This is an automated email from the ASF dual-hosted git repository.
vlsi pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/calcite.git
The following commit(s) were added to refs/heads/main by this push:
new 3c3f89badc Reduce AGENTS.md to a bare minimum, add CLAUDE.md
3c3f89badc is described below
commit 3c3f89badc9c9f48be8ca9adedb5fe2aae28ec68
Author: Vladimir Sitnikov <[email protected]>
AuthorDate: Mon Aug 24 16:16:08 2026 +0300
Reduce AGENTS.md to a bare minimum, add CLAUDE.md
AGENTS.md duplicated the security threat model and the SECURITY.md
triage rules in full, so the two copies could drift. Keep it to a
one-paragraph project description plus a link to SECURITY.md, which
already links to the threat model.
Claude Code reads CLAUDE.md rather than AGENTS.md by default; add it
as a bare @AGENTS.md import so the two stay in sync without
duplicating content, and list it in .ratignore alongside AGENTS.md
and SECURITY.md since it carries no license header either.
Docs only; no production code touched.
Co-Authored-By: Claude Sonnet 5 <[email protected]>
---
.ratignore | 1 +
AGENTS.md | 42 ++++--------------------------------------
CLAUDE.md | 1 +
3 files changed, 6 insertions(+), 38 deletions(-)
diff --git a/.ratignore b/.ratignore
index d42e5ca0fd..4ca565c47e 100644
--- a/.ratignore
+++ b/.ratignore
@@ -15,6 +15,7 @@
.idea/vcs.xml
SECURITY.md
AGENTS.md
+CLAUDE.md
example/csv/src/test/resources/smoke_test.sql
# TODO: remove when pom.xml files are removed
diff --git a/AGENTS.md b/AGENTS.md
index 67870438a7..fdc6278194 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,43 +1,9 @@
# Agent guidance
-This file is read by automated agents (security scanners, code analyzers,
-AI assistants) operating on this repository. It points them at the
-human-authored references they should consult before producing output.
+Apache Calcite is a dynamic data management framework. It provides a SQL
+parser and validator, a customizable cost-based optimizer, and relational
+algebra operators, without a storage engine of its own.
## Security
-Security model: [SECURITY.md](./SECURITY.md), which links to the project's
-threat model at
-[site/_docs/security_threat_model.md](./site/_docs/security_threat_model.md).
-
-Calcite is an embedded SQL framework, not a server. It opens no socket and
-has no authentication or authorization of its own; the host application
-owns transport, identity, and schema scoping. Read the threat model before
-reporting anything — it is explicit about what it does and does not treat
-as a vulnerability.
-
-Two rules carry most of the triage weight:
-
-- **Surprising vs unsurprising class loading.** A class named through a
- Calcite SPI position — `schemaFactory`, `parserFactory`, `typeSystem`,
- `metaTableFactory`, `metaColumnFactory`, `tableFactory`, function
- classes, `dataSource`, `jdbcDriver`, `model` — is loaded only through
- that SPI, gated by `Class.forName(name, false, loader)` plus an
- `isAssignableFrom` check. A class that does not implement the SPI for
- its position is never instantiated by name. SQL may name SPI classes,
- but only SPI implementations run, and only through their SPI.
-- **Pushed-down SQL.** The SQL Calcite generates and sends to a backend
- the operator configured is *not* a vulnerability — the query author can
- already reach that endpoint through the visible schemas. A pushdown bug
- that reads *beyond* the configured schemas is P4 and *is* one.
-
-Explicitly not vulnerabilities (see the model's "Not a vulnerability"
-section): the os-adapter running OS commands, the file/CSV/JSON adapters
-reading paths they were configured with, anything requiring a changed
-system property or classpath, a third-party driver's behaviour past the
-connection boundary, and cross-tenant reads that follow from the embedder
-exposing several principals' schemas on one connection.
-
-The model also lists what belongs to the host rather than the library —
-transport and identity, schema scoping, adapter selection, the classpath,
-and whatever a `model` points at — under "Downstream responsibilities".
+See [SECURITY.md](./SECURITY.md) before reporting a vulnerability.
diff --git a/CLAUDE.md b/CLAUDE.md
new file mode 100644
index 0000000000..43c994c2d3
--- /dev/null
+++ b/CLAUDE.md
@@ -0,0 +1 @@
[email protected]
