From a33f8183c0e0033f7ac67f137c03afe290fba28e Mon Sep 17 00:00:00 2001 From: Anton Afanasyeu Date: Mon, 15 Jun 2026 11:57:19 +0200 Subject: [PATCH] cursor settings --- .cursor/rules/no-prod-be-direct-edit.mdc | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 .cursor/rules/no-prod-be-direct-edit.mdc diff --git a/.cursor/rules/no-prod-be-direct-edit.mdc b/.cursor/rules/no-prod-be-direct-edit.mdc new file mode 100644 index 0000000..b4de4b2 --- /dev/null +++ b/.cursor/rules/no-prod-be-direct-edit.mdc @@ -0,0 +1,23 @@ +# Production BE — read-only for agents; never direct edits + +**Hard rule:** Do **not** modify production backend infrastructure or deployed app trees. The user deploys; agents edit the **repo only**. + +## Forbidden on production BE (`alpine-be`, `apps.f0xx.org`, `artc0.intra.raptor.org`) + +- **No writes:** `scp`, `rsync`, `ssh … sed/vi/tee`, editing files under `/var/www/…`, nginx/php-fpm/mariadb/wg config, cron, sudoers, `wg set`, DB mutations outside repo migrations the user runs +- **No “emergency hotfix” on prod** unless the user **explicitly** says in that message: deploy/hotfix on alpine-be now +- **No assuming** deploy is done because you changed the repo — show the BE deploy banner; user syncs + +## Allowed + +- Edit **`examples/crash_reporter/backend/`** (and related) in the **git repo** only +- **Lab cluster** (`cast01`–`cast03`, `/shared/cluster/`, orchestration sim) for clones, populate, verify, experiments — use these instead of touching prod +- **Read-only** prod checks (tail logs, curl, timed php **read** benchmarks) only when debugging and **never** followed by a write unless user explicitly ordered a prod hotfix + +## Need a BE to test? + +Spin up or use **lab VMs / local orchestration** — do **not** use production `alpine-be` as a playground. + +## If you violated this + +Stop, revert only if user asks, document what was changed on prod so the user can reconcile with their deploy.