红线审计

1. Install redline

Via Homebrew:

brew install rdegges/tap/redline

Via go install:

go install github.com/rdegges/redline/cmd/redline@latest

Or grab a pre-built binary from the releases page.

2. Install Ollama (one-time)

```bash

1. REWRITE — https://example.com/products/container

Priority: 56.3 | Confidence: 0.90 | Word count: 44

Primary label: Contradictory Secondary labels: Stale

Page summary

- Current focus: Positions Container Security as a runtime threat-detection product. - Should focus on: Container handles image and Kubernetes vulnerability scanning; runtime threat detection is out of scope.

Findings

Finding f1 — contradicts_canonical (severity: HIGH)

Quoted text on page: > Continuous runtime threat detection across AWS, Azure, and GCP.

Suggested fix: Delete this sentence entirely. Runtime CSPM is not in scope.

Edit plan

Remove: The runtime threat-detection sentence Rewrite: H1 headline → "Container Security: Image and Kubernetes vulnerability scanning" Add: A cross-link to AppRisk for compliance mapping ```

The quoted_text field is guaranteed to be a literal substring of the page body, so a downstream editor agent can locate it with a string match.

The full report.json is the machine-readable equivalent — validates against an embedded JSON Schema, deterministic ordering, every collection explicitly sorted at the boundary.

Quickstart

redline is local-first. The default invocation needs zero cloud API keys; it talks to a local Ollama server.

Command reference

redline scan       Crawl, judge, embed, and write a report (full pipeline)
redline crawl      Run only the crawl stage (no LLM calls)
redline judge      Run only the LLM judge stage against an existing DB
redline embed      Run only the embedding + dedup stage
redline report     Regenerate a report from an existing DB
redline doctor     Diagnose runtime, DB, and provider readiness (use `--run` to also inspect a scan run)
redline models     Local Ollama model info (list, recommend)
redline version    Print version information

Troubleshooting

• ollama unavailable / connection refused → Start Ollama: ollama serve.
• ollama model not pulled → ollama pull qwen3:30b and ollama pull nomic-embed-text.
• Configured prompts.yaml didn't validate → redline scan --print-schema shows the embedded JSON Schema.
• A run aborted mid-scan? Inspect what stage it stopped at with redline doctor --run latest — it summarizes counts and suggests the right resume command. Re-running redline scan with the same --db path picks up where it left off automatically. Add --json for scriptable NDJSON output: the per-check lines are followed by a single {"kind":"run_inspection",...} record covering the run's state.