fix: taxonomy fields with the agentic distinction for the seven JUSTIFY records

crosswalks/ave-to-agent-evidence-vocabulary.md

@@ -2,72 +2,93 @@
 
 A field-level crosswalk between AVE's evidence-provenance properties and the
 agent-evidence-vocabulary registry, which names the axes an execution-evidence
-claim is read on: who observed the execution, how directly, and what the claim
-leaves out. Machine-readable form in
+claim is read on: who observed the execution, how directly, what the claim
+leaves out, and why a published record's derived value changed. Machine-readable
+form in
 [`ave-to-agent-evidence-vocabulary.json`](ave-to-agent-evidence-vocabulary.json),
 against
 [`schema/crosswalk-1.0.0.schema.json`](../schema/crosswalk-1.0.0.schema.json).
 
 | | |
 |---|---|
-| Source | AVE 1.1.0, 80 records, commit `1e29789e4941b6c1c2435508dbf3c245eedc8d04` |
-| Target | [agent-evidence-vocabulary](https://github.com/probityai/agent-evidence-vocabulary) 0.2.0, 8 terms, CC0-1.0, commit `66177d65690e9d7eb7e4ff59df8f91792a90735b` |
-| Generated | 2026-09-15 |
+| Source | AVE 1.1.0, 89 records, commit `4032785b67d35fed2e542b23577e8c601c61e145` |
+| Target | [agent-evidence-vocabulary](https://github.com/probityai/agent-evidence/tree/agent-evidence-vocabulary-v0.8.0/packages/vocabulary) 0.8.0, 37 terms, CC0-1.0, commit `5fe04d8ffe98710d68ee958c8595d0de6179a3bf` |
+| Generated | 2026-10-27 |
 | Unit | one schema property, not one category |
 
+Previous revision (2026-09-15): AVE 1.1.0 with 80 records at `1e29789e`, against
+vocabulary 0.2.0 with 8 terms at `66177d65`. The registry has since moved into
+the `agent-evidence` repository, and the old repository is archived.
+
 ## Read this first
 
-None of the 80 records carries `evidence_vantage`, `evidence_method` or
-`verification_basis`. All three are optional in schema v1.1.0, and all three
-read absent on every record file at the pinned commit. That was checked by
-fetching each of the 80 files, not by reading the schema.
+At the pinned commit, 16 of the 89 records carry at least one of
+`evidence_vantage` and `verification_basis`, and none carries `evidence_method`.
+Nine records carry `evidence_vantage` (eight `artifact`, and AVE-2026-00074 with
+`substrate`), and seven carry `verification_basis` (all `artifact_reconstructed`).
+That was checked by reading every record file in the pinned tree, not by reading
+the schema. One record, AVE-2026-00074, carries a `revisions` entry, with
+`reason_code` `declaration_added`.
 
-So every row below carries an evidence state of inferred, established by
-comparing two schema definitions. None carries emitted, and a reviewer should
-not read one that way. A row moves to emitted when a record carries the field
-and the reviewer can fetch it. The script that writes verification_basis has
-nothing to derive over until that happens.
+So the `evidence_vantage`, `verification_basis` and `revisions[].reason_code`
+rows carry an evidence state of emitted, and the `evidence_method` and
+`evidence_basis_engines` rows stay inferred, established by comparing two schema
+definitions. AVE records are unsigned JSON files in a git repository, so emitted
+here means a record carries the field and a reviewer can fetch it at the pinned
+commit, which is the rule this file set in September. The registry's own
+definition of emitted names a signed statement, and whether a row meets the
+registry's promotion rule is for the registry to decide.
 
 ## The mapping
 
-| AVE field | Registry term | Match | Why |
-|---|---|---|---|
-| `evidence_vantage` | `observation_vantage` | exact | `substrate` and `artifact` on both sides, same two values, same weakest-input composition |
-| `evidence_method` | `observation_directness` | exact | `intercepted` and `reconstructed` on both sides, same composition, same floor |
-| `verification_basis` | `observation_vantage` + `observation_directness` | structural | AVE's four values are the product of the two registry axes; either side converts without loss |
-| `evidence_basis_engines` | `observation_vantage` | partial | `external_authority` and `sandbox` sit on the substrate side; the five artifact-reading engines sit on the other |
+| AVE field | Registry term | Match | Evidence | Why |
+|---|---|---|---|---|
+| `evidence_vantage` | `observation_vantage` | exact | emitted, 9 records | `substrate` and `artifact` on both sides, same two values, same weakest-input composition |
+| `evidence_method` | `observation_directness` | exact | inferred, 0 records | `intercepted` and `reconstructed` on both sides, same composition, same floor |
+| `verification_basis` | `observation_vantage` + `observation_directness` | structural | emitted, 7 records | AVE's four values are the product of the two registry axes; either side converts without loss |
+| `evidence_basis_engines` | `observation_vantage` | partial | inferred | `external_authority` and `sandbox` sit on the substrate side; the five artifact-reading engines sit on the other |
+| `revisions[].reason_code` | `revision_reason` | exact | emitted, 1 record | the same four codes and the same entry shape; AVE copied the codes when it added the array in #360 |
 
