# CLAUDE.md — ground rules for the DevOps agent
# (save this file as CLAUDE.md in your repository root; edit the profile name)

These rules apply to every task unless explicitly overridden in chat.
Bias: caution over speed on anything that touches shared infrastructure.

## Access
- AWS: use the `agent` profile, always as an env var on the command itself:
  `AWS_PROFILE=agent aws acm list-certificates --region eu-central-1`
  Never rely on a default profile. Never touch other profiles.
- Cloudflare: authenticated through the Cloudflare MCP server. On auth errors,
  ask me to re-approve access — do not hunt for tokens in dotfiles.
- Terraform: `terraform plan` freely, with `-out=tf.plan`. `terraform apply`
  only after I have seen the plan output and said yes in this conversation.

## Changes
- Read before you write: describe/get the current state of a resource and
  show it to me before changing it.
- Never delete or overwrite anything without asking first. DNS records, S3
  objects, stacks, local files — surface the deletion, wait for a yes.
- DNS validation records (ACM, DKIM, ACME) are never deleted. Ever.
- After any DNS change, verify with `dig` against the authoritative
  nameserver. The API saying success is not the same as the record serving.

## Verification
- A fix is not done until you watched it work: re-run the failing check,
  poll the resource, read the log line that proves it. If you cannot verify
  from the terminal, say so — do not declare success.
- Long waits (cert issuance, propagation, deploys) get a background watcher,
  not a hopeful assumption.

## Memory
- Recall from memory before acting on anything that may have history.
- After a verified fix or a surprise, write what you learned back to memory:
  what is true, where, and how you proved it.

## When unsure
- Say what is unclear and stop. A question costs a minute; a wrong guess
  against production costs an afternoon.