This is an automated email from the ASF dual-hosted git repository.
luigidemasi pushed a change to branch docs/5-security-model
in repository https://gitbox.apache.org/repos/asf/camel-kit.git
from 4d1b97ef Merge main and preserve security-model YAML decisions
add 17cb5c82 Fix #153: verify all graph parsers read sources without
execution
add 666a1c69 Fix #154: confine and bound graph parser inputs and deadlines
add a649d6d9 Fix #155: grant only manifest-listed Claude MCP tools
add 968b47b2 Fix #157: confine generated writes and catalog extraction
add a65a37be Fix #158: verify Knowledge boundaries and enforce offline
models
add c13a27b1 Fix #156: verify and correct the process side-effect inventory
No new revisions were added by this update.
Summary of changes:
CHANGELOG.md | 18 ++
docs/agent-architectures.md | 4 +
docs/modules/ROOT/pages/agents.adoc | 19 ++
docs/modules/ROOT/pages/graph.adoc | 19 ++
docs/modules/ROOT/pages/knowledge.adoc | 23 ++
docs/security-model.md | 299 ++++++++++---------
docs/security-model.yaml | 83 +++---
docs/security-verification.md | 171 +++++++++++
.../camel/kit/catalog/CatalogDownloader.java | 5 +
.../camel/kit/catalog/CitrusSchemaDownloader.java | 20 +-
.../camel/kit/catalog/CitrusSchemaProcessor.java | 6 +-
.../camel/kit/generator/AgentsMdGenerator.java | 3 +-
.../camel/kit/generator/AntigravityGenerator.java | 15 +-
.../camel/kit/generator/AtomicFileWriter.java | 45 ++-
.../camel/kit/generator/ClaudeGenerator.java | 13 +-
.../apache/camel/kit/generator/CodexGenerator.java | 29 +-
.../camel/kit/generator/CommandStubGenerator.java | 3 +-
.../camel/kit/generator/CopilotGenerator.java | 2 +-
.../camel/kit/generator/DispatchBlockAppender.java | 2 +-
.../kit/generator/GeneratedAssetPreflight.java | 39 +++
.../camel/kit/generator/McpConfigGenerator.java | 2 +-
.../camel/kit/generator/OpenCodeGenerator.java | 2 +-
.../kit/generator/PersonaResourceInstaller.java | 2 +-
.../apache/camel/kit/generator/PiGenerator.java | 2 +-
.../apache/camel/kit/generator/QwenGenerator.java | 2 +-
.../kit/generator/SkillResourceInstaller.java | 6 +-
.../kit/generator/TemplateResourceCopier.java | 2 +-
.../camel/kit/generator/TraitApplicator.java | 2 +-
.../kit/generator/VersionPlaceholderResolver.java | 2 +-
.../camel/kit/service/ForageCatalogService.java | 11 +
.../org/apache/camel/kit/service/InitService.java | 74 ++---
.../org/apache/camel/kit/util/ConfinedPaths.java | 50 ++++
.../main/resources/templates/claude/settings.json | 5 +-
.../camel/kit/catalog/CatalogDownloaderTest.java | 28 ++
.../kit/catalog/CitrusSchemaDownloaderTest.java | 252 ++++++++++++++++
.../camel/kit/generator/AtomicFileWriterTest.java | 46 +++
.../camel/kit/generator/ClaudeGeneratorTest.java | 22 ++
.../camel/kit/generator/CodexGeneratorTest.java | 4 +-
.../kit/service/ForageCatalogConfinementTest.java | 96 ++++++
.../kit/service/InitWriteConfinementTest.java | 154 ++++++++++
kit/camel-kit-graph/pom.xml | 6 +
.../org/apache/camel/kit/graph/GraphBuilder.java | 42 ++-
.../camel/kit/graph/parser/BizTalkParser.java | 21 +-
.../camel/kit/graph/parser/ConfigParser.java | 4 +-
.../camel/kit/graph/parser/DataWeaveParser.java | 4 +-
.../apache/camel/kit/graph/parser/GraphParser.java | 123 +++++++-
