Skip to content

docs: independent validation section and technical write-ups - #184

Merged
chaksaray merged 3 commits into
developfrom
docs/independent-validation-and-writeups
Aug 15, 2026
Merged

docs: independent validation section and technical write-ups#184
chaksaray merged 3 commits into
developfrom
docs/independent-validation-and-writeups

Conversation

@chaksaray

Copy link
Copy Markdown
Contributor

New README section on independent crosswalk validation, numbers pulled live rather than assumed. First technical write-up(s) for the highest-severity record(s), every specific claim traced to the real record JSON.

Numbers, verified live (not from memory)

  • record_count: 80 (matches the README's own hero badge)
  • CRITICAL 1, HIGH 15, MEDIUM 62, LOW 2
  • Independent crosswalks (tool -> AVE, unprompted): cfgaudit, nova-proximity, Ramparts = 3

Write-ups (3, not the full priority list, quality over quantity per the task brief)

  1. AVE-2026-00046 (CRITICAL, 9.2, the single highest-scoring CRITICAL record) - MCP tool hook hijacking. No crosswalk match yet, so no Independent confirmation section on this one.
  2. AVE-2026-00047 (HIGH, 7.6) - Hardcoded credentials. Appears in all 3 independent crosswalks (cfgaudit x6 rules, nova-proximity, Ramparts x2 findings).
  3. AVE-2026-00003 (MEDIUM, 6.8) - Credential exfiltration via agent instruction. Also appears in all 3 crosswalks; interesting detail, Ramparts' EnvironmentVariableLeakage rule splits across this record and AVE-2026-00047 depending on which internal branch fires.

Every mechanism description, AARF/AIVSS arithmetic, IOC, and remediation step traces to the live dist/ave-records-latest.json pull, not reconstructed from memory. No em-dashes anywhere in the new content.

Two things flagged, not fixed here (out of this task's scope)

  • README's own ## Stats table is stale: it reads CRITICAL 1 / HIGH 14 / MEDIUM 56 / LOW 2 = 73, but the live pull (and the file's own hero badge) says 80 records (1/15/62/2). Undercounts by 7 records. Small doc-sync fix, not bundled into this PR.
  • The live aveproject.org/writeups/AVE-2026-00046.html page describes a different mechanism than the actual record (in-place argument mutation via a wildcard hook with blocking: true, vs. the record's actual external-callback-redirect mechanism). That's on ave-site, out of this repo's scope; flagging for separate follow-up.

Base branch note

This repo's own convention is PRs target develop, not main (confirmed with the requester), so this targets develop despite the task brief's literal --base main.

🤖 Generated with Claude Code

README section built from real, currently-verified numbers (record
count, crosswalk count), not carried forward from an earlier draft.
Write-ups sourced entirely from live record data, no reconstructed
specifics.
# Conflicts:
#	dist/ave-records-latest.manifest.json
Resolves conflict in dist/ave-records-latest.manifest.json (generated_at
timestamp only; both sides already agreed on record_count: 80).
Regenerated the manifest via scripts/build-records.js rather than
hand-editing the timestamp, same approach used in e4db9d4.

339 tests pass, all 80 records validate against schema.
@chaksaray
chaksaray merged commit 4b016ba into develop Aug 15, 2026
6 checks passed
@chaksaray
chaksaray deleted the docs/independent-validation-and-writeups branch August 15, 2026 01:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant