Skip to content

docs: keep MacDent production recon passive only #368

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
NckNA wants to merge 1 commit into
base: main
Choose a base branch
from
Open

docs: keep MacDent production recon passive only #368

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions _ai_work/MACDENT_REFERENCE_RULE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,7 +61,7 @@ Forbidden by default:
- credential theft, password extraction, cookie/session-value extraction or token harvesting;
- memory injection, DLL injection, debugger manipulation intended to defeat protections, or patching the target process;
- reading unrelated users', clinics' or tenants' data;
- making production mutations during STUDY/RECON unless a later task explicitly authorizes a controlled mutation test.
- making any MacDent production mutation for reconnaissance or experimentation. ACTIVE-PROBE writes are postponed until our own DentalFlow/Hermes systems or a separately authorized test/sandbox environment.

## 4. Patient data and secrets

Expand Down Expand Up @@ -140,6 +140,8 @@ Decompilation or deeper binary reconstruction is not categorically forbidden, bu

Reading PE metadata, signatures, hashes, module lists, printable strings and local schema structure is read-only reconnaissance and does not by itself trigger that deeper gate.

Raw process-memory extraction (`ReadProcessMemory`, memory slices/dumps or whole-process scanning) is not exposed as a shared MacDent reconnaissance capability. If later needed for our own DentalFlow/Hermes processes, it must be introduced as a separate project-scoped diagnostic tool with ownership checks and bounded reads.

## 9. MacDent is evidence, not source of truth for DentalFlow architecture

MacDent may show what works in a real clinic, but DentalFlow remains a different product architecture.
Expand Down Expand Up @@ -174,7 +176,7 @@ HERMES SKILL FIRST
→ FREEZE / MERGE
```

During STUDY/RECON the default is read-only.
MacDent production STUDY/RECON is passive read-only. Recon notes, hashes, screenshots and semantic artifacts are stored only in our Hermes/DentalFlow workspace. ACTIVE-PROBE writes are not part of ordinary MacDent production reconnaissance and are postponed until our own DentalFlow/Hermes systems or a separately authorized test/sandbox environment.

Every implementation must be explainable without requiring MacDent source code to be present. The accepted artifact is the DentalFlow semantic contract and our implementation, not a transformed copy of MacDent code.

Expand Down
Loading