Add AD scripts and stage import instructions

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.claude/.periodic-save-state.json

@@ -1,6 +1,6 @@
 {
   "active_seconds": 0,
   "last_update": "2026-01-17T20:54:06.412111+00:00",
-  "last_save": "2026-01-17T23:51:21.065656+00:00",
-  "last_check": "2026-01-17T23:51:21.065947+00:00"
+  "last_save": "2026-01-17T23:55:06.684889+00:00",
+  "last_check": "2026-01-17T23:55:06.685364+00:00"
 }

.claude/AGENT_COORDINATION_RULES.md

@@ -1,400 +1,38 @@
 # Agent Coordination Rules
 
-**CRITICAL: Main Claude is a COORDINATOR, not an executor**
-
----
-
-## Core Principle
-
-**Main Claude Instance:**
-- Coordinates work between user and agents
-- Makes decisions and plans
-- Presents concise results to user
-- **NEVER performs database operations directly**
-- **NEVER makes direct API calls to ClaudeTools API**
-
-**Agents:**
-- Execute specific tasks (database, coding, testing, etc.)
-- Return concise summaries
-- Preserve Main Claude's context space
-
----
-
-## Database Operations - ALWAYS Use Database Agent
-
-### ❌ WRONG (What I Was Doing)
-
-```bash
-# Main Claude making direct queries
-ssh guru@172.16.3.30 "mysql -u claudetools ... SELECT ..."
-curl http://172.16.3.30:8001/api/conversation-contexts ...
-```
-
-### ✅ CORRECT (What Should Happen)
-
-```
-Main Claude → Task tool → Database Agent → Returns summary
-```
-
-**Example:**
-```
-User: "How many contexts are saved?"
-
-Main Claude: "Let me check the database"
-  ↓
-Launches Database Agent with task: "Count conversation_contexts in database"
-  ↓
-Database Agent: Queries database, returns: "7 contexts found"
-  ↓
-Main Claude to User: "There are 7 contexts saved in the database"
-```
+**Purpose:** Reference for agents about their responsibilities and coordination patterns.
+**Main Claude behavioral rules are in CLAUDE.md - this file is for agent reference only.**
 
 ---
 
 ## Agent Responsibilities
 
-### Database Agent (`.claude/agents/database.md`)
-**ONLY agent authorized for database operations**
+| Agent | Authority | Examples |
+|-------|-----------|----------|
+| Database Agent | ALL data operations | Queries, inserts, updates, deletes, API calls |
+| Coding Agent | Production code | Python, PowerShell, Bash; new code and modifications |
+| Testing Agent | Test execution | pytest, validation scripts, performance tests |
+| Code Review Agent | Code quality (MANDATORY) | Security, standards, quality checks before commits |
+| Gitea Agent | Git/version control | Commits, pushes, branches, tags |
+| Backup Agent | Backup/restore | Create backups, restore data, verify integrity |
 
-**Handles:**
-- All SELECT, INSERT, UPDATE, DELETE queries
-- Context storage and retrieval
-- Data validation and integrity
-- Transaction management
-- Query optimization
+## Coordination Flow
 
-**Returns:** Concise summaries, not raw SQL results
-
-**When to use:**
-- Saving contexts to database
-- Retrieving contexts from database
-- Checking record counts
-- Any database operation
-
-### Coding Agent (`.claude/agents/coding.md`)
-**Handles code writing and modifications**
-
-**When to use:**
-- Writing new code
-- Modifying existing code
-- Creating scripts
-
-### Testing Agent (`.claude/agents/testing.md`)
-**Handles test execution**
-
-**When to use:**
-- Running tests
-- Executing validation scripts
-- Performance testing
-
-### Code Review Agent (`.claude/agents/code-review.md`)
-**Reviews code quality**
-
-**When to use:**
-- After significant code changes
-- Before committing
-
-### Gitea Agent (`.claude/agents/gitea.md`)
-**Handles Git operations**
-
-**When to use:**
-- Git commits
-- Push to remote
-- Branch management
-
-### Backup Agent (`.claude/agents/backup.md`)
-**Manages backups**
-
-**When to use:**
-- Creating backups
-- Restoring data
-- Backup verification
-
----
-
-## Violation Examples from This Session
-
-### ❌ Violation 1: Direct Database Queries
-```bash
-ssh guru@172.16.3.30 "mysql ... SELECT COUNT(*) FROM conversation_contexts"
 ```
-**Should have been:** Database Agent task
-
-### ❌ Violation 2: Direct API Calls
-```bash
-curl -X POST http://172.16.3.30:8001/api/conversation-contexts ...
-```
-**Should have been:** Database Agent task
-
-### ❌ Violation 3: Direct Context Creation
-```bash
-curl ... -d '{"context_type": "session_summary", ...}'
-```
-**Should have been:** Database Agent task
-
----
-
-## Correct Coordination Flow
-
-### Example: Save Context to Database
-
-**User Request:** "Save the current context"
-
-**Main Claude Actions:**
-1. ✅ Summarize what needs to be saved
-2. ✅ Launch Database Agent with task:
-   ```
-   "Save session context to database:
-   - Title: [summary]
-   - Dense summary: [compressed context]
-   - Tags: [relevant tags]
-   - Score: 8.5"
-   ```
-3. ✅ Receive agent response: "Context saved with ID abc-123"
-4. ✅ Tell user: "Context saved successfully"
-
-**What Main Claude Does NOT Do:**
-- ❌ Make direct curl calls
-- ❌ Make direct SQL queries
-- ❌ Return raw database results to user
-
----
-
-## Example: Retrieve Contexts
-
-**User Request:** "What contexts do we have about offline mode?"
-
-**Main Claude Actions:**
-1. ✅ Launch Database Agent with task:
-   ```
-   "Search conversation_contexts for entries related to 'offline mode'.
-   Return: titles, scores, and brief summaries of top 5 results"
-   ```
-2. ✅ Receive agent summary:
-   ```
-   Found 3 contexts:
-   1. "Offline Mode Implementation" (score 9.5)
-   2. "Offline Mode Testing" (score 8.0)
-   3. "Offline Mode Documentation" (score 7.5)
-   ```
-3. ✅ Present to user in conversational format
-
-**What Main Claude Does NOT Do:**
-- ❌ Query API directly
-- ❌ Show raw JSON responses
-- ❌ Execute SQL
-
----
-
-## Benefits of Agent Architecture
-
-### Context Preservation
-- Main Claude's context not polluted with raw data
-- Can handle longer conversations
-- Focus on coordination, not execution
-
-### Separation of Concerns
-- Database Agent handles data integrity
-- Coding Agent handles code quality
-- Main Claude handles user interaction
-
-### Scalability
-- Agents can run in parallel
-- Each has full context window for their task
-- Complex operations don't bloat main context
-
----
-
-## Enforcement
-
-### Before Making ANY Database Operation:
-
-**Ask yourself:**
-1. Am I about to query the database directly? → ❌ STOP
-2. Am I about to call the ClaudeTools API? → ❌ STOP
-3. Should the Database Agent handle this? → ✅ USE AGENT
-
-### When to Launch Database Agent:
-- Saving any data (contexts, tasks, sessions, etc.)
-- Retrieving any data from database
-- Counting records
-- Searching contexts
-- Updating existing records
-- Deleting records
-- Any SQL operation
-
----
-
-## Going Forward
-
-**Main Claude Responsibilities:**
-- ✅ Coordinate with user
-- ✅ Make decisions about what to do
-- ✅ Launch appropriate agents
-- ✅ Synthesize agent results for user
-- ✅ Plan and design solutions
-- ✅ **Automatically invoke skills when triggered** (NEW)
-- ✅ **Recognize when Sequential Thinking is needed** (NEW)
-- ✅ **Execute dual checkpoints (git + database)** (NEW)
-
-**Main Claude Does NOT:**
-- ❌ Query database directly
-- ❌ Make API calls to ClaudeTools API
-- ❌ Execute code (unless simple demonstration)
-- ❌ Run tests (use Testing Agent)
-- ❌ Commit to git (use Gitea Agent)
-- ❌ Review code (use Code Review Agent)
-- ❌ Write production code (use Coding Agent)
-
----
-
-## New Capabilities (Added 2026-01-17)
-
-### 1. Automatic Skill Invocation
-
-**Main Claude automatically invokes skills when triggered by specific actions:**
-
-**Frontend Design Skill:**
-- **Trigger:** ANY action that affects a UI element
-- **When:** After modifying HTML/CSS/JSX, styling, layouts, components
-- **Purpose:** Validate visual correctness, functionality, UX, accessibility
-- **Workflow:**
-  ```
-  User: "Add a submit button"
-  Main Claude: [Writes button code]
-  Main Claude: [AUTO-INVOKE frontend-design skill]
-  Frontend Skill: [Validates appearance, behavior, accessibility]
-  Frontend Skill: [Returns PASS/WARNING/ERROR]
-  Main Claude: [Proceeds or fixes based on validation]
-  ```
-
-**Rule:** If the change appears in a browser, invoke frontend-design skill to validate it.
-
-### 2. Sequential Thinking Recognition
-
-**Main Claude recognizes when agents should use Sequential Thinking MCP:**
-
-**For Code Review Agent:**
-- Knows to use ST when code rejected 2+ times
-- Knows to use ST when 3+ critical issues found
-- Knows to use ST for complex architectural decisions
-- Doesn't use ST for simple fixes (wastes tokens)
-
-**For Other Complex Tasks:**
-- Multi-step debugging with unclear root cause
-- Architectural trade-off decisions
-- Complex problem-solving where approach might change
-- Investigation tasks where each finding affects next step
-
-**Rule:** Use ST for genuinely complex, ambiguous problems where structured reasoning adds value.
-
-### 3. Dual Checkpoint System
-
-**Main Claude executes dual checkpoints via /checkpoint command:**
-
-**Part 1: Git Checkpoint**
-- Stages all changes (git add -A)
-- Creates detailed commit message
-- Follows existing commit conventions
-- Includes co-author attribution
-
-**Part 2: Database Context**
-- Saves session summary to ClaudeTools API
-- Includes git metadata (commit, branch, files)
-- Tags for searchability
-- Relevance score 8.0 (important milestone)
-
-**Workflow:**
-```
-User: /checkpoint
-Main Claude: [Analyzes changes]
-Main Claude: [Creates git commit]
-Main Claude: [Saves context to database via API/script]
-Main Claude: [Verifies both succeeded]
-Main Claude: [Reports to user]
+User request -> Main Claude (coordinator) -> Launches agent(s) -> Agent returns summary -> Main Claude presents to user
 ```
 
-**Benefits:**
-- Git: Code versioning and rollback
-- Database: Cross-machine context recall
-- Together: Complete project memory
+- Main Claude NEVER queries databases, writes production code, runs tests, or commits directly
+- Agents return concise summaries, not raw data
+- Independent operations run in parallel
+- Use Sequential Thinking MCP for genuinely complex problems
 
-### 4. Skills vs Agents
+## Skills vs Agents
 
-**Main Claude understands the difference:**
-
-**Skills** (invoked via Skill tool):
-- Frontend design/validation
-- User-invocable with `/skill-name`
-- Specialized capabilities
-- Return enhanced output
-
-**Agents** (invoked via Task tool):
-- Database operations
-- Code writing
-- Testing
-- Code review
-- Git operations
-- Backup/restore
-
-**Rule:** Skills are for specialized enhancements (frontend, design patterns). Agents are for core operations (database, coding, testing).
+- **Skills** (Skill tool): Specialized enhancements - frontend-design validation, design patterns
+- **Agents** (Task tool): Core operations - database, code, testing, git, backups
+- **Rule:** Skills enhance/validate. Agents execute/operate.
 
 ---
 
-## Quick Reference
-
-| Operation | Handler |
-|-----------|---------|
-| Save context | Database Agent |
-| Retrieve contexts | Database Agent |
-| Count records | Database Agent |
-| Write code | Coding Agent |
-| Run tests | Testing Agent |
-| Review code | Code Review Agent |
-| Git operations | Gitea Agent |
-| Backups | Backup Agent |
-| **UI validation** | **Frontend Design Skill (auto-invoked)** |
-| **Complex problem analysis** | **Sequential Thinking MCP** |
-| **Dual checkpoints** | **/checkpoint command (Main Claude)** |
-| **User interaction** | **Main Claude** |
-| **Coordination** | **Main Claude** |
-| **Decision making** | **Main Claude** |
-| **Skill invocation** | **Main Claude** |
-
----
-
-**Remember: Main Claude = Coordinator, not Executor**
-
-**When in doubt, use an agent or skill!**
-
----
-
-## Summary of Main Claude's Role
-
-**Main Claude is the conductor of an orchestra:**
-- Receives user requests
-- Decides which agents/skills to invoke
-- Coordinates workflow between agents
-- Automatically triggers skills when appropriate
-- Synthesizes results for user
-- Maintains conversation context
-
-**Main Claude does NOT:**
-- Execute database operations directly
-- Write production code (delegates to Coding Agent)
-- Run tests directly (delegates to Testing Agent)
-- Review code directly (delegates to Code Review Agent)
-- Perform git operations directly (delegates to Gitea Agent)
-
-**Main Claude DOES automatically:**
-- Invoke frontend-design skill for ANY UI change
-- Recognize when Sequential Thinking is appropriate
-- Execute dual checkpoints (git + database) via /checkpoint
-- Coordinate agents and skills intelligently
-
----
-
-**Created:** 2026-01-17
-**Last Updated:** 2026-01-17 (added new capabilities)
-**Purpose:** Ensure proper agent-based architecture
-**Status:** Mandatory guideline for all future operations
+**Last Updated:** 2026-02-17

.claude/API_SPEC.md

@@ -906,7 +906,7 @@ Main Claude (JWT: user token)
 
 ## Implementation Status
 
-- ✅ API Design (this document)
+- [OK] API Design (this document)
 - ⏳ FastAPI implementation
 - ⏳ Database schema deployment
 - ⏳ JWT authentication flow

.claude/ARCHITECTURE_OVERVIEW.md

@@ -721,10 +721,10 @@ D:\ClaudeTools\
 
 ## Implementation Status
 
-- ✅ Architecture designed
-- ✅ Database schema (36 tables)
-- ✅ Agent types defined (13 agents)
-- ✅ API endpoints specified
+- [OK] Architecture designed
+- [OK] Database schema (36 tables)
+- [OK] Agent types defined (13 agents)
+- [OK] API endpoints specified
 - ⏳ FastAPI implementation
 - ⏳ Database deployment on Jupiter
 - ⏳ JWT authentication flow

.claude/CLAUDE.md

@@ -0,0 +1,246 @@
+# ClaudeTools on AD2 (Dataforth Domain Controller)
+
+## Identity
+
+This is the AD2 workstation instance of ClaudeTools. This machine is a Windows Server on the Dataforth LAN (192.168.0.6). Your scope is Dataforth-only -- you do not need context about other clients.
+
+## NO EMOJIS
+
+Use ASCII markers: [OK], [ERROR], [WARNING], [SUCCESS], [INFO]
+
+---
+
+## Git & Sync
+
+### Gitea Credentials (no 1Password on this machine)
+- URL: https://git.azcomputerguru.com
+- Username: mike@azcomputerguru.com
+- Password: Gptf*77ttb123!@#-git
+- URL-encoded password: Gptf%2A77ttb123%21%40%23-git
+- API Token: 9b1da4b79a38ef782268341d25a4b6880572063f
+- Remote: https://mike%40azcomputerguru.com:Gptf%2A77ttb123%21%40%23-git@git.azcomputerguru.com/azcomputerguru/claudetools.git
+
+### Branch: ad2
+This machine operates on the `ad2` branch. The main workstation merges into main.
+
+### /save behavior
+Save session logs to `session-logs/YYYY-MM-DD-session-ad2.md` (note the -ad2 suffix).
+After saving, commit and push to origin/ad2.
+
+### /sync behavior
+```
+git fetch origin
+git rebase origin/main
+git push origin ad2
+```
+
+---
+
+## Dataforth Network
+
+| Host | IP | Role | Notes |
+|------|-----|------|-------|
+| AD1 | 192.168.0.27 | Primary DC | Disk at 90%, C:\Engineering = 787 GB |
+| **AD2** | **192.168.0.6** | **This machine** | Secondary DC, TestDataDB, file shares |
+| D2TESTNAS | 192.168.0.9 | SMB1 proxy for DOS | Debian 13, Samba, SSH root/Paper123!@#-nas |
+| UDM | 192.168.0.254 | Gateway/Router | UniFi Dream Machine |
+| ESXi-122 | 192.168.0.122 | Hypervisor | ESXi |
+| ESXi-124 | 192.168.0.124 | Hypervisor | ESXi |
+| DOS stations | TS-01 to TS-30+ | Test stations | DOS 6.22, QuickBASIC ATE software |
+
+### Credentials
+- AD Sysadmin: INTRANET\sysadmin / Paper123!@#
+- D2TESTNAS SSH: root@192.168.0.9 / Paper123!@#-nas
+- D2TESTNAS Samba: guest access (no password)
+- WINS/NPS: 192.168.0.27:1812/1813
+- M365 Tenant: 7dfa3ce8-c496-4b51-ab8d-bd3dcd78b584
+- Rsync daemon (NAS): port 873, module "test", user rsync / IQ203s32119
+
+---
+
+## Local Resources
+
+| Resource | Path |
+|----------|------|
+| TestDataDB app | C:\Shares\testdatadb\ |
+| Test database | C:\Shares\testdatadb\database\testdata.db (SQLite, 2.2M+ records) |
+| TestDataDB API | http://localhost:3000 |
+| Parsers | C:\Shares\testdatadb\parsers\ (multiline.js, csvline.js, shtfile.js, spec-reader.js) |
+| Templates | C:\Shares\testdatadb\templates\datasheet-exact.js |
+| Import script | C:\Shares\testdatadb\database\import.js |
+| Export script | C:\Shares\testdatadb\database\export-datasheets.js |
+| Stage import | C:\Shares\testdatadb\import-all-stage.js |
+| NAS share | \\D2TESTNAS\test (mapped as T:) |
+| Datasheets share | X:\For_Web |
+| ProdSW (BAT files) | C:\Shares\test\COMMON\ProdSW\ |
+| Sync script | C:\Shares\test\scripts\Sync-FromNAS.ps1 (bidirectional, 15-min schedule) |
+
+---
+
+## DOS Update System - Batch Files
+
+### Boot Sequence on DOS Machines
+```
+AUTOEXEC.BAT (v4.1)
+  -> STARTNET.BAT (v2.0) -- init network, map T: and X: drives
+  -> ATESYNC.BAT
+      -> CTONW.BAT (v5.0) -- upload test data to network
+          -> CTONWTXT.BAT (v2.3) -- upload C:\STAGE\*.TXT to T:\STAGE\%MACHINE%
+      -> NWTOC.BAT (v5.0) -- download updates from network
+```
+
+### Current Production Versions (on AD2 & NAS)
+| File | Version | Last Update | Purpose |
+|------|---------|-------------|---------|
+| AUTOEXEC.BAT | v4.1 | 2026-03-12 | Startup config |
+| STARTNET.BAT | v2.0 | 2026-01-20 | Network init |
+| NWTOC.BAT | v5.0 | 2026-03-16 | Download updates from network |
+| CTONW.BAT | v5.0 | 2026-03-28 | Upload test data (5 steps with echo) |
+| CTONWTXT.BAT | v2.3 | 2026-03-28 | Upload Stage TXT files (no MD, dirs pre-created) |
+| CHECKUPD.BAT | v1.3 | 2026-01-20 | Check for updates |
+| UPDATE.BAT | v2.3 | 2026-01-20 | Full system backup |
+| STAGE.BAT | v1.0 | Original | Stage system file updates |
+| DEPLOY.BAT | v1.0 | 2026-01-20 | One-time deployment installer |
+
+### DOS 6.22 Compatibility Rules
+- NO `IF NOT` -- unreliable on DOS 6.22. Use positive `IF EXIST` with GOTO
+- NO `IF /I` (case-insensitive compare)
+- NO `FOR /F` loops
+- NO `%COMPUTERNAME%` -- use `%MACHINE%` (set during DEPLOY)
+- `XCOPY /D` requires date parameter (`/D:mm-dd-yy`)
+- `MD` fails with error on existing directories -- pre-create dirs server-side
+- `COPY` without `/Y` hangs on overwrite prompts
+- All paths UPPERCASE for Samba compatibility
+- Line endings MUST be CRLF (0D 0A)
+
+---
+
+## Serial Number Encoding (DOS 8.3 filenames)
+
+QuickBASIC ATE encodes long serial numbers for 8.3 filenames:
+```
+First 2 digits replaced with hex letter if serial too long:
+  178236-12  ->  H8236-12.TXT  (17 -> H, charCode 72 - 55 = 17)
+  10819-1    ->  A819-1.TXT    (10 -> A, charCode 65 - 55 = 10)
+
+Decode: letter.charCodeAt(0) - 55 = numeric prefix
+Only applies when filename starts with [A-Z] followed by digits.
+
+H-prefix files have decoded SN inside the file (SN: 178236-12)
+A-prefix files have encoded SN inside the file (SN: A819-1) -- must decode to 10819-1
+```
+
+---
+
+## Test Datasheet Pipeline
+
+### 5-Stage Architecture
+1. **DOS Test Programs** -> Write DAT files to C:\ATE\*LOG\ and TXT to C:\STAGE\
+2. **Boot Upload** -> CTONW.BAT copies DAT to T:\%MACHINE%\LOGS\, CTONWTXT copies TXT to T:\STAGE\%MACHINE%
+3. **NAS <-> AD2 Sync** -> Rsync every 15 min (Sync-FromNAS.ps1 scheduled task)
+4. **TestDataDB Import** -> import.js parses DAT into SQLite; export-datasheets.js generates TXT to X:\For_Web
+5. **Web Share** -> X:\For_Web\ holds validated datasheets (501K+ files)
+
+### import-all-stage.js (ready to run)
+Located at `C:\Shares\testdatadb\import-all-stage.js`. Processes ~8,100 TXT files:
+- Scans \\D2TESTNAS\test\STAGE\TS-*\*.TXT
+- Decodes hex-prefix serial numbers
+- Cross-references testdata.db by (serial_number, model_number)
+- Inserts missing records as log_type='SHT'
+- Copies to X:\For_Web\{decoded_serial}.TXT
+
+```
+cd C:\Shares\testdatadb
+node import-all-stage.js
+```
+
+### Machine data volumes in STAGE
+| Machine | Files |
+|---------|-------|
+| TS-4L | 3,082 |
+| TS-4R | 2,741 |
+| TS-1R | 509 |
+| TS-8R | 478 |
+| TS-3R | 435 |
+| TS-11R | 325 |
+| TS-8L | 285 |
+| TS-11L | 248 |
+| TS-27 | 10 (already imported) |
+| TS-1L | 1 |
+
+### Web Share Layout (X:\)
+- X:\For_Web -- Validated datasheets (production)
+- X:\For_Web_PDF -- PDF versions (4.7K files)
+- X:\Test_Datasheets -- Incoming/staging
+- X:\Bad_Datasheets -- Invalid files (18K)
+- X:\Datasheets_Log -- Processing logs
+
+---
+
+## Known Issues & Pending Work
+
+### HIGH PRIORITY
+1. **Run import-all-stage.js** -- 8,100 TXT files need cross-referencing and ingestion
+2. **Website Upload Replacement** -- Old ASP.NET endpoints (Uploader.aspx) return 404. Need new approach.
+3. **7B Series Datasheets** -- ~830K records can't generate datasheets (missing 7BMAIN.DAT spec file). Check ENGR share.
+4. **Service Permissions** -- testdatadb runs as SYSTEM, causing file permission issues. Change to INTRANET\sysadmin.
+
+### MEDIUM PRIORITY
+5. **C2 IP Blocking** -- iptables rules added to UDM for 80.76.49.18 and 45.88.91.99. Need permanent rules in UniFi UI.
+6. **MFA Enforcement** -- 19/38 users ready. Report-only until April 4, 2026. Monitor registration.
+7. **Joel Lohr Account** -- Retiring March 31. Disable account post-retirement. Auto-reply set to Dan Center.
+
+---
+
+## Security Incident (2026-03-27)
+
+**DF-JOEL2 (192.168.0.143) compromised via phishing:**
+- Joel Lohr clicked phishing link in personal Yahoo email
+- ScreenConnect C2 installed, "Angel Raya" connected remotely
+- Two C2 backdoors deployed via PowerShell
+- C2 IPs: 80.76.49.18, 45.88.91.99 (AS399486, suspended by host)
+- IC3 Complaint: 1c32ade367084be9acd548f23705736f
+- ConnectWise Case: 03464184
+- **Remediation complete:** IPs blocked, 3 rogue clients removed, password reset, sessions revoked
+- **No lateral movement detected** (32 machines scanned clean)
+
+---
+
+## Key Contacts
+
+| Person | Email | Role |
+|--------|-------|------|
+| John Lehman | jlehman@dataforth.com | Engineering, QB code, test specs |
+| Dan Center | dcenter@dataforth.com | Operations (replacing Joel) |
+| Peter Iliya | pIliya@dataforth.com | Applications Engineer |
+| AJ | dataforthgit@... | Engineering contact |
+| Ken Hoffman | (unresponsive) | TestDataSheetUploader author |
+| Georg Haubner | ghaubner@dataforth.com | Has pre-crypto backup on D: drive |
+
+---
+
+## Quick Reference Commands
+
+```powershell
+# Check BAT files on NAS
+ssh root@192.168.0.9 'ls -la /data/test/COMMON/ProdSW/'
+
+# Trigger NAS sync
+Start-ScheduledTask -TaskName 'Sync-FromNAS'
+
+# Check sync log
+Get-Content 'C:\Shares\test\scripts\sync-from-nas.log' -Tail 20
+
+# Check TestDataDB health
+curl http://localhost:3000/health
+
+# Query test records
+node -e "const db=require('better-sqlite3')('C:\\Shares\\testdatadb\\database\\testdata.db',{readonly:true});console.log(db.prepare('SELECT COUNT(*) as cnt FROM test_records').get())"
+
+# Check Stage files on NAS
+ssh root@192.168.0.9 'find /data/test/STAGE -name "*.TXT" | wc -l'
+```
+
+---
+
+**Last Updated:** 2026-03-29

