This is an automated email from the ASF dual-hosted git repository.
luigidemasi pushed a change to branch main
in repository https://gitbox.apache.org/repos/asf/camel-kit.git
from 71088a98 Bump org.json:json from 20250107 to 20260719 in /knowledge
new d08f5e65 Fix #5: Add security model and threat model documentation
new 645076fe Fix #5: Address review feedback on the security model
new 6dd453e5 docs: align the security model with the monorepo layout
new e0d5c7af Fix #5: Align the security model with the maintainer answers
and the Knowledge product
new 87a75eff Fix #5: Triage breaches through the Claude grant on their
impact; qualify the Pi and Knowledge inventory rows
new af494979 Fix #5: preserve security-model YAML decisions
new 778d73a2 Fix #153: verify all graph parsers read sources without
execution
new d9ed93e3 Fix #154: confine and bound graph parser inputs and deadlines
new 5f1afccd Fix #155: grant only manifest-listed Claude MCP tools
new b92c3b4a Fix #157: confine generated writes and catalog extraction
new b74727c3 Fix #158: verify Knowledge boundaries and enforce offline
models
new 6f642fb3 Fix #156: verify and correct the process side-effect inventory
The 12 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.../ISSUE_TEMPLATE/config.yml | 26 +-
CHANGELOG.md | 24 +
CLAUDE.md | 16 +
CONTRIBUTING.md | 28 +
README.md | 4 +
SECURITY.md | 71 ++
docs/agent-architectures.md | 4 +
docs/architecture.md | 37 +
docs/modules/ROOT/pages/agents.adoc | 19 +
docs/modules/ROOT/pages/graph.adoc | 19 +
docs/modules/ROOT/pages/knowledge.adoc | 23 +
docs/security-model.md | 1124 ++++++++++++++++++++
docs/security-model.yaml | 647 +++++++++++
docs/security-verification.md | 171 +++
kit/README.md | 5 +
.../camel/kit/catalog/CatalogDownloader.java | 5 +
.../camel/kit/catalog/CitrusSchemaDownloader.java | 20 +-
.../camel/kit/catalog/CitrusSchemaProcessor.java | 6 +-
.../camel/kit/generator/AgentsMdGenerator.java | 3 +-
.../camel/kit/generator/AntigravityGenerator.java | 15 +-
.../camel/kit/generator/AtomicFileWriter.java | 45 +-
.../camel/kit/generator/ClaudeGenerator.java | 13 +-
.../apache/camel/kit/generator/CodexGenerator.java | 29 +-
.../camel/kit/generator/CommandStubGenerator.java | 3 +-
.../camel/kit/generator/CopilotGenerator.java | 2 +-
.../camel/kit/generator/DispatchBlockAppender.java | 2 +-
.../kit/generator/GeneratedAssetPreflight.java | 39 +
.../camel/kit/generator/McpConfigGenerator.java | 2 +-
.../camel/kit/generator/OpenCodeGenerator.java | 2 +-
.../kit/generator/PersonaResourceInstaller.java | 2 +-
.../apache/camel/kit/generator/PiGenerator.java | 2 +-
.../apache/camel/kit/generator/QwenGenerator.java | 2 +-
.../kit/generator/SkillResourceInstaller.java | 6 +-
.../kit/generator/TemplateResourceCopier.java | 2 +-
.../camel/kit/generator/TraitApplicator.java | 2 +-
.../kit/generator/VersionPlaceholderResolver.java | 2 +-
.../camel/kit/service/ForageCatalogService.java | 11 +
.../org/apache/camel/kit/service/InitService.java | 74 +-
.../org/apache/camel/kit/util/ConfinedPaths.java | 50 +
.../main/resources/templates/claude/settings.json | 5 +-
.../camel/kit/catalog/CatalogDownloaderTest.java | 28 +
.../kit/catalog/CitrusSchemaDownloaderTest.java | 252 +++++
.../camel/kit/generator/AtomicFileWriterTest.java | 46 +
.../camel/kit/generator/ClaudeGeneratorTest.java | 22 +
.../camel/kit/generator/CodexGeneratorTest.java | 4 +-
.../kit/generator/ResourceConsistencyTest.java | 22 +
.../kit/service/ForageCatalogConfinementTest.java | 96 ++
.../kit/service/InitWriteConfinementTest.java | 154 +++
kit/camel-kit-graph/pom.xml | 6 +
