Skip to content

chore(oie): NIST 800-53 and remaining B2 sources/gold - #1118

Open
northdpole wants to merge 1 commit into
stack/oie-p4-asvs-fixturesfrom
stack/oie-p5-nist-other-fixtures
Open

northdpole wants to merge 1 commit into
stack/oie-p4-asvs-fixturesfrom
stack/oie-p5-nist-other-fixtures

Conversation

@northdpole

@northdpole northdpole commented Sep 29, 2026 •

Copy link
Copy Markdown
Collaborator

Summary

Stacked fixture PR — NIST 800-53 sample OSCAL/sources plus Top10/API/K8s/LLM/AISVS/agentic gold and reports. ASVS landed in the previous PR.

Depends on

  • ASVS fixtures stacked PR

Test plan

  • Spot-check NIST sample + one OWASP Top10 gold JSON
  • Confirm ASVS sources are not re-added here

Made with Cursor

Stack (merge bottom → top)

  1. feat(librarian): Module C retrieval upgrades (stack base) #1088 — librarian base (wip/oie-pipeline-eval-harness → main)
  2. feat(harvester): requirement extract and GitHub URL ingest #1115 — harvester (stack/oie-p2-harvester → feat(librarian): Module C retrieval upgrades (stack base) #1088)
  3. feat(oie): B2 eval harness and CRE neighborhood scorer #1116 — B2 harness (stack/oie-p3-b2-harness → feat(harvester): requirement extract and GitHub URL ingest #1115)
  4. chore(oie): ASVS 5.0 provisional B2 sources and gold #1117 — ASVS fixtures (stack/oie-p4-asvs-fixtures → feat(oie): B2 eval harness and CRE neighborhood scorer #1116)
  5. chore(oie): NIST 800-53 and remaining B2 sources/gold #1118 — NIST + other fixtures (stack/oie-p5-nist-other-fixtures → chore(oie): ASVS 5.0 provisional B2 sources and gold #1117)
  6. feat(mappings): promote Related-orphan remaps into canonical fixtures #1119 — mapping promotions (stack/oie-p6-mapping-promotions → chore(oie): NIST 800-53 and remaining B2 sources/gold #1118)
  7. feat(oie): full-pipeline runner, docs, and experimental-flag notes #1120 — full-pipeline + docs (stack/oie-p7-full-pipeline-docs → feat(mappings): promote Related-orphan remaps into canonical fixtures #1119)

@coderabbitai

coderabbitai Bot commented Sep 29, 2026 •

Copy link
Copy Markdown
Contributor

Important

Review skipped

Too many files!

This PR contains 128 files, which is 28 over the limit of 100.

To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch.

Upgrade to a paid plan to raise the limit.

This review couldn't start because sufficient usage credits or metered capacity aren't available. Add credits or update usage-based reviews in the billing tab, then retry.

Check out review usage here.

⚙️ Run configuration
  • Configuration used: Repository: OWASP/OpenCRE/.coderabbit.yml
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 003fd98d-b255-4f2c-a046-94992322ebb3
📥 Commits

Reviewing files that changed from the base of the PR and between 955528d and 86d320a.

