Cursor rule

1---
2description: Never demo stale GHCR web; pick images by OCI created; gate Caddy URLs
3alwaysApply: true
4---
5 
6# Demo / GHCR — do not test the wrong image
7 
8## What the user will see
9 
10- **Unmerged frontend** (this branch, dirty `frontend/web`, closed-not-published PR): GHCR `openfdd-web` is **stale by definition**. Serve a **local** bundle. Never send a Caddy link for `ghcr.io/bbartling/openfdd-web:sha-*` / `:nightly`.
11- **Merged + published**: pull **newest-by-OCI-`created`**, not tag name. `:nightly` and `sha-*` sort order are not newest.
12 
13```bash
14./scripts/ghcr_newest_by_created.py openfdd-central openfdd-web
15```
16 
17Then pin `OPENFDD_IMAGE_TAG=sha-<that>` and recreate. Do not `docker pull …:nightly` and call it tip.
18 
19## Gate before any login URL
20 
21```bash
22./scripts/openfdd_demo_gate.sh --local-web --marker overview-vibe19-oracle
23# or, only if the user asked for published GHCR:
24./scripts/openfdd_demo_gate.sh --ghcr-web
25```
26 
27If the gate fails: fix serve. Do **not** paste `http://192.168.204.55/auth` and blame the user.
28 
29Say explicitly: **local Overview bundle, not GHCR** — or **GHCR sha-… newest-by-created**.
30 
31## Rust vs web
32 
33Leave `central` / `mqtt` / `fieldbus` on GHCR `sha-*` (newest-by-created). Local cargo is not the demo path. Unmerged UI = Node build + bind-mount / local web image only.
34