This is an automated email from the ASF dual-hosted git repository.
luigidemasi pushed a change to branch docs/5-security-model
in repository https://gitbox.apache.org/repos/asf/camel-kit.git
from a32966fe Fix #5: Triage breaches through the Claude grant on their
impact; qualify the Pi and Knowledge inventory rows
add 011ff80f Fix #137: require https (or loopback http) for remote
knowledge index URIs
add ac688d44 Fix #137: validate every redirect hop's transport before
following it
add 30a7a2a2 Fix #137: preserve If-None-Match across validated redirect
hops
add 9f3a3e7c Fix #139: use SnakeYAML SafeConstructor in the indexer
add 909ac085 Fix #139: correct SafeConstructor rationale and add
global-tag regression tests
add e0f10e47 Fix #139: also cover the verbose !<tag:...> global-tag form
in tests
add 11c575fe fix #147: pin the Camel version in the generated run.sh
add 4edcf09f fix #147: keep the project version token through skill
installation
add e1566e2e fix #100: add Pi execution and run-state compatibility
verification
add d449ffde fix #100: exercise production coordinator submit and guard Pi
against backend injection
add 619cd532 fix #100: handle Pi markdown-wrapped stage JSON in
ShipStageResult parser
add 611c40cd fix #100: update changelog with parser fix and live
certification result
add a5f68b1d fix#100: harden ShipStageResult parser against
fenced-envelope and size-bypass regressions
add 2551c69c fix #100: reject conflicting fenced JSON envelopes explicitly
add 2cd0f0e3 fix #100: reject mixed fenced/bare envelopes and null-padded
array wrappers
add 4b529080 fix #100: bound fence search to linear scan and reject
inline-brace false positives
add e22d9520 fix #100: eliminate quadratic scan paths and same-line bare
correction regression
add 49161b00 fix #100: reject inline-backtick-wrapped stage-result
envelopes
add f29378fb fix #100: parse inline backtick spans with Jackson to detect
escaped envelope keys
add 80f57109 fix #100: fail-closed on malformed inline JSON and
array-wrapped envelopes
add e57a4374 fix #99: OpenCode native Ship backend
add ad749a39 fix: fail-closed collision, global config, ASCII normalization
add d94ec8f4 fix: ancestor/explicit config enumeration, native type-named
server
add 055fe0c6 fix: add global config regression tests
add d98f170f fix #99:inline config content, safe ancestor test,
generation-path tests
add f2b151be fix #99: custom-dir/managed config, fail-closed on
substitutions
add 42acfe14 fix #99: scan raw config for substitutions, platform-specific
managed dir
add 065448c1 fix #99: scan raw config for substitutions, platform-specific
managed dir
add 6193b4f4 fix #99: fail closed on unparsable MCP config, honor
ProgramData and macOS managed preferences
add 7b576f7e fix #99: remove stale Ship worker when project config
validation or merge aborts
add a2a4293d fix #99: docs: align ship.adoc OpenCode entry with final
worker lifecycle and fallback
add 2863e915 fix #99: invalidate Ship worker on any rejected project
config, never through symlinks
add 4d1b97ef Merge main and preserve security-model YAML decisions
No new revisions were added by this update.
Summary of changes:
CHANGELOG.md | 21 +
docs/commands.md | 4 +-
docs/modules/ROOT/pages/agents.adoc | 7 +
docs/modules/ROOT/pages/ship.adoc | 26 +-
docs/security-model.yaml | 14 +-
.../apache/camel/kit/command/ship/ShipCommand.java | 5 +-
.../camel/kit/generator/OpenCodeGenerator.java | 337 +++++++-
.../kit/generator/SkillResourceInstaller.java | 3 +-
.../kit/ship/controller/ShipNativeWorker.java | 1 -
.../apache/camel/kit/ship/controller/ShipRun.java | 3 +-
.../camel/kit/ship/controller/ShipStageResult.java | 155 +++-
.../main/resources/agents/registry/opencode.yaml | 2 +
.../skills/camel-implement/guides/orchestrator.md | 2 +-
.../skills/camel-implement/guides/run-script.md | 10 +-
.../camel-plan/guides/task-template-greenfield.md | 7 +-
.../main/resources/templates/dispatch/opencode.md | 9 +-
.../templates/opencode/agents/brainstormer.md | 2 +-
.../templates/opencode/agents/camel-ship-worker.md | 23 +
.../templates/opencode/agents/executor.md | 2 +-
.../templates/opencode/agents/implementer.md | 2 +-
.../templates/opencode/agents/migrator.md | 2 +-
.../resources/templates/opencode/agents/planner.md | 2 +-
.../templates/opencode/agents/researcher.md | 2 +-
.../templates/opencode/agents/reviewer.md | 2 +-
.../resources/templates/opencode/agents/tester.md | 2 +-
.../templates/opencode/agents/validator.md | 2 +-
.../templates/{qwen => opencode}/camel-ship.md | 37 +-
.../traits/opencode/camel-execute.append.md | 4 +-
.../camel-execute/implementer-context.append.md | 2 +-
.../traits/opencode/camel-knowledge.append.md | 2 +-
.../camel/kit/command/ship/ShipCommandTest.java | 83 +-
.../camel/kit/generator/OpenCodeGeneratorTest.java | 843 ++++++++++++++++++++-
.../kit/generator/ResourceConsistencyTest.java | 64 ++
.../kit/generator/ShippedAssetStructureTest.java | 74 +-
.../apache/camel/kit/service/InitServiceTest.java | 48 ++
.../ship/controller/OpenCodeNativeWorkerTest.java | 15 +
.../kit/ship/controller/ShipCoordinatorTest.java | 14 +
.../kit/ship/controller/ShipRunStoreTest.java | 15 +
.../camel/kit/ship/controller/ShipRunTest.java | 3 +-
.../kit/ship/controller/ShipStageResultTest.java | 199 +++++
.../kit/knowledge/indexer/VersionResolver.java | 6 +-
.../kit/knowledge/indexer/parser/CveParser.java | 6 +-
.../kit/knowledge/indexer/VersionResolverTest.java | 29 +
.../knowledge/indexer/parser/CveParserTest.java | 35 +
.../camel/kit/knowledge/mcp/IndexDownloader.java | 87 ++-
.../kit/knowledge/mcp/IndexDownloaderTest.java | 196 +++++
46 files changed, 2308 insertions(+), 101 deletions(-)
create mode 100644
kit/camel-kit-core/src/main/resources/templates/opencode/agents/camel-ship-worker.md
copy kit/camel-kit-core/src/main/resources/templates/{qwen =>
opencode}/camel-ship.md (72%)
create mode 100644
kit/camel-kit-core/src/test/java/org/apache/camel/kit/ship/controller/OpenCodeNativeWorkerTest.java
