OWASP Agent - Module C: The Librarian (OpenCRE)

The OWASP Agent - Module C: The Librarian (OpenCRE) project makes it possible to use continuously changing OWASP guidance inside OpenCRE, while keeping the OpenCRE graph trustworthy. OpenCRE already links stable standards well, but mapping “living” OWASP content at scale is still manual and can introduce mistakes. Module C becomes the decision boundary: it determines when a new section should automatically map to a CRE node, when an existing mapping should be updated, and when the case is uncertain and must go to human review. The Librarian follows an explicit-link-first workflow and uses a semantic fallback that retrieves the top 20 candidate CRE nodes with pgvector, reranks them with a sentence-transformers cross-encoder (ms-marco-MiniLM-L-6-v2), and applies safeguards such as negation handling, update detection, and contradiction checks. Only results scoring above 0.8 are written automatically; the rest are routed to a review queue. Deliverables include a production-ready Module C pipeline integrated with OpenCRE, a golden dataset and reproducible evaluation harness, CI regression gates to prevent quality drift, and operational documentation for calibration and maintenance. If time permits, I will also prototype hybrid retrieval (vector + BM25) for identifier-heavy cases and a lightweight human review dashboard (Module D). By the end of GSoC, OpenCRE will have a measurable, safe mapping layer that enables Project OIE to ingest OWASP knowledge without sacrificing trust.