-The two exact rows are unusual and worth a sentence. The definitions were
+The two axis rows are unusual and worth a sentence. The definitions were
 written independently, on different sides, and reached the same two-value split
 with the same composition rule. That is the case for calling them exact rather
-than approximate: there is nothing to reconcile.
+than approximate: there is nothing to reconcile. Both value sets and the
+composition rule are unchanged at registry 0.8.0.
+
+The `revisions` row is the newest. The four codes in AVE's schema enum were
+compared with `revision_reason` at 0.8.0 and are identical. AVE states that its
+enum stands on its own and does not follow later changes in the registry. One
+code, `declaration_added`, is used by one record, and the other three are valid
+in the schema and unused.
 
 ## What does not map
 
-Six registry terms have no AVE counterpart, because an AVE record classifies a
-component's behavior while the registry describes one observed execution.
+Thirty-four registry terms have no AVE counterpart, because an AVE record
+classifies a component's behavior while the registry describes one observed
+execution, the admission of a change to a harness, or the decision that a task
+is done. The JSON lists each term with its own reason. By section:
 
-| Registry term with no AVE counterpart | AVE field with no registry counterpart |
+| Registry section | Terms with no AVE counterpart |
 |---|---|
-| `field_evidence_partition` | `confidence_baseline` |
-| `issuance_time_basis` | `detection_stage` |
-| `containment_posture` | `detection_layer` |
-| `coverage_denominator` | `evidence_kind_default` |
-| `does_not_assert` | |
-| `result` | |
-
-The first field in the right-hand column will never get a counterpart. The
-registry's own out-of-scope block excludes scored assessment of an actor, so a
-confidence prior sits outside it by design and not by omission.
+| `evidence_dimensions` | `witness_scope`, `field_evidence_partition`, `issuance_time_basis`, `commitment_anchor`, `anchor_time_rule`, `attestation_tier`, `intent_binding`, `origin_kind`, `independence_basis`, `party_role`, `control_relation`, `evidence_origin_class` |
+| `posture_and_coverage` | `containment_posture`, `coverage_denominator`, `does_not_assert`, `claim_subject`, `base_state_resolution`, `set_sufficiency`, `material_change_trigger` |
+| `outcome_lattice` | `result` |
+| `change_admission` | `admission_decision`, `admission_gate`, `evaluation_mode`, `replay_coverage`, `replay_snapshot`, `authority_change` |
+| `done_verification` | `done_contract`, `done_receipt`, `acceptance_observed`, `protected_path`, `claimed_tool_output`, `observed_tool_output`, `stop_decision`, `inconclusive_verdict` |
 
-The per-field reasons are in the gaps array of the JSON.
+Five AVE fields have no registry counterpart: `confidence_baseline`,
+`detection_stage`, `detection_layer`, `evidence_kind_default` and
+`detection_methodology`. The first will never get one. The registry's own
+out-of-scope block excludes scored assessment of an actor, so a confidence prior
+sits outside it by design and not by omission.
 
 ## Offered as a basis for collaboration
 
-The registry is CC0-1.0 and its eight terms all carry the status proposed and none carries canonical. Its
-promotion rule is that a term becomes canonical only when an independently
-maintained system emits it in a running artifact and files a crosswalk with a
-source path a reviewer can fetch. AVE already declares two of those fields in
-its schema. If records start carrying them, the two exact rows above become the
-evidence that rule asks for, and the coverage number in the JSON moves without
-the mapping changing.
+The registry is CC0-1.0 and all 37 of its terms carry the status proposed and
+none carries canonical. Its promotion rule is that a term becomes canonical only
+when an independently maintained system emits it in a running artifact and files
+a crosswalk with a source path a reviewer can fetch. The `revisions` row above
+carries that source path, `records/AVE-2026-00074.json`, and the registry's
+promotion trigger for `revision_reason` asks for exactly that shape. If more
+records carry `evidence_method` or more revisions, the coverage numbers in the
+JSON move without the mapping changing.

