From 32622a01de5f7f1c4115835c945b4bcfaafd4dda Mon Sep 17 00:00:00 2001 From: J8k3 Date: Thu, 21 May 2026 19:01:04 -0400 Subject: [PATCH] AGENTS.md: add reciprocal knowledge loop rule to APC cross-reference MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The one-way rule (CyberChef gaps → GitHub issue) didn't cover the return path. New paragraph: discoveries from CyberChef sessions (PCI rules, algorithm edge cases, HSM commands) must be written back into the MCP server in the same session. Co-Authored-By: Claude Sonnet 4.6 --- AGENTS.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/AGENTS.md b/AGENTS.md index 95c920b3..8d179344 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -41,6 +41,8 @@ Whenever a payment cryptography question arises — algorithm behavior, key type If the data is not available via APC-agent (endpoint doesn't exist, key-mode constraint, API gap), **treat that as a documented gap** — file a GitHub issue at `J8k3/CyberChef` capturing the operation, what was tried, and what's needed to close it. Do not guess APC behavior from training data; use the live tools. +**Knowledge contribution (reciprocal):** When this session surfaces new payment domain knowledge — a PCI rule, an algorithm edge case, an APC API constraint, an HSM command mapping — write it back into the MCP server in the same session: `payment-knowledge-base.md` for domain facts, `hsm_analysis.py` for HSM commands, `compliance.py` for enforcement rules. Do not defer. The two repos are a knowledge loop: CyberChef proves behavior in tests; the MCP server codifies it for LLM consumption. + This check is for internal development and validation only. APC must never appear in CyberChef UI text (operation names, descriptions, inline help, arg labels). ## Security Constraint