.../org/apache/camel/kit/graph/GraphBuilder.java | 42 +-
.../camel/kit/graph/parser/BizTalkParser.java | 21 +-
.../camel/kit/graph/parser/ConfigParser.java | 4 +-
.../camel/kit/graph/parser/DataWeaveParser.java | 4 +-
.../apache/camel/kit/graph/parser/GraphParser.java | 123 ++-
.../camel/kit/graph/parser/GroovyGraphParser.java | 5 +-
.../camel/kit/graph/parser/JavaGraphParser.java | 5 +-
.../camel/kit/graph/parser/MuleXmlFlowParser.java | 19 +-
.../apache/camel/kit/graph/parser/PomParser.java | 6 +-
.../camel/kit/graph/parser/XmlRouteParser.java | 22 +-
.../camel/kit/graph/parser/YamlRouteParser.java | 3 +-
.../graph/parser/biztalk/BizTalkBindingParser.java | 4 +-
.../kit/graph/parser/biztalk/BizTalkBtmParser.java | 4 +-
.../kit/graph/parser/biztalk/BizTalkBtpParser.java | 4 +-
.../kit/graph/parser/biztalk/BizTalkOdxParser.java | 3 +-
.../camel/kit/graph/GraphInputBoundaryTest.java | 302 ++++++
.../parser/ParserSourceReadingContractTest.java | 324 ++++++
.../test/java/source/contract/ProjectAction.java | 12 +
.../kit/knowledge/embedding/OfflineTokenizer.java | 36 +
.../knowledge/embedding/OnnxEmbeddingProvider.java | 2 +-
.../kit/knowledge/embedding/OnnxReranker.java | 2 +-
.../kit/knowledge/mcp/LuceneSearchService.java | 12 +-
.../knowledge/mcp/IndexArchiveConfinementTest.java | 130 +++
.../knowledge/mcp/KnowledgeInputBoundaryTest.java | 191 ++++
.../knowledge/mcp/LuceneFallbackBoundaryTest.java | 191 ++++
.../camel/kit/knowledge/mcp/OfflineModelsTest.java | 237 +++++
tools/FixtureIndex.java | 21 +
tools/verify_claude_mcp_permissions.py | 272 +++++
tools/verify_knowledge_runtime.py | 311 ++++++
78 files changed, 5330 insertions(+), 174 deletions(-)
copy docs/antora.yml => .github/ISSUE_TEMPLATE/config.yml (57%)
create mode 100644 SECURITY.md
create mode 100644 docs/security-model.md
create mode 100644 docs/security-model.yaml
create mode 100644 docs/security-verification.md
create mode 100644
kit/camel-kit-core/src/main/java/org/apache/camel/kit/generator/GeneratedAssetPreflight.java
create mode 100644
kit/camel-kit-core/src/main/java/org/apache/camel/kit/util/ConfinedPaths.java
create mode 100644
kit/camel-kit-core/src/test/java/org/apache/camel/kit/catalog/CitrusSchemaDownloaderTest.java
create mode 100644
kit/camel-kit-core/src/test/java/org/apache/camel/kit/generator/AtomicFileWriterTest.java
create mode 100644
kit/camel-kit-core/src/test/java/org/apache/camel/kit/service/ForageCatalogConfinementTest.java
create mode 100644
kit/camel-kit-core/src/test/java/org/apache/camel/kit/service/InitWriteConfinementTest.java
create mode 100644
kit/camel-kit-graph/src/test/java/org/apache/camel/kit/graph/GraphInputBoundaryTest.java
create mode 100644
kit/camel-kit-graph/src/test/java/org/apache/camel/kit/graph/parser/ParserSourceReadingContractTest.java
create mode 100644
kit/camel-kit-graph/src/test/java/source/contract/ProjectAction.java
create mode 100644
knowledge/embedding/src/main/java/org/apache/camel/kit/knowledge/embedding/OfflineTokenizer.java
create mode 100644
knowledge/mcp/src/test/java/org/apache/camel/kit/knowledge/mcp/IndexArchiveConfinementTest.java
create mode 100644
knowledge/mcp/src/test/java/org/apache/camel/kit/knowledge/mcp/KnowledgeInputBoundaryTest.java
create mode 100644
knowledge/mcp/src/test/java/org/apache/camel/kit/knowledge/mcp/LuceneFallbackBoundaryTest.java
create mode 100644
knowledge/mcp/src/test/java/org/apache/camel/kit/knowledge/mcp/OfflineModelsTest.java
create mode 100644 tools/FixtureIndex.java
create mode 100644 tools/verify_claude_mcp_permissions.py
create mode 100644 tools/verify_knowledge_runtime.py
