Merge main into gsocmodule_C_week_2 after OWASP#922 merge

Resolve add/add conflicts keeping week_2 C.0 boundary changes.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: northdpole

.cursor/rules/git-workflow.mdc

@@ -0,0 +1,29 @@
+---
+description: Signed commits and rebase-only git workflow for OpenCRE
+alwaysApply: true
+---
+
+# Git Workflow (OpenCRE)
+
+## Verified signed commits (required)
+
+- **Every commit must be cryptographically signed** and show as **Verified** on GitHub.
+- Use `git commit -S` (or rely on `commit.gpgsign=true` / `commit.gpssign=true` when already configured).
+- **Never** pass `--no-gpg-sign`, `--no-gpgSign`, or skip signing hooks unless the user explicitly requests it.
+- Before handoff after a commit, confirm signatures: `git log -1 --show-signature` (or `git verify-commit HEAD`).
+- If signing fails (missing key, agent, or passphrase), **stop and report** — do not create unsigned commits.
+
+## Rebase-only history (no squash, no merge commits)
+
+OpenCRE keeps a **linear history**. All integrations use **rebase** — never squash, never merge commits.
+
+| Do | Don't |
+|----|-------|
+| `git rebase <base>` to update a feature branch | `git merge <branch>` to integrate work |
+| `git pull --rebase` (or `fetch` + `rebase`) | `git pull` (default merge) on shared branches |
+| `gh pr merge --rebase` when merging PRs | `gh pr merge --squash` or `gh pr merge --merge` |
+| Rebase-merge on GitHub (Settings → rebase merging enabled) | Squash merge or merge-commit PRs |
+
+- When the user asks to integrate branches, **rebase onto the target branch**.
+- When merging PRs, **always use rebase merge** (`gh pr merge <n> --rebase`). **Never squash.**
+- **Never** use `git merge --no-ff`, `gh pr merge --squash`, or `gh pr merge --merge` in this repo unless the user explicitly overrides for a one-off exception.

.env.example

@@ -59,6 +59,26 @@ GEMINI_API_KEY=your-gemini-api-key
 VERTEX_CHAT_MODEL=gemini-2.5-flash
 VERTEX_EMBED_CONTENT_MODEL=gemini-embedding-001
 
+# Noise / Relevance Filter (Module B)
+
+CRE_NOISE_FILTER_LLM_MODEL=gemini/gemini-2.5-flash-lite
+CRE_NOISE_FILTER_BATCH_SIZE=10
+CRE_NOISE_FILTER_MAX_CHARS=1500
+CRE_NOISE_FILTER_CONFIDENCE_THRESHOLD=0.8
+
 # Spreadsheet Auth
 
 OpenCRE_gspread_Auth=path/to/credentials.json
+
+# Module C — Librarian
+# Loaded by application/utils/librarian/config_loader.py. Nothing consumes these
+# yet; defaults match the OIE design doc. Constraints enforced at load time:
+# top_k_rerank <= top_k_retrieval; thresholds in [0.0, 1.0]; counts > 0.
+
+CRE_LIBRARIAN_CROSSENCODER_MODEL=cross-encoder/ms-marco-MiniLM-L-6-v2
+CRE_LIBRARIAN_TOP_K_RETRIEVAL=20
+CRE_LIBRARIAN_TOP_K_RERANK=5
+CRE_LIBRARIAN_LINK_THRESHOLD=0.8
+CRE_LIBRARIAN_BATCH_SIZE=32
+CRE_LIBRARIAN_ECE_TARGET=0.10
+CRE_LIBRARIAN_CONFORMAL_ALPHA=0.10

