Repository navigation
Conversation
…kip-done Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…ep policy pages; 6000-char cap Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…ved docs the answer reads Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…ns per raw chunk (--enrich) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…use and answer the real question A pure injection with no question before it is still refused. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…mes first Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…rites the final answer Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…of interleaving Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…unks or digests (cost experiments) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…dings (and merge the two heads) Vector search was a full scan; the index is used when OWASP_PGVECTOR_HALFVEC=1. No-op on SQLite and without the vector extension. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…roject questions (L4) Flagged off by default. Falls back to normal retrieval when the question names no single project, the project is too big, or the answer is unknown. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
… winning flag set Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…_CX_LONGCTX_PROJECTS) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…nd OWASP_CX_DECOMPOSE (multi-part questions) Both off by default; measured before being turned on. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…ed lower) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…inking budget Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The async tool handler called the blocking ask directly on the event loop with a single worker, so concurrent users were answered one after another (3 parallel users saw ~3x the single-user latency). Each call now runs in a thread with its own Flask app context. OPENCRE_MCP_ASK_CONCURRENCY caps threads (default 8). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…concurrency cap Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The first question after a restart took ~30 s (imports, embedding client, database connection). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…stion names Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…imilarity when none is named Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
… skipped Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…w fit) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…comprehend_standard Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…incremental Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…s 90 s on a 250-chunk repo) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…art and cross-standard questions Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
… get, overview of indexed sources) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
* trim/1116: chore(oie): trim #1116 and guard destructive eval scripts Address review feedback on B2 harness scripts. feat(oie): B2 eval harness and CRE neighborhood scorer
* trim/1117: chore(oie): trim #1117 for the staging rollout chore(oie): ASVS 5.0 provisional B2 sources and gold
* trim/1118: chore(oie): trim #1118 for the staging rollout chore(oie): NIST 800-53 and remaining B2 sources/gold
* trim/1119: feat(mappings): promote Related-orphan remaps into canonical fixtures
* trim/1120: trim(#1120): fix merge-conflict markers, guard full pipeline, drop dead experiments style: black-format llm_safety_guard.py feat(librarian): promote d1-winner combo defaults (judge+cap8+top_k=3) feat(oie): full-pipeline runner, docs, and experimental-flag notes
* trim/1125: Add idempotent Alembic migration for OWASP agent meta tables. Isolate OWASP meta concepts to chat and MCP only Add experimental OIE OWASP metadata agent for chat fix(librarian): finish SafetyGuard + leaf-drilldown restack merge fix(librarian): keep LLM SafetyGuard when restacking leaf-drilldown feat(librarian): batch Module C query embeddings Address review feedback on full-pipeline runner.