.../camel/kit/graph/parser/GroovyGraphParser.java | 5 +-
.../camel/kit/graph/parser/JavaGraphParser.java | 5 +-
.../camel/kit/graph/parser/MuleXmlFlowParser.java | 19 +-
.../apache/camel/kit/graph/parser/PomParser.java | 6 +-
.../camel/kit/graph/parser/XmlRouteParser.java | 22 +-
.../camel/kit/graph/parser/YamlRouteParser.java | 3 +-
.../graph/parser/biztalk/BizTalkBindingParser.java | 4 +-
.../kit/graph/parser/biztalk/BizTalkBtmParser.java | 4 +-
.../kit/graph/parser/biztalk/BizTalkBtpParser.java | 4 +-
.../kit/graph/parser/biztalk/BizTalkOdxParser.java | 3 +-
.../camel/kit/graph/GraphInputBoundaryTest.java | 302 +++++++++++++++++++
.../parser/ParserSourceReadingContractTest.java | 324 +++++++++++++++++++++
.../test/java/source/contract/ProjectAction.java | 12 +
.../kit/knowledge/embedding/OfflineTokenizer.java | 36 +++
.../knowledge/embedding/OnnxEmbeddingProvider.java | 2 +-
.../kit/knowledge/embedding/OnnxReranker.java | 2 +-
.../kit/knowledge/mcp/LuceneSearchService.java | 12 +-
.../knowledge/mcp/IndexArchiveConfinementTest.java | 130 +++++++++
.../knowledge/mcp/KnowledgeInputBoundaryTest.java | 191 ++++++++++++
.../knowledge/mcp/LuceneFallbackBoundaryTest.java | 191 ++++++++++++
.../camel/kit/knowledge/mcp/OfflineModelsTest.java | 237 +++++++++++++++
tools/FixtureIndex.java | 21 ++
tools/verify_claude_mcp_permissions.py | 272 +++++++++++++++++
tools/verify_knowledge_runtime.py | 311 ++++++++++++++++++++
70 files changed, 3569 insertions(+), 331 deletions(-)
create mode 100644 docs/security-verification.md
create mode 100644
kit/camel-kit-core/src/main/java/org/apache/camel/kit/generator/GeneratedAssetPreflight.java
create mode 100644
kit/camel-kit-core/src/main/java/org/apache/camel/kit/util/ConfinedPaths.java
create mode 100644
kit/camel-kit-core/src/test/java/org/apache/camel/kit/catalog/CitrusSchemaDownloaderTest.java
create mode 100644
kit/camel-kit-core/src/test/java/org/apache/camel/kit/generator/AtomicFileWriterTest.java
create mode 100644
kit/camel-kit-core/src/test/java/org/apache/camel/kit/service/ForageCatalogConfinementTest.java
create mode 100644
kit/camel-kit-core/src/test/java/org/apache/camel/kit/service/InitWriteConfinementTest.java
create mode 100644
kit/camel-kit-graph/src/test/java/org/apache/camel/kit/graph/GraphInputBoundaryTest.java
create mode 100644
kit/camel-kit-graph/src/test/java/org/apache/camel/kit/graph/parser/ParserSourceReadingContractTest.java
create mode 100644
kit/camel-kit-graph/src/test/java/source/contract/ProjectAction.java
create mode 100644
knowledge/embedding/src/main/java/org/apache/camel/kit/knowledge/embedding/OfflineTokenizer.java
create mode 100644
knowledge/mcp/src/test/java/org/apache/camel/kit/knowledge/mcp/IndexArchiveConfinementTest.java
create mode 100644
knowledge/mcp/src/test/java/org/apache/camel/kit/knowledge/mcp/KnowledgeInputBoundaryTest.java
create mode 100644
knowledge/mcp/src/test/java/org/apache/camel/kit/knowledge/mcp/LuceneFallbackBoundaryTest.java
create mode 100644
knowledge/mcp/src/test/java/org/apache/camel/kit/knowledge/mcp/OfflineModelsTest.java
create mode 100644 tools/FixtureIndex.java
create mode 100644 tools/verify_claude_mcp_permissions.py
create mode 100644 tools/verify_knowledge_runtime.py
