This is an automated email from the ASF dual-hosted git repository. luigidemasi pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/camel-kit.git
commit af4949796f6efba0b1a704291fa237363f6280da Author: Luigi De Masi <[email protected]> AuthorDate: Tue Nov 10 13:42:57 2026 +0100 Fix #5: preserve security-model YAML decisions Quote the seven YAML values whose issue references were interpreted as comments, and retain the parsed-content regression. Preserve both changelog entries from the original merge resolution. Co-authored-by: OpenAI Codex <[email protected]> --- CHANGELOG.md | 12 ++++++------ docs/security-model.yaml | 14 +++++++------- .../kit/generator/ResourceConsistencyTest.java | 22 ++++++++++++++++++++++ 3 files changed, 35 insertions(+), 13 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 8fdeca0c..12e39c0d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -31,6 +31,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 `--backend qwen-native` reuses the native task/result, recovery, oversight and deterministic publication contract while preserving Qwen's named-agent dispatch model. Dispatch never uses `fork` or `fork_turns`. Fresh and regenerated workspaces receive the native skill and worker; runs retain their recorded host. +- **Security model and threat model (apache/camel-kit#5)** — `SECURITY.md` with the Apache Software Foundation + reporting process, `docs/security-model.md` covering the Kit and Knowledge products (trust roles, component + families, trust boundaries, per-process side-effect inventory, claimed and disclaimed properties, known + non-findings, triage dispositions, maintainer answers and verification items) as the additive + sub-project expansion of the Apache Camel Security Model, and the derived `docs/security-model.yaml` sidecar + for automated triage. README, CONTRIBUTING, CLAUDE.md and a GitHub issue-template contact link point to them. - **OpenCode native Ship (#99)** — eligible sessions relay controller-issued stages through a dedicated `camel-ship-worker` agent via OpenCode's `subagent` tool (`agent` argument). The worker denies `edit`, `write`, `bash`, `notebook`, `subagent` and `mcp`, and inherits read access, per-path restrictions and external-directory @@ -45,12 +51,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 `--backend opencode-native` reuses the native task/result, recovery, oversight and deterministic publication contract. Fresh and regenerated workspaces receive the native skill, worker and command stub; runs retain their recorded host. -- **Security model and threat model (apache/camel-kit#5)** — `SECURITY.md` with the Apache Software Foundation - reporting process, `docs/security-model.md` covering the Kit and Knowledge products (trust roles, component - families, trust boundaries, per-process side-effect inventory, claimed and disclaimed properties, known - non-findings, triage dispositions, maintainer answers and verification items) as the additive - sub-project expansion of the Apache Camel Security Model, and the derived `docs/security-model.yaml` sidecar - for automated triage. README, CONTRIBUTING, CLAUDE.md and a GitHub issue-template contact link point to them. - **OpenAI Codex CLI native Ship (#225)** — eligible sessions relay controller-issued stages through the dedicated `camel_ship_worker` custom agent with `sandbox_mode = "read-only"` and instruction-level restrictions. `--backend codex-native` reuses the native task/result, recovery, oversight and deterministic publication contract diff --git a/docs/security-model.yaml b/docs/security-model.yaml index aad204b1..f92d08a3 100644 --- a/docs/security-model.yaml +++ b/docs/security-model.yaml @@ -20,7 +20,7 @@ repository_layout_commit: 9c8173cb revised_at_commit: a19d0529 date: "2026-10-22" last_review_round: "2026-10-27" -status: draft - policy ratified 2026-10-27; acceptance pending verification items V1-V6 (tracked in #153-#158); revised 2026-11-02 after review round 3 +status: "draft - policy ratified 2026-10-27; acceptance pending verification items V1-V6 (tracked in #153-#158); revised 2026-11-02 after review round 3" canonical: docs/security-model.md umbrella_model: https://camel.apache.org/manual/security-model.html reporting: @@ -304,7 +304,7 @@ claimed_properties: property: Ship controller alone writes run state, commits transitions and decides what is accepted and published. Native backends - proposals written only for the approved route and test paths, pom.xml and .camel-kit/config.properties, after a known-secret scan; other paths rejected (ShipNativeWorker.applyProposals). Pi backend (default) - the worker edits the staged candidate directly; acceptance through tree policy, artifact validation (manifest, declared routes and tests, pom poli [...] violation_symptom: Worker output changes a stage, pause or publication decision; a native proposal is written outside the approved set or without the secret check; a Pi candidate is accepted despite a tree-policy denial, a