📒 Files selected for processing: 128
  • application/tests/fixtures/owasp_mappings/nist_800_53_v5.json
  • application/tests/owasp_mapping_fixtures_test.py
  • scripts/oie_owasp_eval/build_nist_800_53_v5_eval.py
  • scripts/oie_owasp_eval/fixtures/b2_gold/owasp_aisvs_1_0.json
  • scripts/oie_owasp_eval/fixtures/b2_gold/owasp_api_top10_2023.json
  • scripts/oie_owasp_eval/fixtures/b2_gold/owasp_kubernetes_top10_2022.json
  • scripts/oie_owasp_eval/fixtures/b2_gold/owasp_kubernetes_top10_2025.json
  • scripts/oie_owasp_eval/fixtures/b2_gold/owasp_llm_top10_2025.json
  • scripts/oie_owasp_eval/fixtures/b2_gold/owasp_top10_2025.json
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/AC-1.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/AC-10.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/AC-11.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/AT-1.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/AT-2.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/AU-1.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/AU-10.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/AU-11.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/CA-1.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/CA-2.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/CM-1.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/CM-10.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/CM-11.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/CP-1.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/CP-10.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/IA-1.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/IA-10.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/IR-1.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/IR-2.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/MA-1.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/MA-2.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/MP-1.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/MP-2.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/PE-1.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/PE-10.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/PE-11.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/PL-1.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/PL-10.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/PM-1.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/PM-10.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/PM-11.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/PS-1.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/PS-2.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/PT-1.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/PT-2.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/RA-1.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/RA-10.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/SA-1.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/SA-10.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/SA-11.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/SC-1.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/SC-10.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/SC-11.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/SI-1.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/SI-10.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/SI-11.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/SR-1.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/nist_800_53_v5/SR-10.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_agentic_ai_stub/AAI01.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_agentic_ai_stub/AAI02.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_agentic_ai_stub/AAI03.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_agentic_ai_stub/AAI04.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_agentic_ai_stub/AAI05.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_aisvs_1_0/AISVS1.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_aisvs_1_0/AISVS10.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_aisvs_1_0/AISVS11.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_aisvs_1_0/AISVS12.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_aisvs_1_0/AISVS2.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_aisvs_1_0/AISVS3.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_aisvs_1_0/AISVS4.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_aisvs_1_0/AISVS5.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_aisvs_1_0/AISVS6.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_aisvs_1_0/AISVS7.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_aisvs_1_0/AISVS8.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_aisvs_1_0/AISVS9.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_api_top10_2023/API1.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_api_top10_2023/API10.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_api_top10_2023/API2.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_api_top10_2023/API3.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_api_top10_2023/API4.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_api_top10_2023/API5.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_api_top10_2023/API6.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_api_top10_2023/API7.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_api_top10_2023/API8.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_api_top10_2023/API9.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_kubernetes_top10_2022_pr927/K01.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_kubernetes_top10_2022_pr927/K02.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_kubernetes_top10_2022_pr927/K03.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_kubernetes_top10_2022_pr927/K04.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_kubernetes_top10_2022_pr927/K05.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_kubernetes_top10_2022_pr927/K06.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_kubernetes_top10_2022_pr927/K07.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_kubernetes_top10_2022_pr927/K08.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_kubernetes_top10_2022_pr927/K09.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_kubernetes_top10_2022_pr927/K10.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_kubernetes_top10_2025/K01.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_kubernetes_top10_2025/K02.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_kubernetes_top10_2025/K03.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_kubernetes_top10_2025/K04.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_kubernetes_top10_2025/K05.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_kubernetes_top10_2025/K06.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_kubernetes_top10_2025/K07.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_kubernetes_top10_2025/K08.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_kubernetes_top10_2025/K09.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_kubernetes_top10_2025/K10.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_llm_top10_2025/LLM01.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_llm_top10_2025/LLM02.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_llm_top10_2025/LLM03.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_llm_top10_2025/LLM04.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_llm_top10_2025/LLM05.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_llm_top10_2025/LLM06.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_llm_top10_2025/LLM07.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_llm_top10_2025/LLM08.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_llm_top10_2025/LLM09.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_llm_top10_2025/LLM10.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_top10_2025/A01.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_top10_2025/A02.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_top10_2025/A03.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_top10_2025/A04.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_top10_2025/A05.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_top10_2025/A06.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_top10_2025/A07.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_top10_2025/A08.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_top10_2025/A09.txt
  • scripts/oie_owasp_eval/fixtures/b2_sources/owasp_top10_2025/A10.txt
  • scripts/oie_owasp_eval/fixtures/reports/b1_accuracy_report.json
  • scripts/oie_owasp_eval/fixtures/reports/b2_accuracy_report.json
  • scripts/oie_owasp_eval/fixtures/reports/b2_accuracy_report_gated.json
  • scripts/oie_owasp_eval/fixtures/reports/module_c_report.json

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

NIST OSCAL sample plus Top10/API/K8s/LLM/AISVS/agentic fixture sources and
gold JSON. Stacked after the ASVS-only fixture PR.
@northdpole
northdpole force-pushed the stack/oie-p5-nist-other-fixtures branch from 8845bab to 86d320a Compare October 14, 2026 08:48

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant