosswalk this project has built (AST10, cfgaudit, ramparts). This repo's existing crosswalk-1.0.0.schema.json shape would not have been usable as-is; flagged in the draft. No contact made with OpenCRE, Otto Sulin, or Rob van der Veer. Step 5 (outreach) is explicitly gated on a separate go-ahead.
Spot-checked every factual claim in the draft against live data rather than trusting the first pass: - CONTRIBUTING.md quote checked verbatim against the actual file, exact match - all 5 AVE record titles in the CSV checked against the real records, exact match - every CRE hierarchy path in the CSV mechanically verified against the live-fetched parent chains, zero mismatches - CRE 307-507's full 13-link list re-fetched (earlier fetch during drafting only printed 8) to confirm CWE-353 really is its only linked CWE -- the 'CWE-routing could not have found this' claim holds on complete data, not a truncated sample - found one additional corroboration not in the original draft: 307-507 carries a Related link to 613-285 Supply chain management, the same node in 577-260's own parent chain -- OpenCRE's own graph already treats these as connected, independent confirmation the 3-CRE proposal for AVE-2026-00034 isn't an arbitrary combination - checked whether aveproject.org has dedicated per-record pages that would be a better AVE|hyperlink target than the raw GitHub blob URL currently used: no (404), raw URL confirmed as the best available choice Nothing in the draft's substantive conclusions changed. No contact made.
Per review decision: submission artifacts (CSV + readable companion) now carry only AVE-2026-00047, 00061, 00053 -- the three single-CRE, no-caveat correspondences. AVE-2026-00034 (3-CRE proposal) and AVE-2026-00033 (partial-scope mapping) are held for a deliberate follow-up round, not dropped: both are fully verified in the draft, just sequenced after this smaller first batch gets feedback. DRAFT.md keeps all 5 candidates' full evidence -- sections 4 and 5 are explicitly labeled [HELD FOR FOLLOW-UP, not in this submission] rather than removed, since they're the follow-up round's starting point. Still no contact made with OpenCRE, Otto Sulin, or Rob van der Veer. Trimming what to send is not a decision to send it -- Step 5 still needs its own explicit go-ahead.
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Steps 0–5 of the OpenCRE integration, verification-first, per the
original task scoping (propagation risk: a wrong mapping into OpenCRE
connects AVE to every standard already in the hub automatically).
Outreach has happened: OWASP/OpenCRE#1017
is open, submitting 3 pilot mappings as an explicit "Batch 1" (modeled
on real precedent — OpenCRE's own #735
was accepted using the identical small-batch framing). No merge, no
maintainer response yet — this PR lands the research and submission
record in AVE's own repo regardless of how that plays out.
What's in this PR
crosswalks/ave-to-opencre-pilot-DRAFT.md— full Step 0–4 writeup:entry-point verification (the "Otto Sulin" premise didn't exist in
TRUST_STRATEGY.mdat all, though the underlying real-world claimchecked out independently), live-API-confirmed CWE structure, 5
candidate mappings each independently re-verified against OpenCRE's
own text search (not just CWE-citation routing —
CONTRIBUTING.mdexplicitly warns against that shortcut, and the first draft did it
anyway; caught and corrected, with the correction kept visible in the
document rather than edited away), and the real submission-format
mismatch found (this repo's own
crosswalch-1.0.0.schema.jsonshapeisn't what OpenCRE actually wants).
crosswalks/ave-to-opencre-pilot-mapping.csv— the actualsubmitted artifact, in OpenCRE's own
CRE 0–CRE 4+AVE|name/id/hyperlink/descriptiontemplate format, trimmed tothe 3 cleanest single-CRE correspondences (AVE-2026-00047, 00061,
00053) after a second review pass.
crosswalks/ave-to-opencre-pilot-mapping-READABLE.md— the same3 rows as a table, plus the 2 held-back candidates (AVE-2026-00034,
AVE-2026-00033) documented as the follow-up batch's starting point,
not dropped work.
Why only 3, and why that's not weak
Real precedent checked, not assumed: OpenCRE's own accepted
#735 ("NIST 800-53
enhancement-level mapping (Batch 1)") shipped 6 individual mapping
changes under the same small-batch framing this PR uses.
CONTRIBUTING.mdsets no minimum and states a quality-over-quantity preference directly.
Not in scope for this PR
changes, acceptance or rejection) — tracked there, not here.
deliberately, fully evidenced in the DRAFT, pending feedback on this
first batch's approach.
TRUST_STRATEGY.md's own gap (currently says nothing about OpenCRE)— flagged in the DRAFT's Step 0, not corrected here; a deliberate
follow-up, not bundled into this research PR.