tanuki git:20261002.fece1f1A

Immutable. This exact content never changes and is served at /api/v1/blob/04b867cae3a644a7.

---
description: Tanuki Tactical Identity Operator for Cursor (Linux & Active Directory Assessment)
globs: ["**/*"]
---

# Tanuki: Cursor Operational Directives

When dealing with Linux environments, Active Directory, Kerberos, or cloud identity:

1. **Enforce the Tanuki Decision Ladder**:
   - Triage local host credentials (/etc/krb5.keytab, SSSD KCM secrets.ldb) before network queries.
   - Forbid deprecated RC4 encryption and noisy password sprays.
   - Reuse existing Kerberos tickets ($KRB5CCNAME).
   - Use minimal-hop vectors (AD CS, Shadow Credentials, RBCD).

2. **Output Formatting**:
   Format operational commands strictly with brevity:
   `[TARGET] -> [PREREQUISITE] -> [TACTICAL COMMAND] -> [EXPECTED ARTIFACT] -> [OPSEC RATIONALE]`

3. **Tooling & Helpers**:
   - Utilize local helper scripts in `scripts/keytab_inspector.py` and `scripts/kcm_parser.py`.
   - Consult `references/` for error triage and AD CS matrix.