diff --git a/application/tests/fixtures/owasp_mappings/owasp_aisvs_1_0.json b/application/tests/fixtures/owasp_mappings/owasp_aisvs_1_0.json
index c06c4d5ad..1ea6dae97 100644
--- a/application/tests/fixtures/owasp_mappings/owasp_aisvs_1_0.json
+++ b/application/tests/fixtures/owasp_mappings/owasp_aisvs_1_0.json
@@ -3,72 +3,173 @@
     "section_id": "AISVS1",
     "section": "Training Data Integrity & Traceability",
     "hyperlink": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C01-Training-Data-Integrity-and-Traceability.md",
-    "cre_ids": ["227-045", "307-507"]
+    "cre_ids": [
+      "227-045",
+      "307-507"
+    ]
   },
   {
     "section_id": "AISVS2",
     "section": "Input Validation",
     "hyperlink": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C02-Input-Validation.md",
-    "cre_ids": ["031-447", "760-764"]
+    "cre_ids": [
+      "031-447",
+      "760-764",
+      "384-344",
+      "010-308",
+      "866-553",
+      "161-451",
+      "764-765",
+      "541-441",
+      "764-507",
+      "048-612"
+    ],
+    "cre_ids_original": [
+      "031-447",
+      "760-764"
+    ],
+    "gold_remap": "related_expand_orphan"
   },
   {
     "section_id": "AISVS3",
     "section": "Model Lifecycle Management & Change Control",
     "hyperlink": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C03-Model-Lifecycle-Management.md",
-    "cre_ids": ["148-853", "613-285"]
+    "cre_ids": [
+      "148-853",
+      "613-285"
+    ]
   },
   {
     "section_id": "AISVS4",
     "section": "Infrastructure, Configuration & Deployment Security",
     "hyperlink": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C04-Infrastructure.md",
-    "cre_ids": ["233-748", "486-813"]
+    "cre_ids": [
+      "233-748",
+      "486-813",
+      "124-564",
+      "154-031",
+      "462-245",
+      "308-515",
+      "764-507",
+      "333-888",
+      "186-540",
+      "430-636",
+      "615-744"
+    ],
+    "cre_ids_original": [
+      "233-748",
+      "486-813"
+    ],
+    "gold_remap": "related_expand_orphan"
   },
   {
     "section_id": "AISVS5",
     "section": "Access Control & Identity for AI Components & Users",
     "hyperlink": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C05-Access-Control-and-Identity.md",
-    "cre_ids": ["633-428", "724-770"]
+    "cre_ids": [
+      "633-428",
+      "724-770"
+    ]
   },
   {
     "section_id": "AISVS6",
     "section": "Supply Chain Security for Models, Frameworks & Data",
     "hyperlink": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C06-Supply-Chain.md",
-    "cre_ids": ["613-285", "613-287", "863-521"]
+    "cre_ids": [
+      "613-285",
+      "613-287",
+      "863-521"
+    ]
   },
   {
     "section_id": "AISVS7",
     "section": "Model Behavior, Output Control & Safety Assurance",
     "hyperlink": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C07-Model-Behavior.md",
-    "cre_ids": ["064-808", "141-555"]
+    "cre_ids": [
+      "064-808",
+      "141-555",
+      "036-810",
+      "166-151"
+    ],
+    "cre_ids_original": [
+      "064-808",
+      "141-555"
+    ],
+    "gold_remap": "related_expand_orphan"
   },
   {
     "section_id": "AISVS8",
     "section": "Memory, Embeddings & Vector Database Security",
     "hyperlink": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C08-Memory-Embeddings-and-Vector-Database.md",
-    "cre_ids": ["126-668", "538-770"]
+    "cre_ids": [
+      "126-668",
+      "538-770"
+    ]
   },
   {
     "section_id": "AISVS9",
     "section": "Autonomous Orchestration & Agentic Action Security",
     "hyperlink": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md",
-    "cre_ids": ["117-371", "650-560"]
+    "cre_ids": [
+      "117-371",
+      "650-560"
+    ]
   },
   {
     "section_id": "AISVS10",
     "section": "Model Context Protocol (MCP) Security",
     "hyperlink": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C10-MCP-Security.md",
-    "cre_ids": ["307-507", "715-223"]
+    "cre_ids": [
+      "307-507",
+      "715-223"
+    ]
   },
   {
     "section_id": "AISVS11",
     "section": "Adversarial Robustness & Privacy Defense",
     "hyperlink": "https://github.com/OWASP/AISVS/blob/main/1.0/en/0x10-C11-Adversarial-Robustness.md",
