fix: owasp_asi mapping audit (48 corrected, 13 confirmed, 11 flagged ambiguous)

[chaksaray]

Full-corpus audit of owasp_asi tags against the current canonical OWASP Top 10 for Agentic Applications (2026), triggered by two wrong mappings found during D2 crosswalk work on wg-security-and-privacy#8.

Report: 70 of 80 records carry an owasp_asi tag. Of those — 13 confirmed correct as-is, 48 corrected, 11 flagged ambiguous and left unchanged (not decided unilaterally).

Canonical list re-confirmed directly from the primary-source PDF (genai.owasp.org/download/52117), not from memory of the prior D2-crosswalk session: ASI01 Agent Goal Hijack · ASI02 Tool Misuse and Exploitation · ASI03 Identity and Privilege Abuse · ASI04 Agentic Supply Chain Vulnerabilities · ASI05 Unexpected Code Execution (RCE) · ASI06 Memory & Context Poisoning · ASI07 Insecure Inter-Agent Communication · ASI08 Cascading Failures · ASI09 Human-Agent Trust Exploitation · ASI10 Rogue Agents. Every correction below was checked against that document's own full descriptions and its explicit differentiators between adjacent categories (e.g. ASI01 vs ASI06 vs ASI10; ASI02 vs ASI03 vs ASI05; ASI04 = compromised at the source vs ASI02 = compromised at runtime; ASI08 = propagation of an existing fault, not its origin), not just the category names.

Two systemic patterns behind most corrections

• ASI08 (Cascading Failures) over-applied to single-instance records. The category requires a fault to spread across agents, sessions, or workflows with measurable fan-out — not merely "this could enable other attacks." Most current ASI08 tags sat on records describing a single, contained event with no propagation mechanism described (e.g. a goal hijack, a jailbreak, a false permission claim) — the record was the origin, not the cascade.
• ASI07 (Insecure Inter-Agent Communication) over-applied to single-agent tool misuse. The category is specifically about compromised real-time messages between agents. Most current ASI07 tags sat on single-agent tool-abuse or supply-chain records with no other agent or inter-agent message involved at all.
• ASI06 (Memory & Context Poisoning) applied to one-time events. The category explicitly excludes one-time input prompts and requires persistent stored/retrievable context (memory, RAG, embeddings across sessions). Several exfiltration records were mistagged ASI06 for a single-request action; conversely AVE-2026-00019 (the record that started this audit) and AVE-2026-00016 were missing ASI06 despite being clean, even textbook, matches.

Honesty checks

• AVE-2026-00038 (excessive agency / unbounded tool use) is left unchanged and flagged ambiguous. ASI02, ASI09, and ASI10 are all defensible readings of the primary source depending on framing. A comment I posted on wg-security-and-privacy#8 speculated ASI09 was the "expected" value based on that WG's own gap-analysis framing (D2) rather than a direct primary-source check — having now read the full primary-source descriptions, that speculation doesn't hold up as a confident correction, so it isn't applied here.
• AVE-2026-00063 loses its owasp_asi tag entirely rather than being reassigned — the record explicitly describes a static configuration weakness "independent of any instruction text," which doesn't cleanly match any of the ten ASI categories. Per CLAUDE.md: omit rather than force a poor fit.
• 11 records are left with a tag I couldn't confidently confirm or reject (e.g. AVE-2026-00047's hardcoded-credential mechanism doesn't cleanly fit ASI02 or ASI06; AVE-2026-00071's daemon-redirect config issue loosely fits both ASI04 and ASI05 without a clean primary). Flagged for a second read rather than decided here.

All 80 records still validate against schema/ave-record-1.1.0.schema.json, all have positive/negative fixtures, and the full pytest suite (339 tests) passes unchanged.