Repository navigation
Conversation
Signed-off-by: chaksaray <chaksaray@gmail.com>
…18 to the decision list (#446) Adds scripts/aivss_v08.py and tests/test_aivss_v08.py (OWASP's ten worked examples, the tie inputs a float product misrounds, the constants, the refusals); nothing imports the module yet. Rereads the conformance statement and the pilot and corrects them: the no-script-changed wording, D3's count of by-value Attacked tiers, an explicit denominator for the ThM finding, a duplicated sentence. Adds D17 (CVSS vector policy) and D18 (when to open the 30-day public comment period). Signed-off-by: chaksaray <chaksaray@gmail.com>
…add D19 and D20 (#446) Approved by the maintainer on 2026-11-05: D1 to D12 (D12 conditional on TX4), D15, D16 and D18; D13, D14 and D17 as changed in the same message. D17 is now the CVSS-B-only policy (reasonable worst case per FIRST, subsequent systems by security domain, tool reach counted once, advisory vector as a start, two implementations, a second assessor on ten records). Corrects the subsequent-system count: 82 of 88 valid vectors have at least one of SC, SI, SA High, not 63 (63 had one or two). Adds D19 (S03a and S03b) and D20 (5 to 8 reference deployment profiles), neither yet approved in writing. Signed-off-by: chaksaray <chaksaray@gmail.com>
chaksaray
marked this pull request as ready for review
November 4, 2026 23:31
…rmed advisory seeds (#446) D19 (S03a vectors, S03b AIVSS inputs) approved by the maintainer. D20 withdrawn as written and replaced by an amendment to D1: section 6.1 publishes the four deployment-factor values per component type (skill, mcp_server, agent); drafted values, applied to the pilot they change no band. Adds D21 (tier S03b by band sensitivity: 47 light and 41 full on today's vectors). D17 part 6 now lists six advisories for five records as S03a seeds, each confirmed against the GitHub Advisory Database entry and recomputed with both implementations. Signed-off-by: chaksaray <chaksaray@gmail.com>
…6.1 (#446) D21 approved by the maintainer with one change: the full tier is band-sensitive records only; band-insensitive records near a band edge get an independent check of their vector and mitigation (D15, D17 part 8), not a full factor assessment. Table 6.1 revised by the maintainer: Non-Determinism and Opacity 1.0 in all three columns (OWASP scores Opacity 1.0 in all ten examples and Non-Determinism 0 in none), marked initial and adjustable during S03b. Applied to the pilot the revised table moves AVE-2026-00063 from 6.7 MEDIUM to 7.0 HIGH. The eight records without a column are assigned to the nearest type in S03b with a stated reason, no new columns. Signed-off-by: chaksaray <chaksaray@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #446.
Step S01 of the plan to conform AVE scoring to OWASP AIVSS v0.8 (#399). The maintainer approved the decision list on 2026-11-05 (status table in section 13 of the statement). S02 does not start until this pull request has merged and the public comment period (D18) has opened.
What is in it
docs/specs/aivss-v0.8-conformance.md: the equations and constants with section numbers, howcvss_baseis determined, the class-level assessment rule, per-factor guidance, a table of initial deployment-factor values per component type (section 6.1, adjustable during S03b), the ThM and mitigation rules, the proposed 2.0.0aivssobject aligned with Appendix A, every difference found between the specification and the other sources, and decisions D1 to D21.docs/audits/aivss-v0.8-pilot.mdanddocs/audits/aivss-v0.8-pilot.json: ten records assessed under the statement, with sensitivity and a plain-language check; the data is in OWASP's Appendix A report format. The pilot's vectors predate decision D17 and are evidence of sensitivity, not scores to apply.scripts/aivss_v08.pyandtests/test_aivss_v08.py: the AIVSS v0.8 arithmetic in exact decimal. Nothing imports it. The tests reproduce OWASP's ten worked examples and the tie inputs a float product misrounds (36 of 19,089 inputs, 2 of them across a band). 22 of 22 mutations of the module are caught.No record, schema file, validator or
dist/file is changed. Full suite: 1033 passed, 1 skipped.Status of the decisions
Numbers to read first
thmby value agrees with the cited evidence for 4 of the 10 pilot records. The ten are not a sample of the 89.