fix: quality batch 7, taxonomy fields for 4 records

.claude/skills/add-ave-record/SKILL.md

@@ -120,6 +120,8 @@ A record passing validation is not yet a published one. Update:
 
 - **dist/ave-records-latest.json**: add or replace this record's entry,
   keeping the array sorted by ave_id.
+- **dist/ave-taxonomy-latest.json**: regenerate it from that file with
+  `python3 scripts/build_taxonomy.py` (`--check` confirms they agree).
 - **CHANGELOG.md**: one line under Unreleased/Added: the ave_id, title,
   severity, and aivss_score.
 - **README.md, three separate things, don't assume any of them share a

.github/workflows/regenerate-records-json.yml

@@ -1,6 +1,7 @@
 name: Regenerate consolidated records JSON
 
-# Keeps dist/ave-records-latest.json current automatically, and creates
+# Keeps dist/ave-records-latest.json and dist/ave-taxonomy-latest.json current
+# automatically, and creates
 # dist/ave-records-v<version>.json the first time a schema version appears
 # (never rewritten after that -- see scripts/build-records.js).
 # Triggers on every push to develop that touches records/ -- the repo that
@@ -37,6 +38,9 @@ jobs:
       - name: Regenerate consolidated records JSON
         run: node scripts/build-records.js
 
+      - name: Regenerate the AVE SARIF taxonomy
+        run: python3 scripts/build_taxonomy.py
+
       - name: Open PR if dist/ changed
         uses: peter-evans/create-pull-request@v8
         with:
@@ -50,9 +54,11 @@ jobs:
           commit-message: "chore: regenerate consolidated records JSON"
           title: "chore: regenerate consolidated records JSON"
           body: |
-            Auto-generated by `scripts/build-records.js` after a change to
-            `records/` on `develop`. Regenerates `dist/ave-records-latest.json`
-            (and its manifest) to stay in sync with the current record set.
+            Auto-generated by `scripts/build-records.js` and
+            `scripts/build_taxonomy.py` after a change to `records/` on
+            `develop`. Regenerates `dist/ave-records-latest.json` (and its
+            manifest) and `dist/ave-taxonomy-latest.json` to stay in sync with
+            the current record set.
             The versioned `dist/ave-records-v<schema_version>.json` snapshot
             is only touched the first time a given schema version appears --
             if this diff includes one, that means a new schema version's

CHANGELOG.md

@@ -8,6 +8,20 @@ Format: [Semantic Versioning](https://semver.org). Schema versions and record se
 
 ## [Unreleased]
 
+### SARIF
+- **The AVE taxonomy as a canonical file, form C and taxonomy checks** (#420). `dist/ave-taxonomy-latest.json` is the AVE
+  taxonomy as a SARIF 2.1.0 `toolComponent` with a frozen `guid` (`5110b285-34d7-5334-94db-0308b24cfb49`, the UUIDv5 of
+  `https://aveproject.org/taxonomy/AVE`) and one taxon per record, including records whose status is not `active`.
+  `scripts/build_taxonomy.py` builds it deterministically from `dist/ave-records-latest.json` (`--check` fails when it is
+  stale; `--only` builds the subset a scanner embeds; `--release`, `--release-date` and `--download-uri` stamp a release),
+  and the workflow that regenerates `dist/` rebuilds it. `docs/specs/ave-in-sarif.md` moves to v1.2: form C (a tool's own
+  `ruleId`, a rule `relationships` link to the AVE taxonomy, `result.taxa` and `supportedTaxonomies`, recommending `kinds`
+  `["relevant"]` and saying why), the guid as the taxonomy's identity, and a form C example. `scripts/ave_conformance.py`
+  reads form C and gains six checks: `taxonomy_guid_missing`, `taxonomy_guid_mismatch`, `taxon_unknown`,
+  `taxon_name_differs`, `reference_guid_mismatch` and `supported_taxonomies_missing`. Forms A and B are unchanged. The
+  generated file mirrors record text exactly, so it carries the em dashes that AVE-2026-00050 and 00051 have in their
+  titles and description until those records are corrected.
+
 ### Records
 - **Eight cut-off fingerprints repaired** (#414). AVE-2026-00023, 00026, 00029, 00030, 00033, 00038, 00039 and
   00040 had a `behavioral_fingerprint` that stopped mid-word at exactly 200 characters (`... human oversight

CLAUDE.md

@@ -146,6 +146,7 @@ def validate_record(record: dict) -> tuple[bool, list[str]]:
 ```bash
 npm install ajv ajv-formats           # schema validation deps
 node scripts/build-records.js         # build dist/ave-records-latest.json
+python3 scripts/build_taxonomy.py     # build dist/ave-taxonomy-latest.json from it (--check: fail if stale)
 
 # Python validation
 pip install -e ".[dev]"

CONTRIBUTING.md

@@ -169,6 +169,7 @@ python scripts/check_mutation_thm_trail.py --strict --only AVE-2026-NNNNN   # if
 python scripts/check_framework_sources.py --strict --only AVE-2026-NNNNN   # CI enforces this for every record now; run it scoped to yours before pushing, same check either way
 python scripts/generate_terms.py      # regenerate docs/terms.md after any schema field or description change
 python scripts/check_terms_sync.py    # hard failure if docs/terms.md disagrees with the live schema -- run before opening a PR
+python3 scripts/build_taxonomy.py --check   # dist/ave-taxonomy-latest.json must match dist/ave-records-latest.json; run python3 scripts/build_taxonomy.py after you change that file
 pytest tests/ -x -q                   # full suite: schema, AIVSS arithmetic, mitigation enums
 ```