.claude/CODE_WORKFLOW.md

@@ -50,7 +50,7 @@ Main Claude (orchestrates)
     Decision Point
     ↓
 ┌──────────────┬──────────────────┐
-│ APPROVED ✅  │ REJECTED ❌      │
+│ APPROVED [OK]  │ REJECTED [ERROR]      │
 │              │                  │
 │ Present to   │ Send back to     │
 │ user with    │ Coding Agent     │
@@ -119,7 +119,7 @@ Attempt 2:
   Coding Agent (with feedback) → Code Review Agent → REJECTED (missing edge case)
     ↓
 Attempt 3:
-  Coding Agent (with feedback) → Code Review Agent → APPROVED ✅
+  Coding Agent (with feedback) → Code Review Agent → APPROVED [OK]
     ↓
   Present to User
 ```
@@ -131,7 +131,7 @@ Attempt 3:
 When code is approved:
 
 ```markdown
-## Implementation Complete ✅
+## Implementation Complete [OK]
 
 [Brief description of what was implemented]
 
@@ -168,11 +168,11 @@ When code is approved:
 
 ## What NEVER Happens
 
-❌ **NEVER** present code directly from Coding Agent to user
-❌ **NEVER** skip review "because it's simple"
-❌ **NEVER** skip review "because we're in a hurry"
-❌ **NEVER** skip review "because user trusts us"
-❌ **NEVER** present unapproved code as "draft" without review
+[ERROR] **NEVER** present code directly from Coding Agent to user
+[ERROR] **NEVER** skip review "because it's simple"
+[ERROR] **NEVER** skip review "because we're in a hurry"
+[ERROR] **NEVER** skip review "because user trusts us"
+[ERROR] **NEVER** present unapproved code as "draft" without review
 
 ## Exceptions: NONE
 
@@ -190,14 +190,14 @@ Even for:
 ## Quality Gates
 
 Code Review Agent checks:
-- ✅ Specification compliance
-- ✅ Security (no vulnerabilities)
-- ✅ Error handling (comprehensive)
-- ✅ Input validation (all inputs)
-- ✅ Best practices (language-specific)
-- ✅ Environment compatibility
-- ✅ Performance (no obvious issues)
-- ✅ Completeness (no TODOs/stubs)
+- [OK] Specification compliance
+- [OK] Security (no vulnerabilities)
+- [OK] Error handling (comprehensive)
+- [OK] Input validation (all inputs)
+- [OK] Best practices (language-specific)
+- [OK] Environment compatibility
+- [OK] Performance (no obvious issues)
+- [OK] Completeness (no TODOs/stubs)
 
 **If any gate fails → REJECTED → Back to Coding Agent**
 

.claude/CONTEXT_RECALL_ARCHITECTURE.md

@@ -1,561 +0,0 @@
-# Context Recall System - Architecture
-
-Visual architecture and data flow for the Claude Code Context Recall System.
-
-## System Overview
-
-```
-┌─────────────────────────────────────────────────────────────────┐
-│                      Claude Code Session                         │
-│                                                                   │
-│  ┌──────────────┐                            ┌──────────────┐   │
-│  │ User writes  │                            │ Task         │   │
-│  │ message      │                            │ completes    │   │
-│  └──────┬───────┘                            └──────┬───────┘   │
-│         │                                            │           │
-│         ▼                                            ▼           │
-│  ┌─────────────────────┐              ┌─────────────────────┐  │
-│  │ user-prompt-submit  │              │  task-complete      │  │
-│  │ hook triggers       │              │  hook triggers      │  │
-│  └─────────┬───────────┘              └─────────┬───────────┘  │
-└────────────┼──────────────────────────────────────┼─────────────┘
-             │                                      │
-             │ ┌──────────────────────────────────┐ │
-             │ │  .claude/context-recall-         │ │
-             └─┤  config.env                      ├─┘
-               │  (JWT_TOKEN, PROJECT_ID, etc.)   │
-               └──────────────────────────────────┘
-             │                                      │
-             ▼                                      ▼
-┌────────────────────────────┐    ┌────────────────────────────┐
-│ GET /api/conversation-     │    │ POST /api/conversation-    │
-│ contexts/recall            │    │ contexts                   │
-│                            │    │                            │
-│ Query Parameters:          │    │ POST /api/project-states   │
-│ - project_id               │    │                            │
-│ - min_relevance_score      │    │ Payload:                   │
-│ - limit                    │    │ - context summary          │
-└────────────┬───────────────┘    │ - metadata                 │
-             │                    │ - relevance score          │
-             │                    └────────────┬───────────────┘
-             │                                 │
-             ▼                                 ▼
-┌─────────────────────────────────────────────────────────────────┐
-│                    FastAPI Application                           │
-│                                                                   │
-│  ┌──────────────────────────┐    ┌───────────────────────────┐ │
-│  │ Context Recall Logic     │    │ Context Save Logic        │ │
-│  │ - Filter by relevance    │    │ - Create context record   │ │
-│  │ - Sort by score          │    │ - Update project state    │ │
-│  │ - Format for display     │    │ - Extract metadata        │ │
-│  └──────────┬───────────────┘    └───────────┬───────────────┘ │
-│             │                                 │                  │
-│             ▼                                 ▼                  │
-│  ┌──────────────────────────────────────────────────────────┐  │
-│  │              Database Access Layer                        │  │
-│  │              (SQLAlchemy ORM)                             │  │
-│  └──────────────────────────┬───────────────────────────────┘  │
-└─────────────────────────────┼──────────────────────────────────┘
-                              │
-                              ▼
-┌─────────────────────────────────────────────────────────────────┐
-│                    PostgreSQL Database                           │
-│                                                                   │
-│  ┌────────────────────────┐       ┌─────────────────────────┐  │
-│  │ conversation_contexts  │       │   project_states        │  │
-│  │                        │       │                         │  │
-│  │ - id (UUID)            │       │ - id (UUID)             │  │
-│  │ - project_id (FK)      │       │ - project_id (FK)       │  │
-│  │ - context_type         │       │ - state_type            │  │
-│  │ - title                │       │ - state_data (JSONB)    │  │
-│  │ - dense_summary        │       │ - created_at            │  │
-│  │ - relevance_score      │       └─────────────────────────┘  │
-│  │ - metadata (JSONB)     │                                     │
-│  │ - created_at           │       ┌─────────────────────────┐  │
-│  │ - updated_at           │       │      projects           │  │
-│  └────────────────────────┘       │                         │  │
-│                                    │ - id (UUID)             │  │
-│                                    │ - name                  │  │
-│                                    │ - description           │  │
-│                                    │ - project_type          │  │
-│                                    └─────────────────────────┘  │
-└─────────────────────────────────────────────────────────────────┘
-```
-
-## Data Flow: Context Recall
-
-```
-1. User writes message in Claude Code
-   │
-   ▼
-2. user-prompt-submit hook executes
-   │
-   ├─ Load config from .claude/context-recall-config.env
-   ├─ Detect PROJECT_ID (git config or remote URL hash)
-   ├─ Check if CONTEXT_RECALL_ENABLED=true
-   │
-   ▼
-3. HTTP GET /api/conversation-contexts/recall
-   │
-   ├─ Headers: Authorization: Bearer {JWT_TOKEN}
-   ├─ Query: ?project_id={ID}&limit=10&min_relevance_score=5.0
-   │
-   ▼
-4. API processes request
-   │
-   ├─ Authenticate JWT token
-   ├─ Query database:
-   │    SELECT * FROM conversation_contexts
-   │    WHERE project_id = {ID}
-   │      AND relevance_score >= 5.0
-   │    ORDER BY relevance_score DESC, created_at DESC
-   │    LIMIT 10
-   │
-   ▼
-5. API returns JSON array of contexts
-   [
-     {
-       "id": "uuid",
-       "title": "Session: 2025-01-15",
-       "dense_summary": "...",
-       "relevance_score": 8.5,
-       "context_type": "session_summary",
-       "metadata": {...}
-     },
-     ...
-   ]
-   │
-   ▼
-6. Hook formats contexts as Markdown
-   │
-   ├─ Parse JSON response
-   ├─ Format each context with title, score, type
-   ├─ Include summary and metadata
-   │
-   ▼
-7. Hook outputs formatted markdown
-   ## 📚 Previous Context
-
-   ### 1. Session: 2025-01-15 (Score: 8.5/10)
-   *Type: session_summary*
-
-   [Summary content...]
-   │
-   ▼
-8. Claude Code injects context before user message
-   │
-   ▼
-9. Claude processes message WITH context
-```
-
-## Data Flow: Context Saving
-
-```
-1. User completes task in Claude Code
-   │
-   ▼
-2. task-complete hook executes
-   │
-   ├─ Load config from .claude/context-recall-config.env
-   ├─ Detect PROJECT_ID
-   ├─ Gather task information:
-   │   ├─ Git branch (git rev-parse --abbrev-ref HEAD)
-   │   ├─ Git commit (git rev-parse --short HEAD)
-   │   ├─ Changed files (git diff --name-only)
-   │   └─ Timestamp
-   │
-   ▼
-3. Build context payload
-   {
-     "project_id": "{PROJECT_ID}",
-     "context_type": "session_summary",
-     "title": "Session: 2025-01-15T14:30:00Z",
-     "dense_summary": "Task completed on branch...",
-     "relevance_score": 7.0,
-     "metadata": {
-       "git_branch": "main",
-       "git_commit": "a1b2c3d",
-       "files_modified": "file1.py,file2.py",
-       "timestamp": "2025-01-15T14:30:00Z"
-     }
-   }
-   │
-   ▼
-4. HTTP POST /api/conversation-contexts
-   │
-   ├─ Headers:
-   │   ├─ Authorization: Bearer {JWT_TOKEN}
-   │   └─ Content-Type: application/json
-   ├─ Body: [context payload]
-   │
-   ▼
-5. API processes request
-   │
-   ├─ Authenticate JWT token
-   ├─ Validate payload
-   ├─ Insert into database:
-   │    INSERT INTO conversation_contexts
-   │    (id, project_id, context_type, title,
-   │     dense_summary, relevance_score, metadata)
-   │    VALUES (...)
-   │
-   ▼
-6. Build project state payload
-   {
-     "project_id": "{PROJECT_ID}",
-     "state_type": "task_completion",
-     "state_data": {
-       "last_task_completion": "2025-01-15T14:30:00Z",
-       "last_git_commit": "a1b2c3d",
-       "last_git_branch": "main",
-       "recent_files": "file1.py,file2.py"
-     }
-   }
-   │
-   ▼
-7. HTTP POST /api/project-states
-   │
-   ├─ Headers: Authorization: Bearer {JWT_TOKEN}
-   ├─ Body: [state payload]
-   │
-   ▼
-8. API updates project state
-   │
-   ├─ Upsert project state record
-   ├─ Merge state_data with existing
-   │
-   ▼
-9. Context saved ✓
-   │
-   ▼
-10. Available for future recall
-```
-
-## Authentication Flow
-
-```
-┌──────────────┐
-│ Initial      │
-│ Setup        │
-└──────┬───────┘
-       │
-       ▼
-┌─────────────────────────────────────┐
-│ bash scripts/setup-context-recall.sh│
-└──────┬──────────────────────────────┘
-       │
-       ├─ Prompt for username/password
-       │
-       ▼
-┌──────────────────────────────────────┐
-│ POST /api/auth/login                 │
-│                                      │
-│ Request:                             │
-│ {                                    │
-│   "username": "admin",               │
-│   "password": "secret"               │
-│ }                                    │
-└──────┬───────────────────────────────┘
-       │
-       ▼
-┌──────────────────────────────────────┐
-│ Response:                            │
-│ {                                    │
-│   "access_token": "eyJ...",          │
-│   "token_type": "bearer",            │
-│   "expires_in": 86400                │
-│ }                                    │
-└──────┬───────────────────────────────┘
-       │
-       ▼
-┌──────────────────────────────────────┐
-│ Save to .claude/context-recall-      │
-│ config.env:                          │
-│                                      │
-│ JWT_TOKEN=eyJ...                     │
-└──────┬───────────────────────────────┘
-       │
-       ▼
-┌──────────────────────────────────────┐
-│ All API requests include:            │
-│ Authorization: Bearer eyJ...         │
-└──────────────────────────────────────┘
-```
-
-## Project Detection Flow
-
-```
-Hook needs PROJECT_ID
-   │
-   ├─ Check: $CLAUDE_PROJECT_ID set?
-   │   └─ Yes → Use it
-   │   └─ No → Continue detection
-   │
-   ├─ Check: git config --local claude.projectid
-   │   └─ Found → Use it
-   │   └─ Not found → Continue detection
-   │
-   ├─ Get: git config --get remote.origin.url
-   │   └─ Found → Hash URL → Use as PROJECT_ID
-   │   └─ Not found → No PROJECT_ID available
-   │
-   └─ If no PROJECT_ID:
-       └─ Silent exit (no context available)
-```
-
-## Database Schema
-
-```sql
--- Projects table
-CREATE TABLE projects (
-    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-    name VARCHAR(255) NOT NULL,
-    description TEXT,
-    project_type VARCHAR(50),
-    metadata JSONB,
-    created_at TIMESTAMP DEFAULT NOW(),
-    updated_at TIMESTAMP DEFAULT NOW()
-);
-
--- Conversation contexts table
-CREATE TABLE conversation_contexts (
-    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-    project_id UUID REFERENCES projects(id),
-    context_type VARCHAR(50),
-    title VARCHAR(500),
-    dense_summary TEXT NOT NULL,
-    relevance_score DECIMAL(3,1) CHECK (relevance_score >= 0 AND relevance_score <= 10),
-    metadata JSONB,
-    created_at TIMESTAMP DEFAULT NOW(),
-    updated_at TIMESTAMP DEFAULT NOW(),
-
-    INDEX idx_project_relevance (project_id, relevance_score DESC),
-    INDEX idx_project_type (project_id, context_type),
-    INDEX idx_created (created_at DESC)
-);
-
--- Project states table
-CREATE TABLE project_states (
-    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-    project_id UUID REFERENCES projects(id),
-    state_type VARCHAR(50),
-    state_data JSONB NOT NULL,
-    created_at TIMESTAMP DEFAULT NOW(),
-    updated_at TIMESTAMP DEFAULT NOW(),
-
-    INDEX idx_project_state (project_id, state_type)
-);
-```
-
-## Component Interaction
-
-```
-┌─────────────────────────────────────────────────────────────┐
-│ File System                                                  │
-│                                                              │
-│ .claude/                                                     │
-│ ├── hooks/                                                   │
-│ │   ├── user-prompt-submit    ◄─── Executed by Claude Code  │
-│ │   └── task-complete         ◄─── Executed by Claude Code  │
-│ │                                                            │
-│ └── context-recall-config.env ◄─── Read by hooks            │
-│                                                              │
-└────────────────┬────────────────────────────────────────────┘
-                 │
-                 │ (Hooks read config and call API)
-                 │
-                 ▼
-┌─────────────────────────────────────────────────────────────┐
-│ FastAPI Application (http://localhost:8000)                  │
-│                                                              │
-│ Endpoints:                                                   │
-│ ├── POST /api/auth/login                                     │
-│ ├── GET  /api/conversation-contexts/recall                   │
-│ ├── POST /api/conversation-contexts                          │
-│ ├── POST /api/project-states                                 │
-│ └── GET  /api/projects/{id}                                  │
-│                                                              │
-└────────────────┬────────────────────────────────────────────┘
-                 │
-                 │ (API queries/updates database)
-                 │
-                 ▼
-┌─────────────────────────────────────────────────────────────┐
-│ PostgreSQL Database                                          │
-│                                                              │
-│ Tables:                                                      │
-│ ├── projects                                                 │
-│ ├── conversation_contexts                                    │
-│ └── project_states                                           │
-│                                                              │
-└─────────────────────────────────────────────────────────────┘
-```
-
-## Error Handling
-
-```
-Hook Execution
-   │
-   ├─ Config file missing?
-   │   └─ Silent exit (context recall unavailable)
-   │
-   ├─ PROJECT_ID not detected?
-   │   └─ Silent exit (no project context)
-   │
-   ├─ JWT_TOKEN missing?
-   │   └─ Silent exit (authentication unavailable)
-   │
-   ├─ API unreachable? (timeout 3-5s)
-   │   └─ Silent exit (API offline)
-   │
-   ├─ API returns error (401, 404, 500)?
-   │   └─ Silent exit (log if debug enabled)
-   │
-   └─ Success
-       └─ Process and inject context
-```
-
-**Philosophy:** Hooks NEVER break Claude Code. All failures are silent.
-
-## Performance Characteristics
-
-```
-Timeline for user-prompt-submit:
-━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-
-0ms        Hook starts
-           ├─ Load config (10ms)
-           ├─ Detect project (5ms)
-           │
-15ms       HTTP request starts
-           ├─ Connection (20ms)
-           ├─ Query execution (50-100ms)
-           ├─ Response formatting (10ms)
-           │
-145ms      Response received
-           ├─ Parse JSON (10ms)
-           ├─ Format markdown (30ms)
-           │
-185ms      Context injected
-           │
-━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-
-Total: ~200ms average overhead per message
-Timeout: 3000ms (fails gracefully)
-```
-
-## Configuration Impact
-
-```
-┌──────────────────────────────────────┐
-│ MIN_RELEVANCE_SCORE                  │
-├──────────────────────────────────────┤
-│  Low (3.0)                           │
-│  ├─ More contexts recalled           │
-│  ├─ Broader historical view          │
-│  └─ Slower queries                   │
-│                                      │
-│  Medium (5.0) ← Recommended          │
-│  ├─ Balanced relevance/quantity      │
-│  └─ Fast queries                     │
-│                                      │
-│  High (7.5)                          │
-│  ├─ Only critical contexts           │
-│  ├─ Very focused                     │
-│  └─ Fastest queries                  │
-└──────────────────────────────────────┘
-
-┌──────────────────────────────────────┐
-│ MAX_CONTEXTS                         │
-├──────────────────────────────────────┤
-│  Few (5)                             │
-│  ├─ Focused context                  │
-│  ├─ Shorter prompts                  │
-│  └─ Faster processing                │
-│                                      │
-│  Medium (10) ← Recommended           │
-│  ├─ Good coverage                    │
-│  └─ Reasonable prompt size           │
-│                                      │
-│  Many (20)                           │
-│  ├─ Comprehensive context            │
-│  ├─ Longer prompts                   │
-│  └─ Slower Claude processing         │
-└──────────────────────────────────────┘
-```
-
-## Security Model
-
-```
-┌─────────────────────────────────────────────────────────────┐
-│ Security Boundaries                                          │
-│                                                              │
-│ 1. Authentication                                            │
-│    ├─ JWT tokens (24h expiry)                               │
-│    ├─ Bcrypt password hashing                               │
-│    └─ Bearer token in Authorization header                  │
-│                                                              │
-│ 2. Authorization                                             │
-│    ├─ Project-level access control                          │
-│    ├─ User can only access own projects                     │
-│    └─ Token includes user_id claim                          │
-│                                                              │
-│ 3. Data Protection                                           │
-│    ├─ Config file gitignored                                │
-│    ├─ JWT tokens never in version control                   │
-│    └─ HTTPS recommended for production                      │
-│                                                              │
-│ 4. Input Validation                                          │
-│    ├─ API validates all payloads                            │
-│    ├─ SQL injection protected (ORM)                         │
-│    └─ JSON schema validation                                │
-│                                                              │
-└─────────────────────────────────────────────────────────────┘
-```
-
-## Deployment Architecture
-
-```
-Development:
-┌──────────────┐     ┌──────────────┐     ┌──────────────┐
-│ Claude Code  │────▶│ API          │────▶│ PostgreSQL   │
-│ (Desktop)    │     │ (localhost)  │     │ (localhost)  │
-└──────────────┘     └──────────────┘     └──────────────┘
-
-Production:
-┌──────────────┐     ┌──────────────┐     ┌──────────────┐
-│ Claude Code  │────▶│ API          │────▶│ PostgreSQL   │
-│ (Desktop)    │     │ (Docker)     │     │ (RDS/Cloud)  │
-└──────────────┘     └──────────────┘     └──────────────┘
-      │                     │
-      │                     │ (HTTPS)
-      │                     ▼
-      │              ┌──────────────┐
-      │              │ Redis Cache  │
-      │              │ (Optional)   │
-      └──────────────┴──────────────┘
-```
-
-## Scalability Considerations
-
-```
-Database Optimization:
-├─ Indexes on (project_id, relevance_score)
-├─ Indexes on (project_id, context_type)
-├─ Indexes on created_at for time-based queries
-└─ JSONB indexes on metadata for complex queries
-
-Caching Strategy:
-├─ Redis for frequently-accessed contexts
-├─ Cache key: project_id + min_score + limit
-├─ TTL: 5 minutes
-└─ Invalidate on new context creation
-
-Query Optimization:
-├─ Limit results (MAX_CONTEXTS)
-├─ Filter early (MIN_RELEVANCE_SCORE)
-├─ Sort in database (not application)
-└─ Paginate for large result sets
-```
-
-This architecture provides a robust, scalable, and secure system for context recall in Claude Code sessions.

