Development record
2026-07-30 — iss-156: the PII rules domain gains the network/infra recall vocabulary the leak incident needed (`ip`, `ips`, `ipv4`, `ipv6`, `vpn`, `tailscale`, `tailnet`, `wireguard`, `firewall`, `network`, `reachability`, `reachable`, `dns`, `ssh`, `subnet`, plus the `mac address` alias) and one new rule line forbidding committed hostnames, IP/MAC addresses, and other live network identifiers: redact or omit, and use a reserved documentation value (RFC 5737/3849/2606/7042, the same citation set as the scanner and the audit privacy-hygiene rule) only where an illustrative example is needed — the rule does not tell an agent to substitute a plausible fake identifier into a factual write-up. Data-only: recall matching is already word-bounded (the prompt is normalised to space-separated tokens and a single-token term must match a whole token), so the bare `ip` keyword is safe and no matcher change was needed — a substring matcher would have forced a phrase form like `ip address`. Placement is dictated by the matcher, not by word count (`aliases` also holds single words such as `pr` and `diataxis`): a term goes in `recall` when it should hit as a standalone token, and in `aliases` when only the multi-word phrase is safe — `mac` alone would recall on an Apple Mac, so `mac address` is a phrase alias and matches via the stemmed-phrase path. The stemmer's own limits force the explicit variants: a three-character floor keeps `ips` from stemming to `ip`, and `-ability` is not bridged to `-able`, so `reachable` is its own entry. Accepted trade: broad tokens like `network` over-fire on prompts with no privacy stake, which is benign here — the injection is four short rule lines, deduped once per session. The never-commit-identifiers rule previously existed only in a parent CLAUDE.md privacy section, so the loader could never inject it; the 2026-07-29 reserved-identifier principle now has a rule-text home the hook actually emits.
2026-07-30 — iss-156: the PII rules domain gains the network/infra recall vocabulary the leak incident needed (ip, ips, ipv4, ipv6, vpn, tailscale, tailnet, wireguard, firewall, network, reachability, reachable, dns, ssh, subnet, plus the mac address alias) and one new rule line forbidding committed hostnames, IP/MAC addresses, and other live network identifiers: redact or omit, and use a reserved documentation value (RFC 5737/3849/2606/7042, the same citation set as the scanner and the audit privacy-hygiene rule) only where an illustrative example is needed — the rule does not tell an agent to substitute a plausible fake identifier into a factual write-up. Data-only: recall matching is already word-bounded (the prompt is normalised to space-separated tokens and a single-token term must match a whole token), so the bare ip keyword is safe and no matcher change was needed — a substring matcher would have forced a phrase form like ip address. Placement is dictated by the matcher, not by word count (aliases also holds single words such as pr and diataxis): a term goes in recall when it should hit as a standalone token, and in aliases when only the multi-word phrase is safe — mac alone would recall on an Apple Mac, so mac address is a phrase alias and matches via the stemmed-phrase path. The stemmer's own limits force the explicit variants: a three-character floor keeps ips from stemming to ip, and -ability is not bridged to -able, so reachable is its own entry. Accepted trade: broad tokens like network over-fire on prompts with no privacy stake, which is benign here — the injection is four short rule lines, deduped once per session. The never-commit-identifiers rule previously existed only in a parent CLAUDE.md privacy section, so the loader could never inject it; the 2026-07-29 reserved-identifier principle now has a rule-text home the hook actually emits.
Frontmatter
| id | dcn-2607300000000001 |
|---|---|
| type | decision |
| date | 2026-07-30 |
.abcd/work/decisions/dcn-2607300000000001-iss-156-the-pii-rules-domain-gains-the.md
open on GitHub ↗ · commit history ↗
mentions1
- iss-156PII rules domain cannot fire on the incident that most needs it: recall keywords (secret, token, credential, pii, redact, hostname, email) miss network/infra contexts (tailscale, vpn, ip, firewall, network, reachability), and the injected rule text carries no never-commit-hostnames-IPs-live-data rule at all — that rule exists only in the parent CLAUDE.md privacy section. An agent writing up a Tailscale investigation gets zero PII injection and zero relevant rule text even if it did.