-    "cre_ids": ["141-555", "623-550"]
+    "cre_ids": [
+      "141-555",
+      "623-550",
+      "036-810",
+      "166-151",
+      "132-146",
+      "630-573",
+      "163-518",
+      "463-820",
+      "660-052",
+      "176-154",
+      "268-088",
+      "854-643",
+      "725-682",
+      "456-535",
+      "418-853",
+      "267-031"
+    ],
+    "cre_ids_original": [
+      "141-555",
+      "623-550"
+    ],
+    "gold_remap": "related_expand_orphan"
   },
   {
     "section_id": "AISVS12",
     "section": "Monitoring, Logging & Anomaly Detection",
     "hyperlink": "https://github.com/OWASP/AISVS/tree/main/1.0/en/0x10-C12-Monitoring-and-Logging.md",
-    "cre_ids": ["058-083", "148-420", "402-706", "843-841"]
+    "cre_ids": [
+      "058-083",
+      "148-420",
+      "402-706",
+      "843-841",
+      "176-154",
+      "418-853"
+    ],
+    "cre_ids_original": [
+      "058-083",
+      "148-420",
+      "402-706",
+      "843-841"
+    ],
+    "gold_remap": "related_expand_orphan"
   }
 ]
diff --git a/application/tests/fixtures/owasp_mappings/owasp_api_top10_2023.json b/application/tests/fixtures/owasp_mappings/owasp_api_top10_2023.json
index 7a8df0ed0..442475b97 100644
--- a/application/tests/fixtures/owasp_mappings/owasp_api_top10_2023.json
+++ b/application/tests/fixtures/owasp_mappings/owasp_api_top10_2023.json
@@ -3,60 +3,127 @@
     "section_id": "API1",
     "section": "Broken Object Level Authorization",
     "hyperlink": "https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/",
-    "cre_ids": ["304-667", "724-770"]
+    "cre_ids": [
+      "304-667",
+      "724-770"
+    ]
   },
   {
     "section_id": "API2",
     "section": "Broken Authentication",
     "hyperlink": "https://owasp.org/API-Security/editions/2023/en/0xa2-broken-authentication/",
-    "cre_ids": ["177-260", "586-842", "633-428"]
+    "cre_ids": [
+      "177-260",
+      "586-842",
+      "633-428"
+    ]
   },
   {
     "section_id": "API3",
     "section": "Broken Object Property Level Authorization",
     "hyperlink": "https://owasp.org/API-Security/editions/2023/en/0xa3-broken-object-property-level-authorization/",
-    "cre_ids": ["538-770", "724-770", "128-128"]
+    "cre_ids": [
+      "538-770",
+      "724-770",
+      "128-128"
+    ]
   },
   {
     "section_id": "API4",
     "section": "Unrestricted Resource Consumption",
     "hyperlink": "https://owasp.org/API-Security/editions/2023/en/0xa4-unrestricted-resource-consumption/",
-    "cre_ids": ["623-550"]
+    "cre_ids": [
+      "623-550",
+      "132-146",
+      "630-573",
+      "163-518",
+      "463-820",
+      "660-052",
+      "176-154",
+      "268-088",
+      "854-643",
+      "725-682",
+      "456-535",
+      "418-853",
+      "267-031"
+    ],
+    "cre_ids_original": [
+      "623-550"
+    ],
+    "gold_remap": "related_expand_orphan"
   },
   {
     "section_id": "API5",
     "section": "Broken Function Level Authorization",
     "hyperlink": "https://owasp.org/API-Security/editions/2023/en/0xa5-broken-function-level-authorization/",
-    "cre_ids": ["650-560", "724-770"]
+    "cre_ids": [
+      "650-560",
+      "724-770"
+    ]
   },
   {
     "section_id": "API6",
     "section": "Unrestricted Access to Sensitive Business Flows",
     "hyperlink": "https://owasp.org/API-Security/editions/2023/en/0xa6-unrestricted-access-to-sensitive-business-flows/",
-    "cre_ids": ["534-605", "630-573"]
+    "cre_ids": [
+      "534-605",
+      "630-573"
+    ]
   },
   {
     "section_id": "API7",
     "section": "Server Side Request Forgery",
     "hyperlink": "https://owasp.org/API-Security/editions/2023/en/0xa7-server-side-request-forgery/",
-    "cre_ids": ["028-728", "657-084"]
+    "cre_ids": [
+      "028-728",
+      "657-084",
+      "814-322",
+      "061-186",
+      "742-056"
+    ],
+    "cre_ids_original": [
+      "028-728",
+      "657-084"
+    ],
+    "gold_remap": "related_expand_orphan"
   },
   {
     "section_id": "API8",
     "section": "Security Misconfiguration",
     "hyperlink": "https://owasp.org/API-Security/editions/2023/en/0xa8-security-misconfiguration/",
-    "cre_ids": ["486-813"]
+    "cre_ids": [
+      "486-813",