dist/ave-records-latest.json

@@ -1036,6 +1036,13 @@
         "private_data"
       ]
     },
+    "security_boundary": "static file content → LLM context window (a boundary that does not exist the same way for a deterministic program reading the same file)",
+    "missing_control": "no separation between content an LLM incidentally reads and content a co-located prompt-injection payload can induce the LLM to act on; a hardcoded credential is exposed to both",
+    "vulnerability_rationale": {
+      "capability": "Skill/component files can contain literal string values, including credential-shaped ones.",
+      "vulnerability": "Conventional secrets-in-source (CWE-798), amplified by a property specific to agent components: the credential sits in the same context window an LLM reads, so a prompt injection payload elsewhere in that context can instruct the agent to read and exfiltrate it. A compiled program reading the same file has no such boundary.",
+      "impact": "The credential is readable by any process that loads the component, including the agent itself, any injected instructions that reach the context window, and any observer with read access to the file."
+    },
     "mitigation": {
       "strategy": [
         "validate_input",
@@ -1066,7 +1073,7 @@
     "researcher": "Saray Chak",
     "researcher_url": "https://bawbel.io",
     "published": "2026-05-16T00:00:00Z",
-    "last_updated": "2026-05-16T00:00:00Z",
+    "last_updated": "2026-11-04T00:00:00Z",
     "references": [
       {
         "tag": "CWE-798",
@@ -3438,6 +3445,13 @@
         "external_comms"
       ]
     },
+    "security_boundary": "trusted instruction content → shell execution, with no boundary between the two once a component's text is treated as instruction",
+    "missing_control": "no distinction between natural-language content that merely describes a step and natural-language content that constitutes an executable directive",
+    "vulnerability_rationale": {
+      "capability": "Agent with shell/code-execution tool access follows embedded commands.",
+      "vulnerability": "Conventional command injection (CWE-78 territory) delivered through natural language rather than code. The mechanism is conventional; what makes it an AVE class is the channel: the input is natural-language content that an agent reads and treats as an instruction, and tools built to find command injection in code, such as SAST scanners, do not read that channel, so the flaw stays invisible to them until the agent has acted on it.",
+      "impact": "Arbitrary remote code executes on the host with the agent's privilege level."
+    },
     "mitigation": {
       "strategy": [
         "deny_by_default",
@@ -3460,7 +3474,7 @@
     "researcher": "Saray Chak",
     "researcher_url": "https://bawbel.io",
     "published": "2026-04-19T09:00:00Z",
-    "last_updated": "2026-08-26T00:00:00Z",
+    "last_updated": "2026-11-04T00:00:00Z",
     "references": [
       {
         "tag": "CWE-78",
@@ -3588,6 +3602,13 @@
         "untrusted_content"
       ]
     },
+    "security_boundary": "instruction content → shell execution, with no boundary between the two",
+    "missing_control": "no distinction between natural-language content that merely describes a step and natural-language content that constitutes an executable directive",
+    "vulnerability_rationale": {
+      "capability": "Agent with filesystem/shell access follows embedded destructive commands.",
+      "vulnerability": "Conventional destructive-command pattern (`rm -rf /` class), delivered through natural language by the same channel as AVE-2026-00004: instructions an agent follows, which code-oriented scanners do not read. It stays a separate class from 00004 because the impact differs: irrecoverable data loss with no code-execution requirement, a severity and detection distinction and not only a label.",
+      "impact": "Files on the host are permanently destroyed, and the loss is irrecoverable without backup."
+    },
     "mitigation": {
       "strategy": [
         "require_human_approval",
@@ -3610,7 +3631,7 @@
     "researcher": "Saray Chak",
     "researcher_url": "https://bawbel.io",
     "published": "2026-04-19T09:00:00Z",
-    "last_updated": "2026-08-26T00:00:00Z",
+    "last_updated": "2026-11-04T00:00:00Z",
     "references": [
       {
         "tag": "CWE-78",
@@ -7531,6 +7552,13 @@
         "untrusted_content"
       ]
     },
+    "security_boundary": "instruction content → unsafe deserialization/eval call, with no boundary between them",
+    "missing_control": "no detection of unsafe deserialization or eval when it is instructed in natural language and not written as code",
+    "vulnerability_rationale": {
+      "capability": "Agent follows instructions to deserialize or evaluate externally supplied data.",
+      "vulnerability": "Conventional remote code execution through unsafe deserialization or eval (CWE-502 and CWE-94), delivered through natural language. The mechanism is conventional; the distinction is the channel, as for AVE-2026-00004 and 00005: the unsafe operation is instructed in text that an agent follows, and code-oriented scanners do not read that text.",
+      "impact": "A reliable code execution path through the agent's execution environment."
