docs: add contributor grid to README

README.md

@@ -561,6 +561,21 @@ See [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md) for community standards.
 
 ---
 
+## Contributors
+
+<a href="https://github.com/aveproject/ave/graphs/contributors">
+  <img src="https://contrib.rocks/image?repo=aveproject/ave" />
+</a>
+
+This shows who has contributed, not what they did. See
+[CONTRIBUTORS.md](CONTRIBUTORS.md) for that — specific credit for
+specific work: astrogilda's crosswalk schema and pin-status design,
+predictor2718's independently-built cfgaudit crosswalk, mmaxjr's
+validator fix, Alex Greenshpun's attribution correction — not a name
+list.
+
+---
+
 ## Related
 
 | | |

docs/terms-relationships.md

@@ -74,3 +74,14 @@ OWASP/www-project-mcp-top-10#52, the live case (not a hypothetical) that
 prompted the field, where two independent projects assigned the same MCP
 category number to genuinely unrelated categories because each read the
 spec at a different point while it was still moving.
+`framework_sources.*.source_url` was added afterward, once an unrelated
+project facing the same #52 gap converged on the same shape:
+BerkantACUN/guardmcp PR #3 ("Pin the OWASP spec commit the mapping was
+drafted against") pins its SARIF taxonomy to the OWASP MCP Top 10 with a
+`specCommit`/`specSource` pair -- not a comment posted in #52 itself, a
+separate repo's independent fix for the versioning gap #52 describes --
+and its `specCommit` happens to be the exact same commit sha AVE's own
+`owasp_mcp` backfill pinned, `165fe0f78ef104459237b4a8e0f6e78db9b02391`.
+`source_url` mirrors `specSource`: the resolved tree URL at `commit`, so
+a reader can check the mapping without reconstructing it from repo and
+sha by hand. Optional even when `commit` is present.

docs/terms.md

@@ -80,6 +80,17 @@ OWASP/www-project-mcp-top-10#52, the live case (not a hypothetical) that
 prompted the field, where two independent projects assigned the same MCP
 category number to genuinely unrelated categories because each read the
 spec at a different point while it was still moving.
+`framework_sources.*.source_url` was added afterward, once an unrelated
+project facing the same #52 gap converged on the same shape:
+BerkantACUN/guardmcp PR #3 ("Pin the OWASP spec commit the mapping was
+drafted against") pins its SARIF taxonomy to the OWASP MCP Top 10 with a
+`specCommit`/`specSource` pair -- not a comment posted in #52 itself, a
+separate repo's independent fix for the versioning gap #52 describes --
+and its `specCommit` happens to be the exact same commit sha AVE's own
+`owasp_mcp` backfill pinned, `165fe0f78ef104459237b4a8e0f6e78db9b02391`.
+`source_url` mirrors `specSource`: the resolved tree URL at `commit`, so
+a reader can check the mapping without reconstructing it from repo and
+sha by hand. Optional even when `commit` is present.
 
 <!-- GENERATED FROM schema/ave-record-1.1.0.schema.json, DO NOT HAND-EDIT BELOW THIS LINE -->
 

schema/ave-record-1.1.0.schema.json

@@ -615,6 +615,11 @@
             "pattern": "^[0-9a-f]{40}$",
             "description": "Full 40-character commit sha pinning the tree this mapping was read against, where the referenced framework has git history to pin. Same convention as crosswalk endpoint commit pinning: full, not abbreviated."
           },
+          "source_url": {
+            "type": "string",
+            "format": "uri",
+            "description": "The resolved tree URL at commit, where a reader can go check the mapping directly without reconstructing it from commit and repo. Optional even when commit is present. Matches the specCommit/specSource pairing independently designed by BerkantACUN/guardmcp (PR #3, 'Pin the OWASP spec commit the mapping was drafted against') for the same OWASP MCP Top 10 versioning gap OWASP/www-project-mcp-top-10#52 raised and this field exists to close -- guardmcp's PR pins the identical commit sha AVE's own owasp_mcp backfill used (165fe0f78ef104459237b4a8e0f6e78db9b02391), independent convergence on the same fix from two unrelated projects reading the same gap."
+          },
           "read_date": {
             "type": "string",
             "format": "date",

schema/ave-record.schema.json

@@ -615,6 +615,11 @@
             "pattern": "^[0-9a-f]{40}$",
             "description": "Full 40-character commit sha pinning the tree this mapping was read against, where the referenced framework has git history to pin. Same convention as crosswalk endpoint commit pinning: full, not abbreviated."
           },
+          "source_url": {
+            "type": "string",
+            "format": "uri",
+            "description": "The resolved tree URL at commit, where a reader can go check the mapping directly without reconstructing it from commit and repo. Optional even when commit is present. Matches the specCommit/specSource pairing independently designed by BerkantACUN/guardmcp (PR #3, 'Pin the OWASP spec commit the mapping was drafted against') for the same OWASP MCP Top 10 versioning gap OWASP/www-project-mcp-top-10#52 raised and this field exists to close -- guardmcp's PR pins the identical commit sha AVE's own owasp_mcp backfill used (165fe0f78ef104459237b4a8e0f6e78db9b02391), independent convergence on the same fix from two unrelated projects reading the same gap."
+          },
           "read_date": {
             "type": "string",
             "format": "date",