.claude/CONTEXT_RECALL_QUICK_START.md

@@ -1,175 +0,0 @@
-# Context Recall - Quick Start
-
-One-page reference for the Claude Code Context Recall System.
-
-## Setup (First Time)
-
-```bash
-# 1. Start API
-uvicorn api.main:app --reload
-
-# 2. Setup (in new terminal)
-bash scripts/setup-context-recall.sh
-
-# 3. Test
-bash scripts/test-context-recall.sh
-```
-
-## Files
-
-```
-.claude/
-├── hooks/
-│   ├── user-prompt-submit      # Recalls context before messages
-│   ├── task-complete           # Saves context after tasks
-│   └── README.md               # Hook documentation
-├── context-recall-config.env   # Configuration (gitignored)
-└── CONTEXT_RECALL_QUICK_START.md
-
-scripts/
-├── setup-context-recall.sh     # One-command setup
-└── test-context-recall.sh      # System testing
-```
-
-## Configuration
-
-Edit `.claude/context-recall-config.env`:
-
-```bash
-CLAUDE_API_URL=http://localhost:8000    # API URL
-CLAUDE_PROJECT_ID=                      # Auto-detected
-JWT_TOKEN=                              # From setup script
-CONTEXT_RECALL_ENABLED=true             # Enable/disable
-MIN_RELEVANCE_SCORE=5.0                 # Filter threshold (0-10)
-MAX_CONTEXTS=10                         # Max contexts per query
-```
-
-## How It Works
-
-```
-User Message → [Recall Context] → Claude (with context) → Response
-                                         ↓
-                                   [Save Context]
-```
-
-### user-prompt-submit Hook
-- Runs **before** each user message
-- Calls `GET /api/conversation-contexts/recall`
-- Injects relevant context from previous sessions
-- Falls back gracefully if API unavailable
-
-### task-complete Hook
-- Runs **after** task completion
-- Calls `POST /api/conversation-contexts`
-- Saves conversation summary
-- Updates project state
-
-## Common Commands
-
-```bash
-# Re-run setup (get new JWT token)
-bash scripts/setup-context-recall.sh
-
-# Test system
-bash scripts/test-context-recall.sh
-
-# Test hooks manually
-source .claude/context-recall-config.env
-bash .claude/hooks/user-prompt-submit
-
-# Enable debug mode
-echo "DEBUG_CONTEXT_RECALL=true" >> .claude/context-recall-config.env
-
-# Disable context recall
-echo "CONTEXT_RECALL_ENABLED=false" >> .claude/context-recall-config.env
-
-# Check API health
-curl http://localhost:8000/health
-
-# View your project
-source .claude/context-recall-config.env
-curl -H "Authorization: Bearer $JWT_TOKEN" \
-  http://localhost:8000/api/projects/$CLAUDE_PROJECT_ID
-
-# Query contexts manually
-curl "http://localhost:8000/api/conversation-contexts/recall?project_id=$CLAUDE_PROJECT_ID&limit=5" \
-  -H "Authorization: Bearer $JWT_TOKEN"
-```
-
-## Troubleshooting
-
-| Problem | Solution |
-|---------|----------|
-| Context not appearing | Check API is running: `curl http://localhost:8000/health` |
-| Hooks not executing | Make executable: `chmod +x .claude/hooks/*` |
-| JWT token expired | Re-run setup: `bash scripts/setup-context-recall.sh` |
-| Context not saving | Check project ID: `echo $CLAUDE_PROJECT_ID` |
-| Debug hook output | Enable debug: `DEBUG_CONTEXT_RECALL=true` in config |
-
-## API Endpoints
-
-- `GET /api/conversation-contexts/recall` - Get relevant contexts
-- `POST /api/conversation-contexts` - Save new context
-- `POST /api/project-states` - Update project state
-- `POST /api/auth/login` - Get JWT token
-- `GET /api/projects` - List projects
-
-## Configuration Parameters
-
-### MIN_RELEVANCE_SCORE (0.0 - 10.0)
-- **5.0** - Balanced (recommended)
-- **7.0** - Only high-quality contexts
-- **3.0** - Include more historical context
-
-### MAX_CONTEXTS (1 - 50)
-- **10** - Balanced (recommended)
-- **5** - Focused, minimal context
-- **20** - Comprehensive history
-
-## Security
-
-- JWT tokens stored in `.claude/context-recall-config.env`
-- File is gitignored (never commit!)
-- Tokens expire after 24 hours
-- Re-run setup to refresh
-
-## Example Output
-
-When context is available:
-
-```markdown
-## 📚 Previous Context
-
-The following context has been automatically recalled from previous sessions:
-
-### 1. Database Schema Updates (Score: 8.5/10)
-*Type: technical_decision*
-
-Updated the Project model to include new fields for MSP integration...
-
----
-
-### 2. API Endpoint Changes (Score: 7.2/10)
-*Type: session_summary*
-
-Implemented new REST endpoints for context recall...
-
----
-```
-
-## Performance
-
-- Hook overhead: <500ms per message
-- API query time: <100ms
-- Timeouts: 3-5 seconds
-- Silent failures (don't break Claude)
-
-## Full Documentation
-
-- **Setup Guide:** `CONTEXT_RECALL_SETUP.md`
-- **Hook Details:** `.claude/hooks/README.md`
-- **API Spec:** `.claude/API_SPEC.md`
-
----
-
-**Quick Start:** `bash scripts/setup-context-recall.sh` and you're done!

.claude/DATABASE_FIRST_PROTOCOL.md

@@ -0,0 +1,283 @@
+# Database-First Protocol
+
+**CRITICAL:** This protocol MUST be followed for EVERY user request.
+
+---
+
+## The Problem
+
+Currently, Claude:
+1. Receives user request
+2. Searches local files (maybe)
+3. Performs work
+4. (Never saves context automatically)
+
+This wastes tokens, misses critical context, and loses work across sessions.
+
+---
+
+## The Solution: Database-First Protocol
+
+### MANDATORY FIRST STEP - For EVERY User Request
+
+```
+BEFORE doing ANYTHING else:
+
+1. Query the context database for relevant information
+2. Inject retrieved context into your working memory
+3. THEN proceed with the user's request
+```
+
+---
+
+## Implementation
+
+### Step 1: Check Database (ALWAYS FIRST)
+
+Before analyzing the user's request, run this command:
+
+```bash
+curl -s -H "Authorization: Bearer $JWT_TOKEN" \
+  "http://172.16.3.30:8001/api/conversation-contexts/recall?\
+search_term={user_keywords}&limit=10" | python -m json.tool
+```
+
+Extract keywords from user request. Examples:
+- User: "What's the status of Dataforth project?" → search_term=dataforth
+- User: "Continue work on GuruConnect" → search_term=guruconnect
+- User: "Fix the API bug" → search_term=API+bug
+- User: "Help with database" → search_term=database
+
+### Step 2: Review Retrieved Context
+
+The API returns up to 10 relevant contexts with:
+- `title` - Short description
+- `dense_summary` - Compressed context (90% token reduction)
+- `relevance_score` - How relevant (0-10)
+- `tags` - Keywords for filtering
+- `created_at` - Timestamp
+
+### Step 3: Use Context in Your Response
+
+Reference the context when responding:
+- "Based on previous context from {date}..."
+- "According to the database, Dataforth DOS project..."
+- "Context shows this was last discussed on..."
+
+### Step 4: Save New Context (After Completion)
+
+After completing a significant task:
+
+```bash
+curl -s -H "Authorization: Bearer $JWT_TOKEN" \
+  -X POST "http://172.16.3.30:8001/api/conversation-contexts" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "project_id": "c3d9f1c8-dc2b-499f-a228-3a53fa950e7b",
+    "context_type": "session_summary",
+    "title": "Brief title of what was accomplished",
+    "dense_summary": "Compressed summary of work done, decisions made, files changed",
+    "relevance_score": 7.0,
+    "tags": "[\"keyword1\", \"keyword2\", \"keyword3\"]"
+  }'
+```
+
+---
+
+## When to Save Context
+
+Save context automatically when:
+
+1. **Task Completion** - TodoWrite task marked as completed
+2. **Major Decision** - Architectural choice, approach selection
+3. **File Changes** - Significant code changes (>50 lines)
+4. **Problem Solved** - Bug fixed, issue resolved
+5. **User Requests** - Via /snapshot command
+6. **Session End** - Before closing conversation
+
+---
+
+## Agent Delegation Rules
+
+**Main Claude is a COORDINATOR, not an EXECUTOR.**
+
+Before performing any task, check delegation table:
+
+| Task Type | Delegate To | Always? |
+|-----------|-------------|---------|
+| Context retrieval | Database Agent | [OK] YES |
+| Codebase search | Explore Agent | For patterns/keywords |
+| Code changes >10 lines | Coding Agent | [OK] YES |
+| Running tests | Testing Agent | [OK] YES |
+| Git operations | Gitea Agent | [OK] YES |
+| File operations <5 files | Main Claude | Direct OK |
+| Documentation | Documentation Squire | For comprehensive docs |
+
+**How to Delegate:**
+
+```
+Instead of: Searching files directly with Grep/Glob
+Do: "Let me delegate to the Explore agent to search the codebase..."
+
+Instead of: Writing code directly
+Do: "Let me delegate to the Coding Agent to implement this change..."
+
+Instead of: Running tests yourself
+Do: "Let me delegate to the Testing Agent to run the test suite..."
+```
+
+---
+
+## Context Database Quick Reference
+
+### Query Endpoints
+
+```bash
+# Search by term
+GET /api/conversation-contexts/recall?search_term={term}&limit=10
+
+# Filter by tags
+GET /api/conversation-contexts/recall?tags=dataforth&tags=dos&limit=10
+
+# Get by project
+GET /api/conversation-contexts/recall?project_id={uuid}&limit=10
+
+# List all recent
+GET /api/conversation-contexts?limit=50
+```
+
+### Save Endpoint
+
+```bash
+POST /api/conversation-contexts
+{
+  "project_id": "uuid",
+  "context_type": "session_summary|checkpoint|decision|problem_solution",
+  "title": "Short title",
+  "dense_summary": "Compressed summary with key info",
+  "relevance_score": 1.0-10.0,
+  "tags": "[\"tag1\", \"tag2\"]"
+}
+```
+
+---
+
+## Example Workflow
+
+### User Request: "What's the status of the Dataforth DOS project?"
+
+**WRONG Approach:**
+```
+Claude: Let me search local files...
+(Wastes tokens, misses imported context in database)
+```
+
+**CORRECT Approach:**
+```
+Claude: Let me check the context database first...
+
+[Runs: curl .../recall?search_term=dataforth]
+
+Claude: "Based on context retrieved from the database, the Dataforth
+DOS machines project involves analyzing drive images from test machines
+with ATE (Automated Test Equipment) software. The conversation was
+imported on 2026-01-18 and includes 1,241KB of data.
+
+The project appears to focus on Dataforth industrial I/O equipment
+testing (5B, 7B, 8B series modules).
+
+Would you like me to delegate to the Explore agent to find specific
+files related to this project?"
+```
+
+---
+
+## Integration with Hooks
+
+The hooks in `.claude/hooks/` should assist but NOT replace manual queries:
+
+- `user-prompt-submit` - Auto-injects context (passive)
+- `task-complete` - Auto-saves context (passive)
+
+**BUT:** You should ACTIVELY query database yourself before major work.
+
+Don't rely solely on hooks. They're a backup, not the primary mechanism.
+
+---
+
+## Token Efficiency
+
+### Before Database-First:
+- Read 3MB of local files: ~750,000 tokens
+- Parse conversation histories: ~250,000 tokens
+- **Total:** ~1,000,000 tokens per session
+
+### After Database-First:
+- Query database: 500 tokens (API call)
+- Receive compressed summaries: ~5,000 tokens (10 contexts)
+- **Total:** ~5,500 tokens per session
+
+**Savings:** 99.4% token reduction
+
+---
+
+## Troubleshooting
+
+### Database Query Returns Empty
+
+```bash
+# Check if API is up
+curl http://172.16.3.30:8001/health
+
+# Check total contexts
+curl -H "Authorization: Bearer $JWT" \
+  http://172.16.3.30:8001/api/conversation-contexts | \
+  python -c "import sys,json; print(f'Total: {json.load(sys.stdin)[\"total\"]}')"
+
+# Try different search term
+# Instead of: search_term=dataforth%20DOS
+# Try: search_term=dataforth
+```
+
+### Authentication Fails
+
+```bash
+# Check JWT token in config
+cat .claude/context-recall-config.env | grep JWT_TOKEN
+
+# Verify token not expired
+# Current token expires: 2026-02-16
+```
+
+### No Results for Known Project
+
+The recall endpoint uses PostgreSQL full-text search. Try:
+- Simpler search terms
+- Individual keywords instead of phrases
+- Checking tags directly: `?tags=dataforth`
+
+---
+
+## Enforcement
+
+This protocol is MANDATORY. To ensure compliance:
+
+1. **Every response** should start with "Checking database for context..."
+2. **Before major work**, always query database
+3. **After completion**, always save summary
+4. **For delegation**, use agents not direct execution
+
+**Violation Example:**
+```
+User: "Find all Python files"
+Claude: [Runs Glob directly] [ERROR] WRONG
+
+Correct:
+Claude: "Let me delegate to Explore agent to search for Python files" [OK]
+```
+
+---
+
+**Last Updated:** 2026-01-18
+**Status:** ACTIVE - MUST BE FOLLOWED
+**Priority:** CRITICAL

.claude/DIRECTIVES_ENFORCEMENT.md

@@ -0,0 +1,418 @@
+# Directives Enforcement Mechanism
+
+**Created:** 2026-01-19
+**Purpose:** Ensure Claude consistently follows operational directives and stops taking shortcuts
+
+---
+
+## The Problem
+
+Claude (Main Instance) has a tendency to:
+- Take shortcuts by querying database directly instead of using Database Agent
+- Use emojis despite explicit prohibition (causes PowerShell errors)
+- Execute operations directly instead of coordinating via agents
+- Forget directives after conversation compaction or long sessions
+
+**Result:** Violated architecture, broken scripts, inconsistent behavior
+
+---
+
+## The Solution: Multi-Layered Enforcement
+
+### Layer 1: Prominent Directive Reference in claude.md
+
+**File:** `.claude/claude.md` (line 3-15)
+
+```markdown
+**FIRST: READ YOUR DIRECTIVES**
+
+Before doing ANYTHING in this project, read and internalize `directives.md` in the project root.
+
+This file defines:
+- Your identity (Coordinator, not Executor)
+- What you DO and DO NOT do
+- Agent coordination rules (NEVER query database directly)
+- Enforcement checklist (NO EMOJIS, ASCII markers only)
+
+**If you haven't read directives.md in this session, STOP and read it now.**
+
+Command: `Read directives.md` (in project root: D:\ClaudeTools\directives.md)
+```
+
+**Effect:** First thing Claude sees when loading project context
+
+---
+
+### Layer 2: /refresh-directives Command
+
+**File:** `.claude/commands/refresh-directives.md`
+
+**Purpose:** Command to re-read and internalize directives
+
+**User invocation:**
+```
+/refresh-directives
+```
+
+**Auto-invocation points:**
+- After `/checkpoint` command
+- After `/save` command
+- After conversation compaction (detected automatically)
+- After large task completion (3+ agents)
+- Every 50 tool uses (optional counter-based)
+
+**What it does:**
+1. Reads `directives.md` completely
+2. Performs self-assessment for violations
+3. Commits to following directives
+4. Reports status to user
+
+**Output:**
+```markdown
+## Directives Refreshed
+
+I've re-read my operational directives.
+
+**Key commitments:**
+- [OK] Coordinate via agents, not execute
+- [OK] Database Agent for ALL data operations
+- [OK] ASCII markers only (no emojis)
+- [OK] Preserve context by delegating
+
+**Self-assessment:** Clean - no violations detected
+
+**Status:** Ready to coordinate effectively.
+```
+
+---
+
+### Layer 3: Integration with /checkpoint Command
+
+**File:** `.claude/commands/checkpoint.md` (step 8)
+
+**After git + database checkpoint:**
+```markdown
+8. **Refresh directives** (MANDATORY):
+   - After checkpoint completion, auto-invoke `/refresh-directives`
+   - Re-read `directives.md` to prevent shortcut-taking
+   - Perform self-assessment for any violations
+   - Confirm commitment to agent coordination rules
+   - Report directives refreshed to user
+```
+
+**Effect:** Every checkpoint automatically refreshes directives
+
+---
+
+### Layer 4: Integration with /save Command
+
+**File:** `.claude/commands/save.md` (step 4)
+
+**After saving session log:**
+```markdown
+4. **Refresh directives** (MANDATORY):
+   - Auto-invoke `/refresh-directives`
+   - Re-read `directives.md` to prevent shortcut-taking
+   - Perform self-assessment for violations
+   - Confirm commitment to coordination rules
+   - Report directives refreshed
+```
+
+**Effect:** Every session save automatically refreshes directives
+
+---
+
+### Layer 5: directives.md (The Source of Truth)
+
+**File:** `directives.md` (project root)
+
+**Contains:**
+- Identity definition (Coordinator, not Executor)
+- What Claude DOES and DOES NOT do
+- Complete agent coordination rules
+- Coding standards (NO EMOJIS - ASCII only)
+- Enforcement checklist
+- Pre-action verification questions
+
+**Key sections:**
+1. My Identity
+2. Core Operating Principle
+3. What I DO [OK]
+4. What I DO NOT DO [ERROR]
+5. Agent Coordination Rules
+6. Skills vs Agents
+7. Automatic Behaviors
+8. Coding Standards (NO EMOJIS)
+9. Enforcement Checklist
+
+---
+
+## Automatic Trigger Points
+
+### Session Start
+```
+Claude loads project → Sees claude.md → "READ DIRECTIVES FIRST"
+→ Reads directives.md → Internalizes rules → Ready to work
+```
+
+### After Checkpoint
+```
+User: /checkpoint
+→ Claude creates git commit + database context
+→ Verifies both succeeded
+→ AUTO-INVOKES /refresh-directives
+→ Re-reads directives.md
+→ Confirms ready to proceed
+```
+
+### After Save
+```
+User: /save
+→ Claude creates/updates session log
+→ Commits to repository
+→ AUTO-INVOKES /refresh-directives
+→ Re-reads directives.md
+→ Confirms ready to proceed
+```
+
+### After Conversation Compaction
+```
+System: [Conversation compacted due to length]
+→ Claude detects compaction (system message)
+→ AUTO-INVOKES /refresh-directives
+→ Re-reads directives.md
+→ Restores operational mode
+→ Continues with proper coordination
+```
+
+### After Large Task
+```
+Claude completes task using 3+ agents
+→ Recognizes major work completed
+→ AUTO-INVOKES /refresh-directives
+→ Re-reads directives.md
+→ Resets to coordination mode
+→ Ready for next task
+```
+
+---
+
+## Violation Detection
+
+### Self-Assessment Process
+
+**During /refresh-directives, Claude checks:**
+
+**Database Operations:**
+- [ ] Did I query database directly via ssh/mysql/curl? → VIOLATION
+- [ ] Did I call ClaudeTools API directly? → VIOLATION
+- [ ] Did I use Database Agent for data operations? → CORRECT
+
+**Code Generation:**
+- [ ] Did I write production code myself? → VIOLATION
+- [ ] Did I delegate to Coding Agent? → CORRECT
+
+**Emoji Usage:**
+- [ ] Did I use [OK][ERROR][WARNING] or other emojis? → VIOLATION
+- [ ] Did I use [OK]/[ERROR]/[WARNING]? → CORRECT
+
+**Agent Coordination:**
+- [ ] Did I execute operations directly? → VIOLATION
+- [ ] Did I coordinate via agents? → CORRECT
+
+**If violations detected:**
+```markdown
+[WARNING] Detected 2 directive violations:
+- Direct database query at timestamp X
+- Emoji usage in output at timestamp Y
+
+[OK] Corrective actions committed:
+- Will use Database Agent for all database operations
+- Will use ASCII markers [OK]/[ERROR] instead of emojis
+
+[SUCCESS] Directives re-internalized. Proper coordination restored.
+```
+
+---
+
+## Benefits
+
+### Prevents Shortcut-Taking
+- Regular reminders not to query database directly
+- Reinforces agent coordination model
+- Stops emoji usage before it causes errors
+
+### Context Recovery
+- Restores operational mode after compaction
+- Ensures consistency across sessions
+- Maintains proper coordination principles
+
+### Self-Correction
+- Detects violations automatically
+- Commits to corrective behavior
+- Provides accountability to user
+
+### User Visibility
+- User sees when directives refreshed
+- Transparent operational changes
+- Builds trust in coordination model
+
+---
+
+## Enforcement Checklist
+
+### For Claude (Self-Check Before Any Action)
+
+**Before database operation:**
+- [ ] Read directives.md this session? If no → STOP and read
+- [ ] Am I about to query database? → Use Database Agent instead
+- [ ] Am I about to use curl/API? → Use Database Agent instead
+
+**Before writing code:**
+- [ ] Am I writing production code? → Delegate to Coding Agent
+- [ ] Am I using emojis? → STOP, use [OK]/[ERROR]/[WARNING]
+
+**Before git operations:**
+- [ ] Am I about to commit? → Delegate to Gitea Agent
+- [ ] Am I about to push? → Delegate to Gitea Agent
+
+**After major operations:**
+- [ ] Completed checkpoint/save? → Auto-invoke /refresh-directives
+- [ ] Completed large task? → Auto-invoke /refresh-directives
+- [ ] Conversation compacted? → Auto-invoke /refresh-directives
+
+---
+
+## User Commands
+
+### Manual Refresh
+```
+/refresh-directives
+```
+Manually trigger directive re-reading and self-assessment
+
+### Checkpoint (Auto-refresh)
+```
+/checkpoint
+```
+Creates git commit + database context, then auto-refreshes directives
+
+### Save (Auto-refresh)
+```
+/save
+```
+Creates session log, then auto-refreshes directives
+
+### Sync
+```
+/sync
+```
+Pulls latest from Gitea (directives.md included if updated)
+
+---
+
+## Monitoring
+
+### User Can Monitor Compliance
+
+**Check for violations:**
+- Look for direct `ssh`, `mysql`, or `curl` commands to database
+- Look for emoji characters ([OK][ERROR][WARNING]) in output
+- Look for direct code generation (should delegate to Coding Agent)
+
+**If violations detected:**
+```
+User: /refresh-directives
+```
+Forces Claude to re-read and commit to directives
+
+---
+
+## Maintenance
+
+### Updating directives.md
+
+**When to update:**
+- New agent added to system
+- New restriction discovered
+- Behavior patterns change
+- New shortcut tendencies identified
+
+**Process:**
+1. Edit `directives.md` with new rules
+2. Commit changes to repository
+3. Push to Gitea
+4. Invoke `/sync` on other machines
+5. Invoke `/refresh-directives` to apply immediately
+
+---
+
+## Summary
+
+**Five-layer enforcement:**
+1. **claude.md** - Prominent reference at top (first thing Claude sees)
+2. **/refresh-directives command** - Explicit directive re-reading
+3. **/checkpoint integration** - Auto-refresh after checkpoints
+4. **/save integration** - Auto-refresh after session saves
+5. **directives.md** - Complete operational ruleset
+
+**Automatic triggers:**
+- Session start
+- After /checkpoint
+- After /save
+- After conversation compaction
+- After large tasks
+
+**Result:** Claude consistently follows directives, stops taking shortcuts, maintains proper agent coordination architecture.
+
+---
+
+## Example: Full Enforcement Flow
+
+```
+Session Start:
+→ Claude loads .claude/claude.md
+→ Sees "READ YOUR DIRECTIVES FIRST"
+→ Reads directives.md completely
+→ Internalizes rules
+→ Ready to coordinate (not execute)
+
+User Request:
+→ "How many projects in database?"
+→ Claude recognizes database operation
+→ Checks directives: "Database Agent handles ALL database operations"
+→ Launches Database Agent with task
+→ Receives count from agent
+→ Presents to user
+
+After /checkpoint:
+→ Git commit created
+→ Database context saved
+→ AUTO-INVOKES /refresh-directives
+→ Re-reads directives.md
+→ Self-assessment: Clean
+→ Confirms: "Directives refreshed. Ready to coordinate."
+
+Conversation Compacted:
+→ System compacts conversation
+→ Claude detects compaction
+→ AUTO-INVOKES /refresh-directives
+→ Re-reads directives.md
+→ Restores coordination mode
+→ Continues properly
+```
+
+---
+
+**This enforcement mechanism ensures Claude maintains proper operational behavior throughout the entire session lifecycle.**
+
+---
+
+**Created:** 2026-01-19
+**Files Modified:**
+- `.claude/claude.md` - Added directive reference at top
+- `.claude/commands/checkpoint.md` - Added step 8 (refresh directives)
+- `.claude/commands/save.md` - Added step 4 (refresh directives)
+- `.claude/commands/refresh-directives.md` - New command definition
+
+**Status:** Active enforcement system

