# Access Methods

Use the minimum access that completes the task.
Keep all access through this scaffold read-only.
This scaffold never authorizes a production write.
Use a separate access method for an approved production write.
Use a change procedure outside this scaffold for that write.
Receive all credentials through an approved private channel.
Store credentials only in `.env` or an approved secret store.
Review `.env` before you use a remote wrapper.
Run wrappers through `scripts/with-environment.sh`.
The loader accepts only known `NAME=VALUE` entries.
The loader does not source or execute `.env`.
The loader clears all ambient contract values before it reads `.env`.
The loader exports only values for the selected access mode.

## Playwright

Use Playwright to inspect public pages and test the local site.
Use `SITE_URL` for read-only production checks.
Use `LOCAL_SITE_URL` for tests that can change data.
Keep TLS verification active.
Do not submit production forms.
Do not start authenticated production sessions without operator approval.

## WordPress MCP

Keep WordPress MCP disabled.
This scaffold does not include an MCP verification command.
Do not translate or load the example manifest.
Do not store WordPress MCP credentials in the repository.

## REST API

Use `scripts/with-environment.sh rest .env scripts/rest-public-read.sh`.
The `rest` mode validates configuration only.
The `rest` mode does not authenticate.
The public check removes the credential placeholders before it runs `curl`.
Use the WordPress REST API URL below `SITE_URL`.
Use only `https://phyllisschlafly.com` or `https://www.phyllisschlafly.com`.
Use the unauthenticated public REST index check in `agent/rest-api/README.md`.
Do not send credentials through the public check.
Do not send production write requests through this scaffold.
Keep TLS certificate verification active.
WordPress updates the application-password `last_used` and `last_ip` metadata after authenticated use.
This metadata update is a production write.
This scaffold cannot validate production application passwords without a WordPress metadata write.
Keep `WP_REST_USER` and `WP_REST_APPLICATION_PASSWORD` as placeholders.
Use the placeholders only for future separately approved access.

## SSH

Run the WP-CLI wrapper with `scripts/with-environment.sh ssh .env`.
Use the `WP_SSH_*` values from `.env`.
Confirm the host, user, port, and host key before login.
Use the path in `WP_REMOTE_PATH` only for read-only inspection.
Do not change remote files, permissions, services, or processes.
Do not copy private keys into the repository.

## WP-CLI

Run WP-CLI locally for local changes.
For production inspection, use commands such as `wp option get`, `wp post list`, or `wp plugin list`.
Review each WP-CLI command for side effects.
Do not use production commands that update, install, activate, import, delete, or flush data.

## Git

Use Git for source files only.
Review staged files before each commit.
Do not commit `.env`, secrets, private keys, database exports, uploads, dependencies, caches, or logs.
Do not put production credentials in GitHub Actions.

## Read-only Database Access

Run the database wrapper with `scripts/with-environment.sh database .env`.
Use only the `WP_DB_*` values from `.env`.
Use a MySQL client that supports `--no-defaults` and `--no-login-paths`.
The database wrapper disables option files and login paths.
Keep `WP_DB_SSL_MODE` set to `VERIFY_IDENTITY`.
Set `WP_DB_SSL_CA` to the approved CA certificate path.
Confirm that the database account has read-only grants.
Treat the read-only database account as the primary control.
Limit production SQL to statements that start with `SELECT`, `SHOW`, `DESCRIBE`, or `EXPLAIN`.
Do not use SQL comments.
Do not use MySQL client commands or backslash escapes.
Do not run stored procedures or multi-statement queries.
Require certificate and hostname verification for each database connection.
Stop if the client cannot verify the server certificate.