From 6fe60b79bd271ea45da399e39017573a6cca63fa Mon Sep 17 00:00:00 2001 From: Jarek Potiuk Date: Mon, 27 Jul 2026 18:34:03 +0200 Subject: [PATCH] Add AGENTS.md so the threat model is discoverable by agents MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CALCITE-7605 landed the threat model at site/_docs/security_threat_model.md and a SECURITY.md that links to it. The remaining gap is the entry point: automated agents locate a project's security model by following AGENTS.md -> SECURITY.md -> the model, and this repository has no AGENTS.md, so the first hop is missing and the chain cannot be walked mechanically. This adds one, pointing at SECURITY.md and summarising the two rules that carry most of the triage weight — the surprising-vs-unsurprising class-loading gate over the SPI positions, and the pushed-down-SQL split (generated SQL reaching a configured backend is not a vulnerability; a pushdown bug reading beyond the configured schemas is P4 and is one) — plus the "Not a vulnerability" and "Downstream responsibilities" lists. No new claims: everything here restates the merged model. AGENTS.md is added to .ratignore alongside SECURITY.md, matching what CALCITE-7605 did for that file, since it carries no license header. Docs only; no production code touched. Generated-by: Claude Opus 5 (1M context) --- .ratignore | 1 + AGENTS.md | 43 +++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 44 insertions(+) create mode 100644 AGENTS.md diff --git a/.ratignore b/.ratignore index 93e7e93e7a1..d42e5ca0fd7 100644 --- a/.ratignore +++ b/.ratignore @@ -14,6 +14,7 @@ **/data2.txt .idea/vcs.xml SECURITY.md +AGENTS.md example/csv/src/test/resources/smoke_test.sql # TODO: remove when pom.xml files are removed diff --git a/AGENTS.md b/AGENTS.md new file mode 100644 index 00000000000..67870438a73 --- /dev/null +++ b/AGENTS.md @@ -0,0 +1,43 @@ +# Agent guidance + +This file is read by automated agents (security scanners, code analyzers, +AI assistants) operating on this repository. It points them at the +human-authored references they should consult before producing output. + +## Security + +Security model: [SECURITY.md](./SECURITY.md), which links to the project's +threat model at +[site/_docs/security_threat_model.md](./site/_docs/security_threat_model.md). + +Calcite is an embedded SQL framework, not a server. It opens no socket and +has no authentication or authorization of its own; the host application +owns transport, identity, and schema scoping. Read the threat model before +reporting anything — it is explicit about what it does and does not treat +as a vulnerability. + +Two rules carry most of the triage weight: + +- **Surprising vs unsurprising class loading.** A class named through a + Calcite SPI position — `schemaFactory`, `parserFactory`, `typeSystem`, + `metaTableFactory`, `metaColumnFactory`, `tableFactory`, function + classes, `dataSource`, `jdbcDriver`, `model` — is loaded only through + that SPI, gated by `Class.forName(name, false, loader)` plus an + `isAssignableFrom` check. A class that does not implement the SPI for + its position is never instantiated by name. SQL may name SPI classes, + but only SPI implementations run, and only through their SPI. +- **Pushed-down SQL.** The SQL Calcite generates and sends to a backend + the operator configured is *not* a vulnerability — the query author can + already reach that endpoint through the visible schemas. A pushdown bug + that reads *beyond* the configured schemas is P4 and *is* one. + +Explicitly not vulnerabilities (see the model's "Not a vulnerability" +section): the os-adapter running OS commands, the file/CSV/JSON adapters +reading paths they were configured with, anything requiring a changed +system property or classpath, a third-party driver's behaviour past the +connection boundary, and cross-tenant reads that follow from the embedder +exposing several principals' schemas on one connection. + +The model also lists what belongs to the host rather than the library — +transport and identity, schema scoping, adapter selection, the classpath, +and whatever a `model` points at — under "Downstream responsibilities".