APRF-RFC-0010: Fine-grained peer crosswalks (AISVS, ASVS, OpenCRE, MAESTRO, FIASSE)

Field	Value
Status	accepted
Author(s)	StackRail (working-draft publisher)
Created	2026-08-10
SemVer impact	MINOR
Index summary	Adds informative section-level crosswalks for OWASP AISVS 1.0 (`aisvs:v1.0-C.`), ASVS, OpenCRE, MAESTRO, and FIASSE; enriches OWASP LLM Top 10 controls with AISVS `relatedPeerControlIds` bridges.

Problem

APRF already ships informative peer maps for NIST AI RMF, ISO/IEC 42001, OWASP LLM Top 10, SOC 2, AWS Well-Architected, and SLSA. Assessors and auditors who already work from OWASP AISVS / ASVS, OpenCRE, CSA MAESTRO, or FIASSE cannot see those alignments on Checks or in `REPORT.html`.

The LLM Top 10 crosswalk exists, but it does not surface the AISVS section bridges that accompany each LLM risk in OWASP AISVS practice.

Proposal

1. Add five informative frameworks under `spec/aprf-spec.json` → `crosswalks[]`:

- aisvs — OWASP AISVS 1.0 section inventory (`aisvs:v1.0-C*.*`, sourced from the locked `1.0/en` tree)

- asvs — 80 ASVS 5.0 sections (`V*.*`)

- opencre — 13 CWE peer controls (CRE IDs in `summary`)

- maestro — 7 MAESTRO layers + 5 extended multi-agent threats

- fiasse — 61 FIASSE / SSEM sections

2. Extend peer control shape with optional `relatedPeerControlIds` and populate OWASP LLM Top 10 controls with official AISVS 1.0 IDs (e.g. LLM01 → `aisvs:v1.0-C2.1`, …).

3. Validate related peer IDs at catalog build time; surface them on assessment controls / HTML as informative related-peer meta.

4. Group the HTML “Framework crosswalk” block by framework so fine-grained maps stay readable.

5. Update `metadata.compatibility.crosswalks` and stats. No gate, scoring, Check YAML, profile, or lens changes.

Crosswalks remain informative alignment only — not certification or proof of compliance. Full peer markdown corpora are not vendored into APRF. AISVS authoring reads a local OWASP/AISVS checkout via `--aisvs-root`; ASVS / OpenCRE / FIASSE draft from compact ID/title/summary inventories under `scripts/peer-crosswalk-inventories/`.

Alternatives considered

- Vendor full peer markdown corpora — rejected for this RFC; APRF keeps ID/title/summary maps only.

- Chapter-only (coarse) maps — rejected; assessors need section-level refs matching AISVS/ASVS practice.

- Peer-to-peer graph as a separate artifact — rejected; `relatedPeerControlIds` on LLM controls is enough for the AISVS bridges without a new runtime model.

Compatibility

Change	Impact
New `crosswalks[]` entries	Additive; consumers may show more peer refs per Check
`relatedPeerControlIds` on controls	Additive optional field; older catalogs ignore it
Gates / Check IDs / profiles	Unchanged
SemVer	MINOR (new compatibility surfaces)

Security considerations

Crosswalk metadata must not be treated as evidence of compliance. Disclaimers remain on each framework. Related-peer bridges are informative only.

Open questions

None for this ship; future RFCs may add MASVS/MASTG or richer peer-to-peer edges if demand appears.

Checklist

- [x] Problem and affected parties

- [x] Proposed change stated

- [x] SemVer impact justified

- [x] Compatibility / deprecation plan

- [x] Checks remain measurable (N/A — no Check changes)

- [x] Crosswalk impact noted

- [x] Security / safety considered

- [x] Open questions listed