.claude/FILE_PLACEMENT_GUIDE.md

@@ -0,0 +1,224 @@
+# File Placement Guide - Where to Save Files
+
+**Purpose:** Ensure all new files are saved to appropriate project/client folders
+**Last Updated:** 2026-01-20
+
+---
+
+## Quick Reference
+
+| File Type | Example | Save To |
+|-----------|---------|---------|
+| DOS Batch Files | `*.BAT` | `projects/dataforth-dos/batch-files/` |
+| DOS Deployment Scripts | `deploy-*.ps1`, `fix-*.ps1` | `projects/dataforth-dos/deployment-scripts/` |
+| DOS Documentation | `DOS_*.md` | `projects/dataforth-dos/documentation/` |
+| DOS Session Logs | Session notes | `projects/dataforth-dos/session-logs/` |
+| Client Info | Client details | `clients/[client-name]/CLIENT_INFO.md` |
+| Client Session Logs | Support notes | `clients/[client-name]/session-logs/` |
+| ClaudeTools API Code | `*.py`, migrations | `api/`, `migrations/` (keep existing structure) |
+| ClaudeTools API Logs | Session notes | `projects/claudetools-api/session-logs/` |
+| General Session Logs | Mixed work | `session-logs/YYYY-MM-DD-session.md` |
+| Credentials | All credentials | `credentials.md` (root - shared) |
+
+---
+
+## Rules for New Files
+
+### 1. Determine Context First
+
+**Ask yourself:** What project or client is this related to?
+- Dataforth DOS → `projects/dataforth-dos/`
+- ClaudeTools API → `projects/claudetools-api/` or root API folders
+- Specific Client → `clients/[client-name]/`
+- Multiple projects → Root or `session-logs/`
+
+### 2. Choose Appropriate Subfolder
+
+**Within project folder:**
+```
+projects/[project-name]/
+├── batch-files/          # .BAT files (DOS only)
+├── scripts/              # .ps1, .sh, .py scripts
+├── deployment-scripts/   # Deployment-specific scripts (DOS)
+├── documentation/        # .md documentation files
+├── session-logs/         # Daily session logs
+└── [custom-folders]/     # Project-specific folders
+```
+
+**Within client folder:**
+```
+clients/[client-name]/
+├── CLIENT_INFO.md        # Master client information
+├── session-logs/         # Support session logs
+├── documentation/        # Client-specific docs
+└── [custom-folders]/     # Client-specific folders
+```
+
+### 3. Naming Conventions
+
+**Session Logs:**
+- Format: `YYYY-MM-DD-session.md`
+- Location: `projects/[project]/session-logs/` or `clients/[client]/session-logs/`
+
+**Documentation:**
+- Descriptive names: `DOS_FIX_SUMMARY.md`, `DEPLOYMENT_GUIDE.md`
+- Location: `projects/[project]/documentation/`
+
+**Scripts:**
+- Descriptive names: `deploy-to-nas.ps1`, `fix-xcopy-error.ps1`
+- Location: `projects/[project]/deployment-scripts/` or `projects/[project]/scripts/`
+
+**Batch Files (DOS):**
+- Uppercase: `NWTOC.BAT`, `UPDATE.BAT`
+- Location: `projects/dataforth-dos/batch-files/`
+
+---
+
+## Examples by Scenario
+
+### Scenario 1: Working on Dataforth DOS Bug Fix
+
+**Files Created:**
+- `NWTOC.BAT` (modified) → `projects/dataforth-dos/batch-files/NWTOC.BAT`
+- `deploy-nwtoc-fix.ps1` → `projects/dataforth-dos/deployment-scripts/deploy-nwtoc-fix.ps1`
+- `NWTOC_FIX_2026-01-20.md` → `projects/dataforth-dos/documentation/NWTOC_FIX_2026-01-20.md`
+- Session log → `projects/dataforth-dos/session-logs/2026-01-20-session.md`
+
+### Scenario 2: Helping Horseshoe Management Client
+
+**Files Created:**
+- Update client info → `clients/horseshoe-management/CLIENT_INFO.md`
+- Session log → `clients/horseshoe-management/session-logs/2026-01-20-session.md`
+- Fix script (if created) → `clients/horseshoe-management/scripts/fix-glance.ps1`
+
+### Scenario 3: Adding ClaudeTools API Endpoint
+
+**Files Created:**
+- New router → `api/routers/new_endpoint.py` (existing structure)
+- Migration → `migrations/versions/xxx_add_table.py` (existing structure)
+- Session log → `projects/claudetools-api/session-logs/2026-01-20-session.md`
+- API docs → `projects/claudetools-api/documentation/NEW_ENDPOINT.md`
+
+### Scenario 4: Mixed Work (Multiple Projects)
+
+**Files Created:**
+- Session log → `session-logs/2026-01-20-session.md` (root)
+- Reference all projects worked on in the log
+- Project-specific files still go to project folders
+
+---
+
+## Automatic File Placement Checklist
+
+Before saving a file, ask:
+
+1. **Is this project-specific?**
+   - YES → Save to `projects/[project-name]/[appropriate-subfolder]/`
+   - NO → Continue to next question
+
+2. **Is this client-specific?**
+   - YES → Save to `clients/[client-name]/[appropriate-subfolder]/`
+   - NO → Continue to next question
+
+3. **Is this a session log?**
+   - Project-specific work → `projects/[project]/session-logs/`
+   - Client-specific work → `clients/[client]/session-logs/`
+   - Mixed/general work → `session-logs/` (root)
+
+4. **Is this shared infrastructure (credentials, main configs)?**
+   - YES → Save to root (e.g., `credentials.md`, `SESSION_STATE.md`)
+   - NO → Reevaluate context
+
+5. **Is this core ClaudeTools API code?**
+   - YES → Use existing structure (`api/`, `migrations/`, etc.)
+   - NO → Project folder
+
+---
+
+## When to Update Index Files
+
+**After creating new files, update:**
+
+1. **Project Index:**
+   - `projects/[project-name]/PROJECT_INDEX.md`
+   - Add new files to relevant sections
+   - Update file counts
+   - Update "Last Updated" date
+
+2. **Client Info:**
+   - `clients/[client-name]/CLIENT_INFO.md`
+   - Add new issues/resolutions
+   - Update "Last Contact" date
+
+3. **Master Organization:**
+   - `PROJECT_ORGANIZATION.md` (only for major changes)
+   - Update file counts quarterly or after major restructuring
+
+---
+
+## Special Cases
+
+### Temporary/Test Files
+- Keep in root temporarily
+- Move to appropriate folder once work is confirmed
+- Delete if no longer needed
+
+### Shared Utilities/Scripts
+- If used across multiple projects → `scripts/` (root)
+- If project-specific → `projects/[project]/scripts/`
+
+### Documentation That Spans Projects
+- Create in most relevant project folder
+- Reference from other project indexes
+- Or save to root `documentation/` if truly cross-project
+
+### Archived Projects
+- Move to `projects/[project-name]-archived/`
+- Update PROJECT_ORGANIZATION.md
+
+---
+
+## Enforcement
+
+**When using `/save` command:**
+- Automatically determine correct session-logs/ location
+- Remind user of file placement rules
+- Update relevant index files
+
+**During code review:**
+- Check file placement
+- Verify project/client organization
+- Ensure indexes are updated
+
+**Monthly maintenance:**
+- Review root directory for misplaced files
+- Move files to correct locations
+- Update all index files
+
+---
+
+## Quick Commands
+
+**Create new project:**
+```bash
+mkdir -p projects/[project-name]/{scripts,documentation,session-logs}
+cp PROJECT_INDEX_TEMPLATE.md projects/[project-name]/PROJECT_INDEX.md
+```
+
+**Create new client:**
+```bash
+mkdir -p clients/[client-name]/session-logs
+cp CLIENT_INFO_TEMPLATE.md clients/[client-name]/CLIENT_INFO.md
+```
+
+**Find misplaced files:**
+```bash
+# Files that should be in project folders
+ls -1 *.BAT *.ps1 *FIX*.md *DEPLOY*.md | grep -v projects/
+```
+
+---
+
+**Remember:** Good organization now saves hours of searching later!
+
+**Context Recovery Depends On:** Files being in predictable, consistent locations!

.claude/NATIVE_TASK_INTEGRATION.md

@@ -0,0 +1,669 @@
+# Native Task Integration Guide
+
+**Last Updated:** 2026-01-23
+**Purpose:** Guide for using Claude Code native task management tools in ClaudeTools workflow
+**Status:** Active
+
+---
+
+## Overview
+
+ClaudeTools integrates Claude Code's native task management tools (TaskCreate, TaskUpdate, TaskList, TaskGet) to provide structured task tracking during complex multi-step operations. Tasks are persisted to `.claude/active-tasks.json` for cross-session continuity.
+
+**Key Principles:**
+- Native tools for session-level coordination and real-time visibility
+- File-based persistence for cross-session recovery
+- Main Claude (coordinator) manages tasks
+- Agents report status, don't manage tasks directly
+- ASCII markers only (no emojis)
+
+---
+
+## When to Use Native Tasks
+
+### Use TaskCreate For:
+- **Complex multi-step operations** (>3 steps)
+- **Agent coordination** requiring status tracking
+- **User-requested progress visibility**
+- **Dependency management** between tasks
+- **Cross-session work** that may span multiple days
+
+### Continue Using TodoWrite For:
+- **Session summaries** (Documentation Squire)
+- **Simple checklists** (<3 items, trivial tasks)
+- **Documentation** in session logs
+- **Backward compatibility** with existing workflows
+
+### Quick Decision Rule:
+```
+If work involves >3 steps OR multiple agents → Use TaskCreate
+If work is simple/quick OR for documentation → Use TodoWrite
+```
+
+---
+
+## Core Tools
+
+### TaskCreate
+Creates a new task with structured metadata.
+
+**Parameters:**
+```javascript
+TaskCreate({
+  subject: "Brief task title (imperative form)",
+  description: "Detailed description of what needs to be done",
+  activeForm: "Present continuous form (e.g., 'Implementing feature')"
+})
+```
+
+**Returns:** Task ID for use in TaskUpdate/TaskGet
+
+**Example:**
+```javascript
+TaskCreate({
+  subject: "Implement API authentication",
+  description: "Complete JWT-based authentication with Argon2 password hashing, refresh tokens, and role-based access control",
+  activeForm: "Implementing API authentication"
+})
+// Returns: Task #7
+```
+
+### TaskUpdate
+Updates task status, ownership, or dependencies.
+
+**Parameters:**
+```javascript
+TaskUpdate({
+  taskId: "7",  // Task number from TaskCreate
+  status: "in_progress",  // pending, in_progress, completed
+  owner: "Coding Agent",  // Optional: which agent is working
+  addBlockedBy: ["5", "6"],  // Optional: dependency task IDs
+  addBlocks: ["8"]  // Optional: tasks that depend on this
+})
+```
+
+**Status Workflow:**
+```
+pending → in_progress → completed
+```
+
+**Example:**
+```javascript
+// Mark task as started
+TaskUpdate({
+  taskId: "7",
+  status: "in_progress",
+  owner: "Coding Agent"
+})
+
+// Mark task as complete
+TaskUpdate({
+  taskId: "7",
+  status: "completed"
+})
+```
+
+### TaskList
+Retrieves all active tasks with status.
+
+**Parameters:** None
+
+**Returns:** Summary of all tasks with ID, status, subject, owner, blockers
+
+**Example:**
+```javascript
+TaskList()
+
+// Returns:
+// #7 [in_progress] Implement API authentication (owner: Coding Agent)
+// #8 [pending] Review authentication code (blockedBy: #7)
+// #9 [pending] Write authentication tests (blockedBy: #8)
+```
+
+### TaskGet
+Retrieves full details of a specific task.
+
+**Parameters:**
+```javascript
+TaskGet({
+  taskId: "7"
+})
+```
+
+**Returns:** Complete task object with all metadata
+
+---
+
+## Workflow Patterns
+
+### Pattern 1: Simple Multi-Step Task
+
+```javascript
+// User request
+User: "Add dark mode toggle to dashboard"
+
+// Main Claude creates tasks
+TaskCreate({
+  subject: "Add dark mode toggle",
+  description: "Implement toggle button with CSS variables and state persistence",
+  activeForm: "Adding dark mode toggle"
+})
+// Returns: #10
+
+TaskCreate({
+  subject: "Design dark mode colors",
+  description: "Define color scheme and CSS variables",
+  activeForm: "Designing dark mode colors"
+})
+// Returns: #11
+
+TaskCreate({
+  subject: "Implement toggle component",
+  description: "Create React component with state management",
+  activeForm: "Implementing toggle component",
+  addBlockedBy: ["11"]  // Depends on design
+})
+// Returns: #12
+
+// Execute
+TaskUpdate({ taskId: "11", status: "in_progress" })
+// ... work happens ...
+TaskUpdate({ taskId: "11", status: "completed" })
+
+TaskUpdate({ taskId: "12", status: "in_progress" })  // Dependency cleared
+// ... work happens ...
+TaskUpdate({ taskId: "12", status: "completed" })
+
+// User sees progress via TaskList
+```
+
+### Pattern 2: Multi-Agent Coordination
+
+```javascript
+// User request
+User: "Implement user profile endpoint"
+
+// Main Claude creates task hierarchy
+parent_task = TaskCreate({
+  subject: "Implement user profile endpoint",
+  description: "Complete FastAPI endpoint with schema, code, review, tests",
+  activeForm: "Implementing profile endpoint"
+})
+// Returns: #13
+
+// Subtasks with dependencies
+design = TaskCreate({
+  subject: "Design endpoint schema",
+  description: "Define Pydantic models and validation rules",
+  activeForm: "Designing endpoint schema"
+})
+// Returns: #14
+
+code = TaskCreate({
+  subject: "Generate endpoint code",
+  description: "Write FastAPI route handler",
+  activeForm: "Generating endpoint code",
+  addBlockedBy: ["14"]
+})
+// Returns: #15
+
+review = TaskCreate({
+  subject: "Review code quality",
+  description: "Code review with security and standards check",
+  activeForm: "Reviewing code",
+  addBlockedBy: ["15"]
+})
+// Returns: #16
+
+tests = TaskCreate({
+  subject: "Write endpoint tests",
+  description: "Create pytest tests for all scenarios",
+  activeForm: "Writing tests",
+  addBlockedBy: ["16"]
+})
+// Returns: #17
+
+// Execute with agent coordination
+TaskUpdate({ taskId: "14", status: "in_progress", owner: "Coding Agent" })
+// Launch Coding Agent → Returns schema design
+TaskUpdate({ taskId: "14", status: "completed" })
+
+TaskUpdate({ taskId: "15", status: "in_progress", owner: "Coding Agent" })
+// Launch Coding Agent → Returns code
+TaskUpdate({ taskId: "15", status: "completed" })
+
+TaskUpdate({ taskId: "16", status: "in_progress", owner: "Code Review Agent" })
+// Launch Code Review Agent → Returns approval
+TaskUpdate({ taskId: "16", status: "completed" })
+
+TaskUpdate({ taskId: "17", status: "in_progress", owner: "Coding Agent" })
+// Launch Coding Agent → Returns tests
+TaskUpdate({ taskId: "17", status: "completed" })
+
+// All subtasks done, mark parent complete
+TaskUpdate({ taskId: "13", status: "completed" })
+```
+
+### Pattern 3: Blocked Task
+
+```javascript
+// Task encounters blocker
+TaskUpdate({
+  taskId: "20",
+  status: "blocked"
+})
+
+// Report to user
+"[ERROR] Task blocked: Need staging environment credentials
+ Would you like to provide credentials or skip deployment?"
+
+// When blocker resolved
+TaskUpdate({
+  taskId: "20",
+  status: "in_progress"
+})
+```
+
+---
+
+## File-Based Persistence
+
+### Storage Location
+`.claude/active-tasks.json`
+
+### File Structure
+```json
+{
+  "last_updated": "2026-01-23T10:30:00Z",
+  "tasks": [
+    {
+      "id": "7",
+      "subject": "Implement API authentication",
+      "description": "Complete JWT-based authentication...",
+      "activeForm": "Implementing API authentication",
+      "status": "in_progress",
+      "owner": "Coding Agent",
+      "created_at": "2026-01-23T10:00:00Z",
+      "started_at": "2026-01-23T10:05:00Z",
+      "completed_at": null,
+      "blocks": [],
+      "blockedBy": [],
+      "metadata": {
+        "client": "Dataforth",
+        "project": "ClaudeTools",
+        "complexity": "moderate"
+      }
+    }
+  ]
+}
+```
+
+### File Update Triggers
+
+**TaskCreate:**
+- Append new task object to tasks array
+- Update last_updated timestamp
+- Save file
+
+**TaskUpdate:**
+- Find task by ID
+- Update status, owner, timestamps
+- Update dependencies (blocks/blockedBy)
+- Update last_updated timestamp
+- Save file
+
+**Task Completion:**
+- Option 1: Update status to "completed" (keep in file)
+- Option 2: Remove from active-tasks.json (archive elsewhere)
+
+### Cross-Session Recovery
+
+**Session Start Workflow:**
+1. Check if `.claude/active-tasks.json` exists
+2. If exists: Read file content
+3. Parse JSON and filter incomplete tasks (status != "completed")
+4. For each incomplete task:
+   - Call TaskCreate with original subject/description/activeForm
+   - Map old ID to new native ID
+   - Restore dependencies using mapped IDs
+5. Call TaskList to show recovered state
+6. Continue execution
+
+**Example Recovery:**
+```javascript
+// Session ended yesterday with 2 incomplete tasks
+
+// New session starts
+if (file_exists(".claude/active-tasks.json")) {
+  tasks = read_json(".claude/active-tasks.json")
+  incomplete = tasks.filter(t => t.status !== "completed")
+
+  for (task of incomplete) {
+    new_id = TaskCreate({
+      subject: task.subject,
+      description: task.description,
+      activeForm: task.activeForm
+    })
+    // Map old task.id → new_id for dependency restoration
+  }
+
+  // Restore dependencies after all tasks recreated
+  for (task of incomplete) {
+    if (task.blockedBy.length > 0) {
+      TaskUpdate({
+        taskId: mapped_id(task.id),
+        addBlockedBy: task.blockedBy.map(mapped_id)
+      })
+    }
+  }
+}
+
+// Show user recovered state
+TaskList()
+"Continuing from previous session:
+ [IN PROGRESS] Design endpoint schema
+ [PENDING] Generate endpoint code (blocked by design)
+ [PENDING] Review code (blocked by generate)"
+```
+
+---
+
+## Agent Integration
+
+### Agents DO NOT Use Task Tools Directly
+
+Agents report status to Main Claude, who updates tasks.
+
+**Agent Workflow:**
+```javascript
+// Agent receives task context
+function execute_work(context) {
+  // 1. Perform specialized work
+  result = do_specialized_work(context)
+
+  // 2. Return structured status to Main Claude
+  return {
+    status: "completed",  // or "failed", "blocked"
+    outcome: "What was accomplished",
+    files_modified: ["file1.py", "file2.py"],
+    blockers: null,  // or array of blocker descriptions
+    next_steps: ["Code review required"]
+  }
+}
+
+// Main Claude receives result
+agent_result = Coding_Agent.execute_work(context)
+
+// Main Claude updates task
+if (agent_result.status === "completed") {
+  TaskUpdate({ taskId: "7", status: "completed" })
+} else if (agent_result.status === "blocked") {
+  TaskUpdate({ taskId: "7", status: "blocked" })
+  // Report blocker to user
+}
+```
+
+### Agent Status Translation
+
+**Agent Returns:**
+- `"completed"` → TaskUpdate(status: "completed")
+- `"failed"` → TaskUpdate(status: "blocked") + report error
+- `"blocked"` → TaskUpdate(status: "blocked") + report blocker
+- `"in_progress"` → TaskUpdate(status: "in_progress")
+
+---
+
+## User-Facing Output Format
+
+### Progress Display (ASCII Markers Only)
+
+```markdown
+## Progress
+
+- [SUCCESS] Design endpoint schema - completed
+- [IN PROGRESS] Generate endpoint code - Coding Agent working
+- [PENDING] Review code - blocked by code generation
+- [PENDING] Write tests - blocked by code review
+```
+
+**ASCII Marker Reference:**
+- `[OK]` - General success/confirmation
+- `[SUCCESS]` - Task completed successfully
+- `[IN PROGRESS]` - Task currently being worked on
+- `[PENDING]` - Task waiting to start
+- `[ERROR]` - Task failed or blocked
+- `[WARNING]` - Caution/potential issue
+
+**Never use emojis** - causes encoding issues, violates coding guidelines
+
+---
+
+## Main Claude Responsibilities
+
+### When Creating Tasks:
+1. Analyze user request for complexity (>3 steps?)
+2. Break down into logical subtasks
+3. Use TaskCreate for each task
+4. Set up dependencies (blockedBy) where appropriate
+5. Write all tasks to `.claude/active-tasks.json`
+6. Show task plan to user
+
+### When Executing Tasks:
+1. TaskUpdate(status: in_progress) BEFORE launching agent
+2. Update active-tasks.json file
+3. Launch specialized agent with context
+4. Receive agent status report
+5. TaskUpdate(status: completed/blocked) based on result
+6. Update active-tasks.json file
+7. Continue to next unblocked task
+
+### When Reporting Progress:
+1. TaskList() to get current state
+2. Translate to user-friendly format with ASCII markers
+3. Show: completed, in-progress, pending, blocked
+4. Provide context (which agent, what blockers)
+
+---
+
+## Quick Reference
+
+### Create Task
+```javascript
+TaskCreate({
+  subject: "Task title",
+  description: "Details",
+  activeForm: "Doing task"
+})
+```
+
+### Start Task
+```javascript
+TaskUpdate({
+  taskId: "7",
+  status: "in_progress",
+  owner: "Agent Name"
+})
+```
+
+### Complete Task
+```javascript
+TaskUpdate({
+  taskId: "7",
+  status: "completed"
+})
+```
+
+### Add Dependency
+```javascript
+TaskUpdate({
+  taskId: "8",
+  addBlockedBy: ["7"]  // Task 8 blocked by task 7
+})
+```
+
+### View All Tasks
+```javascript
+TaskList()
+```
+
+### Get Task Details
+```javascript
+TaskGet({ taskId: "7" })
+```
+
+---
+
+## Edge Cases
+
+### Corrupted JSON File
+```javascript
+try {
+  tasks = read_json(".claude/active-tasks.json")
+} catch (error) {
+  // File corrupted, start fresh
+  tasks = {
+    last_updated: now(),
+    tasks: []
+  }
+  write_json(".claude/active-tasks.json", tasks)
+}
+```
+
+### Missing File
+```javascript
+if (!file_exists(".claude/active-tasks.json")) {
+  // Create new file on first TaskCreate
+  write_json(".claude/active-tasks.json", {
+    last_updated: now(),
+    tasks: []
+  })
+}
+```
+
+### Task ID Mapping Issues
+- Old session task IDs don't match new native IDs
+- Solution: Maintain mapping table during recovery
+- Map old_id → new_id when recreating tasks
+- Use mapping when restoring dependencies
+
+---
+
+## Examples
+
+### Example 1: Add New Feature
+
+```javascript
+User: "Add password reset functionality"
+
+// Create task structure
+main = TaskCreate({
+  subject: "Add password reset functionality",
+  description: "Email-based password reset with token expiration",
+  activeForm: "Adding password reset"
+})
+
+design = TaskCreate({
+  subject: "Design reset token system",
+  description: "Define token generation, storage, and validation",
+  activeForm: "Designing reset tokens"
+})
+
+backend = TaskCreate({
+  subject: "Implement backend endpoints",
+  description: "Create /forgot-password and /reset-password endpoints",
+  activeForm: "Implementing backend",
+  addBlockedBy: [design.id]
+})
+
+email = TaskCreate({
+  subject: "Create password reset email template",
+  description: "Design HTML email with reset link",
+  activeForm: "Creating email template",
+  addBlockedBy: [design.id]
+})
+
+tests = TaskCreate({
+  subject: "Write password reset tests",
+  description: "Test token generation, expiration, and reset flow",
+  activeForm: "Writing tests",
+  addBlockedBy: [backend.id, email.id]
+})
+
+// Execute
+TaskUpdate({ taskId: design.id, status: "in_progress" })
+// ... Coding Agent designs system ...
+TaskUpdate({ taskId: design.id, status: "completed" })
+
+TaskUpdate({ taskId: backend.id, status: "in_progress" })
+TaskUpdate({ taskId: email.id, status: "in_progress" })
+// ... Both agents work in parallel ...
+TaskUpdate({ taskId: backend.id, status: "completed" })
+TaskUpdate({ taskId: email.id, status: "completed" })
+
+TaskUpdate({ taskId: tests.id, status: "in_progress" })
+// ... Testing Agent writes tests ...
+TaskUpdate({ taskId: tests.id, status: "completed" })
+
+TaskUpdate({ taskId: main.id, status: "completed" })
+
+// User sees: "[SUCCESS] Password reset functionality added"
+```
+
+### Example 2: Cross-Session Work
+
+```javascript
+// Monday 4pm - Session ends mid-work
+TaskList()
+// #50 [completed] Design user dashboard
+// #51 [in_progress] Implement dashboard components
+// #52 [pending] Review dashboard code (blockedBy: #51)
+// #53 [pending] Write dashboard tests (blockedBy: #52)
+
+// Tuesday 9am - New session
+// Main Claude auto-recovers tasks from file
+tasks_recovered = load_and_recreate_tasks()
+
+TaskList()
+// #1 [in_progress] Implement dashboard components (recovered)
+// #2 [pending] Review dashboard code (recovered, blocked by #1)
+// #3 [pending] Write dashboard tests (recovered, blocked by #2)
+
+User sees: "Continuing from yesterday: Dashboard implementation in progress"
+
+// Continue work
+TaskUpdate({ taskId: "1", status: "completed" })
+TaskUpdate({ taskId: "2", status: "in_progress" })
+// ... etc
+```
+
+---
+
+## Troubleshooting
+
+### Problem: Tasks not persisting between sessions
+**Solution:** Check that `.claude/active-tasks.json` is being written after each TaskCreate/TaskUpdate
+
+### Problem: Dependency chains broken after recovery
+**Solution:** Ensure ID mapping is maintained during recovery and dependencies are restored correctly
+
+### Problem: File getting too large
+**Solution:** Archive completed tasks periodically, keep only active/pending tasks in file
+
+### Problem: Circular dependencies
+**Solution:** Validate dependency chains before creating, ensure no task blocks itself directly or indirectly
+
+---
+
+## Related Documentation
+
+- `.claude/directives.md` - Main Claude identity and task management rules
+- `.claude/AGENT_COORDINATION_RULES.md` - Agent delegation patterns
+- `.claude/TASK_MANAGEMENT.md` - Task management system overview
+- `.claude/agents/documentation-squire.md` - TodoWrite usage for documentation
+
+---
+
+**Version:** 1.0
+**Created:** 2026-01-23
+**Purpose:** Enable structured task tracking in ClaudeTools workflow
+**Status:** Active