+      "124-564",
+      "154-031",
+      "462-245",
+      "233-748",
+      "308-515",
+      "764-507",
+      "333-888",
+      "186-540",
+      "430-636",
+      "615-744"
+    ],
+    "cre_ids_original": [
+      "486-813"
+    ],
+    "gold_remap": "related_expand_orphan"
   },
   {
     "section_id": "API9",
     "section": "Improper Inventory Management",
     "hyperlink": "https://owasp.org/API-Security/editions/2023/en/0xa9-improper-inventory-management/",
-    "cre_ids": ["162-655", "863-521"]
+    "cre_ids": [
+      "162-655",
+      "863-521"
+    ]
   },
   {
     "section_id": "API10",
     "section": "Unsafe Consumption of APIs",
     "hyperlink": "https://owasp.org/API-Security/editions/2023/en/0xaa-unsafe-consumption-of-apis/",
-    "cre_ids": ["715-223"]
+    "cre_ids": [
+      "715-223"
+    ]
   }
 ]
diff --git a/application/tests/fixtures/owasp_mappings/owasp_kubernetes_top10_2022.json b/application/tests/fixtures/owasp_mappings/owasp_kubernetes_top10_2022.json
index c4eb3d6fd..1a83e412b 100644
--- a/application/tests/fixtures/owasp_mappings/owasp_kubernetes_top10_2022.json
+++ b/application/tests/fixtures/owasp_mappings/owasp_kubernetes_top10_2022.json
@@ -3,60 +3,132 @@
     "section_id": "K01",
     "section": "Insecure Workload Configurations",
     "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K01-insecure-workload-configurations",
-    "cre_ids": ["233-748", "486-813"]
+    "cre_ids": [
+      "233-748",
+      "486-813",
+      "124-564",
+      "154-031",
+      "462-245",
+      "308-515",
+      "764-507",
+      "333-888",
+      "186-540",
+      "430-636",
+      "615-744"
+    ],
+    "cre_ids_original": [
+      "233-748",
+      "486-813"
+    ],
+    "gold_remap": "related_expand_orphan"
   },
   {
     "section_id": "K02",
     "section": "Supply Chain Vulnerabilities",
     "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K02-supply-chain-vulnerabilities",
-    "cre_ids": ["613-285", "613-287"]
+    "cre_ids": [
+      "613-285",
+      "613-287"
+    ]
   },
   {
     "section_id": "K03",
     "section": "Overly Permissive RBAC Configurations",
     "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K03-overly-permissive-rbac-configurations",
-    "cre_ids": ["128-128", "724-770"]
+    "cre_ids": [
+      "128-128",
+      "724-770"
+    ]
   },
   {
     "section_id": "K04",
     "section": "Lack of Centralized Policy Enforcement",
     "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K04-lack-of-centralized-policy-enforcement",
-    "cre_ids": ["117-371"]
+    "cre_ids": [
+      "117-371"
+    ]
   },
   {
     "section_id": "K05",
     "section": "Inadequate Logging and Monitoring",
     "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K05-inadequate-logging-and-monitoring",
-    "cre_ids": ["058-083", "148-420", "402-706", "843-841"]
+    "cre_ids": [
+      "058-083",
+      "148-420",
+      "402-706",
+      "843-841",
+      "176-154",
+      "418-853"
+    ],
+    "cre_ids_original": [
+      "058-083",
+      "148-420",
+      "402-706",
+      "843-841"
+    ],
+    "gold_remap": "related_expand_orphan"
   },
   {
     "section_id": "K06",
     "section": "Broken Authentication Mechanisms",
     "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K06-broken-authentication-mechanisms",
-    "cre_ids": ["177-260", "586-842", "633-428"]
+    "cre_ids": [
+      "177-260",
+      "586-842",
+      "633-428"
+    ]
   },
   {
     "section_id": "K07",
     "section": "Missing Network Segmentation Controls",
     "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K07-missing-network-segmentation-controls",
-    "cre_ids": ["132-146", "467-784", "515-021"]
+    "cre_ids": [
+      "132-146",
+      "467-784",
+      "515-021"
+    ]
   },
   {
     "section_id": "K08",
     "section": "Secrets Management Failures",
     "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K08-secrets-management-failures",
-    "cre_ids": ["340-375", "774-888", "813-610"]
+    "cre_ids": [
+      "340-375",
+      "774-888",
+      "813-610"
+    ]
   },
   {
     "section_id": "K09",
     "section": "Misconfigured Cluster Components",
