feat(mappings): promote Related-orphan remaps into canonical fixtures

[northdpole]

Summary

Stacked on fixture PRs. Promotes Related-orphan remaps into canonical OWASP mapping fixtures and loader helpers.

Depends on

• NIST/other fixtures stacked PR

Test plan

• python -m unittest application.tests.owasp_mapping_fixtures_test
• Diff mapping JSON changes for unexpected CRE moves

Made with Cursor

Stack (merge bottom → top)

1. feat(librarian): Module C retrieval upgrades (stack base) #1088 — librarian base (wip/oie-pipeline-eval-harness → main)
2. feat(harvester): requirement extract and GitHub URL ingest #1115 — harvester (stack/oie-p2-harvester → feat(librarian): Module C retrieval upgrades (stack base) #1088)
3. feat(oie): B2 eval harness and CRE neighborhood scorer #1116 — B2 harness (stack/oie-p3-b2-harness → feat(harvester): requirement extract and GitHub URL ingest #1115)
4. chore(oie): ASVS 5.0 provisional B2 sources and gold #1117 — ASVS fixtures (stack/oie-p4-asvs-fixtures → feat(oie): B2 eval harness and CRE neighborhood scorer #1116)
5. chore(oie): NIST 800-53 and remaining B2 sources/gold #1118 — NIST + other fixtures (stack/oie-p5-nist-other-fixtures → chore(oie): ASVS 5.0 provisional B2 sources and gold #1117)
6. feat(mappings): promote Related-orphan remaps into canonical fixtures #1119 — mapping promotions (stack/oie-p6-mapping-promotions → chore(oie): NIST 800-53 and remaining B2 sources/gold #1118)
7. feat(oie): full-pipeline runner, docs, and experimental-flag notes #1120 — full-pipeline + docs (stack/oie-p7-full-pipeline-docs → feat(mappings): promote Related-orphan remaps into canonical fixtures #1119)

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 44 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 2 included reviews currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository: OWASP/OpenCRE/.coderabbit.yml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 05480db1-9a0f-4eec-9d73-19d4170bb584

📥 Commits

Reviewing files that changed from the base of the PR and between 86d320a and 62cedd4.

📒 Files selected for processing: 9

• application/tests/fixtures/owasp_mappings/owasp_aisvs_1_0.json
• application/tests/fixtures/owasp_mappings/owasp_api_top10_2023.json
• application/tests/fixtures/owasp_mappings/owasp_kubernetes_top10_2022.json
• application/tests/fixtures/owasp_mappings/owasp_kubernetes_top10_2025.json
• application/tests/fixtures/owasp_mappings/owasp_llm_top10_2025.json
• application/tests/fixtures/owasp_mappings/owasp_top10_2025.json
• application/tests/owasp_llm_top10_2025_parser_test.py
• application/tests/owasp_mapping_fixtures_test.py
• application/utils/mapping_fixtures.py

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Bornunique911]

Thanks for the mapping promotion work — I reviewed this alongside my hyperlink correction PR, #1105.

A merge/rebase coordination issue to resolve before this lands: #1119 modifies the same four mapping fixtures as #1105:

• owasp_api_top10_2023.json
• owasp_kubernetes_top10_2022.json
• owasp_kubernetes_top10_2025.json
• owasp_top10_2025.json

#1105 updates these fixtures to use the current canonical OWASP source URLs. Could this branch please rebase onto main after #1105 merges, or cherry-pick the equivalent URL fixes? This will ensure the new expanded gold mappings do not preserve or restore legacy project links.

A few mapping-specific review points:

1. owasp_aisvs_1_0.json, AISVS12 uses a GitHub tree/.../0x10-C12-Monitoring-and-Logging.md URL. As this targets a file, it should use blob, consistent with the other AISVS entries.

2. cre_ids_original is valuable provenance. Please add a test that verifies it remains the original direct mapping, rather than only checking that those IDs appear as a prefix of the expanded cre_ids.

3. For rows marked gold_remap: related_expand_orphan, an audit artifact or test-backed evidence of the graph rule would help future maintainers verify that:

   • the original CRE is an orphan for Contains; and
   • every added CRE comes from the intended Related expansion.

4. The LLM Top 10 changes correctly distinguish hub and provisional provenance. It would be useful to ensure consumers/evaluations do not treat provisional topic matches as equivalent to Hub-backed mappings.

The current lint failures appear inherited from lower PRs in the stacked series, so I think those should be fixed at the owning/base PR rather than in this mapping-promotion PR.