.github/workflows/gsoc-reviews.yml

@@ -0,0 +1,85 @@
+---
+# GSoC 2026 maintainer report — assigned students only.
+# Stops generating reports after 2026-10-31 and deletes this workflow in November 2026.
+name: GSoC Reviews
+
+on:
+  schedule:
+    - cron: "0 9 * * 1"
+    - cron: "0 0 1 11 *"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: read
+
+env:
+  GSOC_REVIEWS_EXPIRY: "2026-10-31T23:59:59Z"
+
+jobs:
+  gate:
+    runs-on: ubuntu-latest
+    outputs:
+      expired: ${{ steps.date.outputs.expired }}
+    steps:
+      - name: Check October 2026 expiry
+        id: date
+        run: |
+          NOW=$(date -u +%s)
+          EXPIRY=$(date -u -d "${GSOC_REVIEWS_EXPIRY}" +%s)
+          if [ "$NOW" -gt "$EXPIRY" ]; then
+            echo "expired=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "expired=false" >> "$GITHUB_OUTPUT"
+          fi
+
+  report:
+    name: GSoC PR and RFC coverage report
+    needs: gate
+    if: needs.gate.outputs.expired == 'false'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Generate report
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          python3 scripts/gsoc_pr_review_report.py --output /tmp/gsoc-review-report.md
+
+      - name: Publish job summary
+        run: cat /tmp/gsoc-review-report.md >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Upload report artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: gsoc-review-report
+          path: /tmp/gsoc-review-report.md
+          retention-days: 90
+
+  cleanup:
+    name: Remove expired GSoC Reviews workflow
+    needs: gate
+    if: needs.gate.outputs.expired == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Delete workflow and scripts
+        run: |
+          rm -f .github/workflows/gsoc-reviews.yml
+          rm -f scripts/gsoc_pr_review_report.py
+          rm -f scripts/gsoc_review_manifest.json
+          if git diff --quiet; then
+            echo "Workflow files already removed."
+            exit 0
+          fi
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add -A
+          git commit -m "chore: remove expired GSoC reviews workflow (October 2026)"
+          git push

.github/workflows/linter.yml

@@ -34,6 +34,18 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+      - name: Install Python dependencies
+        run: |
+          python -m venv venv
+          . ./venv/bin/activate
+          pip install --upgrade pip setuptools
+          pip install -r requirements.txt
+      - name: OpenAPI guardrail
+        run: make openapi-guardrail
       - name: Lint Code Base
         uses: github/super-linter@v6
         env:

.gitignore

@@ -67,6 +67,7 @@ standards_cache.sqlite
 ### Docs
 *.md
 !AGENTS.md
+!docs/faq.md
 
 ### Dev DBDumps
 *.sql

.yarn/install-state.gz

@@ -0,0 +1,8 @@
+approvedGitRepositories:
+  - "**"
+
+enableScripts: true
+
+nodeLinker: node-modules
+
+npmMinimalAgeGate: 0

.yarnrc.yml

@@ -100,7 +100,7 @@ docker-prod-run:
 	 docker run -it -p $(PORT):$(PORT) opencre:$(shell git rev-parse HEAD)
 
 lint:
-	[ -d "./venv" ] && . ./venv/bin/activate && black . && yarn lint
+	[ -d "./venv" ] && . ./venv/bin/activate && black . && yarn lint && make openapi-guardrail
 
 mypy:
 	[ -d "./venv" ] && . ./venv/bin/activate &&  mypy --ignore-missing-imports --implicit-reexport --no-strict-optional --strict application
@@ -122,6 +122,14 @@ alembic-guardrail:
 	[ -d "./venv" ] && . ./venv/bin/activate &&\
 	python scripts/check_alembic_revision_guardrail.py
 
+openapi-generate:
+	[ -d "./venv" ] && . ./venv/bin/activate &&\
+	python scripts/generate_openapi.py
+
+openapi-guardrail:
+	[ -d "./venv" ] && . ./venv/bin/activate &&\
+	python scripts/check_openapi_guardrail.py
+
 migrate-downgrade:
 	[ -d "./venv" ] && . ./venv/bin/activate &&\
 	export FLASK_APP="$(CURDIR)/cre.py"

Makefile

@@ -15,6 +15,12 @@ OpenCRE consists of:
 To see how you can contribute to the application or to the data (catalog or standard mappings), see [Contributing](docs/CONTRIBUTING.md).
 We really welcome you!
 
+# Documentation
+
+- [In-app Docs](https://www.opencre.org/docs) — getting started, FAQ, and interactive API reference
+- [FAQ](docs/faq.md) — frequently asked questions (also rendered at [/docs#faq](https://www.opencre.org/docs#faq))
+- [OpenAPI spec](docs/api/openapi.yaml) — public REST API (`/rest/v1/openapi.yaml` when running)
+
 # Roadmap
 
 For a roadmap please see the [issues](https://github.com/OWASP/OpenCRE/issues).

README.md

@@ -51,6 +51,10 @@ def create_app(mode: str = "production", conf: any = None) -> Any:
 
     app.register_blueprint(app_blueprint)
 
+    from application.web.openapi_registry import init_openapi
+
+    init_openapi(app)
+
     CORS(app)
     app.config["CORS_HEADERS"] = "Content-Type"