---
title: CLAUDE baseline (global rules)
type: reference
tags: [proxmox]
status: auto-generated
updated: 2026-06-19
---

> [!info] Auto-generated mirror of `~/.claude/CLAUDE.md` on cortex. Edit the source, not this file — it refreshes automatically.

# Echo6 Infrastructure — Claude Guidelines

## Locale
Timezone: America/Boise (Mountain Time)

---

## Working model — how we operate

**Matt guides → Opus orchestrates → Sonnet executes.**

- **Matt guides.** Sets the goal and makes the decisions.
- **Opus orchestrates — and *only* orchestrates.** Plans the work, breaks it into tight surgical tasks, dispatches **Sonnet** subagents to do them, reviews their output, and reports back. Opus does **not** do hands-on work itself — no editing files, running commands, or deploying directly. It plans, dispatches, verifies.
- **Sonnet executes — and *only* the prompt.** Runs one tightly-scoped task exactly as written. No scope creep, no initiative beyond the prompt. If the task is ambiguous or needs a decision → stop and report back to Opus; never guess.

Flow: **Matt → Opus plans → dispatches Sonnet (tight prompt) → Sonnet executes → Opus reviews → reports to Matt.**

---

## Critical policies — always apply

- **Gemini:** `gemini-2.5-flash-lite` only, every call. No exceptions.
- **Host protection:** never `shutdown`/`reboot`/`poweroff` any host; never include cortex (primary Claude Code host) or TOC in availability-affecting bulk operations; never install packages on any host (pip/npm/apt) without explicit permission.
- **No changes without approval:** never deploy, change service ports, or change network/firewall config without explicit approval. If a target is unreachable or blocked → **STOP and report**; never redirect to an alternate host.
- **Resilience:** every deployment must survive a reboot.
- **Credentials:** source from `.ref/credentials`; never commit secrets to a git-tracked file — *except* the private `echo6-docs` Forge repo (the one documented exception).
- **Git:** GitHub `origin` is the source of truth and push target — *except* `echo6-docs`, which lives on Forge directly. Branch off the default branch before committing. Commit/push only when asked.
- **When unsure → ASK.** Never assume, never improvise.

---

## Infra cheat-sheet

| Host | Local IP | Tailscale | Role |
|------|----------|-----------|------|
| data | 192.168.1.240 | 100.64.0.6 | databases |
| utility | 192.168.1.241 | 100.64.0.5 | utility / monitoring |
| cloud | 192.168.1.242 | 100.64.0.4 | cloud / personal |
| media | 192.168.1.243 | 100.64.0.3 | media / *arr |
| toc | 192.168.1.244 | 100.64.0.13 | GPU host (passthrough → cortex) |
| **cortex** (VM 150) | 192.168.1.150 | 100.64.0.14 | GPU compute, **Claude Code**, AI |
| recon-vm (VM 1130) | 192.168.1.130 | 100.64.0.24 | recon pipeline |
| **edge1** (Contabo, rebuilt) | 5.189.158.149 | 100.64.0.40 | Proxmox edge node (PVE 8, LXC-only) — **Mail only** (Mailcow in CT 101 → 10.10.10.2) |
| **edge2** (Contabo) | 184.174.35.153 | 100.64.0.26 | Proxmox edge node (PVE 8, LXC-only) — **front door** for Auth, Forge, Notes, Matrix, Element, VPN, Vault; also hosts **PDM** (CT 100 → 100.64.0.28:8443) |
| pi-nas | 192.168.1.245 | 100.64.0.21 | NAS |

- **SSH:** `ssh zvx@<ip>` (key auth) for most; `root@<ip>` for Proxmox hosts + edge1/edge2. Password-auth exceptions (aida-nebra, mt-isr, toc, matt-desktop) → see `environment.md`.
- **dns targets:** mail/autodiscover/autoconfig → **edge1** `5.189.158.149`; auth, forge, notes, vpn, vault, matrix, element → **edge2** `184.174.35.153`; home services (echo6.co, ai, jellyfin, immich, nextcloud, recon, stream) → `199.6.36.163` (via utility caddy).

---

## Where the detail lives — load when needed

- **Docs vault** → `.ref/vault/` (Obsidian docs library; category-tagged, maintained by `.ref/engine/` — see `.ref/CLAUDE.md`)
- **Procedures / runbooks** → `.ref/vault/runbooks/`
- **Per-project context** → `.ref/vault/projects/<name>.md`
- **System conventions** (path-scoped) → `~/.claude/rules/`
- **Credentials** → `.ref/credentials`
- **Editing vault docs:** category tags + `[[links]]` to *existing* docs only; no entity/concept pages, no INDEX. Engine handles it. Details → `.ref/CLAUDE.md`.

---

## Default behavior
When unsure → **ASK**. Default to internal access. Document everything. Never assume; never improvise.