[drk-ram]

Summary

Closes #160.

Appendix A cites AIVSS-1 through AIVSS-10. The mapping file stores the source ordinals 1 through 10, which is what the extraction notes require, and recorded no label a joiner could use. This adds display_id without renumbering those ordinals, and adds an offline check that the rest of the crosswalk still joins.

What the check locks

• Every element id in an Appendix A by-framework table resolves to exactly one mappings/*.json element. AIVSS labels resolve through display_id.
• Mapping files have no duplicate ids.
• A coverage-matrix symbol agrees with the section: primary requires a primary row, supporting requires rows and no primary, and an em dash requires no row.
• Where Appendix A quotes a catalog title (ASI, DSGAI, ATLAS, ATT&CK, AIVSS), the quoted title matches. The one waiver is the DSGAI07 short title, which open PR fix(appendix-a,zenodo): align DSGAI07 title with dsgai-v1.0.json and enforce UTF-8 in zenodo_release.py #153 already replaces. CWE, NIST AI RMF, and AICM are checked by id, because those tables abbreviate titles on purpose.

What this does not touch

• 2_0_vulns/ is not in the repository and is not referenced. Nothing to change.
• Zenodo token handling and UTF-8 reads are open PRs zenodo: send the API token as a Bearer header and verify the bucket host #139 and fix(appendix-a,zenodo): align DSGAI07 title with dsgai-v1.0.json and enforce UTF-8 in zenodo_release.py #153.
• Open PR feat(scripts): add offline Appendix A crosswalk, coverage-matrix, and asset validator #155 adds a different Appendix A script. This one does not edit that path.
• Appendix A itself is not edited, so the DSGAI07 line in fix(appendix-a,zenodo): align DSGAI07 title with dsgai-v1.0.json and enforce UTF-8 in zenodo_release.py #153 is left alone.
• cwe-4.20.json and mitre-atlas-2026.06.json are left alone (open PR feat: implement mapping integrity validator for CWE and MITRE ATLAS #147).

Validation

python .github/scripts/test_validate_mapping_crosswalk.py

Result: 5 tests, OK.

The repository check is one of those tests. The others copy 2026/final/ and fail on a duplicate ASI id, an AIVSS-99 label, and a coverage-matrix mark added for LLM10 / NIST AI RMF without a section row.