     "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K09-misconfigured-cluster-components",
-    "cre_ids": ["233-748", "486-813"]
+    "cre_ids": [
+      "233-748",
+      "486-813",
+      "124-564",
+      "154-031",
+      "462-245",
+      "308-515",
+      "764-507",
+      "333-888",
+      "186-540",
+      "430-636",
+      "615-744"
+    ],
+    "cre_ids_original": [
+      "233-748",
+      "486-813"
+    ],
+    "gold_remap": "related_expand_orphan"
   },
   {
     "section_id": "K10",
     "section": "Outdated and Vulnerable Kubernetes Components",
     "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2022/en/src/K10-outdated-and-vulnerable-kubernetes-components",
-    "cre_ids": ["053-751", "715-334", "863-521"]
+    "cre_ids": [
+      "053-751",
+      "715-334",
+      "863-521"
+    ]
   }
 ]
diff --git a/application/tests/fixtures/owasp_mappings/owasp_kubernetes_top10_2025.json b/application/tests/fixtures/owasp_mappings/owasp_kubernetes_top10_2025.json
index d6546e26f..5a11a42a4 100644
--- a/application/tests/fixtures/owasp_mappings/owasp_kubernetes_top10_2025.json
+++ b/application/tests/fixtures/owasp_mappings/owasp_kubernetes_top10_2025.json
@@ -3,68 +3,162 @@
     "section_id": "K01",
     "section": "Insecure Workload Configurations",
     "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2025/en/src/K01-Insecure-Workload-Configurations.html",
-    "cre_ids": ["233-748", "486-813"]
+    "cre_ids": [
+      "233-748",
+      "486-813",
+      "124-564",
+      "154-031",
+      "462-245",
+      "308-515",
+      "764-507",
+      "333-888",
+      "186-540",
+      "430-636",
+      "615-744"
+    ],
+    "cre_ids_original": [
+      "233-748",
+      "486-813"
+    ],
+    "gold_remap": "related_expand_orphan"
   },
   {
     "section_id": "K02",
     "section": "Overly Permissive Authorization Configurations",
     "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2025/en/src/K02-Overly-Permissive-Authorization-Configurations.html",
-    "cre_ids": ["128-128", "724-770"],
-    "fallback_section_ids": ["K03"]
+    "cre_ids": [
+      "128-128",
+      "724-770"
+    ],
+    "fallback_section_ids": [
+      "K03"
+    ]
   },
   {
     "section_id": "K03",
     "section": "Secrets Management Failures",
     "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2025/en/src/K03-Secrets-Management-Failures.html",
-    "cre_ids": ["340-375", "774-888", "813-610"],
-    "fallback_section_ids": ["K08"]
+    "cre_ids": [
+      "340-375",
+      "774-888",
+      "813-610"
+    ],
+    "fallback_section_ids": [
+      "K08"
+    ]
   },
   {
     "section_id": "K04",
     "section": "Lack Of Cluster Level Policy Enforcement",
     "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2025/en/src/K04-Lack-Of-Cluster-Level-Policy-Enforcement.html",
-    "cre_ids": ["117-371"]
+    "cre_ids": [
+      "117-371"
+    ]
   },
   {
     "section_id": "K05",
     "section": "Missing Network Segmentation Controls",
     "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2025/en/src/K05-Missing-Network-Segmentation-Controls.html",
-    "cre_ids": ["132-146", "467-784", "515-021"],
-    "fallback_section_ids": ["K07"]
+    "cre_ids": [
+      "132-146",
+      "467-784",
+      "515-021"
+    ],
+    "fallback_section_ids": [
+      "K07"
+    ]
   },
   {
     "section_id": "K06",
     "section": "Overly Exposed Kubernetes Components",
     "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2025/en/src/K06-Overly-Exposed-Kubernetes-Components.html",
-    "cre_ids": ["152-725", "640-364"],
-    "fallback_section_ids": ["K09"]
+    "cre_ids": [
+      "152-725",
+      "640-364"
+    ],
+    "fallback_section_ids": [
+      "K09"
+    ]
   },
   {
     "section_id": "K07",
     "section": "Misconfigured And Vulnerable Cluster Components",
     "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2025/en/src/K07-Misconfigured-And-Vulnerable-Cluster-Components.html",
-    "cre_ids": ["053-751", "233-748", "486-813", "715-334"],
-    "fallback_section_ids": ["K09", "K10"]
+    "cre_ids": [
+      "053-751",
+      "233-748",
+      "486-813",
+      "715-334",
+      "124-564",
+      "154-031",
+      "462-245",
+      "308-515",
+      "764-507",
+      "333-888",
