luigidemasi opened a new issue, #85: URL: https://github.com/apache/camel-kit/issues/85
> Imported from [luigidemasi/camel-kit#205](https://github.com/luigidemasi/camel-kit/issues/205), opened by [luigidemasi](https://github.com/luigidemasi) on 2026-09-03. > Closed by [luigidemasi/camel-kit#206](https://github.com/luigidemasi/camel-kit/pull/206), merged on 2026-09-03. --- ## Description Narrow replacement for luigidemasi/camel-kit#73, which proposed extracting three shared reference checklists (security, testing, performance). Re-checking that issue against `main` (`8d4206b0`) showed its premise no longer holds: guides are loaded selectively (per-guide "When to Load" manifest in `skills/camel-design/SKILL.md`), and subagent personas reference exact guide files rather than loading whole skills (`agents/code-quality-reviewer.md` lists the five `camel-validate/guides/*.md` paths; `agents/test-engineer.md` lists the four `camel-test/guides/*.md` paths). Neither testing nor performance has duplication worth extracting. Security is the one domain with a measurable maintenance cost. The same core rules (no hardcoded credentials, TLS everywhere, no sensitive data in logs, input validation, authentication on external endpoints) are restated in 6–9 shipped artifacts: - `skills/shared/iron-laws.md` (constitution rule 6 wording) - `skills/camel-design/guides/security.md` - `skills/camel-validate/guides/security-analysis.md` - `skills/camel-validate/guides/anti-patterns.md` (security section) - `skills/camel-validate/guides/quality-checks.md` - `agents/critic-security.md` (inline checklist) - `agents/code-quality-reviewer.md` - `templates/bob/gates/camel-validate.md` and `templates/bob/gates/camel-execute.md` - `templates/constitution.md` Observed drift between copies (line numbers at `8d4206b0`): - Vault reference syntax: `security.md:131` uses `${vault:secret/database/credentials#password}`; `anti-patterns.md:250` uses `${vault:secret/database#password}`. - Masking field list: `security.md:77` has `logging.mask.fields=email,phone,ssn,creditCard`; `anti-patterns.md:318` has the same list plus `password`. - The bob gates' "8 constitution rules" list had drifted from `templates/constitution.md` (realigned separately in PR luigidemasi/camel-kit#204). Byte-identical blocks also exist, e.g. the `http.maxRequestSize`/`kafka.maxMessageSize` config block and the `camel.component.kafka.securityProtocol=SSL` line appear in both `security.md` and `anti-patterns.md`. ## Expected Behavior One canonical `skills/shared/camel-security-checklist.md` holding the shared Camel-specific security rules and the canonical config snippets. Guides keep their phase-specific framing but reference the canonical file for the shared rules instead of restating them, and the drifted values above are reconciled to a single canonical form. Scope notes: - This is a maintenance/drift-prevention change, not a token optimization: the consuming files load in different pipeline phases, so deduplication does not shrink any single context. - The ACR critic persona (`agents/critic-security.md`) is deliberately self-contained (fresh-context dispatch); it can keep its inline checklist but should name the canonical file as its source of truth so updates propagate. - Bob gate templates inline their steps by design and cannot read repo files at run time; keeping them aligned remains a manual step and is out of scope here. ## Additional Context Replaces luigidemasi/camel-kit#73. Unlike luigidemasi/camel-kit#73, no testing or performance checklist is proposed: testing knowledge is owned by `camel-test` (its one duplicated block was deduplicated in PR luigidemasi/camel-kit#204), and the duplicated performance snippets carry no cross-context cost (their two observed inconsistencies were one-line fixes, also in PR luigidemasi/camel-kit#204). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
