This is an automated email from the ASF dual-hosted git repository.
rubenada pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/calcite.git
The following commit(s) were added to refs/heads/main by this push:
new 871e8639ca Add AGENTS.md so the threat model is discoverable by agents
871e8639ca is described below
commit 871e8639ca9c609c96af395dc5b5a00df560ba10
Author: Jarek Potiuk <[email protected]>
AuthorDate: Mon Jul 27 18:34:03 2026 +0200
Add AGENTS.md so the threat model is discoverable by agents
CALCITE-7605 landed the threat model at site/_docs/security_threat_model.md
and a SECURITY.md that links to it. The remaining gap is the entry point:
automated agents locate a project's security model by following
AGENTS.md -> SECURITY.md -> the model, and this repository has no
AGENTS.md, so the first hop is missing and the chain cannot be walked
mechanically.
This adds one, pointing at SECURITY.md and summarising the two rules that
carry most of the triage weight — the surprising-vs-unsurprising
class-loading gate over the SPI positions, and the pushed-down-SQL split
(generated SQL reaching a configured backend is not a vulnerability; a
pushdown bug reading beyond the configured schemas is P4 and is one) —
plus the "Not a vulnerability" and "Downstream responsibilities" lists.
No new claims: everything here restates the merged model.
AGENTS.md is added to .ratignore alongside SECURITY.md, matching what
CALCITE-7605 did for that file, since it carries no license header.
Docs only; no production code touched.
Generated-by: Claude Opus 5 (1M context)
---
.ratignore | 1 +
AGENTS.md | 43 +++++++++++++++++++++++++++++++++++++++++++
2 files changed, 44 insertions(+)
diff --git a/.ratignore b/.ratignore
index 93e7e93e7a..d42e5ca0fd 100644
--- a/.ratignore
+++ b/.ratignore
@@ -14,6 +14,7 @@
**/data2.txt
.idea/vcs.xml
SECURITY.md
+AGENTS.md
example/csv/src/test/resources/smoke_test.sql
# TODO: remove when pom.xml files are removed
diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 0000000000..67870438a7
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,43 @@
+# Agent guidance
+
+This file is read by automated agents (security scanners, code analyzers,
+AI assistants) operating on this repository. It points them at the
+human-authored references they should consult before producing output.
+
+## Security
+
+Security model: [SECURITY.md](./SECURITY.md), which links to the project's
+threat model at
+[site/_docs/security_threat_model.md](./site/_docs/security_threat_model.md).
+
+Calcite is an embedded SQL framework, not a server. It opens no socket and
+has no authentication or authorization of its own; the host application
+owns transport, identity, and schema scoping. Read the threat model before
+reporting anything — it is explicit about what it does and does not treat
+as a vulnerability.
+
+Two rules carry most of the triage weight:
+
+- **Surprising vs unsurprising class loading.** A class named through a
+ Calcite SPI position — `schemaFactory`, `parserFactory`, `typeSystem`,
+ `metaTableFactory`, `metaColumnFactory`, `tableFactory`, function
+ classes, `dataSource`, `jdbcDriver`, `model` — is loaded only through
+ that SPI, gated by `Class.forName(name, false, loader)` plus an
+ `isAssignableFrom` check. A class that does not implement the SPI for
+ its position is never instantiated by name. SQL may name SPI classes,
+ but only SPI implementations run, and only through their SPI.
+- **Pushed-down SQL.** The SQL Calcite generates and sends to a backend
+ the operator configured is *not* a vulnerability — the query author can
+ already reach that endpoint through the visible schemas. A pushdown bug
+ that reads *beyond* the configured schemas is P4 and *is* one.
+
+Explicitly not vulnerabilities (see the model's "Not a vulnerability"
+section): the os-adapter running OS commands, the file/CSV/JSON adapters
+reading paths they were configured with, anything requiring a changed
+system property or classpath, a third-party driver's behaviour past the
+connection boundary, and cross-tenant reads that follow from the embedder
+exposing several principals' schemas on one connection.
+
+The model also lists what belongs to the host rather than the library —
+transport and identity, schema scoping, adapter selection, the classpath,
+and whatever a `model` points at — under "Downstream responsibilities".
