# PowerDNS API Simulator — project rules

Read PLAN.md before doing anything. It is the spec; docs/SEMANTICS.md (produced in Phase 0) is the data-shape contract.

Invariants that hold in every session and every subagent:

- Configuration is environment variables ONLY. No config files. `config.yaml` and its loader are being removed, not maintained.
- Never run acme.sh against the Let's Encrypt production CA. `--staging` always.
- The live MySQL schema is the source of truth for the CoreDNS side, not plugin documentation. Verify against the running DB.
- Dockerfile and Makefile already exist: follow their style, amend only when required, never rewrite.
- The binary starts as root and drops to PUID/PGID before serving. Do not add a `USER` directive to the Dockerfile.
- DNS verification goes through `dig @1.2.3.4` (authoritative, no cache). Remember CoreDNS `zone_update_interval` before declaring a propagation failure.
- Follow existing repository style. Direct, minimal output. No speculative features beyond PLAN.md's scope; the Explicit non-goals section is binding.