+      "186-540",
+      "430-636",
+      "615-744"
+    ],
+    "fallback_section_ids": [
+      "K09",
+      "K10"
+    ],
+    "cre_ids_original": [
+      "053-751",
+      "233-748",
+      "486-813",
+      "715-334"
+    ],
+    "gold_remap": "related_expand_orphan"
   },
   {
     "section_id": "K08",
     "section": "Cluster To Cloud Lateral Movement",
     "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2025/en/src/K08-Cluster-To-Cloud-Lateral-Movement.html",
-    "cre_ids": ["132-146", "640-364", "724-770"],
-    "fallback_section_ids": ["K03", "K07"]
+    "cre_ids": [
+      "132-146",
+      "640-364",
+      "724-770"
+    ],
+    "fallback_section_ids": [
+      "K03",
+      "K07"
+    ]
   },
   {
     "section_id": "K09",
     "section": "Broken Authentication Mechanisms",
     "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2025/en/src/K09-Broken-Authentication-Mechanisms.html",
-    "cre_ids": ["177-260", "586-842", "633-428"],
-    "fallback_section_ids": ["K06"]
+    "cre_ids": [
+      "177-260",
+      "586-842",
+      "633-428"
+    ],
+    "fallback_section_ids": [
+      "K06"
+    ]
   },
   {
     "section_id": "K10",
     "section": "Inadequate Logging And Monitoring",
     "hyperlink": "https://owasp.org/www-project-kubernetes-top-ten/2025/en/src/K10-Inadequate-Logging-And-Monitoring.html",
-    "cre_ids": ["058-083", "148-420", "402-706", "843-841"],
-    "fallback_section_ids": ["K05"]
+    "cre_ids": [
+      "058-083",
+      "148-420",
+      "402-706",
+      "843-841",
+      "176-154",
+      "418-853"
+    ],
+    "fallback_section_ids": [
+      "K05"
+    ],
+    "cre_ids_original": [
+      "058-083",
+      "148-420",
+      "402-706",
+      "843-841"
+    ],
+    "gold_remap": "related_expand_orphan"
   }
 ]
diff --git a/application/tests/fixtures/owasp_mappings/owasp_llm_top10_2025.json b/application/tests/fixtures/owasp_mappings/owasp_llm_top10_2025.json
index b761d5e09..578a3e3b1 100644
--- a/application/tests/fixtures/owasp_mappings/owasp_llm_top10_2025.json
+++ b/application/tests/fixtures/owasp_mappings/owasp_llm_top10_2025.json
@@ -3,60 +3,149 @@
     "section_id": "LLM01",
     "section": "Prompt Injection",
     "hyperlink": "https://genai.owasp.org/llmrisk/llm01-prompt-injection/",
-    "cre_ids": ["161-451", "760-764"]
+    "cre_ids": [
+      "012-625",
+      "686-110"
+    ],
+    "gold_provenance": {
+      "kind": "hub",
+      "method": "owasp_top10_for_llm_hub_links",
+      "issue": "https://github.com/OWASP/OpenCRE/issues/1124"
+    }
   },
   {
     "section_id": "LLM02",
     "section": "Sensitive Information Disclosure",
     "hyperlink": "https://genai.owasp.org/llmrisk/llm022025-sensitive-information-disclosure/",
-    "cre_ids": ["126-668", "227-045"]
+    "cre_ids": [
+      "034-540",
+      "044-202",
+      "077-772"
+    ],
+    "gold_provenance": {
+      "kind": "hub",
+      "method": "owasp_top10_for_llm_hub_links",
+      "issue": "https://github.com/OWASP/OpenCRE/issues/1124"
+    }
   },
   {
     "section_id": "LLM03",
     "section": "Supply Chain",
     "hyperlink": "https://genai.owasp.org/llmrisk/llm032025-supply-chain/",
-    "cre_ids": ["613-285", "613-287"]
+    "cre_ids": [
+      "701-654"
+    ],
+    "gold_provenance": {
+      "kind": "hub",
+      "method": "owasp_top10_for_llm_hub_links",
+      "issue": "https://github.com/OWASP/OpenCRE/issues/1124"
+    }
   },
   {
     "section_id": "LLM04",
     "section": "Data and Model Poisoning",
     "hyperlink": "https://genai.owasp.org/llmrisk/llm042025-data-and-model-poisoning/",
-    "cre_ids": ["307-507", "613-287"]
+    "cre_ids": [
+      "020-540",
+      "481-710",
+      "615-663",
+      "867-642"
+    ],
+    "gold_provenance": {
+      "kind": "hub",
+      "method": "owasp_top10_for_llm_hub_links",
+      "issue": "https://github.com/OWASP/OpenCRE/issues/1124"
+    }
   },
   {
     "section_id": "LLM05",
     "section": "Improper Output Handling",
     "hyperlink": "https://genai.owasp.org/llmrisk/llm052025-improper-output-handling/",
-    "cre_ids": ["064-808"]
+    "cre_ids": [
+      "044-202",
+      "780-757"
+    ],
+    "gold_provenance": {
+      "kind": "hub",