* trim/1127: (24 commits) test(owasp-agent): restore the environment with a plain helper instead of patch.dict in the embed_sync tests test(owasp-agent): sync and concepts must not import application.database chore(owasp-agent): type embed_sync and its test chore: drop generated frontend bundle (rebuild at deploy) refactor(owasp-agent): move the meta-embedding push out of sync_all into embed_sync trim(#1127): drop adversarial asker/batch scripts and canned CRE follow-ups, set source_channel in raw embedding writers fix(owasp-agent): drop keyword dumps; derive project aliases on ingest fix(owasp-agent): drop meta/normative keyword dump gates fix(owasp-agent): stop substring event/chapter traps and city hardcodes feat(owasp-agent): sim-first retrieve with normalize, chapters, board ontology Reuse one Flask app in the adversarial completion asker. Treat named-chapter meetup asks as chapter lookup. Fix OWASP agent routing for chapter-in-city and project leaders. Add adversarial completion asker and align embed model ids. Make OWASP agent meta embedding work on low-memory staging. Route OWASP chat via multi-lane embedding similarity. Harden OWASP agent routing for board, geo, CRE, and PG index. Add multi-turn chat memory with New chat. Answer OWASP entity chat probes from agent metadata. Black-format remaining owasp_agent modules for CI. ... # Conflicts: # application/utils/postgres_url.py
* trim/1137: (57 commits) test(owasp-agent): exercise the meta-embedding push through injected embed_fn instead of patching embed_sync fix(owasp-agent): admin sync and scheduler stage apply the opt-in meta-embedding push trim(#1137): drop brevity-bot skills and stale handover doc, restore README/dev setup, loopback guard for run_admin_local.sh test: fix stale admin config assertion, env leaks between tests, and the sync isolation guardrail style: format files flagged by CI (black, prettier) Restore clarify followup test dropped in admin rebase. Default Module C.1 auto-filing off behind an admin Config toggle. Add Module C.1 graph filing to the OIE A→B→C pipeline. Paint Module C auto-filed graph edges and nodes in the explorer. Run admin OIE ingest through Modules B and C by default. Black-format admin_imports_api_test for CI Chain admin panel tables migration after oie_run Add Mac handover for admin/OIE/agent E2E validation. Wire golden-set harvest and OWASP agent sync into Admin Config. Wire Postgres admin bootstrap into make install and make dev. Auto-pull CRE graph in admin-local when Postgres is empty. Surface OIE skip reasons, flags, and graph path in pipeline logs. Fix Graph management Accept/errors for empty OIE import runs. Restore degraded stop contract; tighten admin ingest defaults. Skip invalid harvest docs; surface agent last_sync from meta_entity. ... # Conflicts: # application/config.py # application/utils/db_backend.py
* trim/1136: test(oie-scheduler): restore the environment with a plain helper in the new opt-in assertions fix(oie-scheduler): embed_filed_nodes defaults off, document OIE_HARVEST_EVENTS and OIE_EMBED_FILED_NODES test: embedding-failure scheduler test needs graph filing enabled now that it defaults off style: format files flagged by CI (black, prettier) Make event-repo harvesting opt-in (OIE_HARVEST_EVENTS) Make event page parsing linear-time and clean Playwright fallback text Embed auto-filed graph nodes in the CRE expansion job Parse OWASP event pages and harvest event repos
* trim/1142: (30 commits) docs(staging): use placeholder tester addresses; test: restore the environment with a plain helper in the #1142 tests fix(admin): CRE embedding guard only treats a missing table as empty and counts real vectors trim(#1142): admin upstream-sync-and-ingest no longer replaces existing CRE embeddings trim(#1142): no credentialed CORS without an allowlist, OIE workers opt-in in import-all, guard levers-matrix queue reset style: format files flagged by CI (black); keep test environment changes from leaking between tests; pin the in-memory retriever backend in librarian tests feat(oie-scheduler): owasp job runs daily by default; health staleness follows the admin-set interval feat(admin): Schedules tab to change job intervals and switch jobs off feat(oie-scheduler): admin-editable job interval and on/off fix(owasp-agent): restore intent/sim-first agent after fanout restack fix(owasp-agent): restore sim-first router after fanout restack fix(mcp): run ask meta router in app context before CRE defer feat(mcp): staging Streamable HTTP with Admin JWT gate for ask fix(mcp): only treat CRE-shaped ids as ask security hits feat(mcp): add fact-only ask tool for Cursor multi-call synthesis fix(auth): admit admin API keys on MyOpenCRE after MCP rebase Fix Admin ingest ETA to use Module C remaining, not HI backlog. Add Admin active ingestions status with config, progress, and ETA. Allow Bearer on Admin OIE REST and fix staging filing lookup. Redesign admin panel with CRE blues, env/.env diff, and review widgets. Add Admin REST + UI to requeue/cancel failed OIE RQ jobs. ...