.claude/OFFLINE_MODE.md

@@ -254,7 +254,7 @@ sudo systemctl start claudetools-api
 
 ```
 <!-- Context Recall: Retrieved 3 relevant context(s) from API -->
-## 📚 Previous Context
+## [DOCS] Previous Context
 
 The following context has been automatically recalled:
 ...
@@ -264,9 +264,9 @@ The following context has been automatically recalled:
 
 ```
 <!-- Context Recall: Retrieved 3 relevant context(s) from LOCAL CACHE (offline mode) -->
-## 📚 Previous Context
+## [DOCS] Previous Context
 
-⚠️ **Offline Mode** - Using cached context (API unavailable)
+[WARNING] **Offline Mode** - Using cached context (API unavailable)
 
 The following context has been automatically recalled:
 ...
@@ -433,14 +433,14 @@ Create a cron job or scheduled task:
 
 | Feature | V1 (Original) | V2 (Offline-Capable) |
 |---------|---------------|----------------------|
-| API Recall | ✅ Yes | ✅ Yes |
-| API Save | ✅ Yes | ✅ Yes |
-| Offline Recall | ❌ Silent fail | ✅ Uses local cache |
-| Offline Save | ❌ Data loss | ✅ Queues locally |
-| Auto-sync | ❌ No | ✅ Background sync |
-| Manual sync | ❌ No | ✅ sync-contexts script |
-| Status indicators | ❌ Silent | ✅ Clear messages |
-| Data resilience | ❌ Low | ✅ High |
+| API Recall | [OK] Yes | [OK] Yes |
+| API Save | [OK] Yes | [OK] Yes |
+| Offline Recall | [ERROR] Silent fail | [OK] Uses local cache |
+| Offline Save | [ERROR] Data loss | [OK] Queues locally |
+| Auto-sync | [ERROR] No | [OK] Background sync |
+| Manual sync | [ERROR] No | [OK] sync-contexts script |
+| Status indicators | [ERROR] Silent | [OK] Clear messages |
+| Data resilience | [ERROR] Low | [OK] High |
 
 ---
 

.claude/PERIODIC_CONTEXT_SAVE.md

@@ -1,357 +0,0 @@
-# Periodic Context Save
-
-**Automatic context saving every 5 minutes of active work**
-
----
-
-## Overview
-
-The periodic context save daemon runs in the background and automatically saves your work context to the database every 5 minutes of active time. This ensures continuous context preservation even during long work sessions.
-
-### Key Features
-
-- ✅ **Active Time Tracking** - Only counts time when Claude is actively working
-- ✅ **Ignores Idle Time** - Doesn't save when waiting for permissions or idle
-- ✅ **Background Process** - Runs independently, doesn't interrupt work
-- ✅ **Automatic Recovery** - Resumes tracking after restarts
-- ✅ **Low Overhead** - Checks activity every 60 seconds
-
----
-
-## How It Works
-
-```
-┌─────────────────────────────────────────────────────┐
-│ Every 60 seconds:                                   │
-│                                                      │
-│ 1. Check if Claude Code is active                  │
-│    - Recent file modifications?                     │
-│    - Claude process running?                        │
-│                                                      │
-│ 2. If ACTIVE → Add 60s to timer                    │
-│    If IDLE → Don't add time                        │
-│                                                      │
-│ 3. When timer reaches 300s (5 min):                │
-│    - Save context to database                       │
-│    - Reset timer to 0                               │
-│    - Continue monitoring                            │
-└─────────────────────────────────────────────────────┘
-```
-
-**Active time includes:**
-- Writing code
-- Running commands
-- Making changes to files
-- Interacting with Claude
-
-**Idle time (not counted):**
-- Waiting for user input
-- Permission prompts
-- No file changes or activity
-- Claude process not running
-
----
-
-## Usage
-
-### Start the Daemon
-
-```bash
-python .claude/hooks/periodic_context_save.py start
-```
-
-Output:
-```
-Started periodic context save daemon (PID: 12345)
-Logs: D:\ClaudeTools\.claude\periodic-save.log
-```
-
-### Check Status
-
-```bash
-python .claude/hooks/periodic_context_save.py status
-```
-
-Output:
-```
-Periodic context save daemon is running (PID: 12345)
-Active time: 180s / 300s
-Last save: 2026-01-17T19:05:23+00:00
-```
-
-### Stop the Daemon
-
-```bash
-python .claude/hooks/periodic_context_save.py stop
-```
-
-Output:
-```
-Stopped periodic context save daemon (PID: 12345)
-```
-
----
-
-## Installation
-
-### One-Time Setup
-
-1. **Ensure JWT token is configured:**
-   ```bash
-   # Token should already be in .claude/context-recall-config.env
-   cat .claude/context-recall-config.env | grep JWT_TOKEN
-   ```
-
-2. **Start the daemon:**
-   ```bash
-   python .claude/hooks/periodic_context_save.py start
-   ```
-
-3. **Verify it's running:**
-   ```bash
-   python .claude/hooks/periodic_context_save.py status
-   ```
-
-### Auto-Start on Login (Optional)
-
-**Windows - Task Scheduler:**
-
-1. Open Task Scheduler
-2. Create Basic Task:
-   - Name: "Claude Periodic Context Save"
-   - Trigger: At log on
-   - Action: Start a program
-   - Program: `python`
-   - Arguments: `D:\ClaudeTools\.claude\hooks\periodic_context_save.py start`
-   - Start in: `D:\ClaudeTools`
-
-**Linux/Mac - systemd/launchd:**
-
-Create a systemd service or launchd plist to start on login.
-
----
-
-## What Gets Saved
-
-Every 5 minutes of active time, the daemon saves:
-
-```json
-{
-  "context_type": "session_summary",
-  "title": "Periodic Save - 2026-01-17 14:30",
-  "dense_summary": "Auto-saved context after 5 minutes of active work. Session in progress on project: claudetools-main",
-  "relevance_score": 5.0,
-  "tags": ["auto-save", "periodic", "active-session"]
-}
-```
-
-**Benefits:**
-- Never lose more than 5 minutes of work context
-- Automatic recovery if session crashes
-- Historical timeline of work sessions
-- Can review what you were working on at specific times
-
----
-
-## Monitoring
-
-### View Logs
-
-```bash
-# View last 20 log lines
-tail -20 .claude/periodic-save.log
-
-# Follow logs in real-time
-tail -f .claude/periodic-save.log
-```
-
-**Sample log output:**
-```
-[2026-01-17 14:25:00] Periodic context save daemon started
-[2026-01-17 14:25:00] Will save context every 300s of active time
-[2026-01-17 14:26:00] Active: 60s / 300s
-[2026-01-17 14:27:00] Active: 120s / 300s
-[2026-01-17 14:28:00] Claude Code inactive - not counting time
-[2026-01-17 14:29:00] Active: 180s / 300s
-[2026-01-17 14:30:00] Active: 240s / 300s
-[2026-01-17 14:31:00] 300s of active time reached - saving context
-[2026-01-17 14:31:01] ✓ Context saved successfully (ID: 1e2c3408-9146-4e98-b302-fe219280344c)
-[2026-01-17 14:32:00] Active: 60s / 300s
-```
-
-### View State
-
-```bash
-# Check current state
-cat .claude/.periodic-save-state.json | python -m json.tool
-```
-
-Output:
-```json
-{
-  "active_seconds": 180,
-  "last_update": "2026-01-17T19:28:00+00:00",
-  "last_save": "2026-01-17T19:26:00+00:00"
-}
-```
-
----
-
-## Configuration
-
-Edit the script to customize:
-
-```python
-# In periodic_context_save.py
-
-SAVE_INTERVAL_SECONDS = 300  # Change to 600 for 10 minutes
-CHECK_INTERVAL_SECONDS = 60  # How often to check activity
-```
-
-**Common configurations:**
-- Every 5 minutes: `SAVE_INTERVAL_SECONDS = 300`
-- Every 10 minutes: `SAVE_INTERVAL_SECONDS = 600`
-- Every 15 minutes: `SAVE_INTERVAL_SECONDS = 900`
-
----
-
-## Troubleshooting
-
-### Daemon won't start
-
-**Check logs:**
-```bash
-cat .claude/periodic-save.log
-```
-
-**Common issues:**
-- JWT token missing or invalid
-- Python not in PATH
-- Permissions issue with log file
-
-**Solution:**
-```bash
-# Verify JWT token exists
-grep JWT_TOKEN .claude/context-recall-config.env
-
-# Test Python
-python --version
-
-# Check permissions
-ls -la .claude/
-```
-
-### Contexts not being saved
-
-**Check:**
-1. Daemon is running: `python .claude/hooks/periodic_context_save.py status`
-2. JWT token is valid: Token expires after 30 days
-3. API is accessible: `curl http://172.16.3.30:8001/health`
-4. View logs for errors: `tail .claude/periodic-save.log`
-
-**If JWT token expired:**
-```bash
-# Generate new token
-python create_jwt_token.py
-
-# Update config
-# Copy new JWT_TOKEN to .claude/context-recall-config.env
-
-# Restart daemon
-python .claude/hooks/periodic_context_save.py stop
-python .claude/hooks/periodic_context_save.py start
-```
-
-### Activity not being detected
-
-The daemon uses these heuristics:
-- File modifications in project directory (within last 2 minutes)
-- Claude process running (on Windows)
-
-**Improve detection:**
-Modify `is_claude_active()` function to add:
-- Check for recent git commits
-- Monitor specific files
-- Check for recent bash history
-
----
-
-## Integration with Other Hooks
-
-The periodic save works alongside existing hooks:
-
-| Hook | Trigger | What It Saves |
-|------|---------|---------------|
-| **user-prompt-submit** | Before each message | Recalls context from DB |
-| **task-complete** | After task completes | Rich context with decisions |
-| **periodic-context-save** | Every 5min active | Quick checkpoint save |
-
-**Result:**
-- Comprehensive context coverage
-- Never lose more than 5 minutes of work
-- Detailed context when tasks complete
-- Continuous backup of active sessions
-
----
-
-## Performance Impact
-
-**Resource Usage:**
-- **CPU:** < 0.1% (checks once per minute)
-- **Memory:** ~30 MB (Python process)
-- **Disk:** ~2 KB per save (~25 KB/hour)
-- **Network:** Minimal (single API call every 5 min)
-
-**Impact on Claude Code:**
-- None - runs as separate process
-- Doesn't block or interrupt work
-- No user-facing delays
-
----
-
-## Uninstall
-
-To remove periodic context save:
-
-```bash
-# Stop daemon
-python .claude/hooks/periodic_context_save.py stop
-
-# Remove files (optional)
-rm .claude/hooks/periodic_context_save.py
-rm .claude/.periodic-save.pid
-rm .claude/.periodic-save-state.json
-rm .claude/periodic-save.log
-
-# Remove from auto-start (if configured)
-# Windows: Delete from Task Scheduler
-# Linux: Remove systemd service
-```
-
----
-
-## FAQ
-
-**Q: Does it save when I'm idle?**
-A: No - only counts active work time (file changes, Claude activity).
-
-**Q: What if the API is down?**
-A: Contexts queue locally and sync when API is restored (offline mode).
-
-**Q: Can I change the interval?**
-A: Yes - edit `SAVE_INTERVAL_SECONDS` in the script.
-
-**Q: Does it work offline?**
-A: Yes - uses the same offline queue as other hooks (v2).
-
-**Q: How do I know it's working?**
-A: Check logs: `tail .claude/periodic-save.log`
-
-**Q: Can I run multiple instances?**
-A: No - PID file prevents multiple daemons.
-
----
-
-**Created:** 2026-01-17
-**Version:** 1.0
-**Status:** Ready for use

.claude/REFERENCE.md

@@ -0,0 +1,213 @@
+# ClaudeTools Reference Guide
+
+**Purpose:** On-demand reference material for agents and deep-dive questions.
+**Not loaded automatically** - agents read this when they need project details.
+
+---
+
+## Project Structure
+
+```
+D:\ClaudeTools/
+├── api/                    # FastAPI application
+│   ├── main.py            # API entry point
+│   ├── models/            # SQLAlchemy models
+│   ├── routers/           # API endpoints
+│   ├── schemas/           # Pydantic schemas
+│   ├── services/          # Business logic
+│   ├── middleware/        # Auth & error handling
+│   └── utils/             # Crypto utilities
+├── migrations/            # Alembic database migrations
+├── .claude/              # Claude Code hooks & config
+│   ├── commands/         # Commands (create-spec, checkpoint)
+│   ├── skills/           # Skills (frontend-design)
+│   └── templates/        # Templates (app spec, prompts)
+├── mcp-servers/          # MCP server implementations
+│   └── feature-management/  # Feature tracking MCP server
+├── scripts/              # Setup & test scripts
+└── projects/             # Project workspaces
+```
+
+---
+
+## Starting the API
+
+```bash
+# Activate virtual environment
+api\venv\Scripts\activate
+
+# Start API server
+python -m api.main
+# OR
+uvicorn api.main:app --reload --host 0.0.0.0 --port 8000
+
+# Access documentation
+http://localhost:8000/api/docs
+```
+
+---
+
+## API Endpoints
+
+### Core Entities (Phase 4)
+- `/api/machines` - Machine inventory
+- `/api/clients` - Client management
+- `/api/projects` - Project tracking
+- `/api/sessions` - Work sessions
+- `/api/tags` - Tagging system
+
+### MSP Work Tracking (Phase 5)
+- `/api/work-items` - Work item tracking
+- `/api/tasks` - Task management
+- `/api/billable-time` - Time & billing
+
+### Infrastructure (Phase 5)
+- `/api/sites` - Physical locations
+- `/api/infrastructure` - IT assets
+- `/api/services` - Application services
+- `/api/networks` - Network configs
+- `/api/firewall-rules` - Firewall documentation
+- `/api/m365-tenants` - M365 tenant management
+
+### Credentials (Phase 5)
+- `/api/credentials` - Encrypted credential storage
+- `/api/credential-audit-logs` - Audit trail (read-only)
+- `/api/security-incidents` - Incident tracking
+
+---
+
+## Common Workflows
+
+### 1. Create New Project
+
+```python
+POST /api/projects
+{
+  "name": "New Website",
+  "client_id": "client-uuid",
+  "status": "planning"
+}
+```
+
+### 2. Track Work Session
+
+```python
+# Create session
+POST /api/sessions
+{
+  "project_id": "project-uuid",
+  "machine_id": "machine-uuid",
+  "started_at": "2026-01-16T10:00:00Z"
+}
+
+# Log billable time
+POST /api/billable-time
+{
+  "session_id": "session-uuid",
+  "work_item_id": "work-item-uuid",
+  "client_id": "client-uuid",
+  "start_time": "2026-01-16T10:00:00Z",
+  "end_time": "2026-01-16T12:00:00Z",
+  "duration_hours": 2.0,
+  "hourly_rate": 150.00,
+  "total_amount": 300.00
+}
+```
+
+### 3. Store Encrypted Credential
+
+```python
+POST /api/credentials
+{
+  "credential_type": "api_key",
+  "service_name": "OpenAI API",
+  "username": "api_key",
+  "password": "sk-1234567890",  # Auto-encrypted
+  "client_id": "client-uuid",
+  "notes": "Production API key"
+}
+# Password automatically encrypted with AES-256-GCM
+# Audit log automatically created
+```
+
+---
+
+## Important Files
+
+| File | Purpose |
+|------|---------|
+| `SESSION_STATE.md` | Complete project history and status |
+| `credentials.md` | ALL infrastructure credentials (UNREDACTED) |
+| `session-logs/` | Daily session documentation |
+| `.env` / `.env.example` | Environment variables |
+| `test_api_endpoints.py` | Phase 4 tests |
+| `test_phase5_api_endpoints.py` | Phase 5 tests |
+| `AUTOCODER_INTEGRATION.md` | AutoCoder resources guide |
+| `TEST_PHASE5_RESULTS.md` | Phase 5 test results |
+
+---
+
+## Security
+
+- **Authentication:** JWT tokens (Argon2 password hashing)
+- **Encryption:** AES-256-GCM (Fernet) for credentials
+- **Audit Logging:** All credential operations logged
+
+```bash
+# Get JWT Token
+POST /api/auth/token
+{ "email": "user@example.com", "password": "your-password" }
+```
+
+---
+
+## Troubleshooting
+
+```bash
+# API won't start - check port
+netstat -ano | findstr :8000
+# Check database connection
+python test_db_connection.py
+
+# Database migration issues
+alembic current        # Check current revision
+alembic history        # Show migration history
+alembic upgrade head   # Upgrade to latest
+```
+
+---
+
+## MCP Servers
+
+See `MCP_SERVERS.md` for complete details.
+
+- **GitHub MCP** - Repository and PR management (requires token)
+- **Filesystem MCP** - Enhanced file operations (D:\ClaudeTools access)
+- **Sequential Thinking MCP** - Structured problem-solving
+
+Config: `.mcp.json` | Setup: `bash scripts/setup-mcp-servers.sh`
+
+---
+
+## Next Steps (Optional Phase 7)
+
+- File Changes API - Track file modifications
+- Command Runs API - Command execution history
+- Problem Solutions API - Knowledge base
+- Failure Patterns API - Error pattern recognition
+- Environmental Insights API - Contextual learning
+
+These are optional - the system is fully functional without them.
+
+---
+
+## Session Log Locations
+
+**Project-Specific:**
+- Dataforth DOS: `projects/dataforth-dos/session-logs/YYYY-MM-DD-session.md`
+- ClaudeTools API: `projects/claudetools-api/session-logs/YYYY-MM-DD-session.md`
+
+**Client-Specific:** `clients/[client-name]/session-logs/YYYY-MM-DD-session.md`
+**General/Mixed:** `session-logs/YYYY-MM-DD-session.md` (root)
+
+See `PROJECT_ORGANIZATION.md` for complete structure.

