sync: auto-sync from HOWARD-HOME at 2026-06-26 11:40:19

Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-06-26 11:40:19

.claude/CLAUDE.md

@@ -31,6 +31,17 @@ production, data-loss. Detail: EXTENDED + `.claude/OLLAMA.md`.
 
 ## Key rules (always)
 - **NO EMOJIS.** Use ASCII markers: `[OK]` `[ERROR]` `[WARNING]` `[INFO]` `[CRITICAL]`.
+- **Skill-first — if a skill/command covers the task, USE IT; never hand-roll the API.**
+  When a request maps to an installed skill or slash-command, INVOKE THAT SKILL instead of
+  improvising raw `curl`/API calls from memory. The skill encodes the correct payload shape,
+  validation, attribution, and preview gates; free-handing the API is exactly how malformed
+  records (e.g. Syncro tickets/invoices) reach a human for cleanup. **Syncro billing/invoicing
+  ALWAYS runs through `/syncro` (or `/syncro-emergency-billing`) — no exceptions.** Same for
+  other covered domains: credentials → `vault`, RMM actions → `/rmm` (+ `rmm-search` to find a
+  host), M365 → `remediation-tool`, etc. Knowing the API is NOT a reason to bypass the skill —
+  the memory rules (e.g. [[feedback_syncro_billing]]) describe what the SKILL does, not a license
+  to free-hand it. Reach for raw API ONLY when no skill fits or the skill genuinely cannot do it
+  — and say so explicitly when you do. Mistakes here go to `errorlog.md` (`--correction`).
 - **Credentials — capture, vault, document (ALWAYS).** ANY credential that surfaces in a
   session — one the user pastes, one you create/rotate, one you discover in a log/config — you
   MUST immediately store it in the SOPS vault **via the `vault` skill** (the canonical path —