* trim/1155: trim(#1155): drop laptop-local edge probe scripts, make node metadata seeding opt-in, fix empty-key blurb match feat(owasp-agent): curated node facts for structural standard questions fix(owasp-agent): close the 24 non-structural edge misses fix(mcp): use chatbot embedding retrieval for ask security facts
* trim/1159: test(owasp-agent): restore the environment with a plain helper in index_routing_test trim(#1159): drop cambridge->boston alias, dead locals, test env/tempfile leaks fix(owasp-agent): whole-name project match first; ambiguous first name lists candidates fix(owasp-agent): meta-lane grounding floor, compound questions, nearest-to place fix(owasp-agent): board name parsing, indexed event lookup, metro chapter aliases fix(owasp-agent): index-resolved chapters, defensive-vs-attack gate, prompt cap, leader noise/email test(owasp-agent): add staging regression + AppSec USA attendee suites and multi-suite eval
* trim/1158: (54 commits) docs(env): OWASP_CX_LONGCTX off and OWASP_CX_LONGCTX_CHARS back to the code default trim(#1158): strip_injection no longer truncates legitimate questions; correct default-off claims fix(comprehension): Nest pager reads a failing page item by item and skips the record Nest cannot serialise feat(comprehension): talk catalogue loader (title/speaker/date/length per OWASP YouTube talk) feat(comprehension): Nest loader - current project leaders/level/dates and issue titles as retrievable documents feat(comprehension): OWASP_CX_PERSTD reads each named project and answers per standard (off by default) feat(mcp): ask returns the source passages its answer used (evidence) feat(comprehension): ROUTE flag - stronger reader for people/count questions (off by default) fix(comprehension): raw ingest retries embedding calls and writes in slices, so a provider outage no longer discards a repo's enrichment docs(oie): replatform options draft feat(mcp): read-only research tools for calling agents (search, list, get, overview of indexed sources) feat(comprehension): OWASP_CX_COMPLETE asks for every part of multi-part and cross-standard questions perf(comprehension): default to 16 ingest workers (24 workers: 55 s vs 90 s on a 250-chunk repo) feat(comprehension): --skip-unchanged makes raw ingest resumable and incremental feat(comprehension): print metered LLM tokens and cost at the end of comprehend_standard docs(env): whole-project cap 2M chars (ASVS and other big projects now fit) feat(comprehension): --supplement indexes repo markdown the harvester skipped feat(comprehension): OWASP_CX_PROJROUTE picks a project by overview similarity when none is named feat(comprehension): OWASP_CX_EDITION answers for the edition the question names feat(comprehension): ask which project is meant when nothing is found ...
* trim/1162: (52 commits) test(auth): inject the Google flow and id-token verifier into the web callback instead of patching them; plain env helper; placeholder addresses in .env.example test(roles): type the env helper and the new domain tests fix(auth): one strict domain check in the web callback, tolerate .edu-style domains, require email_verified is True fix(auth): web sign-in needs an exact or subdomain match and a verified Google email docs(env): document CHAT_BLOCK_UNVERIFIED (default on, changes public chat answers) trim(#1162): drop prune_noise_chunks (unguarded DELETE on embeddings), validate authority weights before use, document ANSWER_LOG_*, no host paths in sync_check_staging fix(auth): harden web sign-in found by adversarial review fix(auth): /auth/user needs any role, not admin fix(auth): carry the PKCE code_verifier from login to callback fix(auth): build a fresh OAuth flow per login instead of a shared singleton fix(auth): stable session secret key; NO_LOGIN=0 no longer randomizes it feat(chat): ask for a short comment inline after a thumbs down feat(comprehension): skip asset/vendored paths at ingestion, rank by file path, show 2 CREs and at most 5 resources fix(chat): CRE names that share a keyword with the question rank into the shown near-ties fix(chat): CRE references link to /cre/<id>; list near-tie CREs; show Related before child-of on CRE pages fix(deps): keep litellm below 1.107 (reported malicious release) fix(chat): strip links whose URLs contain spaces; percent-encode spaces in citation URLs fix(chat): strip copied markdown links and [[n]] markers from answers so [n] stays the only link form feat(chat): attach the closest CRE to every evidence answer (CRE-first references) feat(chat): move 'Continue conversation' next to Ask; send only the last question and answer ... # Conflicts: # requirements.txt
* trim/1188: test(mcp): restore the environment with a plain helper in the public-url tests chore: drop generated bundle license file (rebuild at deploy) docs(mcp): OAuth stays off beyond named testers until registration is restricted and consent exists trim(#1188): require OPENCRE_MCP_PUBLIC_URL for MCP OAuth, document the per-account budget, drop personal email from beta docs feat(budget): per-account daily LLM spend budget for the chatbot and MCP docs: beta tester guide for the chatbot and the MCP server fix(mcp): list the rate_answer tool so clients can give thumbs up/down fix(mcp): give the MCP OAuth migration a unique revision id feat(mcp): Google sign-in (OAuth) for the remote MCP server
Brings external sources, YouTube, the crawler, and the OIE review step (#1195). Keeps embed_nodes alongside the new external stages, leaves the adversarial asker deleted, and keeps sync_check_staging.sh from requiring a host path instead of a hardcoded one.