+    },
     "mitigation": {
       "strategy": [
         "validate_input",
@@ -7575,7 +7603,7 @@
     "researcher": "Saray Chak",
     "researcher_url": "https://bawbel.io",
     "published": "2026-04-19T09:00:00Z",
-    "last_updated": "2026-10-31T00:00:00Z",
+    "last_updated": "2026-11-04T00:00:00Z",
     "references": [
       {
         "tag": "CWE-502",
@@ -8596,6 +8624,13 @@
         "untrusted_content"
       ]
     },
+    "security_boundary": "agent output (trusted-intermediary status) → downstream interpreter (SQL/HTML/shell)",
+    "missing_control": "no escaping or sanitization gate between agent-generated output and downstream interpretation",
+    "vulnerability_rationale": {
+      "capability": "Agent output is passed to downstream interpreters as a trusted intermediary.",
+      "vulnerability": "No escaping/sanitization gate exists between agent-generated output and downstream interpretation. The mechanism is classic injection (CWE-79 and CWE-89 territory); what is agentic is the trust elevation backend systems grant an agent compared with raw user input, so the agent's trusted role draws less scrutiny than raw user input would.",
+      "impact": "Classic injection (SQLi/XSS/command injection) via a trust-elevated conduit."
+    },
     "mitigation": {
       "strategy": [
         "sanitize_output",
@@ -8640,7 +8675,7 @@
     "researcher": "Saray Chak",
     "researcher_url": "https://bawbel.io",
     "published": "2026-04-19T09:00:00Z",
-    "last_updated": "2026-10-31T00:00:00Z",
+    "last_updated": "2026-11-04T00:00:00Z",
     "references": [
       {
         "tag": "OWASP LLM Insecure Output",
@@ -11179,6 +11214,13 @@
         "external_comms"
       ]
     },
+    "security_boundary": "declared or default provider endpoint → actual configured endpoint",
+    "missing_control": "no verification that a provider or telemetry endpoint value matches the component's declared or default provider before traffic is sent",
+    "vulnerability_rationale": {
+      "capability": "Components can declare telemetry, provider and API endpoint values in configuration.",
+      "vulnerability": "Conventional config-based traffic redirection, but tied to infrastructure that exists only because the component is agentic: LLM provider base URLs, MCP server URLs and A2A agent-card URLs. No verification checks the endpoint against the declared or default provider, and a committed value redirects the traffic with no content injected into the model's context. The record cites a real case, CVE-2026-21852, where a redirected ANTHROPIC_BASE_URL leaked a user's API key.",
+      "impact": "Telemetry, model or provider traffic is sent to a host the component's author did not intend, so credentials such as the user's API key can leak, before any trust confirmation is shown."
+    },
     "mitigation": {
       "strategy": [
         "deny_by_default",
@@ -11206,7 +11248,7 @@
     "researcher": "Nicolai (predictor2718)",
     "researcher_url": "https://github.com/predictor2718",
     "published": "2026-08-06T00:00:00Z",
-    "last_updated": "2026-08-08T00:00:00Z",
+    "last_updated": "2026-11-04T00:00:00Z",
     "references": [
       {
         "tag": "cfgaudit crosswalk gap detail",
@@ -11314,6 +11356,13 @@
         "untrusted_content"
       ]
     },
+    "security_boundary": "reviewed artifact (the .py source a human or scanner reads) → executed artifact (the .pyc the interpreter actually loads)",
+    "missing_control": "no bytecode-versus-source comparison step in the review or scanning pipeline",
+    "vulnerability_rationale": {
+      "capability": "CPython prefers a valid cached .pyc over recompiling source when one is present.",
+      "vulnerability": "The bytecode-cache preference is a general interpreter property and not agent-specific in mechanism. What makes it an AVE class is the target: research cited in the record (CSA AI Safety Initiative and Trail of Bits) frames it as a technique for evading agent-skill scanners specifically, which document their own inability to analyze binary or encrypted code, so a skill's .pyc can carry dangerous primitives that a source-only scan never sees.",
+      "impact": "The interpreter executes dangerous primitives (process execution, network calls, credential-path access) that appear nowhere in the .py source a reviewer or source-only scanner reads."
+    },
     "mitigation": {
       "strategy": [
         "validate_input",
@@ -11340,7 +11389,7 @@
     "researcher": "CSA / Trail of Bits",
     "researcher_url": "https://labs.cloudsecurityalliance.org/research/csa-research-note-ai-agent-skill-scanner-bypass-20260610-csa/",
     "published": "2026-08-07T00:00:00Z",
-    "last_updated": "2026-08-07T00:00:00Z",
+    "last_updated": "2026-11-04T00:00:00Z",
     "references": [
       {
         "tag": "repo-forensics bytecode scanner",

dist/ave-records-latest.manifest.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.3.0",
   "record_count": 89,
-  "generated_at": "2026-11-04T13:46:15.467Z",
+  "generated_at": "2026-11-05T00:00:53.487Z",
   "source": "https://github.com/aveproject/ave",
-  "sha256": "ef927adae8c9deca9361808f60869d1bfa6e65622de60c5c6c9e4bbcb82cb4ab"
+  "sha256": "3631a6920bec6aad889b610bfabf8a9cac28aabfe29e687a3f6d79c3ae3ef944"
 }