diff --git a/data/frameworks/maestro.json b/data/frameworks/maestro.json index 8d2c0b4..ed47473 100644 --- a/data/frameworks/maestro.json +++ b/data/frameworks/maestro.json @@ -13,7 +13,7 @@ { "control_id": "L1", "title": "Foundation Models", - "description": "Base model layer — covers model selection, provenance, fine-tuning security, and model integrity threats.", + "description": "Base LLMs providing core reasoning and generation", "parent": null, "function": "Architecture Layer", "kind": "layer" @@ -45,7 +45,7 @@ { "control_id": "L2", "title": "Data Operations", - "description": "Data pipelines — covers RAG, vector stores, training data, embedding security, and data governance.", + "description": "Ingestion pipelines, storage, RAG, embeddings, vector stores", "parent": null, "function": "Architecture Layer", "kind": "layer" @@ -77,7 +77,7 @@ { "control_id": "L3", "title": "Agent Frameworks", - "description": "Agent runtime — covers agent orchestration, goal management, memory, and planning security.", + "description": "Orchestration platforms, tool registries, MCP, plugin ecosystems", "parent": null, "function": "Architecture Layer", "kind": "layer" @@ -109,7 +109,7 @@ { "control_id": "L4", "title": "Deployment & Infrastructure", - "description": "Tool access — covers MCP, API integrations, plugin security, and tool authorization.", + "description": "Servers, containers, networks, CI/CD, runtime environments", "parent": null, "function": "Architecture Layer", "kind": "layer" @@ -141,7 +141,7 @@ { "control_id": "L5", "title": "Evaluation & Observability", - "description": "Infrastructure — covers containerization, networking, secrets management, and runtime isolation.", + "description": "Monitoring, logging, telemetry, behavioural baselines", "parent": null, "function": "Architecture Layer", "kind": "layer" @@ -173,7 +173,7 @@ { "control_id": "L6", "title": "Security & Compliance", - "description": "Multi-agent coordination — covers inter-agent communication, delegation, consensus, and cascading failure prevention.", + "description": "Identity, access control, audit, governance, credential management", "parent": null, "function": "Architecture Layer", "kind": "layer" @@ -205,7 +205,7 @@ { "control_id": "L7", "title": "Agent Ecosystem", - "description": "Human-agent interface — covers user authentication, output validation, human oversight, and trust management.", + "description": "Multi-agent interaction, A2A communication, cascade dynamics", "parent": null, "function": "Architecture Layer", "kind": "layer" @@ -240,6 +240,11 @@ "date": "2026-04-09", "change": "Initial seed — 7 layers with 21 sub-controls from CSA MAESTRO framework", "author": "OWASP GenAI Data Security Initiative" + }, + { + "date": "2026-09-14", + "change": "Layer descriptions L1–L7 transcribed from the architecture table in llm-top10/LLM_MAESTRO.md. #32 corrected the titles to the CSA model but left the descriptions of the superseded one, so L4–L7 each carried the correct name and another layer's definition. Sub-controls unchanged (issue #31).", + "author": "OWASP GenAI Data Security Initiative" } ], "inventory_completeness": { diff --git a/docs/frameworks-registry.js b/docs/frameworks-registry.js index a18a714..350983b 100644 --- a/docs/frameworks-registry.js +++ b/docs/frameworks-registry.js @@ -4653,7 +4653,7 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "L1", "title": "Foundation Models", - "description": "Base model layer — covers model selection, provenance, fine-tuning security, and model integrity threats.", + "description": "Base LLMs providing core reasoning and generation", "parent": null, "function": "Architecture Layer", "kind": "layer" @@ -4685,7 +4685,7 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "L2", "title": "Data Operations", - "description": "Data pipelines — covers RAG, vector stores, training data, embedding security, and data governance.", + "description": "Ingestion pipelines, storage, RAG, embeddings, vector stores", "parent": null, "function": "Architecture Layer", "kind": "layer" @@ -4717,7 +4717,7 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "L3", "title": "Agent Frameworks", - "description": "Agent runtime — covers agent orchestration, goal management, memory, and