.claude/REVIEW_FIX_VERIFY_WORKFLOW.md

@@ -207,13 +207,13 @@ Create `.git/hooks/pre-commit` (or use existing):
 # Pre-commit hook: Check for coding guideline violations
 
 # Check for emojis in code files
-if git diff --cached --name-only | grep -E '\.(py|sh|ps1)$' | xargs grep -l '[✓✗⚠❌✅📚]' 2>/dev/null; then
+if git diff --cached --name-only | grep -E '\.(py|sh|ps1)$' | xargs grep -l '[✓✗⚠[ERROR][OK][DOCS]]' 2>/dev/null; then
     echo "[ERROR] Emoji characters found in code files"
     echo "Code files must not contain emojis per CODING_GUIDELINES.md"
     echo "Use ASCII markers: [OK], [ERROR], [WARNING], [SUCCESS]"
     echo ""
     echo "Files with violations:"
-    git diff --cached --name-only | grep -E '\.(py|sh|ps1)$' | xargs grep -l '[✓✗⚠❌✅📚]'
+    git diff --cached --name-only | grep -E '\.(py|sh|ps1)$' | xargs grep -l '[✓✗⚠[ERROR][OK][DOCS]]'
     exit 1
 fi
 

.claude/SCHEMA_CONTEXT.md

@@ -1,892 +0,0 @@
-# Learning & Context Schema
-
-**MSP Mode Database Schema - Self-Learning System**
-
-**Status:** Designed 2026-01-15
-**Database:** msp_tracking (MariaDB on Jupiter)
-
----
-
-## Overview
-
-The Learning & Context subsystem enables MSP Mode to learn from every failure, build environmental awareness, and prevent recurring mistakes. This self-improving system captures failure patterns, generates actionable insights, and proactively checks environmental constraints before making suggestions.
-
-**Core Principle:** Every failure is a learning opportunity. Agents must never make the same mistake twice.
-
-**Related Documentation:**
-- [MSP-MODE-SPEC.md](../MSP-MODE-SPEC.md) - Full system specification
-- [ARCHITECTURE_OVERVIEW.md](ARCHITECTURE_OVERVIEW.md) - Agent architecture
-- [SCHEMA_CREDENTIALS.md](SCHEMA_CREDENTIALS.md) - Security tables
-- [API_SPEC.md](API_SPEC.md) - API endpoints
-
----
-
-## Tables Summary
-
-| Table | Purpose | Auto-Generated |
-|-------|---------|----------------|
-| `environmental_insights` | Generated insights per client/infrastructure | Yes |
-| `problem_solutions` | Issue tracking with root cause and resolution | Partial |
-| `failure_patterns` | Aggregated failure analysis and learnings | Yes |
-| `operation_failures` | Non-command failures (API, file ops, network) | Yes |
-
-**Total:** 4 tables
-
-**Specialized Agents:**
-- **Failure Analysis Agent** - Analyzes failures, identifies patterns, generates insights
-- **Environment Context Agent** - Pre-checks environmental constraints before operations
-- **Problem Pattern Matching Agent** - Searches historical solutions for similar issues
-
----
-
-## Table Schemas
-
-### `environmental_insights`
-
-Auto-generated insights about client infrastructure constraints, limitations, and quirks. Used by Environment Context Agent to prevent failures before they occur.
-
-```sql
-CREATE TABLE environmental_insights (
-    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-    client_id UUID REFERENCES clients(id) ON DELETE CASCADE,
-    infrastructure_id UUID REFERENCES infrastructure(id) ON DELETE CASCADE,
-
-    -- Insight classification
-    insight_category VARCHAR(100) NOT NULL CHECK(insight_category IN (
-        'command_constraints', 'service_configuration', 'version_limitations',
-        'custom_installations', 'network_constraints', 'permissions',
-        'compatibility', 'performance', 'security'
-    )),
-    insight_title VARCHAR(500) NOT NULL,
-    insight_description TEXT NOT NULL, -- markdown formatted
-
-    -- Examples and documentation
-    examples TEXT, -- JSON array of command/config examples
-    affected_operations TEXT, -- JSON array: ["user_management", "service_restart"]
-
-    -- Source and verification
-    source_pattern_id UUID REFERENCES failure_patterns(id) ON DELETE SET NULL,
-    confidence_level VARCHAR(20) CHECK(confidence_level IN ('confirmed', 'likely', 'suspected')),
-    verification_count INTEGER DEFAULT 1, -- how many times verified
-    last_verified TIMESTAMP,
-
-    -- Priority (1-10, higher = more important to avoid)
-    priority INTEGER DEFAULT 5 CHECK(priority BETWEEN 1 AND 10),
-
-    -- Status
-    is_active BOOLEAN DEFAULT true, -- false if pattern no longer applies
-    superseded_by UUID REFERENCES environmental_insights(id), -- if replaced by better insight
-
-    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-    updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-
-    INDEX idx_insights_client (client_id),
-    INDEX idx_insights_infrastructure (infrastructure_id),
-    INDEX idx_insights_category (insight_category),
-    INDEX idx_insights_priority (priority),
-    INDEX idx_insights_active (is_active)
-);
-```
-
-**Real-World Examples:**
-
-**D2TESTNAS - Custom WINS Installation:**
-```json
-{
-  "infrastructure_id": "d2testnas-uuid",
-  "client_id": "dataforth-uuid",
-  "insight_category": "custom_installations",
-  "insight_title": "WINS Service: Manual Samba installation (no native ReadyNAS service)",
-  "insight_description": "**Installation:** Manually installed via Samba nmbd, not a native ReadyNAS service.\n\n**Constraints:**\n- No GUI service manager for WINS\n- Cannot use standard service management commands\n- Configuration via `/etc/frontview/samba/smb.conf.overrides`\n\n**Correct commands:**\n- Check status: `ssh root@192.168.0.9 'ps aux | grep nmbd'`\n- View config: `ssh root@192.168.0.9 'cat /etc/frontview/samba/smb.conf.overrides | grep wins'`\n- Restart: `ssh root@192.168.0.9 'service nmbd restart'`",
-  "examples": [
-    "ps aux | grep nmbd",
-    "cat /etc/frontview/samba/smb.conf.overrides | grep wins",
-    "service nmbd restart"
-  ],
-  "affected_operations": ["service_management", "wins_configuration"],
-  "confidence_level": "confirmed",
-  "verification_count": 3,
-  "priority": 9
-}
-```
-
-**AD2 - PowerShell Version Constraints:**
-```json
-{
-  "infrastructure_id": "ad2-uuid",
-  "client_id": "dataforth-uuid",
-  "insight_category": "version_limitations",
-  "insight_title": "Server 2022: PowerShell 5.1 command compatibility",
-  "insight_description": "**PowerShell Version:** 5.1 (default)\n\n**Compatible:** Modern cmdlets work (Get-LocalUser, Get-LocalGroup)\n\n**Not available:** PowerShell 7 specific features\n\n**Remote execution:** Use Invoke-Command for remote operations",
-  "examples": [
-    "Get-LocalUser",
-    "Get-LocalGroup",
-    "Invoke-Command -ComputerName AD2 -ScriptBlock { Get-LocalUser }"
-  ],
-  "confidence_level": "confirmed",
-  "verification_count": 5,
-  "priority": 6
-}
-```
-
-**Server 2008 - PowerShell 2.0 Limitations:**
-```json
-{
-  "infrastructure_id": "old-server-2008-uuid",
-  "insight_category": "version_limitations",
-  "insight_title": "Server 2008: PowerShell 2.0 command compatibility",
-  "insight_description": "**PowerShell Version:** 2.0 only\n\n**Avoid:** Get-LocalUser, Get-LocalGroup, New-LocalUser (not available in PS 2.0)\n\n**Use instead:** Get-WmiObject Win32_UserAccount, Get-WmiObject Win32_Group\n\n**Why:** Server 2008 predates modern PowerShell user management cmdlets",
-  "examples": [
-    "Get-WmiObject Win32_UserAccount",
-    "Get-WmiObject Win32_Group",
-    "Get-WmiObject Win32_UserAccount -Filter \"Name='username'\""
-  ],
-  "affected_operations": ["user_management", "group_management"],
-  "confidence_level": "confirmed",
-  "verification_count": 5,
-  "priority": 8
-}
-```
-
-**DOS Machines (TS-XX) - Batch Syntax Constraints:**
-```json
-{
-  "infrastructure_id": "ts-27-uuid",
-  "client_id": "dataforth-uuid",
-  "insight_category": "command_constraints",
-  "insight_title": "MS-DOS 6.22: Batch file syntax limitations",
-  "insight_description": "**OS:** MS-DOS 6.22\n\n**No support for:**\n- `IF /I` (case insensitive) - added in Windows 2000\n- Long filenames (8.3 format only)\n- Unicode or special characters\n- Modern batch features\n\n**Workarounds:**\n- Use duplicate IF statements for upper/lowercase\n- Keep filenames to 8.3 format\n- Use basic batch syntax only",
-  "examples": [
-    "IF \"%1\"=\"STATUS\" GOTO STATUS",
-    "IF \"%1\"=\"status\" GOTO STATUS",
-    "COPY FILE.TXT BACKUP.TXT"
-  ],
-  "affected_operations": ["batch_scripting", "file_operations"],
-  "confidence_level": "confirmed",
-  "verification_count": 8,
-  "priority": 10
-}
-```
-
-**D2TESTNAS - SMB Protocol Constraints:**
-```json
-{
-  "infrastructure_id": "d2testnas-uuid",
-  "insight_category": "network_constraints",
-  "insight_title": "ReadyNAS: SMB1/CORE protocol for DOS compatibility",
-  "insight_description": "**Protocol:** CORE/SMB1 only (for DOS machine compatibility)\n\n**Implications:**\n- Modern SMB2/3 clients may need configuration\n- Use NetBIOS name, not IP address for DOS machines\n- Security risk: SMB1 deprecated due to vulnerabilities\n\n**Configuration:**\n- Set in `/etc/frontview/samba/smb.conf.overrides`\n- `min protocol = CORE`",
-  "examples": [
-    "NET USE Z: \\\\D2TESTNAS\\SHARE (from DOS)",
-    "smbclient -L //192.168.0.9 -m SMB1"
-  ],
-  "confidence_level": "confirmed",
-  "priority": 7
-}
-```
-
-**Generated insights.md Example:**
-
-When Failure Analysis Agent runs, it generates markdown files for each client:
-
-```markdown
-# Environmental Insights: Dataforth
-
-Auto-generated from failure patterns and verified operations.
-
-## D2TESTNAS (192.168.0.9)
-
-### Custom Installations
-
-**WINS Service: Manual Samba installation**
-- Manually installed via Samba nmbd, not native ReadyNAS service
-- No GUI service manager for WINS
-- Configure via `/etc/frontview/samba/smb.conf.overrides`
-- Check status: `ssh root@192.168.0.9 'ps aux | grep nmbd'`
-
-### Network Constraints
-
-**SMB Protocol: CORE/SMB1 only**
-- For DOS compatibility
-- Modern SMB2/3 clients may need configuration
-- Use NetBIOS name from DOS machines
-
-## AD2 (192.168.0.6 - Server 2022)
-
-### PowerShell Version
-
-**Version:** PowerShell 5.1 (default)
-- **Compatible:** Modern cmdlets work
-- **Not available:** PowerShell 7 specific features
-
-## TS-XX Machines (DOS 6.22)
-
-### Command Constraints
-
-**No support for:**
-- `IF /I` (case insensitive) - use duplicate IF statements
-- Long filenames (8.3 format only)
-- Unicode or special characters
-- Modern batch features
-
-**Examples:**
-```batch
-REM Correct (DOS 6.22)
-IF "%1"=="STATUS" GOTO STATUS
-IF "%1"=="status" GOTO STATUS
-
-REM Incorrect (requires Windows 2000+)
-IF /I "%1"=="STATUS" GOTO STATUS
-```
-```
-
----
-
-### `problem_solutions`
-
-Issue tracking with root cause analysis and resolution documentation. Searchable historical knowledge base.
-
-```sql
-CREATE TABLE problem_solutions (
-    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-    work_item_id UUID NOT NULL REFERENCES work_items(id) ON DELETE CASCADE,
-    session_id UUID NOT NULL REFERENCES sessions(id) ON DELETE CASCADE,
-    client_id UUID REFERENCES clients(id) ON DELETE SET NULL,
-    infrastructure_id UUID REFERENCES infrastructure(id) ON DELETE SET NULL,
-
-    -- Problem description
-    problem_title VARCHAR(500) NOT NULL,
-    problem_description TEXT NOT NULL,
-    symptom TEXT, -- what user/system exhibited
-    error_message TEXT, -- exact error code/message
-    error_code VARCHAR(100), -- structured error code
-
-    -- Investigation
-    investigation_steps TEXT, -- JSON array of diagnostic commands/actions
-    diagnostic_output TEXT, -- key outputs that led to root cause
-    investigation_duration_minutes INTEGER,
-
-    -- Root cause
-    root_cause TEXT NOT NULL,
-    root_cause_category VARCHAR(100), -- "configuration", "hardware", "software", "network"
-
-    -- Solution
-    solution_applied TEXT NOT NULL,
-    solution_category VARCHAR(100), -- "config_change", "restart", "replacement", "patch"
-    commands_run TEXT, -- JSON array of commands used to fix
-    files_modified TEXT, -- JSON array of config files changed
-
-    -- Verification
-    verification_method TEXT,
-    verification_successful BOOLEAN DEFAULT true,
-    verification_notes TEXT,
-
-    -- Prevention and rollback
-    rollback_plan TEXT,
-    prevention_measures TEXT, -- what was done to prevent recurrence
-
-    -- Pattern tracking
-    recurrence_count INTEGER DEFAULT 1, -- if same problem reoccurs
-    similar_problems TEXT, -- JSON array of related problem_solution IDs
-    tags TEXT, -- JSON array: ["ssl", "apache", "certificate"]
-
-    -- Resolution
-    resolved_at TIMESTAMP,
-    time_to_resolution_minutes INTEGER,
-
-    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-    updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-
-    INDEX idx_problems_work_item (work_item_id),
-    INDEX idx_problems_session (session_id),
-    INDEX idx_problems_client (client_id),
-    INDEX idx_problems_infrastructure (infrastructure_id),
-    INDEX idx_problems_category (root_cause_category),
-    FULLTEXT idx_problems_search (problem_description, symptom, error_message, root_cause)
-);
-```
-
-**Example Problem Solutions:**
-
-**Apache SSL Certificate Expiration:**
-```json
-{
-  "problem_title": "Apache SSL certificate expiration causing ERR_SSL_PROTOCOL_ERROR",
-  "problem_description": "Website inaccessible via HTTPS. Browser shows ERR_SSL_PROTOCOL_ERROR.",
-  "symptom": "Users unable to access website. SSL handshake failure.",
-  "error_message": "ERR_SSL_PROTOCOL_ERROR",
-  "investigation_steps": [
-    "curl -I https://example.com",
-    "openssl s_client -connect example.com:443",
-    "systemctl status apache2",
-    "openssl x509 -in /etc/ssl/certs/example.com.crt -text -noout"
-  ],
-  "diagnostic_output": "Certificate expiration: 2026-01-10 (3 days ago)",
-  "root_cause": "SSL certificate expired on 2026-01-10. Certbot auto-renewal failed due to DNS validation issue.",
-  "root_cause_category": "configuration",
-  "solution_applied": "1. Fixed DNS TXT record for Let's Encrypt validation\n2. Ran: certbot renew --force-renewal\n3. Restarted Apache: systemctl restart apache2",
-  "solution_category": "config_change",
-  "commands_run": [
-    "certbot renew --force-renewal",
-    "systemctl restart apache2"
-  ],
-  "files_modified": [
-    "/etc/apache2/sites-enabled/example.com.conf"
-  ],
-  "verification_method": "curl test successful. Browser loads HTTPS site without error.",
-  "verification_successful": true,
-  "prevention_measures": "Set up monitoring for certificate expiration (30 days warning). Fixed DNS automation for certbot.",
-  "tags": ["ssl", "apache", "certificate", "certbot"],
-  "time_to_resolution_minutes": 25
-}
-```
-
-**PowerShell Compatibility Issue:**
-```json
-{
-  "problem_title": "Get-LocalUser fails on Server 2008 (PowerShell 2.0)",
-  "problem_description": "Attempting to list local users on Server 2008 using Get-LocalUser cmdlet",
-  "symptom": "Command not recognized error",
-  "error_message": "Get-LocalUser : The term 'Get-LocalUser' is not recognized as the name of a cmdlet",
-  "error_code": "CommandNotFoundException",
-  "investigation_steps": [
-    "$PSVersionTable",
-    "Get-Command Get-LocalUser",
-    "Get-WmiObject Win32_OperatingSystem | Select Caption, Version"
-  ],
-  "root_cause": "Server 2008 has PowerShell 2.0 only. Get-LocalUser introduced in PowerShell 5.1 (Windows 10/Server 2016).",
-  "root_cause_category": "software",
-  "solution_applied": "Use WMI instead: Get-WmiObject Win32_UserAccount",
-  "solution_category": "alternative_approach",
-  "commands_run": [
-    "Get-WmiObject Win32_UserAccount | Select Name, Disabled, LocalAccount"
-  ],
-  "verification_method": "Successfully retrieved local user list",
-  "verification_successful": true,
-  "prevention_measures": "Created environmental insight for all Server 2008 machines. Environment Context Agent now checks PowerShell version before suggesting cmdlets.",
-  "tags": ["powershell", "server_2008", "compatibility", "user_management"],
-  "recurrence_count": 5
-}
-```
-
-**Queries:**
-
-```sql
--- Find similar problems by error message
-SELECT problem_title, solution_applied, created_at
-FROM problem_solutions
-WHERE MATCH(error_message) AGAINST('SSL_PROTOCOL_ERROR' IN BOOLEAN MODE)
-ORDER BY created_at DESC;
-
--- Most common problems (by recurrence)
-SELECT problem_title, recurrence_count, root_cause_category
-FROM problem_solutions
-WHERE recurrence_count > 1
-ORDER BY recurrence_count DESC;
-
--- Recent solutions for client
-SELECT problem_title, solution_applied, resolved_at
-FROM problem_solutions
-WHERE client_id = 'dataforth-uuid'
-ORDER BY resolved_at DESC
-LIMIT 10;
-```
-
----
-
-### `failure_patterns`
-
-Aggregated failure insights learned from command/operation failures. Auto-generated by Failure Analysis Agent.
-
-```sql
-CREATE TABLE failure_patterns (
-    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-    infrastructure_id UUID REFERENCES infrastructure(id) ON DELETE CASCADE,
-    client_id UUID REFERENCES clients(id) ON DELETE CASCADE,
-
-    -- Pattern identification
-    pattern_type VARCHAR(100) NOT NULL CHECK(pattern_type IN (
-        'command_compatibility', 'version_mismatch', 'permission_denied',
-        'service_unavailable', 'configuration_error', 'environmental_limitation',
-        'network_connectivity', 'authentication_failure', 'syntax_error'
-    )),
-    pattern_signature VARCHAR(500) NOT NULL, -- "PowerShell 7 cmdlets on Server 2008"
-    error_pattern TEXT, -- regex or keywords: "Get-LocalUser.*not recognized"
-
-    -- Context
-    affected_systems TEXT, -- JSON array: ["all_server_2008", "D2TESTNAS"]
-    affected_os_versions TEXT, -- JSON array: ["Server 2008", "DOS 6.22"]
-    triggering_commands TEXT, -- JSON array of command patterns
-    triggering_operations TEXT, -- JSON array of operation types
-
-    -- Failure details
-    failure_description TEXT NOT NULL,
-    typical_error_messages TEXT, -- JSON array of common error texts
-
-    -- Resolution
-    root_cause TEXT NOT NULL, -- "Server 2008 only has PowerShell 2.0"
-    recommended_solution TEXT NOT NULL, -- "Use Get-WmiObject instead of Get-LocalUser"
-    alternative_approaches TEXT, -- JSON array of alternatives
-    workaround_commands TEXT, -- JSON array of working commands
-
-    -- Metadata
-    occurrence_count INTEGER DEFAULT 1, -- how many times seen
-    first_seen TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-    last_seen TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-    severity VARCHAR(20) CHECK(severity IN ('blocking', 'major', 'minor', 'info')),
-
-    -- Status
-    is_active BOOLEAN DEFAULT true, -- false if pattern no longer applies (e.g., server upgraded)
-    added_to_insights BOOLEAN DEFAULT false, -- environmental_insight generated
-
-    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-    updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-
-    INDEX idx_failure_infrastructure (infrastructure_id),
-    INDEX idx_failure_client (client_id),
-    INDEX idx_failure_pattern_type (pattern_type),
-    INDEX idx_failure_signature (pattern_signature),
-    INDEX idx_failure_active (is_active),
-    INDEX idx_failure_severity (severity)
-);
-```
-
-**Example Failure Patterns:**
-
-**PowerShell Version Incompatibility:**
-```json
-{
-  "pattern_type": "command_compatibility",
-  "pattern_signature": "Modern PowerShell cmdlets on Server 2008",
-  "error_pattern": "(Get-LocalUser|Get-LocalGroup|New-LocalUser).*not recognized",
-  "affected_systems": ["all_server_2008_machines"],
-  "affected_os_versions": ["Server 2008", "Server 2008 R2"],
-  "triggering_commands": [
-    "Get-LocalUser",
-    "Get-LocalGroup",
-    "New-LocalUser",
-    "Remove-LocalUser"
-  ],
-  "failure_description": "Modern PowerShell user management cmdlets fail on Server 2008 with 'not recognized' error",
-  "typical_error_messages": [
-    "Get-LocalUser : The term 'Get-LocalUser' is not recognized",
-    "Get-LocalGroup : The term 'Get-LocalGroup' is not recognized"
-  ],
-  "root_cause": "Server 2008 has PowerShell 2.0 only. Modern user management cmdlets (Get-LocalUser, etc.) were introduced in PowerShell 5.1 (Windows 10/Server 2016).",
-  "recommended_solution": "Use WMI for user/group management: Get-WmiObject Win32_UserAccount, Get-WmiObject Win32_Group",
-  "alternative_approaches": [
-    "Use Get-WmiObject Win32_UserAccount",
-    "Use net user command",
-    "Upgrade to PowerShell 5.1 (if possible on Server 2008 R2)"
-  ],
-  "workaround_commands": [
-    "Get-WmiObject Win32_UserAccount",
-    "Get-WmiObject Win32_Group",
-    "net user"
-  ],
-  "occurrence_count": 5,
-  "severity": "major",
-  "added_to_insights": true
-}
-```
-
-**DOS Batch Syntax Limitation:**
-```json
-{
-  "pattern_type": "environmental_limitation",
-  "pattern_signature": "Modern batch syntax on MS-DOS 6.22",
-  "error_pattern": "IF /I.*Invalid switch",
-  "affected_systems": ["all_dos_machines"],
-  "affected_os_versions": ["MS-DOS 6.22"],
-  "triggering_commands": [
-    "IF /I \"%1\"==\"value\" ...",
-    "Long filenames with spaces"
-  ],
-  "failure_description": "Modern batch file syntax not supported in MS-DOS 6.22",
-  "typical_error_messages": [
-    "Invalid switch - /I",
-    "File not found (long filename)",
-    "Bad command or file name"
-  ],
-  "root_cause": "DOS 6.22 does not support /I flag (added in Windows 2000), long filenames, or many modern batch features",
-  "recommended_solution": "Use duplicate IF statements for upper/lowercase. Keep filenames to 8.3 format. Use basic batch syntax only.",
-  "alternative_approaches": [
-    "Duplicate IF for case-insensitive: IF \"%1\"==\"VALUE\" ... + IF \"%1\"==\"value\" ...",
-    "Use 8.3 filenames only",
-    "Avoid advanced batch features"
-  ],
-  "workaround_commands": [
-    "IF \"%1\"==\"STATUS\" GOTO STATUS",
-    "IF \"%1\"==\"status\" GOTO STATUS"
-  ],
-  "occurrence_count": 8,
-  "severity": "blocking",
-  "added_to_insights": true
-}
-```
-
-**ReadyNAS Service Management:**
-```json
-{
-  "pattern_type": "service_unavailable",
-  "pattern_signature": "systemd commands on ReadyNAS",
-  "error_pattern": "systemctl.*command not found",
-  "affected_systems": ["D2TESTNAS"],
-  "triggering_commands": [
-    "systemctl status nmbd",
-    "systemctl restart samba"
-  ],
-  "failure_description": "ReadyNAS does not use systemd for service management",
-  "typical_error_messages": [
-    "systemctl: command not found",
-    "-ash: systemctl: not found"
-  ],
-  "root_cause": "ReadyNAS OS is based on older Linux without systemd. Uses traditional init scripts.",
-  "recommended_solution": "Use 'service' command or direct process management: service nmbd status, ps aux | grep nmbd",
-  "alternative_approaches": [
-    "service nmbd status",
-    "ps aux | grep nmbd",
-    "/etc/init.d/nmbd status"
-  ],
-  "occurrence_count": 3,
-  "severity": "major",
-  "added_to_insights": true
-}
-```
-
----
-
-### `operation_failures`
-
-Non-command failures (API calls, integrations, file operations, network requests). Complements commands_run failure tracking.
-
-```sql
-CREATE TABLE operation_failures (
-    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
-    session_id UUID REFERENCES sessions(id) ON DELETE CASCADE,
-    work_item_id UUID REFERENCES work_items(id) ON DELETE CASCADE,
-    client_id UUID REFERENCES clients(id) ON DELETE SET NULL,
-
-    -- Operation details
-    operation_type VARCHAR(100) NOT NULL CHECK(operation_type IN (
-        'api_call', 'file_operation', 'network_request',
-        'database_query', 'external_integration', 'service_restart',
-        'backup_operation', 'restore_operation', 'migration'
-    )),
-    operation_description TEXT NOT NULL,
-    target_system VARCHAR(255), -- host, URL, service name
-
-    -- Failure details
-    error_message TEXT NOT NULL,
-    error_code VARCHAR(50), -- HTTP status, exit code, error number
-    failure_category VARCHAR(100), -- "timeout", "authentication", "not_found", etc.
-    stack_trace TEXT,
-
-    -- Context
-    request_data TEXT, -- JSON: what was attempted
-    response_data TEXT, -- JSON: error response
-    environment_snapshot TEXT, -- JSON: relevant env vars, versions
-
-    -- Resolution
-    resolution_applied TEXT,
-    resolved BOOLEAN DEFAULT false,
-    resolved_at TIMESTAMP,
-    time_to_resolution_minutes INTEGER,
-
-    -- Pattern linkage
-    related_pattern_id UUID REFERENCES failure_patterns(id),
-
-    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-
-    INDEX idx_op_failure_session (session_id),
-    INDEX idx_op_failure_type (operation_type),
-    INDEX idx_op_failure_category (failure_category),
-    INDEX idx_op_failure_resolved (resolved),
-    INDEX idx_op_failure_client (client_id)
-);
-```
-
-**Example Operation Failures:**
-
-**SyncroMSP API Timeout:**
-```json
-{
-  "operation_type": "api_call",
-  "operation_description": "Search SyncroMSP tickets for Dataforth",
-  "target_system": "https://azcomputerguru.syncromsp.com/api/v1",
-  "error_message": "Request timeout after 30 seconds",
-  "error_code": "ETIMEDOUT",
-  "failure_category": "timeout",
-  "request_data": {
-    "endpoint": "/api/v1/tickets",
-    "params": {"customer_id": 12345, "status": "open"}
-  },
-  "response_data": null,
-  "resolution_applied": "Increased timeout to 60 seconds. Added retry logic with exponential backoff.",
-  "resolved": true,
-  "time_to_resolution_minutes": 15
-}
-```
-
-**File Upload Permission Denied:**
-```json
-{
-  "operation_type": "file_operation",
-  "operation_description": "Upload backup file to NAS",
-  "target_system": "D2TESTNAS:/mnt/backups",
-  "error_message": "Permission denied: /mnt/backups/db_backup_2026-01-15.sql",
-  "error_code": "EACCES",
-  "failure_category": "permission",
-  "environment_snapshot": {
-    "user": "backupuser",
-    "directory_perms": "drwxr-xr-x root root"
-  },
-  "resolution_applied": "Changed directory ownership: chown -R backupuser:backupgroup /mnt/backups",
-  "resolved": true
-}
-```
-
-**Database Query Performance:**
-```json
-{
-  "operation_type": "database_query",
-  "operation_description": "Query sessions table for large date range",
-  "target_system": "MariaDB msp_tracking",
-  "error_message": "Query execution time: 45 seconds (threshold: 5 seconds)",
-  "failure_category": "performance",
-  "request_data": {
-    "query": "SELECT * FROM sessions WHERE session_date BETWEEN '2020-01-01' AND '2026-01-15'"
-  },
-  "resolution_applied": "Added index on session_date column. Query now runs in 0.3 seconds.",
-  "resolved": true
-}
-```
-
----
-
-## Self-Learning Workflow
-
-### 1. Failure Detection and Logging
-
-**Command Execution with Failure Tracking:**
-
-```
-User: "Check WINS status on D2TESTNAS"
-
-Main Claude → Environment Context Agent:
-  - Queries infrastructure table for D2TESTNAS
-  - Reads environmental_notes: "Manual WINS install, no native service"
-  - Reads environmental_insights for D2TESTNAS
-  - Returns: "D2TESTNAS has manually installed WINS (not native ReadyNAS service)"
-
-Main Claude suggests command based on environmental context:
-  - Executes: ssh root@192.168.0.9 'systemctl status nmbd'
-
-Command fails:
-  - success = false
-  - exit_code = 127
-  - error_message = "systemctl: command not found"
-  - failure_category = "command_compatibility"
-
-Trigger Failure Analysis Agent:
-  - Analyzes error: ReadyNAS doesn't use systemd
-  - Identifies correct approach: "service nmbd status" or "ps aux | grep nmbd"
-  - Creates failure_pattern entry
-  - Updates environmental_insights with correction
-  - Returns resolution to Main Claude
-
-Main Claude tries corrected command:
-  - Executes: ssh root@192.168.0.9 'ps aux | grep nmbd'
-  - Success = true
-  - Updates original failure record with resolution
-```
-
-### 2. Pattern Analysis (Periodic Agent Run)
-
-**Failure Analysis Agent runs periodically:**
-
-**Agent Task:** "Analyze recent failures and update environmental insights"
-
-1. **Query failures:**
-   ```sql
-   SELECT * FROM commands_run
-   WHERE success = false AND resolved = false
-   ORDER BY created_at DESC;
-
-   SELECT * FROM operation_failures
-   WHERE resolved = false
-   ORDER BY created_at DESC;
-   ```
-
-2. **Group by pattern:**
-   - Group by infrastructure_id, error_pattern, failure_category
-   - Identify recurring patterns
-
-3. **Create/update failure_patterns:**
-   - If pattern seen 3+ times → Create failure_pattern
-   - Increment occurrence_count for existing patterns
-   - Update last_seen timestamp
-
-4. **Generate environmental_insights:**
-   - Transform failure_patterns into actionable insights
-   - Create markdown-formatted descriptions
-   - Add command examples
-   - Set priority based on severity and frequency
-
-5. **Update infrastructure environmental_notes:**
-   - Add constraints to infrastructure.environmental_notes
-   - Set powershell_version, shell_type, limitations
-
-6. **Generate insights.md file:**
-   - Query all environmental_insights for client
-   - Format as markdown
-   - Save to D:\ClaudeTools\insights\[client-name].md
-   - Agents read this file before making suggestions
-
-### 3. Pre-Operation Environment Check
-
-**Environment Context Agent runs before operations:**
-
-**Agent Task:** "Check environmental constraints for D2TESTNAS before command suggestion"
-
-1. **Query infrastructure:**
-   ```sql
-   SELECT environmental_notes, powershell_version, shell_type, limitations
-   FROM infrastructure
-   WHERE id = 'd2testnas-uuid';
-   ```
-
-2. **Query environmental_insights:**
-   ```sql
-   SELECT insight_title, insight_description, examples, priority
-   FROM environmental_insights
-   WHERE infrastructure_id = 'd2testnas-uuid'
-     AND is_active = true
-   ORDER BY priority DESC;
-   ```
-
-3. **Query failure_patterns:**
-   ```sql
-   SELECT pattern_signature, recommended_solution, workaround_commands
-   FROM failure_patterns
-   WHERE infrastructure_id = 'd2testnas-uuid'
-     AND is_active = true;
-   ```
-
-4. **Check proposed command compatibility:**
-   - Proposed: "systemctl status nmbd"
-   - Pattern match: "systemctl.*command not found"
-   - **Result:** INCOMPATIBLE
-   - Recommended: "ps aux | grep nmbd"
-
-5. **Return environmental context:**
-   ```
-   Environmental Context for D2TESTNAS:
-   - ReadyNAS OS (Linux-based)
-   - Manual WINS installation (Samba nmbd)
-   - No systemd (use 'service' or ps commands)
-   - SMB1/CORE protocol for DOS compatibility
-
-   Recommended commands:
-   ✓ ps aux | grep nmbd
-   ✓ service nmbd status
-   ✗ systemctl status nmbd (not available)
-   ```
-
-Main Claude uses this context to suggest correct approach.
-
----
-
-## Benefits
-
-### 1. Self-Improving System
-- Each failure makes the system smarter
-- Patterns identified automatically
-- Insights generated without manual documentation
-- Knowledge accumulates over time
-
-### 2. Reduced User Friction
-- User doesn't have to keep correcting same mistakes
-- Claude learns environmental constraints once
-- Suggestions are environmentally aware from start
-- Proactive problem prevention
-
-### 3. Institutional Knowledge Capture
-- All environmental quirks documented in database
-- Survives across sessions and Claude instances
-- Queryable: "What are known issues with D2TESTNAS?"
-- Transferable to new team members
-
-### 4. Proactive Problem Prevention
-- Environment Context Agent prevents failures before they happen
-- Suggests compatible alternatives automatically
-- Warns about known limitations
-- Avoids wasting time on incompatible approaches
-
-### 5. Audit Trail
-- Every failure tracked with full context
-- Resolution history for troubleshooting
-- Pattern analysis for infrastructure planning
-- ROI tracking: time saved by avoiding repeat failures
-
----
-
-## Integration with Other Schemas
-
-**Sources data from:**
-- `commands_run` - Command execution failures
-- `infrastructure` - System capabilities and limitations
-- `work_items` - Context for failures
-- `sessions` - Session context for operations
-
-**Provides data to:**
-- Environment Context Agent (pre-operation checks)
-- Problem Pattern Matching Agent (solution lookup)
-- MSP Mode (intelligent suggestions)
-- Reporting (failure analysis, improvement metrics)
-
----
-
-## Example Queries
-
-### Find all insights for a client
-```sql
-SELECT ei.insight_title, ei.insight_description, i.hostname
-FROM environmental_insights ei
-JOIN infrastructure i ON ei.infrastructure_id = i.id
-WHERE ei.client_id = 'dataforth-uuid'
-  AND ei.is_active = true
-ORDER BY ei.priority DESC;
-```
-
-### Search for similar problems
-```sql
-SELECT ps.problem_title, ps.solution_applied, ps.created_at
-FROM problem_solutions ps
-WHERE MATCH(ps.problem_description, ps.symptom, ps.error_message)
-      AGAINST('SSL certificate' IN BOOLEAN MODE)
-ORDER BY ps.created_at DESC
-LIMIT 10;
-```
-
-### Active failure patterns
-```sql
-SELECT fp.pattern_signature, fp.occurrence_count, fp.recommended_solution
-FROM failure_patterns fp
-WHERE fp.is_active = true
-  AND fp.severity IN ('blocking', 'major')
-ORDER BY fp.occurrence_count DESC;
-```
-
-### Unresolved operation failures
-```sql
-SELECT of.operation_type, of.target_system, of.error_message, of.created_at
-FROM operation_failures of
-WHERE of.resolved = false
-ORDER BY of.created_at DESC;
-```
-
----
-
-**Document Version:** 1.0
-**Last Updated:** 2026-01-15
-**Author:** MSP Mode Schema Design Team