+      "method": "owasp_top10_for_llm_hub_links",
+      "issue": "https://github.com/OWASP/OpenCRE/issues/1124"
+    }
   },
   {
     "section_id": "LLM06",
     "section": "Excessive Agency",
     "hyperlink": "https://genai.owasp.org/llmrisk/llm062025-excessive-agency/",
-    "cre_ids": ["117-371", "650-560"]
+    "cre_ids": [
+      "202-604",
+      "205-522",
+      "220-442"
+    ],
+    "gold_provenance": {
+      "kind": "provisional",
+      "method": "ai_exchange_topic_match",
+      "note": "Hub Top10-for-LLM Links empty for LLM06; AI Exchange CREs for agency/oversight",
+      "issue": "https://github.com/OWASP/OpenCRE/issues/1124"
+    }
   },
   {
     "section_id": "LLM07",
     "section": "System Prompt Leakage",
     "hyperlink": "https://genai.owasp.org/llmrisk/llm072025-system-prompt-leakage/",
-    "cre_ids": ["126-668", "227-045"]
+    "cre_ids": [
+      "077-235",
+      "106-447",
+      "768-532"
+    ],
+    "gold_provenance": {
+      "kind": "provisional",
+      "method": "ai_exchange_topic_match",
+      "note": "Hub Top10-for-LLM Links empty for LLM07; AI Exchange CREs for prompt/input leak",
+      "issue": "https://github.com/OWASP/OpenCRE/issues/1124"
+    }
   },
   {
     "section_id": "LLM08",
     "section": "Vector and Embedding Weaknesses",
     "hyperlink": "https://genai.owasp.org/llmrisk/llm082025-vector-and-embedding-weaknesses/",
-    "cre_ids": ["126-668", "538-770"]
+    "cre_ids": [
+      "088-316",
+      "173-554",
+      "440-372"
+    ],
+    "gold_provenance": {
+      "kind": "provisional",
+      "method": "ai_exchange_topic_match",
+      "note": "Hub Top10-for-LLM Links empty for LLM08; AI Exchange augmentation-data CREs (RAG/vector path)",
+      "issue": "https://github.com/OWASP/OpenCRE/issues/1124"
+    }
   },
   {
     "section_id": "LLM09",
     "section": "Misinformation",
     "hyperlink": "https://genai.owasp.org/llmrisk/llm092025-misinformation/",
-    "cre_ids": ["141-555"]
+    "cre_ids": [
+      "010-108",
+      "810-884",
+      "860-723"
+    ],
+    "gold_provenance": {
+      "kind": "provisional",
+      "method": "ai_exchange_topic_match",
+      "note": "Hub Top10-for-LLM Links empty for LLM09; AI Exchange CREs for alignment/transparency/confidence",
+      "issue": "https://github.com/OWASP/OpenCRE/issues/1124"
+    }
   },
   {
     "section_id": "LLM10",
     "section": "Unbounded Consumption",
     "hyperlink": "https://genai.owasp.org/llmrisk/llm102025-unbounded-consumption/",
-    "cre_ids": ["267-031", "623-550"]
+    "cre_ids": [
+      "230-318"
+    ],
+    "gold_provenance": {
+      "kind": "hub",
+      "method": "owasp_top10_for_llm_hub_links",
+      "issue": "https://github.com/OWASP/OpenCRE/issues/1124"
+    }
   }
 ]
diff --git a/application/tests/fixtures/owasp_mappings/owasp_top10_2025.json b/application/tests/fixtures/owasp_mappings/owasp_top10_2025.json
index 7e19d1a4e..cd51d1547 100644
--- a/application/tests/fixtures/owasp_mappings/owasp_top10_2025.json
+++ b/application/tests/fixtures/owasp_mappings/owasp_top10_2025.json
@@ -3,60 +3,165 @@
     "section_id": "A01",
     "section": "Broken Access Control",
     "hyperlink": "https://owasp.org/Top10/2025/A01_2025-Broken_Access_Control/",
-    "cre_ids": ["117-371", "177-260", "724-770"]
+    "cre_ids": [
+      "117-371",
+      "177-260",
+      "724-770"
+    ]
   },
   {
     "section_id": "A02",
     "section": "Security Misconfiguration",
     "hyperlink": "https://owasp.org/Top10/2025/A02_2025-Security_Misconfiguration/",
-    "cre_ids": ["486-813"]
+    "cre_ids": [
+      "486-813",
+      "124-564",
+      "154-031",
+      "462-245",
+      "233-748",
+      "308-515",
+      "764-507",
+      "333-888",
+      "186-540",
+      "430-636",
+      "615-744"
+    ],
+    "cre_ids_original": [
+      "486-813"
+    ],
+    "gold_remap": "related_expand_orphan"
   },
   {
     "section_id": "A03",
     "section": "Software Supply Chain Failures",
     "hyperlink": "https://owasp.org/Top10/2025/A03_2025-Software_Supply_Chain_Failures/",
-    "cre_ids": ["613-286", "613-287", "715-223", "863-521"]
+    "cre_ids": [
+      "613-286",
+      "613-287",
+      "715-223",
+      "863-521"
+    ]
