[PR] Wire the security threat model for agent discoverability (AGENTS.md + SECURITY.md); rename draft-THREAT-MODEL.md -> THREAT_MODEL.md [jackrabbit-oak]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk opened a new pull request, #3028:
URL: https://github.com/apache/jackrabbit-oak/pull/3028

   **This is a proposal for the Jackrabbit PMC to review — please correct, reject, or discuss as needed.** Nothing here is a requirement; the maintainer is the decision-maker.
   
   Thanks for merging the threat-model draft, Angela. Two small follow-ups make it mechanically discoverable to automated security scanners (and to any agent that follows the conventional file layout):
   
   **1. Wire the discoverability chain.** This adds `AGENTS.md` (a `## Security` pointer) and `SECURITY.md`, so the conventional `AGENTS.md → SECURITY.md → THREAT_MODEL.md` chain resolves. An automated scanner mechanically follows that chain to locate the model; without it, the model file is present but the scanner can't find it — discoverability is the one hard gate before a scan can run. *(On jackrabbit-oak this appends a `## Security` pointer to the existing `AGENTS.md` rather than creating a new one.)*
   
   **2. Rename `draft-THREAT-MODEL.md` → `THREAT_MODEL.md` (optional proposal).** Two reasons:
   - **It's no longer a draft.** The PMC has reviewed and merged it, so the `draft-` prefix now reads as "not yet adopted" when it is, in fact, the project's adopted model — the name undersells it.
   - **`THREAT_MODEL.md` is the conventional, discoverable name.** It's what the `AGENTS.md → SECURITY.md → model` chain and the scanners look for by default, and it matches the layout used across the other Apache repos in this effort (e.g. `apache/solr`). The rename also normalizes the separator (`THREAT-MODEL` → `THREAT_MODEL`).
   
   If you'd rather keep the `draft-` name (or pick a different one), just say so — the rename is the optional part; the wiring is the substantive fix, and we'll point `SECURITY.md` at whatever filename you prefer.
   
   Context: the ASF Security team is preparing the project for an automated agentic security scan. This PR changes **no model content** — only the file name and the discoverability wiring around it.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: oak-dev-unsubscribe@jackrabbit.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Wire the security threat model for agent discoverability (AGENTS.md + SECURITY.md); rename draft-THREAT-MODEL.md -> THREAT_MODEL.md [jackrabbit-oak]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk closed pull request #3028: Wire the security threat model for agent discoverability (AGENTS.md + SECURITY.md); rename draft-THREAT-MODEL.md -> THREAT_MODEL.md
URL: https://github.com/apache/jackrabbit-oak/pull/3028


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: oak-dev-unsubscribe@jackrabbit.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Wire the security threat model for agent discoverability (AGENTS.md + SECURITY.md); rename draft-THREAT-MODEL.md -> THREAT_MODEL.md [jackrabbit-oak]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk commented on PR #3028:
URL: https://github.com/apache/jackrabbit-oak/pull/3028#issuecomment-5016485170

   Superseded by #3042 — identical change, with the commit message reworded to `docs: …` so the Conventional-Commits `commit-check` gate passes. (This PR couldn't be reopened after the commit was amended, so #3042 replaces it.)


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: oak-dev-unsubscribe@jackrabbit.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org