The crawler commit is already present on staging in a later form (time budget, PDF off by default, slow-body guard, logging). Keep that version, including the JS fallback and the PDF timeout path.
* origin/feat/oie-unified-sources: feat(oie): one pipeline for repos and websites (url source, bridge, shared filer, provenance tag)
…page marked too-short when the browser render fails.
* fix: update hyperlinks in OWASP mappings to point to the correct URLs * fix: update hyperlink in OWASP test to point to the correct URL * fix: update hyperlink in AISVS12 section to point to the correct URL * fix: update hyperlink for AISVS12 section to point to the correct URL * test(mappings): cover canonical OWASP project URLs * fix: update hyperlinks in OWASP Kubernetes Top 10 mappings to correct URLs * fix: update hyperlinks in test for OWASP Top 10 2025 to include all sections * fix: remove trailing whitespace in test for OWASP Top 10 2025 parser
* feat: Phase 1 CRE descriptions generator and UI hide Add approved RAG/OIE parity design + Phase 1 plan under tracked docs/superpowers. Ship a one-shot generate_cre_descriptions script that emits a human approval table (no DB writes), hermetic unit tests with a mocked LLM, and stop rendering cre.description on the CRE detail page. Co-authored-by: Spyros <northdpole@users.noreply.github.com> * docs: Phase 0 worktree hygiene inventory for RAG/OIE parity Record keep/merge/delete guidance without mass-deleting local worktrees from cloud. Inventory lives on the parity PR branch for humans. Co-authored-by: Spyros <northdpole@users.noreply.github.com> * feat: Phase 2 RAG parity ingest loaders into existing embeddings tables Add prose-hole and chunk-quality helpers plus optional LI/Docling ingest adapters that write via injected upserts — no second VectorStoreIndex as source of truth. Hermetic tests mock loaders. Co-authored-by: Spyros <northdpole@users.noreply.github.com> * feat: Phase 3 hybrid RRF retrieve, LC router strangler, decide node Ship LI-style hybrid/RRF/multi-query over a pgvector searcher adapter, LangChain router behind flags (regex fallback), citation stripping, and a LangGraph-compatible node that always calls OpenCRE decide()/τ. Co-authored-by: Spyros <northdpole@users.noreply.github.com> * feat: Phase 4 modern rerank and contextual compression (env-gated) Add Cohere-capable rerank with identity fallback and rerank-then-trim compression. Default off; document ≥+3 pts ablation gate. New deps in requirements-dev only. Co-authored-by: Spyros <northdpole@users.noreply.github.com> * feat: Phase 5 knowledge_claim table and quote-verified extract Additive Alembic migration plus structured claim extraction that drops unverified quotes. No unsupervised CRE graph writes — review queue only. Co-authored-by: Spyros <northdpole@users.noreply.github.com> * feat: Phase 6 Langfuse/OTel gates and Ragas/DeepEval gold bridge Optional observability when keys exist; offline neighbourhood hit@k bridge for Ragas/DeepEval. Keep paid eval off the default make test path. Co-authored-by: Spyros <northdpole@users.noreply.github.com> * feat: Phase 7 Redis answer cache, queue lock policy, budgets, checkpointer Shared Redis answer cache behind a flag, Postgres SKIP LOCKED default-on (refuse silent degrade), ASVS/long-context compression budgets, and a LangGraph checkpointer factory that is not ConversationBuffer. Co-authored-by: Spyros <northdpole@users.noreply.github.com> * test: align CRE page guard with Phase 1 description hide Update librarian frontend source guard to assert cre.description is not rendered, while still forbidding librarian-private summary fields. Co-authored-by: Spyros <northdpole@users.noreply.github.com> * feat: wire LlamaIndex/LangChain into live ask and Librarian paths Cut over comprehension retrieve (LI QueryFusion RRF), owasp_agent intent routing (real LC tool-calling via LiteLLM), citation strip, and modern rerank into the production ask stack behind OWASP_CX_* flags (with CRE_RAG_PARITY_* aliases). Optional LI fusion wraps Librarian C.1 without changing decide()/τ. Defaults remain off pending ablate. Co-authored-by: Spyros <northdpole@users.noreply.github.com> * feat(rag): public QueryFusion LI retrieve, unconfound HYBRID, port gate Replace private QueryFusion RRF helper with public QueryFusionRetriever (RECIPROCAL_RANK, num_queries=1). LI_RETRIEVE no longer aliases from LI_HYBRID; HYBRID alone keeps hand RRF + keyword. Add framework-port staging gate rule and AIX+board multicite regression helpers. Staging ablate: public LI_RETRIEVE 66.7%/7.61s vs Part1 OFF 66.3%/7.5s (private helper was 61.4%). * feat(rag): LI VectorStoreIndex over OpenCRE pgvector (LI_VSTORE) TASK-14.2 experiment: read-only BasePydanticVectorStore + VectorStoreIndex querying existing embeddings via retrieve._dense. Flag OWASP_CX_LI_VSTORE / CRE_RAG_PARITY_LI_VSTORE default off. No second embed SoT, no new LI package. * fix(ci,router): Python 3.12 for Ubuntu 26.04; LC soft-intent gate Actions runners on Ubuntu 26.04 no longer ship 3.12.3 builds — use 3.12. LC_ROUTER: soft intents (clarify/person/events) fall through to regex so normative asks are not misrouted; tighten LC system prompt (TASK-14.4). --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com>
* fix: update hyperlinks in OWASP mappings to point to the correct URLs * fix: update hyperlink in OWASP test to point to the correct URL * fix: update hyperlink in AISVS12 section to point to the correct URL * fix: update hyperlink for AISVS12 section to point to the correct URL * test(mappings): cover canonical OWASP project URLs * fix: update hyperlinks in OWASP Kubernetes Top 10 mappings to correct URLs * fix: update hyperlinks in test for OWASP Top 10 2025 to include all sections * fix: remove trailing whitespace in test for OWASP Top 10 2025 parser * fix: update workflow configurations to use ubuntu-24.04 and Python 3.11 * fix: downgrade Python version to 3.11 in workflow configurations --------- Signed-off-by: Bornunique911 <69379200+Bornunique911@users.noreply.github.com>
Pa04rth
requested review from
northdpole,
paoga87 and
robvanderveer
as code owners
November 5, 2026 14:55
Contributor
|
Important Review skippedToo many files! This PR contains 865 files, which is 765 over the limit of 100. To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch. Upgrade to a paid plan to raise the limit. Usage-priced reviews support at most 300 files.
 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
#1202 , by @Bornunique911