[jmanico]

Scope

1.01 research only. Completes the review tracked in #1109. No requirement, level, release metadata, or 1.0 changes.

Changes

• Source audit of every chapter and appendix research page. About 4,900 claims were checked against original sources; roughly 70% matched as written, and the rest were corrected, qualified, re-sourced, or removed. Each area's edits were re-verified in a separate pass that also spot-checked about 400 unchanged claims.
• Appendix B: the 14 pending statistics are resolved (4 checked, 7 corrected, 3 held). 28.3% is VulnCheck's Q1 2025 KEV figure, not Mandiant M-Trends 2026. 45:1 is CyberArk's 2022 survey and 144:1 is Entro Labs' H1 2025 telemetry. The ~250-document poisoning result is scoped to a narrow denial-of-service backdoor across the 600M–13B models tested. DoControl's 47% and ~67% and the blog-sourced "30+ MCP CVEs" are held. The snapshot now has 41 checked rows and 7 held entries, and corrected readings are applied wherever these figures recur.
• OWASP Top 10 for LLM Applications citations follow the 2026 edition adopted in Update LLM Top 10 references to the 2026 edition #1182, including LLM08:2026 Hidden Context Exposure.
• EU AI Act dates follow Regulation (EU) 2026/1744 (Digital Omnibus on AI; OJ 24 July 2026, in force 27 July 2026; Annex III high-risk obligations from 2 December 2027, Annex I from 2 August 2028).
• C12-01 prose no longer attributes tiered logging, content exclusion, or extra field sets to 12.1.2 and 12.1.3; that material is now framed as implementation guidance.
• Four CVE IDs cited as published are reserved with no record (CVE-2026-33224, CVE-2025-61510, CVE-2026-26390, CVE-2025-69898); the text now says so.
• Colorado AI Act references now reflect SB 26-189 (signed May 14, 2026), which repealed and re-enacted the Act as a narrower automated decision-making law effective January 1, 2027.
• CVE-2026-32211 descriptions in C09 now follow Microsoft's advisory (Azure MCP Server information disclosure, CWE-306, cloud service, no customer action) instead of write-ups that conflated it with @azure-devops/mcp.
• Examples of other corrections: GitGuardian's 33,185 secrets belong to Shai-Hulud, not LiteLLM; a statement attributed to a Hive Security article does not appear there and was removed; the INT8 quantization result was restated to match the paper's scope.
• Appendix A term table now includes Action Chain and Reversibility Classification (158 rows, matching the glossary).
• Research README: eight broken section anchors fixed; dates updated.
• REVIEW-STATUS.md: close-out record, per-area counts, and known limitations.

Validation

• Requirement rows: no text, ID, or level differences from 1.01-dev/en or main across 48 pages; headers and ID ranges match (213 core, 69 Appendix C).
• Links: 552 relative links and anchors resolve (main had 8 broken README anchors). New external URLs are well formed, and sampled fetches resolve.
• markdownlint: no new findings relative to main. New cspell words are proper nouns and identifiers; the research folder is outside CI's spell check.
• git diff --check is clean.

Known limitations

See REVIEW-STATUS.md. In short: "checked" means a claim matched the publisher's own material, not independent validation; some publishers blocked retrieval (ISO, NSA, OpenAI, Gartner, OpenReview); vendor tool-table rows and paper body figures were sampled; CVSS conflicts between CNA, NVD, and GitHub are recorded rather than resolved; mid-2026 "as of" statements were not re-surveyed; about 350 claims remain unresolved for post-1.01 review.