ave-site

Source for aveproject.org, the site presenting AVE (Agentic Vulnerability Enumeration), the behavioral classification standard for agentic AI components.

The records and schema badges read aveproject/ave's dist/ave-records-latest.manifest.json, so they never need editing.

This repo is presentation. The standard itself, its records, and its schema live in aveproject/ave; this repo has no authority over that content and generates none of its own. Every page here either renders data pulled from that repo, or documents how to use it. If a change is about what AVE says, it belongs in aveproject/ave, not here.

Every page's footer says which catalog release and which records it shows, for example AVE catalog v1.2.0 + unreleased changes · schema 1.3.0 · 89 records when the site's records are newer than the latest release.

records.js is generated by scripts/build-records.js, which pulls from aveproject/ave's published records, not from any copy kept in this repo. The consolidated JSON dump (dist/ave-records-latest.json, an alias that always points at current, distinct from the versioned, frozen dist/ave-records-v<version>.json snapshots) is the same artifact ave-api and any external implementer would use; this site is one more consumer of it, not a second source of truth.

node scripts/build-records.js
# regenerates records.js from aveproject/ave's current published records

schema/, crosswalks/*.json (including crosswalks/manifest.json), records.js, site-meta.js, schema.html, implementer-guide.html and scoring.html are build outputs from aveproject/ave. The deploy workflow regenerates them on every deploy and they are listed in .gitignore.

• site-meta.js (scripts/build-site-meta.js): the newest v* tag of the aveproject/ave checkout, its dist/ave-records-latest.manifest.json, and every catalog release with its manifest, read from the GitHub Releases API. The footer strip and versions.html read it.
• schema.html, implementer-guide.html and scoring.html (scripts/build-pages.js): the sources are templates/schema.html, templates/implementer-guide.html and templates/scoring.html, filled from schema/ave-record.schema.json, docs/specs/ave-implementer-guide.md, and for scoring CONTRIBUTING.md, README.md, the schema and records.js. Edit the templates for layout; edit aveproject/ave for content. The guide is rendered with marked, pinned exactly in package.json.
• scoring.html (scripts/lib/scoring.js) states nothing about scoring that the ave repo does not: the formula, factor wording, ThM values and severity bands are read from its README and CONTRIBUTING, cross-checked against each other and the schema, and the numbers come from the records. If those documents disagree, the build fails and the previous page stays live. A record whose own numbers disagree with them is a build warning, counted on the page. npm test covers this. The page understands the 1.x equation and OWASP AIVSS v0.8 (schema 2.x), whichever the documents state; one that states neither stops the build. The 1.x support is temporary, see the comment above EQUATIONS.

Never edit or commit these. A committed copy is overwritten at deploy time, so it can only mislead whoever reads it. After publishing the schema files the deploy compares each one with aveproject/ave byte for byte and fails the build on any difference.

The .md write-ups in crosswalks/ are not produced by these scripts. They are plain tracked copies, the deploy does not refresh them, and no page links to them, so they can drift from aveproject/ave.

git clone https://github.com/aveproject/ave-site.git
git clone https://github.com/aveproject/ave.git   # must sit next to ave-site
cd ave-site
npm ci
npm run build:site         # everything below, in order
# or one at a time:
npm run build:local        # records.js from ../ave/records
npm run build:schemas      # schema/ from ../ave/schema
npm run build:crosswalks   # crosswalks/*.json and manifest.json from ../ave/crosswalks
npm run build:meta         # site-meta.js (needs network; build:meta:offline lists releases from tags only)
npm run build:pages        # schema.html, implementer-guide.html and scoring.html from ../ave (run build:local first: scoring.html reads records.js)
npm test                   # the scoring page's tests
python3 -m http.server 8080
# or: npx serve .

Serve over HTTP, don't open the HTML files directly from disk; several pages fetch JSON at runtime, and fetch() does not work against a file:// URL.

GitHub Pages, custom domain aveproject.org. deploy.yml runs on a push to main, when aveproject/ave dispatches a data update, once a day (a new catalog release or a change to the implementer guide does not dispatch one), and by hand. DNS and Pages configuration aren't duplicated here; see the repo's deployment workflow and GitHub Pages settings for the current setup.

Third-party tools and services that consume AVE, commercial or otherwise, are implementations of the standard, not part of it, and are documented in their own repos, not here, matching aveproject/ave's own CONTEXT.md.

Changes to AVE's own content (records, schema, framework mappings) go to aveproject/ave's own CONTRIBUTING.md. Changes to this repo are about presentation only: page layout, the build script, styling, and site-level bugs.

Apache 2.0, see LICENSE.