Skip to content

Fix: MAESTRO layer descriptions still defined the superseded model #88

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
emmanuelgjr merged 6 commits into from
Sep 15, 2026
Merged

Fix: MAESTRO layer descriptions still defined the superseded model #88

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
1258005
T-ENG03: make the webapp data bundles deterministic
emmanuelgjr Aug 30, 2026
b0445fe
Fix: MAESTRO layer descriptions still defined the superseded model
emmanuelgjr Sep 14, 2026
786ee28
Merge main (#91, #92) into T-ENG03
emmanuelgjr Sep 14, 2026
95f04a5
Merge updated T-ENG03 (main #91, #92) into maestro-layer-descriptions
emmanuelgjr Sep 14, 2026
ad68d62
Merge main (#37, #94, #96) into maestro-layer-descriptions
emmanuelgjr Sep 14, 2026
ad5f68d
Merge main into maestro-layer-descriptions before merge
emmanuelgjr Sep 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 12 additions & 7 deletions data/frameworks/maestro.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@
{
"control_id": "L1",
"title": "Foundation Models",
"description": "Base model layer — covers model selection, provenance, fine-tuning security, and model integrity threats.",
"description": "Base LLMs providing core reasoning and generation",
"parent": null,
"function": "Architecture Layer",
"kind": "layer"
Expand Down Expand Up @@ -45,7 +45,7 @@
{
"control_id": "L2",
"title": "Data Operations",
"description": "Data pipelines — covers RAG, vector stores, training data, embedding security, and data governance.",
"description": "Ingestion pipelines, storage, RAG, embeddings, vector stores",
"parent": null,
"function": "Architecture Layer",
"kind": "layer"
Expand Down Expand Up @@ -77,7 +77,7 @@
{
"control_id": "L3",
"title": "Agent Frameworks",
"description": "Agent runtime — covers agent orchestration, goal management, memory, and planning security.",
"description": "Orchestration platforms, tool registries, MCP, plugin ecosystems",
"parent": null,
"function": "Architecture Layer",
"kind": "layer"
Expand Down Expand Up @@ -109,7 +109,7 @@
{
"control_id": "L4",
"title": "Deployment & Infrastructure",
"description": "Tool access — covers MCP, API integrations, plugin security, and tool authorization.",
"description": "Servers, containers, networks, CI/CD, runtime environments",
"parent": null,
"function": "Architecture Layer",
"kind": "layer"
Expand Down Expand Up @@ -141,7 +141,7 @@
{
"control_id": "L5",
"title": "Evaluation & Observability",
"description": "Infrastructure — covers containerization, networking, secrets management, and runtime isolation.",
"description": "Monitoring, logging, telemetry, behavioural baselines",
"parent": null,
"function": "Architecture Layer",
"kind": "layer"
Expand Down Expand Up @@ -173,7 +173,7 @@
{
"control_id": "L6",
"title": "Security & Compliance",
"description": "Multi-agent coordination — covers inter-agent communication, delegation, consensus, and cascading failure prevention.",
"description": "Identity, access control, audit, governance, credential management",
"parent": null,
"function": "Architecture Layer",
"kind": "layer"
Expand Down Expand Up @@ -205,7 +205,7 @@
{
"control_id": "L7",
"title": "Agent Ecosystem",
"description": "Human-agent interface — covers user authentication, output validation, human oversight, and trust management.",
"description": "Multi-agent interaction, A2A communication, cascade dynamics",
"parent": null,
"function": "Architecture Layer",
"kind": "layer"
Expand Down Expand Up @@ -240,6 +240,11 @@
"date": "2026-04-09",
"change": "Initial seed — 7 layers with 21 sub-controls from CSA MAESTRO framework",
"author": "OWASP GenAI Data Security Initiative"
},
{
"date": "2026-09-14",
"change": "Layer descriptions L1–L7 transcribed from the architecture table in llm-top10/LLM_MAESTRO.md. #32 corrected the titles to the CSA model but left the descriptions of the superseded one, so L4–L7 each carried the correct name and another layer's definition. Sub-controls unchanged (issue #31).",
"author": "OWASP GenAI Data Security Initiative"
}
],
"inventory_completeness": {
Expand Down
19 changes: 12 additions & 7 deletions docs/frameworks-registry.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4653,7 +4653,7 @@ window.CROSSWALK_FRAMEWORKS = [
{
"control_id": "L1",
"title": "Foundation Models",
"description": "Base model layer — covers model selection, provenance, fine-tuning security, and model integrity threats.",
"description": "Base LLMs providing core reasoning and generation",
"parent": null,
"function": "Architecture Layer",
"kind": "layer"
Expand Down Expand Up @@ -4685,7 +4685,7 @@ window.CROSSWALK_FRAMEWORKS = [
{
"control_id": "L2",
"title": "Data Operations",
"description": "Data pipelines — covers RAG, vector stores, training data, embedding security, and data governance.",
"description": "Ingestion pipelines, storage, RAG, embeddings, vector stores",
"parent": null,
"function": "Architecture Layer",
"kind": "layer"
Expand Down Expand Up @@ -4717,7 +4717,7 @@ window.CROSSWALK_FRAMEWORKS = [
{
"control_id": "L3",
"title": "Agent Frameworks",
"description": "Agent runtime — covers agent orchestration, goal management, memory, and planning security.",
"description": "Orchestration platforms, tool registries, MCP, plugin ecosystems",
"parent": null,
"function": "Architecture Layer",
"kind": "layer"
Expand Down Expand Up @@ -4749,7 +4749,7 @@ window.CROSSWALK_FRAMEWORKS = [
{
"control_id": "L4",
"title": "Deployment & Infrastructure",
"description": "Tool access — covers MCP, API integrations, plugin security, and tool authorization.",
"description": "Servers, containers, networks, CI/CD, runtime environments",
"parent": null,
"function": "Architecture Layer",
"kind": "layer"
Expand Down Expand Up @@ -4781,7 +4781,7 @@ window.CROSSWALK_FRAMEWORKS = [
{
"control_id": "L5",
"title": "Evaluation & Observability",
"description": "Infrastructure — covers containerization, networking, secrets management, and runtime isolation.",
"description": "Monitoring, logging, telemetry, behavioural baselines",
"parent": null,
"function": "Architecture Layer",
"kind": "layer"
Expand Down Expand Up @@ -4813,7 +4813,7 @@ window.CROSSWALK_FRAMEWORKS = [
{
"control_id": "L6",
"title": "Security & Compliance",
"description": "Multi-agent coordination — covers inter-agent communication, delegation, consensus, and cascading failure prevention.",
"description": "Identity, access control, audit, governance, credential management",
"parent": null,
"function": "Architecture Layer",
"kind": "layer"
Expand Down Expand Up @@ -4845,7 +4845,7 @@ window.CROSSWALK_FRAMEWORKS = [
{
"control_id": "L7",
"title": "Agent Ecosystem",
"description": "Human-agent interface — covers user authentication, output validation, human oversight, and trust management.",
"description": "Multi-agent interaction, A2A communication, cascade dynamics",
"parent": null,
"function": "Architecture Layer",
"kind": "layer"
Expand Down Expand Up @@ -4880,6 +4880,11 @@ window.CROSSWALK_FRAMEWORKS = [
"date": "2026-04-09",
"change": "Initial seed — 7 layers with 21 sub-controls from CSA MAESTRO framework",
"author": "OWASP GenAI Data Security Initiative"
},
{
"date": "2026-09-14",
"change": "Layer descriptions L1–L7 transcribed from the architecture table in llm-top10/LLM_MAESTRO.md. #32 corrected the titles to the CSA model but left the descriptions of the superseded one, so L4–L7 each carried the correct name and another layer's definition. Sub-controls unchanged (issue #31).",
"author": "OWASP GenAI Data Security Initiative"
}
],
"inventory_completeness": {
Expand Down
20 changes: 16 additions & 4 deletions scripts/validate.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -766,11 +766,15 @@ function checkMaestroLayers() {
const regPath = path.join(ROOT, 'data', 'frameworks', 'maestro.json');
if (!fs.existsSync(mdPath) || !fs.existsSync(regPath)) return true;

