crosswalks: refresh cfgaudit to v1.11.0 (53 rules onto 23 classes)

[predictor2718]

Follow-up to #67, and it closes most of what #68 was tracking.

Coverage

35 rules onto 19 classes → 53 onto 23.

Most of that is not new cfgaudit rules. Five were added in v1.11.0 and three of them map. The other fifteen new mappings are rules that existed all along and now have a home in the four config classes you added from this crosswalk's own gap list:

Record	cfgaudit rules
AVE-2026-00061 TLS verification disabled	CFG075
AVE-2026-00062 unpinned dependency	CFG010, CFG074, CFG055, CFG089
AVE-2026-00063 approval gate bypassed by config	CFG003, CFG004, CFG048, CFG053, CFG063, CFG079, CFG087, CFG091, CFG093, CFG096
AVE-2026-00064 zero-click project-load auto-run	CFG047, CFG067, CFG086

00063 is doing a lot of work, which I take as a sign it was the right class to add.

One mapping moved, on your wording

CFG091 (qwen tools.approvalMode: "yolo") was on AVE-2026-00021, whose text is "a component that explicitly instructs the agent to bypass this confirmation step". It is a setting, not an instruction, and 00063 says it covers the declarative case "independent of any instruction text". Moved. 00021 keeps the instruction-driven rule, CFG029.

The two surfaces you were blocked on

Both are now at mechanism level rather than a topic label, matching what I posted in #68.

Container posture is three mechanisms with no shared detection logic: the daemon redirected off-host (DOCKER_HOST, -H), image trust verification disabled (DOCKER_CONTENT_TRUST=0, --disable-content-trust, --insecure-registry), and a Chromium launcher flag replacing the browser subprocess.

MCP network posture is five: bind-all, wildcard CORS escalating when auth is off in the same env, deprecated sse, a non-loopback proxy, and HTTP transport without log redaction.

Neither is one class. If you pick either up, the daemon redirect and the bind-all case are the highest-value single records.

Two shapes with no class in either direction

Added to the surfaces table because they are the honest leftovers:

• A cleartext endpoint, distinct from TLS verification being disabled. 00061 covers verification switched off; this is no TLS at all. A committed http:// MCP server URL, model base URL, or agent_card_url.
• Natural-language steering of an approval classifier. Cursor's autoRun.allow_instructions is prose the repository feeds to the classifier that decides whether a tool call runs unattended. It falls between 00063 (explicitly not instruction text) and 00021 (an instruction to the agent, not to a gatekeeper).

Three gaps added going the other way

Classes cfgaudit does not cover, recorded so the crosswalk is honest in both directions:

• 00060 and 00069 need server source and binary image analysis respectively, the same layer as 00052, 00053 and 00024.
• 00065 (A2A agent card poisoning) is reachable only as far as the committed pointer. A .gemini/agents/*.md may carry an inline agent_card_json, which cfgaudit recognises well enough to classify the file as a remote agent, but it does not audit the card's contents. It does flag a cleartext agent_card_url and a credential literal in the same file's auth block.

Validation

• crosswalks/cfgaudit-to-ave.json validates against schema/crosswalk-1.0.0.schema.json
• All 29 referenced AVE ids resolve to records in this repo
• All 53 rule-to-class pairs match cfgaudit's cmd/cfgaudit/avemap.go exactly, which is itself drift-guarded on our side by a test that fails if the map and the crosswalk diverge
• Counts taken from dist/ave-records-latest.manifest.json (70 records) and a detection_stage tally (51 static)

One note on cfgaudit's side, since it affects nothing here but is the reason the version moved: v1.11.0 shipped after a false-positive pass over 432 real repositories, which changed two rules. Neither is mapped.