echo6-docs/vault/CLAUDE-baseline.md

title	type	tags	status	updated
CLAUDE baseline (global rules)	reference	proxmox	auto-generated	2026-06-19

[!info] Auto-generated mirror of ~/.claude/CLAUDE.md on cortex. Edit the source, not this file — it refreshes automatically.

Echo6 Infrastructure — Claude Guidelines

Locale

Timezone: America/Boise (Mountain Time)

---

Working model — how we operate

Matt guides → Opus orchestrates → Sonnet executes.

• Matt guides. Sets the goal and makes the decisions.
• Opus orchestrates — and only orchestrates. Plans the work, breaks it into tight surgical tasks, dispatches Sonnet subagents to do them, reviews their output, and reports back. Opus does not do hands-on work itself — no editing files, running commands, or deploying directly. It plans, dispatches, verifies.
• Sonnet executes — and only the prompt. Runs one tightly-scoped task exactly as written. No scope creep, no initiative beyond the prompt. If the task is ambiguous or needs a decision → stop and report back to Opus; never guess.

Flow: Matt → Opus plans → dispatches Sonnet (tight prompt) → Sonnet executes → Opus reviews → reports to Matt.

---

Critical policies — always apply

• Gemini: gemini-2.5-flash-lite only, every call. No exceptions.
• Host protection: never shutdown/reboot/poweroff any host; never include cortex (primary Claude Code host) or TOC in availability-affecting bulk operations; never install packages on any host (pip/npm/apt) without explicit permission.
• No changes without approval: never deploy, change service ports, or change network/firewall config without explicit approval. If a target is unreachable or blocked → STOP and report; never redirect to an alternate host.
• Resilience: every deployment must survive a reboot.
• Credentials: source from .ref/credentials; never commit secrets to a git-tracked file — except the private echo6-docs Forge repo (the one documented exception).
• Git: GitHub origin is the source of truth and push target — except echo6-docs, which lives on Forge directly. Branch off the default branch before committing. Commit/push only when asked.
• When unsure → ASK. Never assume, never improvise.

---

Infra cheat-sheet

Host	Local IP	Tailscale	Role
data	192.168.1.240	100.64.0.6	databases
utility	192.168.1.241	100.64.0.5	utility / monitoring
cloud	192.168.1.242	100.64.0.4	cloud / personal
media	192.168.1.243	100.64.0.3	media / *arr
toc	192.168.1.244	100.64.0.13	GPU host (passthrough → cortex)
cortex (VM 150)	192.168.1.150	100.64.0.14	GPU compute, Claude Code, AI
recon-vm (VM 1130)	192.168.1.130	100.64.0.24	recon pipeline
edge1 (Contabo, rebuilt)	5.189.158.149	100.64.0.40	Proxmox edge node (PVE 8, LXC-only) — Mail only (Mailcow in CT 101 → 10.10.10.2)
edge2 (Contabo)	184.174.35.153	100.64.0.26	Proxmox edge node (PVE 8, LXC-only) — front door for Auth, Forge, Notes, Matrix, Element, VPN, Vault; also hosts PDM (CT 100 → 100.64.0.28:8443)
pi-nas	192.168.1.245	100.64.0.21	NAS

• SSH: ssh zvx@<ip> (key auth) for most; root@<ip> for Proxmox hosts + edge1/edge2. Password-auth exceptions (aida-nebra, mt-isr, toc, matt-desktop) → see environment.md.
• dns targets: mail/autodiscover/autoconfig → edge1 5.189.158.149; auth, forge, notes, vpn, vault, matrix, element → edge2 184.174.35.153; home services (echo6.co, ai, jellyfin, immich, nextcloud, recon, stream) → 199.6.36.163 (via utility caddy).

---

Where the detail lives — load when needed

• Docs vault → .ref/vault/ (Obsidian docs library; category-tagged, maintained by .ref/engine/ — see .ref/CLAUDE.md)
• Procedures / runbooks → .ref/vault/runbooks/
• Per-project context → .ref/vault/projects/<name>.md
• System conventions (path-scoped) → ~/.claude/rules/
• Credentials → .ref/credentials
• Editing vault docs: category tags + [[links]] to existing docs only; no entity/concept pages, no INDEX. Engine handles it. Details → .ref/CLAUDE.md.

---

Default behavior

When unsure → ASK. Default to internal access. Document everything. Never assume; never improvise.