   },
   {
     "section_id": "A04",
     "section": "Cryptographic Failures",
     "hyperlink": "https://owasp.org/Top10/2025/A04_2025-Cryptographic_Failures/",
-    "cre_ids": ["170-772", "227-045"]
+    "cre_ids": [
+      "170-772",
+      "227-045",
+      "333-858",
+      "585-408",
+      "062-850",
+      "841-757",
+      "206-254",
+      "543-428",
+      "605-735",
+      "435-702",
+      "527-034",
+      "426-842",
+      "228-551",
+      "248-646",
+      "400-007",
+      "742-432",
+      "223-780",
+      "542-270",
+      "664-571",
+      "704-530",
+      "727-043"
+    ],
+    "cre_ids_original": [
+      "170-772",
+      "227-045"
+    ],
+    "gold_remap": "related_expand_orphan"
   },
   {
     "section_id": "A05",
     "section": "Injection",
     "hyperlink": "https://owasp.org/Top10/2025/A05_2025-Injection/",
-    "cre_ids": ["031-447", "064-808", "760-764"]
+    "cre_ids": [
+      "031-447",
+      "064-808",
+      "760-764",
+      "384-344",
+      "010-308",
+      "866-553",
+      "161-451",
+      "764-765",
+      "541-441",
+      "764-507",
+      "048-612"
+    ],
+    "cre_ids_original": [
+      "031-447",
+      "064-808",
+      "760-764"
+    ],
+    "gold_remap": "related_expand_orphan"
   },
   {
     "section_id": "A06",
     "section": "Insecure Design",
     "hyperlink": "https://owasp.org/Top10/2025/A06_2025-Insecure_Design/",
-    "cre_ids": ["126-668", "155-155"]
+    "cre_ids": [
+      "126-668",
+      "155-155",
+      "326-704",
+      "820-878",
+      "515-021",
+      "113-133",
+      "278-413",
+      "612-252",
+      "848-711",
+      "117-371",
+      "708-355",
+      "344-611",
+      "640-364",
+      "650-560"
+    ],
+    "cre_ids_original": [
+      "126-668",
+      "155-155"
+    ],
+    "gold_remap": "related_expand_orphan"
   },
   {
     "section_id": "A07",
     "section": "Authentication Failures",
     "hyperlink": "https://owasp.org/Top10/2025/A07_2025-Authentication_Failures/",
-    "cre_ids": ["002-630", "177-260", "586-842", "633-428"]
+    "cre_ids": [
+      "002-630",
+      "177-260",
+      "586-842",
+      "633-428"
+    ]
   },
   {
     "section_id": "A08",
     "section": "Software or Data Integrity Failures",
     "hyperlink": "https://owasp.org/Top10/2025/A08_2025-Software_or_Data_Integrity_Failures/",
-    "cre_ids": ["613-287", "836-068"]
+    "cre_ids": [
+      "613-287",
+      "836-068"
+    ]
   },
   {
     "section_id": "A09",
     "section": "Security Logging and Alerting Failures",
     "hyperlink": "https://owasp.org/Top10/2025/A09_2025-Security_Logging_and_Alerting_Failures/",
-    "cre_ids": ["067-050", "148-420", "402-706", "843-841"]
+    "cre_ids": [
+      "067-050",
+      "148-420",
+      "402-706",
+      "843-841"
+    ]
   },
   {
     "section_id": "A10",
     "section": "Mishandling of Exceptional Conditions",
     "hyperlink": "https://owasp.org/Top10/2025/A10_2025-Mishandling_of_Exceptional_Conditions/",
-    "cre_ids": ["513-183"]
+    "cre_ids": [
+      "513-183"
+    ]
   }
 ]
diff --git a/application/tests/owasp_llm_top10_2025_parser_test.py b/application/tests/owasp_llm_top10_2025_parser_test.py
index 2f2e8ccef..9a98fbcb4 100644
--- a/application/tests/owasp_llm_top10_2025_parser_test.py
+++ b/application/tests/owasp_llm_top10_2025_parser_test.py
@@ -8,6 +8,7 @@
 from application.database import db
 from application.defs import cre_defs as defs
 from application.prompt_client import prompt_client
+from application.utils import mapping_fixtures
 from application.utils.external_project_parsers.parsers import owasp_llm_top10_2025
 
 
@@ -25,13 +26,17 @@ def setUp(self) -> None:
         self.collection = db.Node_collection()
 
     def test_parse(self) -> None:
-        for cre_id, name in [
-            ("161-451", "Output encoding and injection prevention"),
-            ("064-808", "Encode output context-specifically"),
-            ("760-764", "Injection protection"),
-            ("623-550", "Denial Of Service protection"),
-        ]:
-            self.collection.add_cre(defs.CRE(id=cre_id, name=name, description=""))
+        # Seed the AI-topic hub CREs from the LLM mapping fixture (not classic web CREs).