failing artifact or launch-surface check, or a verbatim secret; published tree differs from the validated candidate; torn publication left unrecovered. severity: security-critical - provenance: documented (docs/commands.md, docs/ship-native.md, ShipNativeWorker, ArtifactValidator, ShipCamelMainBootstrap.validateLaunchSurface, ShipPublicationService); Pi acceptance and extra material files - maintainer, 2026-10-22 (review of #6) and 2026-10-27 (Q8) + provenance: "documented (docs/commands.md, docs/ship-native.md, ShipNativeWorker, ArtifactValidator, ShipCamelMainBootstrap.validateLaunchSurface, ShipPublicationService); Pi acceptance and extra material files - maintainer, 2026-10-22 (review of #6) and 2026-10-27 (Q8)" - id: P6 property: Ship tree policy - denied credential and state paths, protected and volatile classes, rejection of symlinks, hard links and special files, quotas (20000 entries, 64 MiB per file, 1 GiB aggregate, depth 128, 4096-char paths). violation_symptom: Denied path enters a snapshot, workspace, prompt or publication; a link is followed. @@ -327,9 +327,9 @@ claimed_properties: provenance: documented (ShipExpressionPolicy) - id: P10 property: Generated harness assets carry the accepted least-privilege posture - read-only Ship workers, read-only Codex roles, Copilot deny hook, Pi guard policy, no HTTP port for the Camel and Citrus MCP servers, and MCP grants aligned with the manifest allowed_tools (no runtime mutation or control tools) - as availability filters for Codex (enabled_tools), Copilot (tools), Pi (directTools) and Qwen (includeTools), as Bob 2's auto-approval list, with Codex, Copilot, Qwen and OpenCod [...] - violation_symptom: Generated asset grants more than the accepted posture - a worker with edit or shell tools, a filter or auto-approval list containing a tool outside the manifest allowed_tools, a prompt-mode target generated with auto-approval, a hook or guard that fails open on a documented pattern. The known Claude wildcard pre-approval is a documented deviation, not a breach - a report that only restates it is tracked under V3 (#155) as VALID-HARDENING until the template changes; [...] + violation_symptom: "Generated asset grants more than the accepted posture - a worker with edit or shell tools, a filter or auto-approval list containing a tool outside the manifest allowed_tools, a prompt-mode target generated with auto-approval, a hook or guard that fails open on a documented pattern. The known Claude wildcard pre-approval is a documented deviation, not a breach - a report that only restates it is tracked under V3 (#155) as VALID-HARDENING until the template changes [...] severity: hardening; security-critical when the widened grant reaches a credential or destructive action without a prompt - provenance: documented (docs/agent-architectures.md, docs/ship-claude.md, docs/ship-native.md, templates/mcp-configs/*, templates/claude/settings.json, Claude Code permissions reference); current Claude grant - maintainer, 2026-10-22 (review of #6); accepted posture - maintainer, 2026-10-27 (Q3) + provenance: "documented (docs/agent-architectures.md, docs/ship-claude.md, docs/ship-native.md, templates/mcp-configs/*, templates/claude/settings.json, Claude Code permissions reference); current Claude grant - maintainer, 2026-10-22 (review of #6); accepted posture - maintainer, 2026-10-27 (Q3)" - id: P11 property: Stated resource bounds - route/Citrus YAML 2 MiB, native result 16 MiB and 1000 files, Pi prompt 1 MiB, Pi log 16 MiB, session 64 MiB, evidence log 64 MiB, stage timeout 10m, resolver 64 roots/512 artifacts/128 MiB JAR/4 MiB POM, tree quotas, migration-context depth 3 and 50 nodes; graph parsers other than the POM parser 60 s each (serves P1); Knowledge tool results at most 25 per call, release pages at most 2 MiB and 10 pages, manifest 5 s and archive 5 min deadlines. violation_symptom: A limit not enforced at its documented value. @@ -519,7 +519,7 @@ triage_notes: maintainer_decisions: - date: "2026-10-27" - decision: Review round 3 of #6 - a report that only restates the known Claude wildcard grant is VALID-HARDENING under V3, while a demonstrated breach through the grant is triaged on the breach and its impact; the Pi inventory row distinguishes intended writes from the worker's unconfined OS-account reach; the Knowledge classpath fallback (temporary knowledge-index* directory, pinned-version exception) is part of the inventory. Each verification item has a tracking issue (#153-#158). + decision: "Review round 3 of #6 - a report that only restates the known Claude wildcard grant is VALID-HARDENING under V3, while a demonstrated breach through the grant is triaged on the breach and its impact; the Pi inventory row distinguishes intended writes from the worker's unconfined OS-account reach; the Knowledge classpath fallback (temporary knowledge-index* directory, pinned-version exception) is part of the inventory. Each verification item has a tracking issue (#153-#158)." sections: ["4.4a", "4.5", "4.8 P10", "4.8 P13", "4.11a", "4.13", "4.14.2"] - date: "2026-10-27" decision: Review round 2 answers to Q1-Q13 (see answered_questions). Policy ratified; acceptance pending V1-V6. @@ -528,7 +528,7 @@ maintainer_decisions: decision: Graph source-reading contract inherited in full from the Apache Camel Security Model; enforcement gaps are tracked as verification items, not disclaimed. sections: ["4.1", "4.8 P1", "4.8 P11", "4.13", "V1", "V2"] - date: "2026-10-22" - decision: Review of #6 - the proposal allowlist applies to native backends only; Pi candidates are accepted through tree, artifact and launch-surface validation with ordinary extra material files permitted and published; the generated Claude settings.json wildcards grant every MCP tool and the .mcp.json autoApprove/alwaysAllow keys are not a Claude Code filter. + decision: "Review of #6 - the proposal allowlist applies to native backends only; Pi candidates are accepted through tree, artifact and launch-surface validation with ordinary extra material files permitted and published; the generated Claude settings.json wildcards grant every MCP tool and the .mcp.json autoApprove/alwaysAllow keys are not a Claude Code filter." sections: ["4.5a", "4.6", "4.8 P5", "4.8 P10", "4.9", "4.11a"] answered_questions: @@ -618,7 +618,7 @@ verification_items: title: Knowledge section verification from: [Q11] sections: ["4.4a", "4.8 P12", "4.8 P13", "4.8 P14"] - work: Maintainer verification of the Knowledge statements drafted from code and README - no listener in the default configuration, no process execution and no network access other than index acquisition, tool-argument handling, cache permissions, the SSE posture, and the classpath fallback (temporary-directory permissions, no bundled index in the monorepo runner). Related hardening - #137 (PR #143), #139 (PR #142), #140. + work: "Maintainer verification of the Knowledge statements drafted from code and README - no listener in the default configuration, no process execution and no network access other than index acquisition, tool-argument handling, cache permissions, the SSE posture, and the classpath fallback (temporary-directory permissions, no bundled index in the monorepo runner). Related hardening - #137 (PR #143), #139 (PR #142), #140." interim_triage: A breach of P12-P14 is VALID. status: open diff --git a/kit/camel-kit-core/src/test/java/org/apache/camel/kit/generator/ResourceConsistencyTest.java b/kit/camel-kit-core/src/test/java/org/apache/camel/kit/generator/ResourceConsistencyTest.java index d0227995..96b930a4 100644 --- a/kit/camel-kit-core/src/test/java/org/apache/camel/kit/generator/ResourceConsistencyTest.java +++ b/kit/camel-kit-core/src/test/java/org/apache/camel/kit/generator/ResourceConsistencyTest.java @@ -5,9 +5,11 @@ import java.nio.file.Files; import java.nio.file.Path; import java.util.ArrayList; import java.util.Comparator; +import java.util.HashMap; import java.util.LinkedHashSet; import java.util.List; import java.util.Locale; +import java.util.Map; import java.util.Set; import java.util.regex.Matcher; import java.util.regex.Pattern; @@ -24,6 +26,7 @@ import org.apache.camel.kit.workflow.WorkflowManifestLoader; import com.fasterxml.jackson.databind.JsonNode; import com.fasterxml.jackson.databind.ObjectMapper; +import com.fasterxml.jackson.dataformat.yaml.YAMLFactory; import org.junit.jupiter.api.Test; import org.junit.jupiter.api.io.TempDir; import org.tomlj.Toml; @@ -320,6 +323,25 @@ class ResourceConsistencyTest { assertTrue(unknown.isEmpty(), "Shipped guidance references unknown MCP tools:\n" + String.join("\n", unknown)); } + @Test + void securityModelSidecarRetainsIssueReferencesAndDecisions() throws IOException { + JsonNode model = new ObjectMapper(new YAMLFactory()) + .readTree(repositoryRoot().resolve("docs/security-model.yaml").toFile()); + Map<String, JsonNode> properties = new HashMap<>(); + model.path("claimed_properties").forEach(property -> properties.put(property.path("id").asText(), property)); + JsonNode p5 = properties.get("P5"); + JsonNode p10 = properties.get("P10"); + assertTrue(model.path("status").asText().contains("#153-#158")); + assertTrue(p5.path("provenance").asText().contains("2026-10-27 (Q8)")); + assertTrue(p10.path("violation_symptom").asText().contains("review of #6")); + assertTrue(p10.path("provenance").asText().contains("accepted posture")); + assertTrue(model.path("maintainer_decisions").get(0).path("decision").asText() + .contains("a demonstrated breach through the grant is triaged on the breach and its impact")); + assertTrue(model.path("maintainer_decisions").get(3).path("decision").asText() + .contains("Pi candidates are accepted")); + assertTrue(model.path("verification_items").get(5).path("work").asText().contains("#143")); + } + @Test void architectureDocumentsActualCamelRouteTestScaffoldOutput() throws IOException { String architecture = Files.readString(repositoryRoot().resolve("docs/architecture.md"));
