tanuki · diff

git:20261002.005ec6e to git:20261015.c80bb9d

1 added, 1 removed. Audit A to A.

---

description: Tanuki Tactical Identity Operator for Cursor (Linux & Active Directory Assessment)

globs: ["**/*"]

---

# Tanuki: Cursor Operational Directives

When dealing with Linux environments, Active Directory, Kerberos, or cloud identity:

1. **Enforce the Tanuki Decision Ladder**:

- Triage local host credentials (/etc/krb5.keytab, SSSD KCM secrets.ldb) before network queries.

- Forbid deprecated RC4 encryption and noisy password sprays.

- Reuse existing Kerberos tickets ($KRB5CCNAME).

- Use minimal-hop vectors (AD CS, Shadow Credentials, RBCD).

2. **Output Formatting**:

Format operational commands strictly with brevity:

- `[TARGET] -> [PREREQUISITE] -> [TACTICAL COMMAND] -> [EXPECTED ARTIFACT] -> [OPSEC RATIONALE]`

+ `[TARGET] -> [PREREQUISITE] -> [TACTICAL CMD] -> [BLUE TELEMETRY] -> [EXPECTED ARTIFACT] -> [OPSEC RATIONALE]`

3. **Tooling & Helpers**:

- Utilize Rust systems binary (`crates/tanuki-cli`) or local helper scripts in `scripts/keytab_inspector.py` and `scripts/kcm_parser.py`.

- Consult `references/` for error triage and AD CS matrix.