# Repository Rules

These rules apply to all work in this repository.

## Production

- Treat `https://phyllisschlafly.com` as the production site.
- Keep production read-only unless the operator gives explicit approval for a specific change.
- Do not make production changes during local setup or validation.
- Do not infer approval from repository access or available credentials.
- Stop if a command can change production and explicit approval is absent.

## Protected Data

Never store these items in the repository:

- Secrets or credentials
- Private keys
- Database exports
- WordPress uploads
- WordPress core files
- Installed dependencies
- Caches
- Logs

Use `.env` for local configuration. Keep `.env` outside version control.

## Access

- Use TLS verification for each network connection.
- Do not bypass TLS verification.
- Use read-only credentials when production access is necessary.
- Limit production SQL to `SELECT`, `SHOW`, `DESCRIBE`, or `EXPLAIN`.
- Do not put production credentials in GitHub Actions.
- Follow [docs/ACCESS.md](docs/ACCESS.md) before you activate an access method.

## Work Method

- Make and test changes in the local environment.
- Review each command before you run it against a remote host.
- Record public site structure in [docs/SITE-INVENTORY.md](docs/SITE-INVENTORY.md).
- Follow [docs/SAFETY.md](docs/SAFETY.md) for all validation work.

## Prose

Use ASD-STE100 Simplified Technical English for new or revised prose.