+        gold = mapping_fixtures.load_owasp_mapping_fixture("owasp_llm_top10_2025")
+        seeded: set[str] = set()
+        for entry in gold:
+            for cre_id in entry["cre_ids"]:
+                if cre_id in seeded:
+                    continue
+                self.collection.add_cre(
+                    defs.CRE(id=cre_id, name=f"CRE {cre_id}", description="")
+                )
+                seeded.add(cre_id)
 
         result = owasp_llm_top10_2025.OwaspLlmTop10_2025().parse(
             self.collection, prompt_client.PromptHandler(database=self.collection)
@@ -42,8 +47,12 @@ def test_parse(self) -> None:
         self.assertEqual("LLM01", entries[0].sectionID)
         self.assertEqual("Prompt Injection", entries[0].section)
         self.assertEqual(
-            ["161-451", "760-764"], [link.document.id for link in entries[0].links]
+            ["012-625", "686-110"],
+            [link.document.id for link in entries[0].links],
+        )
+        self.assertEqual(
+            ["044-202", "780-757"],
+            [link.document.id for link in entries[4].links],
         )
-        self.assertEqual(["064-808"], [link.document.id for link in entries[4].links])
         self.assertEqual("LLM10", entries[-1].sectionID)
-        self.assertEqual(["623-550"], [link.document.id for link in entries[-1].links])
+        self.assertEqual(["230-318"], [link.document.id for link in entries[-1].links])
diff --git a/application/tests/owasp_mapping_fixtures_test.py b/application/tests/owasp_mapping_fixtures_test.py
index 491d43e65..ff91ab727 100644
--- a/application/tests/owasp_mapping_fixtures_test.py
+++ b/application/tests/owasp_mapping_fixtures_test.py
@@ -46,6 +46,62 @@ def test_load_unknown_fixture_raises(self) -> None:
             mapping_fixtures.load_owasp_mapping_fixture("not_a_real_mapping")
         self.assertIn("not_a_real_mapping.json", str(ctx.exception))
 
+    def test_asvs5_provisional_marks_gold_provenance(self) -> None:
+        entries = mapping_fixtures.load_owasp_mapping_fixture(
+            "owasp_asvs_5_0_provisional"
+        )
+        self.assertGreater(len(entries), 0)
+        for entry in entries:
+            prov = entry.get("gold_provenance")
+            self.assertIsInstance(prov, dict)
+            self.assertEqual(prov.get("kind"), "provisional")
+            self.assertTrue(prov.get("source_v4_section_ids"))
+
+    def test_llm_top10_uses_ai_topic_cres_not_classic(self) -> None:
+        """LLM gold must target AI-topic CREs (hub LLM Links / AI Exchange), not classic web CREs."""
+        entries = mapping_fixtures.load_owasp_mapping_fixture("owasp_llm_top10_2025")
+        self.assertEqual(10, len(entries))
+        classic_leak = {
+            "161-451",
+            "760-764",
+            "126-668",
+            "227-045",
+            "613-285",
+            "613-287",
+            "307-507",
+            "064-808",
+            "117-371",
+            "650-560",
+            "538-770",
+            "141-555",
+            "267-031",
+            "623-550",
+        }
+        hub_ai = {
+            "012-625",
+            "686-110",
+            "034-540",
+            "044-202",
+            "077-772",
+            "701-654",
+            "020-540",
+            "615-663",
+            "867-642",
+            "780-757",
+            "230-318",
+        }
+        for entry in entries:
+            with self.subTest(section=entry["section_id"]):
+                cre_ids = set(entry["cre_ids"])
+                self.assertTrue(cre_ids)
+                self.assertFalse(cre_ids & classic_leak)
+                prov = entry.get("gold_provenance") or {}
+                self.assertIn(prov.get("kind"), {"hub", "provisional"})
+        # Prompt injection must be the AI hub CREs shared with AI Exchange
+        llm01 = next(e for e in entries if e["section_id"] == "LLM01")
+        self.assertEqual(set(llm01["cre_ids"]), {"012-625", "686-110"})
+        self.assertTrue(set(llm01["cre_ids"]) <= hub_ai)
+
     def test_k8s_2025_uses_per_item_owasp_hyperlinks(self) -> None:
         # Data from #953 (Bornunique911): section pages, not the family homepage.
         entries = mapping_fixtures.load_owasp_mapping_fixture(
@@ -54,7 +110,8 @@ def test_k8s_2025_uses_per_item_owasp_hyperlinks(self) -> None:
         self.assertEqual(10, len(entries))
         self.assertEqual("K01", entries[0]["section_id"])
         self.assertIn("/2025/en/src/K01-", entries[0]["hyperlink"])
-        self.assertEqual(["233-748", "486-813"], entries[0]["cre_ids"])
+        # Promoted Related-orphan CREs follow the original direct mappings.
+        self.assertEqual(["233-748", "486-813"], entries[0]["cre_ids"][:2])
 
     def test_resolved_cre_ids_follow_fallback_when_own_ids_empty(self) -> None:
         by_id = {
diff --git a/application/utils/mapping_fixtures.py b/application/utils/mapping_fixtures.py
index 5c9d3d6cc..a21254588 100644
--- a/application/utils/mapping_fixtures.py
+++ b/application/utils/mapping_fixtures.py
@@ -4,6 +4,11 @@
 projects should link to OpenCRE so we can parse at the source; shipping
 hand-maintained CRE mappings as importers would make OpenCRE another
 spreadsheet. The exception is GSoC/OIE pipeline validation.
+
+Some rows expand orphan umbrella CREs (no Contains children) with their
+``Related`` graph neighbors into ``cre_ids``, keeping the authored ids in
+``cre_ids_original`` and tagging ``gold_remap: related_expand_orphan``.
+B2 grading treats the expanded ``cre_ids`` as the answer key.
 """
 
 from __future__ import annotations