planning security.", + "description": "Orchestration platforms, tool registries, MCP, plugin ecosystems", "parent": null, "function": "Architecture Layer", "kind": "layer" @@ -4749,7 +4749,7 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "L4", "title": "Deployment & Infrastructure", - "description": "Tool access — covers MCP, API integrations, plugin security, and tool authorization.", + "description": "Servers, containers, networks, CI/CD, runtime environments", "parent": null, "function": "Architecture Layer", "kind": "layer" @@ -4781,7 +4781,7 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "L5", "title": "Evaluation & Observability", - "description": "Infrastructure — covers containerization, networking, secrets management, and runtime isolation.", + "description": "Monitoring, logging, telemetry, behavioural baselines", "parent": null, "function": "Architecture Layer", "kind": "layer" @@ -4813,7 +4813,7 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "L6", "title": "Security & Compliance", - "description": "Multi-agent coordination — covers inter-agent communication, delegation, consensus, and cascading failure prevention.", + "description": "Identity, access control, audit, governance, credential management", "parent": null, "function": "Architecture Layer", "kind": "layer" @@ -4845,7 +4845,7 @@ window.CROSSWALK_FRAMEWORKS = [ { "control_id": "L7", "title": "Agent Ecosystem", - "description": "Human-agent interface — covers user authentication, output validation, human oversight, and trust management.", + "description": "Multi-agent interaction, A2A communication, cascade dynamics", "parent": null, "function": "Architecture Layer", "kind": "layer" @@ -4880,6 +4880,11 @@ window.CROSSWALK_FRAMEWORKS = [ "date": "2026-04-09", "change": "Initial seed — 7 layers with 21 sub-controls from CSA MAESTRO framework", "author": "OWASP GenAI Data Security Initiative" + }, + { + "date": "2026-09-14", + "change": "Layer descriptions L1–L7 transcribed from the architecture table in llm-top10/LLM_MAESTRO.md. #32 corrected the titles to the CSA model but left the descriptions of the superseded one, so L4–L7 each carried the correct name and another layer's definition. Sub-controls unchanged (issue #31).", + "author": "OWASP GenAI Data Security Initiative" } ], "inventory_completeness": { diff --git a/scripts/validate.js b/scripts/validate.js index fe53e5e..0581b6b 100644 --- a/scripts/validate.js +++ b/scripts/validate.js @@ -766,11 +766,15 @@ function checkMaestroLayers() { const regPath = path.join(ROOT, 'data', 'frameworks', 'maestro.json'); if (!fs.existsSync(mdPath) || !fs.existsSync(regPath)) return true; - // The architecture table: | | L | ... | + // The architecture table: | | L | | | const canon = {}; + const canonDesc = {}; for (const line of fs.readFileSync(mdPath, 'utf8').split('\n')) { - const m = line.match(/^\|\s*([^|]+?)\s*\|\s*(L[1-7])\s*\|/); - if (m) canon[m[2]] = m[1].trim(); + const m = line.match(/^\|\s*([^|]+?)\s*\|\s*(L[1-7])\s*\|\s*([^|]+?)\s*\|/); + if (m) { + canon[m[2]] = m[1].trim(); + canonDesc[m[2]] = m[3].trim(); + } } if (Object.keys(canon).length !== 7) { warn('MAESTRO layers', `Could not read all seven layers from LLM_MAESTRO.md (found ${Object.keys(canon).length})`); @@ -784,6 +788,14 @@ function checkMaestroLayers() { `maestro.json ${c.control_id} is "${c.title}", but LLM_MAESTRO.md calls it "${canon[c.control_id]}"`); bad++; } + // #32 fixed the titles but left the superseded model's descriptions, so + // L4–L7 each had the right name and another layer's definition. A title + // check alone cannot see that. + if (c.kind === 'layer' && canonDesc[c.control_id] && c.description !== canonDesc[c.control_id]) { + fail('MAESTRO layers', + `maestro.json ${c.control_id} description "${c.description}" does not match LLM_MAESTRO.md: "${canonDesc[c.control_id]}"`); + bad++; + } } const incPath = path.join(ROOT, 'data', 'incidents.json'); @@ -803,7 +815,7 @@ function checkMaestroLayers() { } } - if (!bad) pass('MAESTRO layers', 'Registry and incident labels match all seven canonical layer names'); + if (!bad) pass('MAESTRO layers', 'Registry titles, layer descriptions and incident labels match the canonical architecture table'); return bad === 0; }