Malwarebytes

Build me a focused consumer security workflow for the personal core of Malwarebytes. Requirements:

- Use exactly this stack: Go 1.24 + SQLite. Model authorized targets, source observations, findings, review decisions, and exports; keep stable source IDs and timestamps.
- Paid product context: Malware protection, browser safety, identity monitoring, and VPN plans. Build only this DIY scope: Build a local diagnostic or backup companion for consumer security; do not claim to replace audited security, identity, VPN, or cloud-storage infrastructure.
- For consumer security, configure one user-owned VPN endpoint, peer identity, and permitted routes.
- Create or import the supported tunnel configuration and bring it up through the operating system API.
- Show connected state, route, DNS resolver, and disconnect control without claiming a global VPN network.
- Use a focused consumer security input, review, and export interface. Required input or access: user-controlled storage target; documented threat-model limits.
- Acceptance: with one labelled sample, show the input, saved intermediate state, and exported result; verify this invariant: After disconnect, the original route and resolver must be restored; a failed handshake must never display connected state.
- Out of scope: audited cryptography and incident response; global network or redundant storage infrastructure. Keep this a personal, inspectable workflow.
- Include a README with setup, a sample input, required keys or permissions, data location, and the supported scope.

# AGENTS.md — Build guide for Malwarebytes

## Project scope
Build a local diagnostic or backup companion for consumer security; do not claim to replace audited security, identity, VPN, or cloud-storage infrastructure.

Catalogue verdict: no. Do not mistake the interface for the product. Malwarebytes's durable value is security, infrastructure, trust, which a solo one-shot build cannot reproduce responsibly. The prompt therefore builds only the closest honest personal consolation tool.
Use the implementation prompt below to define the deliverable. Complete each phase's acceptance checks before extending the scope.

## Working agreement
- Inspect the repository and its existing instructions before choosing paths, dependencies or commands. Keep one coherent stack and explain changes to the proposed architecture.
- Plan a vertical slice that accepts a real input and produces the useful output described below. Persist only the state the prompt calls for; respect memory-only and upstream-managed workflows. Use fixtures only when they are clearly labelled.
- After scaffolding, document the actual install, development, check and build commands in README and keep them synchronized with the package or project manifest. Do not report commands as successful unless they ran.
- Work in small steps. At handoff, list implemented flows, checks actually performed, remaining blockers, and any credentials or provider setup the owner must supply.
- Do not publish, spend money, contact customers, delete source data or run irreversible migrations without the project owner's authorization.

## Prerequisites
- desktop development machine
- user-controlled storage target
- documented threat-model limits
- Explicit README warning that this is a consolation build, not a production replacement

## Stack and architecture
- Use exactly this stack: Go 1.24 + SQLite.
- Model authorized targets, source observations, findings, review decisions, and exports; keep stable source IDs and timestamps.
- Interface for this consumer security workflow: a focused consumer security input, review, and export interface.

## Security and data integrity
- After disconnect, the original route and resolver must be restored; a failed handshake must never display connected state.
- Validate imported records and file paths; keep user data within the storage location named in the prompt.
- State the practical limit: audited cryptography and incident response.

## Agent implementation rules
- Project rule, data: Model authorized targets, source observations, findings, review decisions, and exports; keep stable source IDs and timestamps.
- Project rule, behavior: For consumer security, configure one user-owned VPN endpoint, peer identity, and permitted routes.
- Project rule, recovery: After disconnect, the original route and resolver must be restored; a failed handshake must never display connected state.

## Optional agent skills and references
No installable skill is listed for this guide; use the project rules and the stack documentation.

Read the linked SKILL.md and its dependencies before adding a skill. Select only the skills matching this project's runtime and task; their documentation does not supply API access, credentials or approval to perform external actions. Pin the reviewed revision where the tool supports it. Follow the chosen agent's documented project-level installation mechanism.

## Distribution ideas
These are optional planning notes. Obtain the owner's approval before publishing or contacting anyone.
- Demonstrate this consumer security operation with sample or user-owned data: For consumer security, configure one user-owned VPN endpoint, peer identity, and permitted routes.
- Show a concrete result or export: Show connected state, route, DNS resolver, and disconnect control without claiming a global VPN network.
- State the practical limit: audited cryptography and incident response.

## Engineering roadmap
1. Phase 1, architecture and data: Use exactly this stack: Go 1.24 + SQLite. Model authorized targets, source observations, findings, review decisions, and exports; keep stable source IDs and timestamps.
2. Phase 2, implement: For consumer security, configure one user-owned VPN endpoint, peer identity, and permitted routes.
3. Phase 3, implement: Create or import the supported tunnel configuration and bring it up through the operating system API.
4. Phase 4, review and output: Show connected state, route, DNS resolver, and disconnect control without claiming a global VPN network.
5. Phase 5, recovery and acceptance: Verify this invariant with a saved fixture: After disconnect, the original route and resolver must be restored; a failed handshake must never display connected state. State the practical limit: audited cryptography and incident response.

## Paid-product capabilities outside this build
- audited cryptography and incident response
- global network or redundant storage infrastructure
- identity, credit, or broker-removal operations
- recovery guarantees and regulated trust

## Implementation prompt
Build me a focused consumer security workflow for the personal core of Malwarebytes. Requirements:

- Use exactly this stack: Go 1.24 + SQLite. Model authorized targets, source observations, findings, review decisions, and exports; keep stable source IDs and timestamps.
- Paid product context: Malware protection, browser safety, identity monitoring, and VPN plans. Build only this DIY scope: Build a local diagnostic or backup companion for consumer security; do not claim to replace audited security, identity, VPN, or cloud-storage infrastructure.
- For consumer security, configure one user-owned VPN endpoint, peer identity, and permitted routes.
- Create or import the supported tunnel configuration and bring it up through the operating system API.
- Show connected state, route, DNS resolver, and disconnect control without claiming a global VPN network.
- Use a focused consumer security input, review, and export interface. Required input or access: user-controlled storage target; documented threat-model limits.
- Acceptance: with one labelled sample, show the input, saved intermediate state, and exported result; verify this invariant: After disconnect, the original route and resolver must be restored; a failed handshake must never display connected state.
- Out of scope: audited cryptography and incident response; global network or redundant storage infrastructure. Keep this a personal, inspectable workflow.
- Include a README with setup, a sample input, required keys or permissions, data location, and the supported scope.

## Completion evidence
Demonstrate the prompt's acceptance scenarios against the scoped workflow. Include setup from a clean checkout and failure recovery. Check persistence across restart and export/restore only for the state the prompt says to store; for memory-only tools, confirm that temporary content is discarded as specified. Record actual results and remaining limitations. A detailed plan alone does not establish a working replacement.