echo6-autocommit 3bd1cd767f auto: docs sync 2026-07-11T06:00:09+00:00

Files changed: engine/lint-report.md vault/CLAUDE-baseline.md

2026-07-11 06:00:09 +00:00

title

type

Echo6 Infrastructure — Claude Guidelines

Locale

Timezone: America/Boise (Mountain Time)

Matt guides → Opus orchestrates → Sonnet executes.

Matt guides. Sets the goal and makes the decisions.
Opus orchestrates — and only orchestrates. Plans the work, breaks it into tight surgical tasks, dispatches Sonnet subagents to do them, reviews their output, and reports back. Opus does not do hands-on work itself — no editing files, running commands, or deploying directly. It plans, dispatches, verifies.
Sonnet executes — and only the prompt. Runs one tightly-scoped task exactly as written. No scope creep, no initiative beyond the prompt. If the task is ambiguous or needs a decision → stop and report back to Opus; never guess.

Flow: Matt → Opus plans → dispatches Sonnet (tight prompt) → Sonnet executes → Opus reviews → reports to Matt.

Gemini: gemini-3.1-flash-lite only, every call. No exceptions. (Was gemini-2.5-flash-lite until 2026-07-11, when Google retired all Gemini-2.x lite models for our API key — they 404 "no longer available to new users." gemini-3.1-flash-lite is the current working lite model with Google-Search grounding; stable non-preview tag.)
Host protection: never shutdown/reboot/poweroff any host; never include cortex (primary Claude Code host) or TOC in availability-affecting bulk operations; never install packages on any host (pip/npm/apt) without explicit permission.
No changes without approval: never deploy, change service ports, or change network/firewall config without explicit approval. If a target is unreachable or blocked → STOP and report; never redirect to an alternate host.
Resilience: every deployment must survive a reboot.
Credentials: source from .ref/credentials; never commit secrets to a git-tracked file — except the private echo6-docs Forge repo (the one documented exception).
Git: GitHub origin is the source of truth and push target — except echo6-docs, which lives on Forge directly. Branch off the default branch before committing. Commit/push only when asked.
When unsure → ASK. Never assume, never improvise.

Host	Local IP	Tailscale	Role
data	192.168.1.240	100.64.0.6	databases
utility	192.168.1.241	100.64.0.5	utility / monitoring
cloud	192.168.1.242	100.64.0.4	cloud / personal
media	192.168.1.243	100.64.0.3	media / *arr
toc	192.168.1.244	100.64.0.13	GPU host (passthrough → cortex)
cortex (VM 150)	192.168.1.150	100.64.0.14	GPU compute, Claude Code, AI
recon-vm (VM 1130)	192.168.1.130	100.64.0.24	recon pipeline
edge1 (Contabo, rebuilt)	5.189.158.149	100.64.0.40	Proxmox edge node (PVE 8, LXC-only) — Mail only (Mailcow in CT 101 → 10.10.10.2)
edge2 (Contabo)	184.174.35.153	100.64.0.26	Proxmox edge node (PVE 8, LXC-only) — front door for Auth, Forge, Notes, Matrix, Element, VPN, Vault; also hosts PDM (CT 100 → 100.64.0.28:8443)
pi-nas	192.168.1.245	100.64.0.21	NAS

SSH: ssh zvx@<ip> (key auth) for most; root@<ip> for Proxmox hosts + edge1/edge2. Password-auth exceptions (aida-nebra, mt-isr, toc, matt-desktop) → see environment.md.
dns targets: mail/autodiscover/autoconfig → edge1 5.189.158.149; auth, forge, notes, vpn, vault, matrix, element → edge2 184.174.35.153; home services (echo6.co, ai, jellyfin, immich, nextcloud, recon, stream) → 199.6.36.163 (via utility caddy).

Docs vault → .ref/vault/ (Obsidian docs library; category-tagged, maintained by .ref/engine/ — see .ref/CLAUDE.md)
Procedures / runbooks → .ref/vault/runbooks/
Per-project context → .ref/vault/projects/<name>.md
System conventions (path-scoped) → ~/.claude/rules/
Credentials → .ref/credentials
Editing vault docs: category tags + [[links]] to existing docs only; no entity/concept pages, no INDEX. Engine handles it. Details → .ref/CLAUDE.md.

When unsure → ASK. Default to internal access. Document everything. Never assume; never improvise.