cursor settings

.cursor/rules/no-prod-be-direct-edit.mdc

@@ -0,0 +1,23 @@
+# Production BE — read-only for agents; never direct edits
+
+**Hard rule:** Do **not** modify production backend infrastructure or deployed app trees. The user deploys; agents edit the **repo only**.
+
+## Forbidden on production BE (`alpine-be`, `apps.f0xx.org`, `artc0.intra.raptor.org`)
+
+- **No writes:** `scp`, `rsync`, `ssh … sed/vi/tee`, editing files under `/var/www/…`, nginx/php-fpm/mariadb/wg config, cron, sudoers, `wg set`, DB mutations outside repo migrations the user runs
+- **No “emergency hotfix” on prod** unless the user **explicitly** says in that message: deploy/hotfix on alpine-be now
+- **No assuming** deploy is done because you changed the repo — show the BE deploy banner; user syncs
+
+## Allowed
+
+- Edit **`examples/crash_reporter/backend/`** (and related) in the **git repo** only
+- **Lab cluster** (`cast01`–`cast03`, `/shared/cluster/`, orchestration sim) for clones, populate, verify, experiments — use these instead of touching prod
+- **Read-only** prod checks (tail logs, curl, timed php **read** benchmarks) only when debugging and **never** followed by a write unless user explicitly ordered a prod hotfix
+
+## Need a BE to test?
+
+Spin up or use **lab VMs / local orchestration** — do **not** use production `alpine-be` as a playground.
+
+## If you violated this
+
+Stop, revert only if user asks, document what was changed on prod so the user can reconcile with their deploy.