.claude/TASK_MANAGEMENT.md

@@ -2,7 +2,13 @@
 
 ## Overview
 
-All tasks and subtasks across all modes (MSP, Development, Normal) are tracked in a centralized checklist system. The orchestrator (main Claude session) manages this checklist, updating status as work progresses. All task data and context is persisted to the database via the Database Agent.
+All tasks and subtasks across all modes (MSP, Development, Normal) are tracked using **Claude Code's native task management tools** (TaskCreate, TaskUpdate, TaskList, TaskGet). The orchestrator (main Claude session) manages tasks, updating status as work progresses. Task data is persisted to `.claude/active-tasks.json` for cross-session continuity.
+
+**Native Task Integration (NEW - 2026-01-23):**
+- **Session Layer:** TaskCreate/Update/List for real-time coordination
+- **Persistence Layer:** `.claude/active-tasks.json` file for cross-session recovery
+- **Agent Pattern:** Agents report status → Main Claude updates tasks
+- **See:** `.claude/NATIVE_TASK_INTEGRATION.md` for complete guide
 
 ## Core Principles
 
@@ -29,14 +35,14 @@ Agents don't manage tasks directly - they report to orchestrator:
 - Agent encounters blocker → Orchestrator marks task 'blocked' with reason
 
 ### 4. Context is Preserved
-Every task stores rich context in the database:
-- What was requested
-- Why it's needed
-- What environment it runs in
-- What agents worked on it
-- What files were modified
-- What blockers were encountered
-- What the outcome was
+Every task stores rich context in `.claude/active-tasks.json`:
+- What was requested (subject, description)
+- Task status (pending, in_progress, completed)
+- Which agent is working (owner field)
+- Task dependencies (blocks, blockedBy)
+- Timestamps (created_at, started_at, completed_at)
+- Metadata (client, project, complexity)
+- Cross-session persistence for recovery
 
 ## Workflow
 
@@ -46,53 +52,54 @@ User: "Implement authentication for the API"
 ```
 
 ### Step 2: Orchestrator Creates Task(s)
-Main Claude analyzes request and creates task structure:
+Main Claude analyzes request and creates task structure using native tools:
 
-```python
-# Orchestrator thinks:
-# This is a complex task - break it down
+```javascript
+// Orchestrator thinks:
+// This is a complex task - break it down
 
-# Request to Database Agent:
-{
-  "operation": "create_task",
-  "title": "Implement API authentication",
-  "description": "Complete JWT-based authentication system",
-  "task_type": "implementation",
-  "status": "pending",
-  "estimated_complexity": "moderate",
-  "task_context": {
-    "user_request": "Implement authentication for the API",
-    "environment": "Python FastAPI project"
-  }
-}
+// Create parent task
+TaskCreate({
+  subject: "Implement API authentication",
+  description: "Complete JWT-based authentication system with Argon2 hashing",
+  activeForm: "Implementing API authentication"
+})
+// Returns: Task #7
 
-# Then create subtasks:
-{
-  "operation": "create_subtasks",
-  "parent_task_id": "parent-uuid",
-  "subtasks": [
-    {
-      "title": "Design authentication schema",
-      "task_type": "analysis",
-      "status": "pending"
-    },
-    {
-      "title": "Generate code for JWT authentication",
-      "task_type": "implementation",
-      "status": "pending"
-    },
-    {
-      "title": "Review authentication code",
-      "task_type": "review",
-      "status": "pending"
-    },
-    {
-      "title": "Write authentication tests",
-      "task_type": "testing",
-      "status": "pending"
-    }
-  ]
-}
+// Create subtasks with dependencies
+design = TaskCreate({
+  subject: "Design authentication schema",
+  description: "Define users, tokens, and refresh_tokens tables",
+  activeForm: "Designing auth schema"
+})
+// Returns: Task #8
+
+generate = TaskCreate({
+  subject: "Generate JWT authentication code",
+  description: "Implement FastAPI endpoints with JWT token generation",
+  activeForm: "Generating auth code",
+  addBlockedBy: ["8"]  // Depends on design
+})
+// Returns: Task #9
+
+review = TaskCreate({
+  subject: "Review authentication code",
+  description: "Code review for security and standards compliance",
+  activeForm: "Reviewing auth code",
+  addBlockedBy: ["9"]  // Depends on code generation
+})
+// Returns: Task #10
+
+tests = TaskCreate({
+  subject: "Write authentication tests",
+  description: "Create pytest tests for auth flow",
+  activeForm: "Writing auth tests",
+  addBlockedBy: ["10"]  // Depends on review
+})
+// Returns: Task #11
+
+// Persist all tasks to file
+Write(".claude/active-tasks.json", tasks_data)
 ```
 
 ### Step 3: Orchestrator Shows Checklist to User
@@ -110,34 +117,46 @@ Starting with the design phase...
 ```
 
 ### Step 4: Orchestrator Launches Agents
-```python
-# Update task status
-Database Agent: update_task(
-  task_id="design-subtask-uuid",
-  status="in_progress",
-  assigned_agent="Coding Agent",
-  started_at=now()
-)
+```javascript
+// Update task status to in_progress
+TaskUpdate({
+  taskId: "8",  // Design task
+  status: "in_progress",
+  owner: "Coding Agent"
+})
 
-# Launch agent
+// Update file
+Update active-tasks.json with new status
+
+// Launch agent
 Coding Agent: analyze_and_design_auth_schema(...)
 ```
 
 ### Step 5: Agent Completes, Orchestrator Updates
-```python
-# Agent returns design
-# Orchestrator updates task
+```javascript
+// Agent returns design
+agent_result = {
+  status: "completed",
+  outcome: "Schema designed with users, tokens, refresh_tokens tables",
+  files_created: ["docs/auth_schema.md"]
+}
 
-Database Agent: complete_task(
-  task_id="design-subtask-uuid",
-  completed_at=now(),
-  task_context={
-    "outcome": "Schema designed with users, tokens, refresh_tokens tables",
-    "files_created": ["docs/auth_schema.md"]
-  }
-)
+// Orchestrator updates task
+TaskUpdate({
+  taskId: "8",
+  status: "completed"
+})
 
-# Update checklist shown to user
+// Update file
+Update active-tasks.json with completion
+
+// Next task (dependency cleared automatically)
+TaskUpdate({
+  taskId: "9",  // Generate code task
+  status: "in_progress"
+})
+
+// Update checklist shown to user via TaskList()
 ```
 
 ### Step 6: Progress Visibility
@@ -368,65 +387,102 @@ Tasks not linked to client or project:
    - Blocked by: Need staging environment credentials
 ```
 
-## Database Schema
+## File-Based Storage
 
-See Database Agent documentation for full `tasks` table schema.
+Tasks are persisted to `.claude/active-tasks.json` for cross-session continuity.
 
