Cline rules

1# Content safety: nothing proprietary leaves the on-prem machine
2 
3The user reads your reports off your screen and hand-types into Teacher LLM. Teacher LLM must NEVER
4see verbatim corpus content, MNO names, plan IDs, requirement IDs, release codes, or any
5file path under `<env_dir>/input/`.
6 
7## Redaction protocol
8 
9You maintain a literal-string mapping at `<env_dir>/state/cline-mapping.json`. Apply it
10forward (real → placeholder) before emitting any report, and reverse (placeholder → real)
11when acting on Teacher LLM's response.
12 
13**Mapping schema**:
14 
15```json
16{
17  "version": 1,
18  "mappings": {
19    "<real-string>": "<placeholder>"
20  }
21}
22```
23 
24**Placeholder format** — angle-bracketed, category-prefixed, stable index:
25 
26| Category | Pattern | Example |
27|---|---|---|
28| MNO short prefix | `<MNO{N}>` | `VZ` → `<MNO0>` |
29| MNO alias | `<MNO{N}_ALIAS>` | `VZW` → `<MNO0_ALIAS>` |
30| MNO full name | `<MNO{N}_NAME>` | `Verizon` → `<MNO0_NAME>` |
31| Plan ID | `<PLAN{N}>` | `LTEAT` → `<PLAN0>` |
32| Plan name | `<PLAN{N}_NAME>` | (use when plan_name differs from plan_id) |
33| Release | `<REL{N}>` | `OA-baseline` → `<REL0>` |
34| Requirement ID | `<REQID-{N}>` | `VZ_REQ_LTEAT_45` → `<REQID-0>` |
35| Standards spec | `<SPEC{N}>` | `3GPP TS 24.301` → keep as-is (public standard, not proprietary) |
36 
37`{N}` is a stable index — once allocated, never changes. New entries get the next free index.
38 
39Apply substitution **longest-match-first** so `VZ_REQ_LTEAT_45` matches before `VZ`.
40 
41The mapping playbook (`cline-playbooks/mapping.md`) describes how to seed and grow this
42file.
43 
44## Hard rules — never include in your report
45 
46- Verbatim quotes from any document under `<env_dir>/input/`
47- Section heading text > 5 words (treat as title-class quoted prose)
48- Requirement body text (any length)
49- Acronym definitions in full (the expansion phrase IS corpus content)
50- Tabular requirement data
51- Real values for any token in the mapping (always emit the placeholder)
52- Un-redacted file paths under `<env_dir>/input/<...>` (the path components are MNO/RELEASE/PLAN)
53 
54## OK to include (after redaction)
55 
56- Counts, percentages, ratios
57- Generic regex patterns — `^\d+(?:\.\d+)+\s+\S` is fine
58- Format-class observations — `89% of headings are numbered N.N.N`
59- Coverage stats — `rule catches 487/503`
60- Counts of misses by severity — `HIGH=96%, MED=3%, LOW=0.1%`
61- Source code paths inside the repo — `core/src/parser/structural_parser.py:1243`
62  (those are repo paths, not corpus)
63- Public standards references — `3GPP TS 24.301, Section 5.5.1.2.6` (public knowledge)
64- Domain terminology — `ATTACH`, `EMM`, `NAS` (3GPP standard terms)
65 
66## Borderline cases
67 
68A regex that ORs corpus-specific values is suspect: `(ATTACH|DETACH|FOO)` is fine if all
69three are public 3GPP terms; not fine if `FOO` is a customer-specific keyword. When unsure,
70add `FOO` to the mapping and emit the redacted form.
71 
72When unsure in general: ask the user. Default to redaction.
73 
74## What this protects against
75 
76A passing observer of the user's hand-typed reports — and Teacher LLM itself, which logs
77conversations — never sees any string that uniquely identifies a customer, document,
78release, or specific requirement. Patterns and counts are sufficient for Teacher LLM to
79update code; concrete values stay on-prem.
80 
81## Mapping snapshot location [D-062]
82 
83Beyond the live `<env_dir>/state/cline-mapping.json` (forward redaction for outgoing
84reports), Cline also maintains a **per-bootstrap mapping snapshot** at:
85 
86```
87customizations/mappings/<bootstrap_id>.json
88```
89 
90This snapshot pairs with the placeholdered profile at
91`customizations/profiles/<bootstrap_id>.json` (which Teacher LLM commits to public
92github). At parse time, NORA's runtime substitution layer reads the snapshot and
93resolves placeholders in the profile's regex strings to real values.
94 
95**The `customizations/mappings/` directory is NOT gitignored**. The contents are
96committed and pushed to the **company-internal** git remote so every team member
97shares one source of truth for the mappings. The trust boundary against the **public**
98mirror (`github.com`) is the work-PC pre-push hook installed by
99`~/work/utils/git-sync/sync-work.sh`: any `git push` whose remote URL is `github.com`
100is rejected unless `NORA_ALLOW_PUBLIC_PUSH=1` is set explicitly (used only for
101audited force-pushes such as history rewrites).
102 
103You own this directory. `cline-playbooks/bootstrap.md` Step 8 specifies the write
104operation; `cline-playbooks/mapping.md` documents the on-disk shape and the live-vs-
105snapshot distinction. The directory IS suitable for git tracking — staging and
106committing mapping files is part of the normal team-sync flow. The hook (not
107`.gitignore`) is what keeps them off the public mirror.
108