docs(compliance): correct stale evidence and ratings in OWASP ASI mapping - #3837
Closed
Kevin Burrowes (kevinondanet) wants to merge 1 commit into
Closed
docs(compliance): correct stale evidence and ratings in OWASP ASI mapping#3837Kevin Burrowes (kevinondanet) wants to merge 1 commit into
Kevin Burrowes (kevinondanet) wants to merge 1 commit into
Conversation
…ping A source-level sweep of the ASI01-ASI10 mapping found the compliance doc had drifted from the code in both directions: - ASI06 understated: cited agent_os/audit/hash_chain.py (does not exist) and claimed no dedicated module, while MemoryGuard, agent-rag-governance, and the TypeScript ContextPoisoningDetector ship today. Evidence and mitigation text now reference the real modules. - ASI05 overstated: no lint rule blocks eval()/exec() (the reviewer's 18 rules cover unsafe pickle, and the sandbox scanner targets process spawning only). Downgraded to Partial with an accurate Known Gap. - ASI07 cited agent_os/trust/gate.py (does not exist); now points at the agent-mesh DID handshake and the A2A trust gate. - ASI04 claimed no SBOM generation exists, but .github/workflows/sbom.yml covers AGT's own releases (as the physical profile already noted); the Known Gap now scopes it to governed-application runtime SBOMs. - AGT traceability extension cited the same dead hash_chain.py path; now points at the chained audit loggers in the agentmesh integrations. Coverage summary updated to 6/10 Full, 4/10 Partial. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017RZS152tpaHAhzA2BpAdyN
Kevin Burrowes (kevinondanet)
requested review from
MohammadHaroonAbuomar and
liamcrumm
as code owners
August 25, 2026 17:36
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
|
Welcome to the Agent Governance Toolkit! Thanks for your first pull request. |
github-actions
Bot
added
documentation
PR Review Summary
Verdict: AI review comments are untrusted advisory output. The summary reports workflow-generated completion status only, not model-authored pass/fail claims. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
A source-level sweep of the ASI01–ASI10 mapping (
docs/compliance/owasp-agentic-top10-architecture.md) against the actual tree found the document had drifted from the code in both directions. This PR corrects the evidence lists, mitigation text, and two coverage ratings. Every file path now cited was verified to exist on disk, and every behavioral claim was checked against the referenced source.Drift corrected
agent-governance-python/agent-os/src/agent_os/audit/hash_chain.py— a file that does not exist (there is noagent_os/audit/package) — and claimed "no dedicated memory-sandbox or context-integrity module." The shipped modulesagent_os/memory_guard.py, theagent-rag-governancepackage (ContentScanner,RAGGovernor), and the TypeScriptContextPoisoningDetectornow anchor the section. (The physical-profile table later in the same document already citedmemory_guard.py, so the doc contradicted itself.) Rating stays Partial for accurate reasons: no policy-engine intervention points for memory writes/retrieval, no Go/Rust/.NET parity, heuristic detection.eval()andexec()in agent code via lint rules" could not be confirmed: the copilot-governance reviewer has no eval/exec rule, andagent-sandbox/code_scanner.pytargetssubprocess/os.exec*/pty.spawnpatterns, not Python'seval/exec/compilebuiltins. Downgraded to Partial with a Known Gap, and the real sandbox-layer evidence (code_scanner.py,Dockerfile.sandbox) added.agent_os/trust/gate.py, which does not exist. Now points at the agent-mesh DID challenge-response handshake (agentmesh/trust/handshake.py) and the A2Atrust_gate.py..github/workflows/sbom.ymlgenerates SBOMs for AGT's own releases (as the physical profile already acknowledged). The Known Gap is now scoped to governed-application runtime SBOMs, and the marketplace Ed25519 verification andMCPSecurityScannerfingerprinting are added as evidence with their limits (TOFU fingerprints, no key revocation) stated.hash_chain.py; the real chained audit loggers live in the agentmesh integrations (haystack_agentmesh/audit.pywithverify_chain(),openai_agents_trust/audit.pywithprevious_hashchaining).Rating changes
Coverage summary moves from 7/10 Full, 3/10 Partial to 6/10 Full, 4/10 Partial (ASI05 Full → Partial). No section's actual capability changed — only the description of it.
🤖 Generated with Claude Code
https://claude.ai/code/session_017RZS152tpaHAhzA2BpAdyN