luigidemasi commented on PR #6: URL: https://github.com/apache/camel-kit/pull/6#issuecomment-6443031943
Thanks Andrea. These are my answers to §4.14. They define the intended security contract; they do not certify that the current implementation already enforces every property. 1. **Q1 — All graph parsers:** adopt the source-inspection contract for every parser: no execution of project code, loading project classes, resolving runtime secrets, network access or child processes. Add regression coverage for each parser, including the compiler-based paths. Keep unverified enforcement visible as implementation work. 2. **Q2 — Graph confinement and bounds:** retain your decision to inherit the umbrella contract in full. Outside-root reads, including symlink escapes, non-termination and unbounded memory remain in scope. Symlink confinement, the POM parser timeout and memory/file-size limits need verification and, where absent, implementation; they are not scope exclusions. 3. **Q3 — Claude permissions:** require narrower Claude defaults before accepting the model. Replace the blanket MCP wildcard pre-approvals with explicit grants aligned with the intended tool policy, and verify the generated behavior. Keep the per-agent distinction between tool availability and approval. Documenting the current wildcard grants is necessary, but does not make them the accepted default posture. 4. **Q4 — Snapshots:** retain snapshots for development, document their mutability, and pin release defaults to released versions. Snapshot mutability does not waive any other security control. 5. **Q5 — Prompt injection:** use the boundary-based rule across the model. An injection that breaks a documented tool, permission, parser or controller boundary is in scope. Incorrect or insecure model output within permitted actions, without such a boundary failure, is outside that contract. 6. **Q6 — Side effects:** replace blanket statements with a verified inventory for each product and process. Include Knowledge caches and downloads, Ship state, worker access, external-tool behavior, listeners, telemetry, filesystem writes and actual parser limits. Scope every negative claim to the process and configuration that support it. 7. **Q7 — Init downloads:** accept the documented HTTPS and upstream-distribution trust boundary. State the redirect behavior and absence of independent artifact verification. This does not exclude defects in Camel-Kit's own parsing, extraction or path controls. 8. **Q8 — Pi:** retain support with the existing documented boundary: inherited controller environment, no process sandbox, and limited exact-value scanning of selected environment secrets. Staging is not isolation, and the scan does not guarantee comprehensive secret detection or confidentiality. Failures of the controls that are actually claimed remain in scope. 9. **Q9 — Init writes:** generated writes must remain within the operator-selected target. An untrusted tree or symlink that redirects a write outside it is in scope. An intentional operator-selected destination is authorized; distinguish that from an unintended escape. 10. **Q10 — Publication:** retain this as an additive Camel subproject security model, linked from SECURITY.md. Register it on the ASF security site and Camel security page after acceptance, with #131 tracking that work. 11. **Q11 — Knowledge:** include its server and index in this same security model, with a dedicated Knowledge section. The monorepo move has happened. Missing coverage remains work to complete, and reports use the same private reporting process. 12. **Q12 — Supported versions:** support the latest release line of each independently released product, Kit and Knowledge. Fixes land on main and ship in the next applicable product release. Ship's claimed controls remain covered despite Technology Preview status. 13. **Q13 — Generated instructions:** keep the actionable local security rules in generated AGENTS.md/CLAUDE.md files and the shipped guidance. Do not add a mandatory link to the security model. The Iron Laws, context-authority rules and security checklist remain the operative guidance. Please carry the agreed answers through the canonical Markdown, YAML sidecar, SECURITY.md and affected triage dispositions. In particular, narrower Claude defaults, tested parser guarantees and a verified Knowledge/side-effect inventory still need work before the draft can be accepted; answering the policy questions does not mark that work complete. _AI-generated by OpenAI Codex on behalf of @luigidemasi._ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
