# Production BE — read-only for agents; never direct edits

**Hard rule:** Do **not** modify production backend infrastructure or deployed app trees. The user deploys; agents edit the **repo only**.

## Forbidden on production BE (`alpine-be`, `apps.f0xx.org`, `artc0.intra.raptor.org`)

- **No writes:** `scp`, `rsync`, `ssh … sed/vi/tee`, editing files under `/var/www/…`, nginx/php-fpm/mariadb/wg config, cron, sudoers, `wg set`, DB mutations outside repo migrations the user runs
- **No “emergency hotfix” on prod** unless the user **explicitly** says in that message: deploy/hotfix on alpine-be now
- **No assuming** deploy is done because you changed the repo — show the BE deploy banner; user syncs

## Allowed

- Edit **`examples/crash_reporter/backend/`** (and related) in the **git repo** only
- **Lab cluster** (`cast01`–`cast03`, `/shared/cluster/`, orchestration sim) for clones, populate, verify, experiments — use these instead of touching prod
- **Read-only** prod checks (tail logs, curl, timed php **read** benchmarks) only when debugging and **never** followed by a write unless user explicitly ordered a prod hotfix

## Need a BE to test?

Spin up or use **lab VMs / local orchestration** — do **not** use production `alpine-be` as a playground.

## If you violated this

Stop, revert only if user asks, document what was changed on prod so the user can reconcile with their deploy.