// The architecture table: | <name> | L<n> | ... |
// The architecture table: | <name> | L<n> | <description> | <threat theme> |
const canon = {};
const canonDesc = {};
for (const line of fs.readFileSync(mdPath, 'utf8').split('\n')) {
const m = line.match(/^\|\s*([^|]+?)\s*\|\s*(L[1-7])\s*\|/);
if (m) canon[m[2]] = m[1].trim();
const m = line.match(/^\|\s*([^|]+?)\s*\|\s*(L[1-7])\s*\|\s*([^|]+?)\s*\|/);
if (m) {
canon[m[2]] = m[1].trim();
canonDesc[m[2]] = m[3].trim();
}
}
if (Object.keys(canon).length !== 7) {
warn('MAESTRO layers', `Could not read all seven layers from LLM_MAESTRO.md (found ${Object.keys(canon).length})`);
Expand All @@ -784,6 +788,14 @@ function checkMaestroLayers() {
`maestro.json ${c.control_id} is "${c.title}", but LLM_MAESTRO.md calls it "${canon[c.control_id]}"`);
bad++;
}
// #32 fixed the titles but left the superseded model's descriptions, so
// L4–L7 each had the right name and another layer's definition. A title
// check alone cannot see that.
if (c.kind === 'layer' && canonDesc[c.control_id] && c.description !== canonDesc[c.control_id]) {
fail('MAESTRO layers',
`maestro.json ${c.control_id} description "${c.description}" does not match LLM_MAESTRO.md: "${canonDesc[c.control_id]}"`);
bad++;
}
}

const incPath = path.join(ROOT, 'data', 'incidents.json');
Expand All @@ -803,7 +815,7 @@ function checkMaestroLayers() {
}
}

if (!bad) pass('MAESTRO layers', 'Registry and incident labels match all seven canonical layer names');
if (!bad) pass('MAESTRO layers', 'Registry titles, layer descriptions and incident labels match the canonical architecture table');
return bad === 0;
}

Expand Down
Loading