[Yimura]

What was wrong

The corpus had no requirement set for AI systems. owasp_checklist served ASVS 5.0.0 for web and MASVS 2.1.0 for mobile only. Neither covers prompt injection screening, agent action approval, vector-store tenant isolation, MCP token validation, or training-data provenance. A finding about an MCP server cited an ASVS requirement by analogy, or cited nothing. A reviewer who checked that id found a requirement that did not cover the control.

The Cheat Sheet Series already shipped the AI guidance (AI_Agent_Security, MCP_Security, RAG_Security, LLM_Prompt_Injection_Prevention, and others), but those sheets had no requirement to link to.

What changed

• ingest/packs/aisvs.py parses the 12 frozen chapter files of AISVS 1.01 into 213 requirements with chapter, section, and level. Ids keep the upstream C prefix (C10.2.2), and a search hit cites aisvs 1.01 C10.2.2. Chapter objectives and section prose are retrievable chunks with no requirement row. The ingest skips the 10.2.6 "Requirement removed." tombstone and raises on any other unlevelled row, on a row outside its section, and on a chapter with no rows.
• sources.lock.yml pins OWASP/AISVS at v1.01 and fetches the chapters as extra_paths, because the release's only asset is a PDF. build.EXPECTED_REQUIREMENTS["aisvs"] = 213, so run_checks fails a build that comes up short.
• ingest_aisvs_guidance_links (ingest/links.py) writes chapter-level aisvs_section guidance edges from three sources, in order of authority. First come AISVS's own chapter references, then cheat sheets that link an AISVS chapter, then the reviewed map in ingest/aisvs_guidance.py. Each edge's source names which one it came from.
• The checklist row clearing that ASVS and MASVS each copied moves to ingest/packs/checklist_rows.py, so AISVS does not add a third copy.
• The tool descriptions, TOOL_TRIGGER_TOPICS, licence texts (LICENSE-OWASP-AISVS, NOTICE, Dockerfile, smoke test), the image tag prefix, and the docs cover the new pack. docs/kb-packs.md "The AISVS pack" records each decision.

Start reading at src/owasp_kb/ingest/packs/aisvs.py. New tests: tests/ingest/test_aisvs.py and tests/ingest/test_aisvs_links.py, with fixtures under tests/fixtures/aisvs/. The build, lock, and packaging tests are extended.

Why this way

• 1.01/en/, not 1.0/en/. The issue measured 1.0/en/ (191 requirements). Tag v1.01 also ships 1.01/, which 1.0/LOCKED.md names "the latest stable release" and 1.01/LOCKED.md freezes. So the acceptance figures become 57 / 167 / 213 rather than 51 / 146 / 191. This was decided on the issue before implementation.
• The C prefix is load-bearing. links ids carry no pack, so a bare 10.2.2 would sit beside ASVS's V10.2.2.
• The curated map breaks a stated principle on purpose. The MASVS section says this project does not author mappings upstream did not provide. Without the map, AI_Agent_Security, Secure_AI_Model_Ops, and Secure_Coding_with_AI link to no requirement. To keep it honest, every entry names the cheat sheet sections that justify it, and every curated edge carries the source owasp-kb curated AISVS map. A curated chapter the release lacks also fails the build. Please review the map entry by entry. C5 (Access Control & Identity) has no edge, because no AI cheat sheet gives it a section of its own.
• The research wiki is not a source. It is AI-generated, and LOCKED.md lets automation change it.
• Appendices B and C stay out. Appendix C governs using AI to write code. Appendix B is filed as a follow-up.
• A level filter with no pack now returns ASVS and AISVS together. AISVS levels align with ASVS's one to one, so only the descriptions changed.

Evidence

Full suite, with data/ fetched at the pinned sources and both indexes built:

1162 passed in 12.24s

The real build passes integrity:

INFO built dist/owasp-kb-full.sqlite: 345 ASVS requirements, 24 MASVS controls, 213 AISVS requirements, 137 cheat sheet documents, 1391 CWE catalogue entries, 5525 chunks index-wide (75 truncated), 187 guidance links, 204 CWE links (8 dropped), 265 supersedes links, 48 NIST links (11 unmatched), 5525 vectors

The tools against that index:

checklist L 1 57
checklist L 2 167
checklist L 3 213
C2 [('AI_Agent_Security_Cheat_Sheet', 'owasp-kb curated AISVS map'), ('LLM_Prompt_Injection_Prevention_Cheat_Sheet', 'AISVS chapter references')]
C8 [('AI_Agent_Security_Cheat_Sheet', 'owasp-kb curated AISVS map'), ('RAG_Security_Cheat_Sheet', 'cheat sheet links to AISVS')]
C10 [('MCP_Security_Cheat_Sheet', 'AISVS chapter references'), ('Secure_Coding_with_AI_Cheat_Sheet', 'owasp-kb curated AISVS map')]

The retrieval quality gate (tests/test_retrieval_quality.py) passes 25 of 25 against both indexes, and owasp_roster(pack="aisvs", level="1") returns a complete 57-row roster. I mutation-checked the tombstone guard (15 tests fail without it) and the curated-chapter guard (1 test fails without it).

What is left

Searching AISVS by control name through Appendix B is a separate issue.

Closes #87