Feature: NestBot /ai — route security questions to OpenCRE (keep community RAG local)

Community & Support: [LinkedIn Group](https://www.linkedin.com/groups/14656108/) · [Slack #project-nest](https://owasp.slack.com/archives/project-nest)

Active project leaders: Arkadii Yakovets -- [GitHub](https://github.com/arkid15r/) · [LinkedIn](https://www.linkedin.com/in/arkid15r/) · [Slack](https://owasp.slack.com/team/U060W3NKLTF); Kate Golovanova -- [GitHub](https://github.com/kasya/) · [LinkedIn](https://www.linkedin.com/in/kate-golovanova/) · [Slack](https://owasp.slack.com/team/U07PWB1JZ6Z)

[Contributing](https://github.com/owasp/nest/blob/main/CONTRIBUTING.md) · [Code of Conduct](https://github.com/owasp/nest/blob/main/CODE_OF_CONDUCT.md)

---

cc @arkid15r @kasya

Opened by OpenCRE (@northdpole). Epic: https://github.com/OWASP/OpenCRE/issues/1072
OpenCRE will expose a cited ask API for you: https://github.com/OWASP/OpenCRE/issues/1074
OpenCRE MCP v1 (lookup/search GETs) already exists: https://github.com/OWASP/OpenCRE/issues/1003

**Is your feature request related to a problem? Please describe.**

NestBot `/ai` (`apps/slack/common/handlers/ai.py` → `AgenticRAGAgent`) retrieves chunks typed `chapter | committee | event | message | project`. Project extractors use **description, summary, tags, stats** — not ASVS / Top 10 / Cheat Sheet body text.

The `/ai` help examples include “What are the OWASP Top 10 vulnerabilities?” and Slack keywords include cheat sheets, CSRF, injection, Top 10. Those questions will be answered from project cards unless we route them.

OpenCRE already has the graph + embeddings for that class of question. We should not compete; NestBot should **call OpenCRE** when the intent is normative.

**Describe the solution you'd like**

1. Intent split (same as OpenCRE’s router, inverted):
- **Community** (chapter, event, contribute, GSoC, “what is project X”) → existing Nest RAG / Algolia
- **Security knowledge** (controls, ASVS, Top 10, CWE, how do I store passwords) → OpenCRE
2. Phase 1: HTTP to OpenCRE public REST (`text_search`, `GET /rest/v1/id/{creid}`, `GET /rest/v1/standards`). Phase 1.5: cited `ask` once https://github.com/OWASP/OpenCRE/issues/1074 lands (answer + CRE/standard URLs).
3. Show OpenCRE citations in Slack (CRE id + link), do not mention “context”.
4. If OpenCRE is down / insufficient_context, say so — do not fill from project metadata as if it were ASVS.

**Describe alternatives you've considered**

- Embedding full standard markdown into Nest `ai_chunks` — duplicates OpenCRE harvest/librarian and diverges.
- Pointing users at opencre.org with no API — worse UX than NestBot staying the Slack front door.

**Are you going to work on implementing this?**

- [x] Yes
- [ ] No — proposing for NestBot; OpenCRE will ship the cited ask contract on our side

**Additional context**

- Nest RAG: `backend/src/apps/ai/agent/` (LangGraph retrieve → generate → evaluate)
- OpenCRE REST: https://www.opencre.org/rest/v1/ · OpenAPI in OpenCRE `docs/api/openapi.yaml`
- We want the November “OWASP Agent” demo to be **NestBot + OpenCRE**, not a second bot

Start with apps/slack/common/handlers/ai.py and AgenticRAGAgent, then trace backend/src/apps/ai/agent/ and its retrieve → generate → evaluate flow. Review OpenCRE’s REST documentation and OpenAPI contract first; done means community questions still use Nest RAG, normative security questions use OpenCRE with CRE citations, and failures report insufficient availability without substituting project metadata.

Written by the indexing model from the issue text.