diff --git a/docs/terms-relationships.md b/docs/terms-relationships.md index 0c8ac9c..a186646 100644 --- a/docs/terms-relationships.md +++ b/docs/terms-relationships.md @@ -74,3 +74,14 @@ OWASP/www-project-mcp-top-10#52, the live case (not a hypothetical) that prompted the field, where two independent projects assigned the same MCP category number to genuinely unrelated categories because each read the spec at a different point while it was still moving. +`framework_sources.*.source_url` was added afterward, once an unrelated +project facing the same #52 gap converged on the same shape: +BerkantACUN/guardmcp PR #3 ("Pin the OWASP spec commit the mapping was +drafted against") pins its SARIF taxonomy to the OWASP MCP Top 10 with a +`specCommit`/`specSource` pair -- not a comment posted in #52 itself, a +separate repo's independent fix for the versioning gap #52 describes -- +and its `specCommit` happens to be the exact same commit sha AVE's own +`owasp_mcp` backfill pinned, `165fe0f78ef104459237b4a8e0f6e78db9b02391`. +`source_url` mirrors `specSource`: the resolved tree URL at `commit`, so +a reader can check the mapping without reconstructing it from repo and +sha by hand. Optional even when `commit` is present. diff --git a/docs/terms.md b/docs/terms.md index a5d0fef..8ba23ca 100644 --- a/docs/terms.md +++ b/docs/terms.md @@ -80,6 +80,17 @@ OWASP/www-project-mcp-top-10#52, the live case (not a hypothetical) that prompted the field, where two independent projects assigned the same MCP category number to genuinely unrelated categories because each read the spec at a different point while it was still moving. +`framework_sources.*.source_url` was added afterward, once an unrelated +project facing the same #52 gap converged on the same shape: +BerkantACUN/guardmcp PR #3 ("Pin the OWASP spec commit the mapping was +drafted against") pins its SARIF taxonomy to the OWASP MCP Top 10 with a +`specCommit`/`specSource` pair -- not a comment posted in #52 itself, a +separate repo's independent fix for the versioning gap #52 describes -- +and its `specCommit` happens to be the exact same commit sha AVE's own +`owasp_mcp` backfill pinned, `165fe0f78ef104459237b4a8e0f6e78db9b02391`. +`source_url` mirrors `specSource`: the resolved tree URL at `commit`, so +a reader can check the mapping without reconstructing it from repo and +sha by hand. Optional even when `commit` is present. diff --git a/schema/ave-record-1.1.0.schema.json b/schema/ave-record-1.1.0.schema.json index 0b9efef..b842e1f 100644 --- a/schema/ave-record-1.1.0.schema.json +++ b/schema/ave-record-1.1.0.schema.json @@ -615,6 +615,11 @@ "pattern": "^[0-9a-f]{40}$", "description": "Full 40-character commit sha pinning the tree this mapping was read against, where the referenced framework has git history to pin. Same convention as crosswalk endpoint commit pinning: full, not abbreviated." }, + "source_url": { + "type": "string", + "format": "uri", + "description": "The resolved tree URL at commit, where a reader can go check the mapping directly without reconstructing it from commit and repo. Optional even when commit is present. Matches the specCommit/specSource pairing independently designed by BerkantACUN/guardmcp (PR #3, 'Pin the OWASP spec commit the mapping was drafted against') for the same OWASP MCP Top 10 versioning gap OWASP/www-project-mcp-top-10#52 raised and this field exists to close -- guardmcp's PR pins the identical commit sha AVE's own owasp_mcp backfill used (165fe0f78ef104459237b4a8e0f6e78db9b02391), independent convergence on the same fix from two unrelated projects reading the same gap." + }, "read_date": { "type": "string", "format": "date", diff --git a/schema/ave-record.schema.json b/schema/ave-record.schema.json index 0b9efef..b842e1f 100644 --- a/schema/ave-record.schema.json +++ b/schema/ave-record.schema.json @@ -615,6 +615,11 @@ "pattern": "^[0-9a-f]{40}$", "description": "Full 40-character commit sha pinning the tree this mapping was read against, where the referenced framework has git history to pin. Same convention as crosswalk endpoint commit pinning: full, not abbreviated." }, + "source_url": { + "type": "string", + "format": "uri", + "description": "The resolved tree URL at commit, where a reader can go check the mapping directly without reconstructing it from commit and repo. Optional even when commit is present. Matches the specCommit/specSource pairing independently designed by BerkantACUN/guardmcp (PR #3, 'Pin the OWASP spec commit the mapping was drafted against') for the same OWASP MCP Top 10 versioning gap OWASP/www-project-mcp-top-10#52 raised and this field exists to close -- guardmcp's PR pins the identical commit sha AVE's own owasp_mcp backfill used (165fe0f78ef104459237b4a8e0f6e78db9b02391), independent convergence on the same fix from two unrelated projects reading the same gap." + }, "read_date": { "type": "string", "format": "date",