Mullvad

Build me a focused VPN service workflow for the personal core of Mullvad. Requirements:

- Use exactly this stack: Go 1.24 + SQLite. Model authorized targets, source observations, findings, review decisions, and exports; keep stable source IDs and timestamps.
- Paid product context: Privacy-first flat-price VPN with anonymous account numbers. Build only this DIY scope: Build a local diagnostic or backup companion for VPN service; do not claim to replace audited security, identity, VPN, or cloud-storage infrastructure.
- For VPN service, configure one user-owned VPN endpoint, peer identity, and permitted routes.
- Create or import the supported tunnel configuration and bring it up through the operating system API.
- Show connected state, route, DNS resolver, and disconnect control without claiming a global VPN network.
- Use a focused VPN service input, review, and export interface. Required input or access: user-controlled storage target; documented threat-model limits.
- Acceptance: with one labelled sample, show the input, saved intermediate state, and exported result; verify this invariant: After disconnect, the original route and resolver must be restored; a failed handshake must never display connected state.
- Out of scope: global network or redundant storage infrastructure; identity, credit, or broker-removal operations. Keep this a personal, inspectable workflow.
- Include a README with setup, a sample input, required keys or permissions, data location, and the supported scope.

# AGENTS.md — Build guide for Mullvad

## Project scope
Build a local diagnostic or backup companion for VPN service; do not claim to replace audited security, identity, VPN, or cloud-storage infrastructure.

Catalogue verdict: no. Do not mistake the interface for the product. Mullvad's durable value is security, infrastructure, trust, which a solo one-shot build cannot reproduce responsibly. The prompt therefore builds only the closest honest personal consolation tool.
Use the implementation prompt below to define the deliverable. Complete each phase's acceptance checks before extending the scope.

## Working agreement
- Inspect the repository and its existing instructions before choosing paths, dependencies or commands. Keep one coherent stack and explain changes to the proposed architecture.
- Plan a vertical slice that accepts a real input and produces the useful output described below. Persist only the state the prompt calls for; respect memory-only and upstream-managed workflows. Use fixtures only when they are clearly labelled.
- After scaffolding, document the actual install, development, check and build commands in README and keep them synchronized with the package or project manifest. Do not report commands as successful unless they ran.
- Work in small steps. At handoff, list implemented flows, checks actually performed, remaining blockers, and any credentials or provider setup the owner must supply.
- Do not publish, spend money, contact customers, delete source data or run irreversible migrations without the project owner's authorization.

## Prerequisites
- desktop development machine
- user-controlled storage target
- documented threat-model limits
- Explicit README warning that this is a consolation build, not a production replacement

## Stack and architecture
- Use exactly this stack: Go 1.24 + SQLite.
- Model authorized targets, source observations, findings, review decisions, and exports; keep stable source IDs and timestamps.
- Interface for this VPN service workflow: a focused VPN service input, review, and export interface.

## Security and data integrity
- After disconnect, the original route and resolver must be restored; a failed handshake must never display connected state.
- Validate imported records and file paths; keep user data within the storage location named in the prompt.
- State the practical limit: global network or redundant storage infrastructure.

## Agent implementation rules
- Project rule, data: Model authorized targets, source observations, findings, review decisions, and exports; keep stable source IDs and timestamps.
- Project rule, behavior: For VPN service, configure one user-owned VPN endpoint, peer identity, and permitted routes.
- Project rule, recovery: After disconnect, the original route and resolver must be restored; a failed handshake must never display connected state.

## Optional agent skills and references
No installable skill is listed for this guide; use the project rules and the stack documentation.

Read the linked SKILL.md and its dependencies before adding a skill. Select only the skills matching this project's runtime and task; their documentation does not supply API access, credentials or approval to perform external actions. Pin the reviewed revision where the tool supports it. Follow the chosen agent's documented project-level installation mechanism.

## Distribution ideas
These are optional planning notes. Obtain the owner's approval before publishing or contacting anyone.
- Demonstrate this VPN service operation with sample or user-owned data: For VPN service, configure one user-owned VPN endpoint, peer identity, and permitted routes.
- Show a concrete result or export: Show connected state, route, DNS resolver, and disconnect control without claiming a global VPN network.
- State the practical limit: global network or redundant storage infrastructure.

## Engineering roadmap
1. Phase 1, architecture and data: Use exactly this stack: Go 1.24 + SQLite. Model authorized targets, source observations, findings, review decisions, and exports; keep stable source IDs and timestamps.
2. Phase 2, implement: For VPN service, configure one user-owned VPN endpoint, peer identity, and permitted routes.
3. Phase 3, implement: Create or import the supported tunnel configuration and bring it up through the operating system API.
4. Phase 4, review and output: Show connected state, route, DNS resolver, and disconnect control without claiming a global VPN network.
5. Phase 5, recovery and acceptance: Verify this invariant with a saved fixture: After disconnect, the original route and resolver must be restored; a failed handshake must never display connected state. State the practical limit: global network or redundant storage infrastructure.

## Paid-product capabilities outside this build
- global network or redundant storage infrastructure
- identity, credit, or broker-removal operations
- recovery guarantees and regulated trust
- bank, payment, tax, and reconciliation integrations
- audited cryptography and incident response

## Implementation prompt
Build me a focused VPN service workflow for the personal core of Mullvad. Requirements:

- Use exactly this stack: Go 1.24 + SQLite. Model authorized targets, source observations, findings, review decisions, and exports; keep stable source IDs and timestamps.
- Paid product context: Privacy-first flat-price VPN with anonymous account numbers. Build only this DIY scope: Build a local diagnostic or backup companion for VPN service; do not claim to replace audited security, identity, VPN, or cloud-storage infrastructure.
- For VPN service, configure one user-owned VPN endpoint, peer identity, and permitted routes.
- Create or import the supported tunnel configuration and bring it up through the operating system API.
- Show connected state, route, DNS resolver, and disconnect control without claiming a global VPN network.
- Use a focused VPN service input, review, and export interface. Required input or access: user-controlled storage target; documented threat-model limits.
- Acceptance: with one labelled sample, show the input, saved intermediate state, and exported result; verify this invariant: After disconnect, the original route and resolver must be restored; a failed handshake must never display connected state.
- Out of scope: global network or redundant storage infrastructure; identity, credit, or broker-removal operations. Keep this a personal, inspectable workflow.
- Include a README with setup, a sample input, required keys or permissions, data location, and the supported scope.

## Completion evidence
Demonstrate the prompt's acceptance scenarios against the scoped workflow. Include setup from a clean checkout and failure recovery. Check persistence across restart and export/restore only for the state the prompt says to store; for memory-only tools, confirm that temporary content is discarded as specified. Record actual results and remaining limitations. A detailed plan alone does not establish a working replacement.