feat(rules): scope 04-cybersecurity off the always-on set (reclaim ~29% of budget)#21
Merged
Merged
Conversation
The offensive-security doctrine was alwaysApply:true, loading into every session's context (~7.8 KB, ~29% of the always-on rule budget) even for non-security work. Flip it to alwaysApply:false with globs matching offensive-security file contexts (exploits, CTF/pwn, pentest findings, AI red-team configs). It now renders like the language rules: on-demand references/rules/04-cybersecurity.md for every target (preserved, not dropped — instruction-only hosts get the reference doc too) plus a native glob rule for cursor. Nothing is lost; it just loads when relevant. Effect: codex AGENTS.md 27727 -> 19874 bytes (-28.3%). check rules confirms 04 attaches only to the security-exploit scenario, not the 8 generic ones. Tests: updated the assertions that pinned 04's always-on placement to its real new placement (codex/kilo references vs rules dir; kilo instruction lists; cline file count 73->74 as 04 becomes a separate reference file). Verified against actual build /install output, not flipped to pass. check rules/check/check generated/build/test green. by mass-energy equivalence
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
04-cybersecuritywasalwaysApply:true— the full offensive-security doctrine (~7.8 KB, ~29% of the always-on rule budget) loaded into every session, security work or not. Per the decision to load it only when necessary, flip it to a scoped rule.Change
04-cybersecurity.mdcfrontmatter:alwaysApply:true→alwaysApply:false+globsmatching offensive-security file contexts (**/exploit*,**/pwn*,**/poc*,**/shellcode*,ctf/**,**/pentest*,findings/**,**/*.nmap,**/.garak.*). Globs verified againstcheck rules'security-exploitscenario paths.10–14): an on-demandreferences/rules/04-cybersecurity.mdfor every target (instruction-only hosts included — preserved, not dropped) plus a native glob rule for cursor. Description notes you can pull it in explicitly for ROE-authorized work with no matching file yet.Effect
AGENTS.md: 27,727 → 19,874 bytes (−7,853, −28.3%). Same reclaim on every always-on surface.check rules: 04 attaches only to thesecurity-exploitscenario; drops from the 8 generic scenarios. No information lost — the doctrine is intact, just on-demand.Tests (contract update, verified — not flipped to pass)
Updated the assertions that pinned 04's old always-on placement to its actual new placement, each confirmed against real build/install output:
security-exploit, absent for the 7 others (+ generic-chat).AGENTS.mdno longer has a## 04section;references/rules/04-cybersecurity.mdnow exists.rules/+ all three instruction lists, moves toreferences/.managed.lengthlikewise.check rules·check·check generated·build --target all·test— all green (clean sequential run).Note: 13 unrelated
commands/*.mdfiles are dirty in the working tree (a blank-line-after-frontmatter formatter normalization, not from this change) — left unstaged.by mass-energy equivalence