oscerd opened a new issue, #158: URL: https://github.com/apache/camel-kit/issues/158
Tracking issue for verification item **V6** of the Camel-Kit security model (apache/camel-kit#6, part of the acceptance of #5), from maintainer answer Q11. **What to verify.** The Knowledge statements of §4.4a and §4.8 P12–P14 drafted from code and the README: no listener in the default (stdio) configuration; no process execution; no network access other than index acquisition; tool-argument handling (`QueryParser.escape`, structured lookups, the 25-result clamp, catalog-only endpoint validation); cache directory permissions; the SSE opt-in posture; the classpath-fallback behaviour of `LuceneSearchService` (temporary `knowledge-index*` directory, pinned-version exception). Related hardening already in flight: #137 (https-only index URIs, PR #143), #139 (SnakeYAML SafeConstructor in the indexer, PR #142), #140 (uber-jar component exclusions). **Interim triage** while open: a breach of P12–P14 is `VALID`. **Done when** each statement is maintainer-verified or corrected, and §4.14.2 and the YAML sidecar mark V6 verified. _AI-generated by Claude Code (Claude Fable 5.1) on behalf of @oscerd._ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