-Key fields:
-- `id` - UUID primary key
-- `parent_task_id` - For subtasks
-- `title` - Task name
-- `status` - pending, in_progress, blocked, completed, cancelled
-- `task_type` - implementation, research, review, etc.
-- `assigned_agent` - Which agent is handling it
-- `task_context` - Rich JSON context
-- `session_id` - Link to session
-- `client_id` - Link to client (MSP mode)
-- `project_id` - Link to project (Dev mode)
+**File Structure:**
+```json
+{
+  "last_updated": "2026-01-23T10:30:00Z",
+  "tasks": [
+    {
+      "id": "7",
+      "subject": "Implement API authentication",
+      "description": "Complete JWT-based authentication...",
+      "activeForm": "Implementing API authentication",
+      "status": "in_progress",
+      "owner": "Coding Agent",
+      "created_at": "2026-01-23T10:00:00Z",
+      "started_at": "2026-01-23T10:05:00Z",
+      "completed_at": null,
+      "blocks": [],
+      "blockedBy": [],
+      "metadata": {
+        "client": "Dataforth",
+        "project": "ClaudeTools",
+        "complexity": "moderate"
+      }
+    }
+  ]
+}
+```
+
+**Key Fields:**
+- `id` - Task number from TaskCreate
+- `subject` - Brief task title
+- `description` - Detailed description
+- `status` - pending, in_progress, completed
+- `owner` - Which agent is working (from TaskUpdate)
+- `blocks`/`blockedBy` - Task dependencies
+- `metadata` - Client, project, complexity
 
 ## Agent Interaction Pattern
 
 ### Agents Don't Manage Tasks Directly
-```python
-# ❌ WRONG - Agent updates database directly
-# Inside Coding Agent:
-Database.update_task(task_id, status="completed")
+```javascript
+// [ERROR] WRONG - Agent uses TaskUpdate directly
+// Inside Coding Agent:
+TaskUpdate({ taskId: "7", status: "completed" })
 
-# ✓ CORRECT - Agent reports to orchestrator
-# Inside Coding Agent:
+// ✓ CORRECT - Agent reports to orchestrator
+// Inside Coding Agent:
 return {
   "status": "completed",
   "outcome": "Authentication code generated",
   "files_created": ["auth.py"]
 }
 
-# Orchestrator receives agent result, then updates task
-Database Agent.update_task(
-  task_id=task_id,
-  status="completed",
-  task_context=agent_result
-)
+// Orchestrator receives agent result, then updates task
+TaskUpdate({
+  taskId: "7",
+  status: "completed"
+})
+
+// Update file
+Update active-tasks.json with completion data
 ```
 
 ### Orchestrator Sequence
-```python
-# 1. Create task
-task = Database_Agent.create_task(title="Generate auth code", ...)
+```javascript
+// 1. Create task
+task_id = TaskCreate({
+  subject: "Generate auth code",
+  description: "Create JWT authentication endpoints",
+  activeForm: "Generating auth code"
+})
+// Returns: "7"
 
-# 2. Update status before launching agent
-Database_Agent.update_task(task.id, status="in_progress", assigned_agent="Coding Agent")
+// 2. Update status before launching agent
+TaskUpdate({
+  taskId: "7",
+  status: "in_progress",
+  owner: "Coding Agent"
+})
+Update active-tasks.json
 
-# 3. Launch agent
+// 3. Launch agent
 result = Coding_Agent.generate_auth_code(...)
 
-# 4. Update task with result
-Database_Agent.complete_task(
-  task_id=task.id,
-  task_context=result
-)
+// 4. Update task with result
+TaskUpdate({
+  taskId: "7",
+  status: "completed"
+})
+Update active-tasks.json with outcome
 
-# 5. Show updated checklist to user
-display_checklist_update(task)
+// 5. Show updated checklist to user
+TaskList()  // Shows current state
 ```
 
 ## Benefits
@@ -510,7 +566,7 @@ parent_task = {
 
 **On Completion:**
 ```markdown
-## Implementation Complete ✅
+## Implementation Complete [OK]
 
 NAS monitoring set up for Dataforth:
 
@@ -531,32 +587,80 @@ NAS monitoring set up for Dataforth:
 [docs created]
 ```
 
-**Stored in Database:**
-```python
-# Parent task marked complete
-# work_item created with billable time
-# Context preserved for future reference
-# Environmental insights updated if issues encountered
+**Stored in File:**
+```javascript
+// Parent task marked complete in active-tasks.json
+// Task removed from active list (or status updated to completed)
+// Context preserved for session logs
+// Can be archived to tasks/archive/ directory
 ```
 
 ---
 
+## Cross-Session Recovery
+
+**When a new session starts:**
+
+1. **Check for active tasks file**
+   ```javascript
+   if (file_exists(".claude/active-tasks.json")) {
+     tasks_data = read_json(".claude/active-tasks.json")
+   }
+   ```
+
+2. **Filter incomplete tasks**
+   ```javascript
+   incomplete_tasks = tasks_data.tasks.filter(t => t.status !== "completed")
+   ```
+
+3. **Recreate native tasks**
+   ```javascript
+   for (task of incomplete_tasks) {
+     new_id = TaskCreate({
+       subject: task.subject,
+       description: task.description,
+       activeForm: task.activeForm
+     })
+     // Map old task.id → new_id for dependencies
+   }
+   ```
+
+4. **Restore dependencies**
+   ```javascript
+   for (task of incomplete_tasks) {
+     if (task.blockedBy.length > 0) {
+       TaskUpdate({
+         taskId: mapped_id(task.id),
+         addBlockedBy: task.blockedBy.map(mapped_id)
+       })
+     }
+   }
+   ```
+
+5. **Show recovered state**
+   ```javascript
+   TaskList()
+   // User sees: "Continuing from previous session: 3 tasks in progress"
+   ```
+
+---
+
 ## Summary
 
-**Orchestrator (main Claude) manages checklist**
-- Creates tasks from user requests
-- Updates status as agents report
-- Provides progress visibility
-- Stores context via Database Agent
+**Orchestrator (main Claude) manages tasks**
+- Creates tasks using TaskCreate for complex work
+- Updates status as agents report using TaskUpdate
+- Provides progress visibility via TaskList
+- Persists to `.claude/active-tasks.json` file
 
 **Agents report progress**
 - Don't manage tasks directly
 - Return results to orchestrator
-- Orchestrator updates database
+- Orchestrator updates tasks and file
 
-**Database Agent persists everything**
-- All task data and context
-- Links to clients/projects
-- Enables cross-session continuity
+**File-based persistence**
+- All active task data stored in JSON
+- Cross-session recovery on startup
+- Human-readable and editable
 
 **Result: Complete visibility and context preservation**

.claude/active-tasks.json

@@ -0,0 +1,66 @@
+{
+  "last_updated": "2026-03-23T20:10:00Z",
+  "tasks": [
+    {
+      "id": "win-setup-001",
+      "title": "Windows Machine Setup - Align with Directives",
+      "created": "2026-03-23",
+      "status": "in_progress",
+      "context": "Setting up Windows guru workstation to match ClaudeTools project directives. This session is non-elevated. Elevated session should pick up remaining items.",
+      "completed_items": [
+        "Node.js v24.14.0 installed via winget (PATH: C:\\Program Files\\nodejs)",
+        ".mcp.json created at C:\\Users\\guru\\ClaudeTools\\.mcp.json (filesystem + sequential-thinking)",
+        "GrepAI v0.35.0 binary downloaded to C:\\Users\\guru\\ClaudeTools\\grepai.exe"
+      ],
+      "remaining_items": [
+        {
+          "step": 1,
+          "item": "Finish Ollama installation",
+          "priority": "HIGH",
+          "details": "winget install was downloading v0.18.2 (1.61GB) but session interrupted ~50%. Run: winget install Ollama.Ollama --accept-package-agreements --accept-source-agreements. Verify with: ollama --version"
+        },
+        {
+          "step": 2,
+          "item": "Pull Ollama models",
+          "priority": "HIGH",
+          "depends_on": "step 1",
+          "details": "ollama pull nomic-embed-text && ollama pull qwen3:14b && ollama pull codestral:22b"
+        },
+        {
+          "step": 3,
+          "item": "Initialize GrepAI index",
+          "priority": "HIGH",
+          "depends_on": "step 2 (needs nomic-embed-text)",
+          "details": "cd C:\\Users\\guru\\ClaudeTools && ./grepai.exe init && ./grepai.exe watch --background"
+        },
+        {
+          "step": 4,
+          "item": "Add GrepAI to .mcp.json",
+          "priority": "HIGH",
+          "depends_on": "step 3",
+          "details": "Add to C:\\Users\\guru\\ClaudeTools\\.mcp.json mcpServers section: \"grepai\": { \"command\": \"C:\\\\Users\\\\guru\\\\ClaudeTools\\\\grepai.exe\", \"args\": [\"mcp-serve\"] }"
+        },
+        {
+          "step": 5,
+          "item": "Verify MCP servers load",
+          "priority": "MEDIUM",
+          "depends_on": "steps 1-4",
+          "details": "Restart Claude Code and confirm sequential-thinking, filesystem, and grepai MCP servers connect. Node.js is installed but current shell may need PATH refresh."
+        },
+        {
+          "step": 6,
+          "item": "Update machine memory record",
+          "priority": "LOW",
+          "depends_on": "all above",
+          "details": "Update .claude/memory/machine_windows_guru_setup_status.md to reflect completed setup. Remove all 'Missing' items, mark as fully aligned."
+        }
+      ],
+      "notes": [
+        "GitHub MCP server intentionally excluded - project uses Gitea not GitHub",
+        "User said they'll get back on git setup separately",
+        "Node.js may not be in current shell PATH - new terminal needed",
+        "Ollama download was partially through when interrupted"
+      ]
+    }
+  ]
+}

.claude/agents/AGENT_QUICK_REFERENCE.md

@@ -0,0 +1,434 @@
+---
+name: "Agent Quick Reference"
+description: "Quick reference guide for all available specialized agents"
+---
+
+# Agent Quick Reference
+
+**Last Updated:** 2026-01-18
+
+---
+
+## Available Specialized Agents
+
+### Documentation Squire (documentation-squire)
+**Purpose:** Handle all documentation and keep Main Claude organized
+**When to Use:**
+- Creating/updating .md files (guides, summaries, trackers)
+- Need task checklist for complex work
+- Main Claude forgetting TodoWrite
+- Documentation getting out of sync
+- Need completion summaries
+
+**Invocation:**
+```
+Task tool:
+  subagent_type: "documentation-squire"
+  model: "haiku"  (cost-efficient)
+  prompt: "Create [type] documentation for [work]"
+```
+
+**Example:**
+```
+User: "Create a technical debt tracker"
+
+Main Claude invokes:
+  subagent_type: "documentation-squire"
+  prompt: "Create comprehensive technical debt tracker for GuruConnect, including all pending items from Phase 1"
+```
+
+---
+
+## Agent Delegation Rules
+
+### Main Claude Should Delegate When:
+
+**Documentation Work:**
+- ✓ Creating README, guides, summaries
+- ✓ Updating technical debt trackers
+- ✓ Writing installation instructions
+- ✓ Creating troubleshooting guides
+- ✗ Inline code comments (Main Claude handles)
+- ✗ Quick status messages to user (Main Claude handles)
+
+**Task Organization:**
+- ✓ Complex tasks (>3 steps) - Let Doc Squire create checklist
+- ✓ Multiple parallel tasks - Doc Squire manages
+- ✗ Simple single-step tasks (Main Claude uses TodoWrite directly)
+
+**Specialized Work:**
+- ✓ Code review - Invoke code review agent
+- ✓ Testing - Invoke testing agent
+- ✓ Frontend - Invoke frontend design skill
+- ✓ Infrastructure setup - Invoke infrastructure agent
+- ✗ Simple edits (Main Claude handles directly)
+
+---
+
+## Invocation Patterns
+
+### Pattern 1: Documentation Creation (Most Common)
+```
+User: "Document the CI/CD setup"
+
+Main Claude:
+1. Invokes Documentation Squire
+2. Provides context (what was built, key details)
+3. Receives completed documentation
+4. Shows user summary and file location
+```
+
+### Pattern 2: Task Management Reminder
+```
+Main Claude: [Starting complex work without TodoWrite]
+
+Documentation Squire: [Auto-reminder]
+"You're starting complex CI/CD work without a task list.
+Consider using TodoWrite to track progress."
+
+Main Claude: [Uses TodoWrite or delegates to Doc Squire for checklist]
+```
+
+### Pattern 3: Agent Coordination
+```
+Code Review Agent: [Completes review]
+"Documentation needed: Update technical debt tracker"
+
+Main Claude: [Invokes Documentation Squire]
+"Update TECHNICAL_DEBT.md with code review findings"
+
+Documentation Squire: [Updates tracker]
+Main Claude: "Tracker updated. Proceeding with fixes..."
+```
+
+### Pattern 4: Status Check
+```
+User: "What's the current status?"
+
+Main Claude: [Invokes Documentation Squire]
+"Generate current project status summary"
+
+Documentation Squire:
+- Reads PHASE1_COMPLETE.md, TECHNICAL_DEBT.md, etc.
+- Creates unified status report
+- Returns summary
+
+Main Claude: [Shows user the summary]
+```
+
+---
+
+## When NOT to Use Agents
+
+### Main Claude Should Handle Directly:
+
+**Simple Tasks:**
+- Single file edits
+- Quick code changes
+- Simple questions
+- User responses
+- Status updates
+
+**Interactive Work:**
+- Debugging with user
+- Asking clarifying questions
+- Real-time troubleshooting
+- Immediate user requests
+
+**Code Work:**
+- Writing code (unless specialized like frontend)
+- Code comments
+- Simple refactoring
+- Bug fixes
+
+---
+
+## Agent Communication Protocol
+
+### Requesting Documentation from Agent
+
+**Template:**
+```
+Task tool:
+  subagent_type: "documentation-squire"
+  model: "haiku"
+  prompt: "[Action] [Type] for [Context]
+
+  Details:
+  - [Key detail 1]
+  - [Key detail 2]
+  - [Key detail 3]
+
+  Output format: [What you want]"
+```
+
+**Example:**
+```
+Task tool:
+  subagent_type: "documentation-squire"
+  model: "haiku"
+  prompt: "Create CI/CD activation guide for GuruConnect
+
+  Details:
+  - 3 workflows created (build, test, deploy)
+  - Runner installed but not registered
+  - Need step-by-step activation instructions
+
+  Output format: Comprehensive guide with troubleshooting section"
+```
+
+### Agent Signaling Documentation Needed
+
+**Template:**
+```
+[DOCUMENTATION NEEDED]
+
+Work completed: [description]
+Documentation type: [guide/summary/tracker update]
+Key information:
+- [point 1]
+- [point 2]
+- [point 3]
+
+Files to update: [file list]
+Suggested filename: [name]
+
+Passing to Documentation Squire agent...
+```
+
+---
+
+## TodoWrite Best Practices
+
+### When to Use TodoWrite
+
+**YES - Use TodoWrite:**
+- Complex tasks with 3+ steps
+- Multi-file changes
+- Long-running work (>10 minutes)
+- Tasks with dependencies
+- Work that might span messages
+
+**NO - Don't Use TodoWrite:**
+- Single-step tasks
+- Quick responses
+- Simple questions
+- Already delegated to agent
+
+### TodoWrite Format
+
+```
+TodoWrite:
+  todos:
+    - content: "Action in imperative form"
+      activeForm: "Action in present continuous"
+      status: "pending" | "in_progress" | "completed"
+```
+
+**Example:**
+```
+todos:
+  - content: "Create build workflow"
+    activeForm: "Creating build workflow"
+    status: "in_progress"
+
+  - content: "Test workflow triggers"
+    activeForm: "Testing workflow triggers"
+    status: "pending"
+```
+
+### TodoWrite Rules
+
+1. **Exactly ONE task in_progress at a time**
+2. **Mark complete immediately after finishing**
+3. **Update before switching tasks**
+4. **Remove irrelevant tasks**
+5. **Break down complex tasks**
+
+---
+
+## Documentation Standards
+
+### File Naming
+- `ALL_CAPS.md` - Major documents (TECHNICAL_DEBT.md)
+- `lowercase-dashed.md` - Specific guides (activation-guide.md)
+- `PascalCase.md` - Code-related docs (APIReference.md)
+- `PHASE#_WEEKN_STATUS.md` - Phase tracking
+
+### Document Headers
+```markdown
+# Title
+
+**Status:** [Active/Complete/Deprecated]
+**Last Updated:** YYYY-MM-DD
+**Related Docs:** [Links]
+
+---
+
+## Overview
+...
+```
+
+### Formatting Rules
+- ✓ Headers for hierarchy (##, ###)
+- ✓ Code blocks with language tags
+- ✓ Tables for structured data
+- ✓ Lists for sequences
+- ✓ Bold for emphasis
+- ✗ NO EMOJIS (project guideline)
+- ✗ No ALL CAPS in prose
+- ✓ Clear section breaks (---)
+
+---
+
+## Decision Matrix: Should I Delegate?
+
+| Task Type | Delegate To | Direct Handle |
+|-----------|-------------|---------------|
+| Create README | Documentation Squire | - |
+| Update tech debt | Documentation Squire | - |
+| Write guide | Documentation Squire | - |
+| Code review | Code Review Agent | - |
+| Run tests | Testing Agent | - |
+| Frontend design | Frontend Skill | - |
+| Simple code edit | - | Main Claude |
+| Answer question | - | Main Claude |
+| Debug with user | - | Main Claude |
+| Quick status | - | Main Claude |
+
+**Rule of Thumb:**
+- **Specialized work** → Delegate to specialist
+- **Documentation** → Documentation Squire
+- **Simple/interactive** → Main Claude
+- **When unsure** → Ask Documentation Squire for advice
+
+---
+
+## Common Scenarios
+
+### Scenario 1: User Asks for Status
+```
+User: "What's the current status?"
+
+Main Claude options:
+A) Quick status → Answer directly from memory
+B) Comprehensive status → Invoke Documentation Squire to generate report
+C) Unknown status → Invoke Doc Squire to research and report
+
+Choose: Based on complexity and detail needed
+```
+
+### Scenario 2: Completed Major Work
+```
+Main Claude: [Just completed CI/CD setup]
+
+Next steps:
+1. Mark todos complete
+2. Invoke Documentation Squire to create completion summary
+3. Update TECHNICAL_DEBT.md (via Doc Squire)
+4. Tell user what was accomplished
+
+DON'T: Write completion summary inline (delegate to Doc Squire)
+```
+
+### Scenario 3: Starting Complex Task
+```
+User: "Implement CI/CD pipeline"
+
+Main Claude:
+1. Invoke Documentation Squire: "Create task checklist for CI/CD implementation"
+2. Doc Squire returns checklist
+3. Use TodoWrite with checklist items
+4. Begin implementation
+
+DON'T: Skip straight to implementation without task list
+```
+
+### Scenario 4: Found Technical Debt
+```
+Main Claude: [Discovers systemd watchdog issue]
+
+Next steps:
+1. Fix immediate problem
+2. Note need for proper implementation
+3. Invoke Documentation Squire: "Add systemd watchdog implementation to TECHNICAL_DEBT.md"
+4. Continue with main work
+
+DON'T: Manually edit TECHNICAL_DEBT.md (let Doc Squire maintain it)
+```
+
+---
+
+## Troubleshooting
+
+### "When should I invoke vs handle directly?"
+
+**Invoke agent when:**
+- Specialized knowledge needed
+- Large documentation work
+- Want to save context
+- Task will take multiple steps
+- Need consistency across files
+
+**Handle directly when:**
+- Simple one-off task
+- Need immediate response
+- Interactive with user
+- Already know exactly what to do
+
+### "Agent not available?"
+
+If agent doesn't exist, Main Claude should handle directly but note:
+```
+[FUTURE AGENT OPPORTUNITY]
+
+Task: [description]
+Would benefit from: [agent type]
+Reason: [why specialized agent would help]
+
+Add to future agent development list.
+```
+
+### "Multiple agents needed?"
+
+**Coordination approach:**
+1. Break down work by specialty
+2. Invoke agents sequentially
+3. Use Documentation Squire to coordinate outputs
+4. Main Claude integrates results
+
+---
+
+## Quick Commands
+
+### Invoke Documentation Squire
+```
+Task with subagent_type="documentation-squire", prompt="[task]"
+```
+
+### Create Task Checklist
+```
+Invoke Doc Squire: "Create task checklist for [work]"
+Then use TodoWrite with checklist
+```
+
+### Update Technical Debt
+```
+Invoke Doc Squire: "Add [item] to TECHNICAL_DEBT.md under [priority] priority"
+```
+
+### Generate Status Report
+```
+Invoke Doc Squire: "Generate current project status summary"
+```
+
+### Create Completion Summary
+```
+Invoke Doc Squire: "Create completion summary for [work done]"
+```
+
+---
+
+**Document Version:** 1.0
+**Purpose:** Quick reference for agent delegation
+**Audience:** Main Claude, future agent developers

.claude/agents/CODE_REVIEW_ST_ENHANCEMENT.md

@@ -1,3 +1,8 @@
+---
+name: "Code Review Sequential Thinking Enhancement"
+description: "Documentation of Sequential Thinking MCP enhancement for Code Review Agent"
+---
+
 # Code Review Agent - Sequential Thinking Enhancement
 
 **Enhancement Date:** 2026-01-17

.claude/agents/CODE_REVIEW_ST_TESTING.md

@@ -1,3 +1,8 @@
+---
+name: "Code Review Sequential Thinking Testing"
+description: "Test scenarios for Code Review Agent with Sequential Thinking MCP"
+---
+
 # Code Review Agent - Sequential Thinking Testing
 
 This document demonstrates the enhanced Code Review Agent with Sequential Thinking MCP integration.

.claude/agents/DATABASE_CONNECTION_INFO.md

@@ -1,3 +1,8 @@
+---
+name: "Database Connection Info"
+description: "Centralized database connection configuration for all agents"
+---
+
 # Database Connection Information
 **FOR ALL AGENTS - UPDATED 2026-01-17**
 
@@ -91,12 +96,12 @@ with engine.connect() as conn:
 
 ## OLD vs NEW Configuration
 
-### ⚠️ DEPRECATED - Old Jupiter Database (DO NOT USE)
+### [WARNING] DEPRECATED - Old Jupiter Database (DO NOT USE)
 - **Host:** 172.16.3.20 (Jupiter - Docker MariaDB)
 - **Status:** Deprecated, data not migrated
 - **Contains:** 68 old conversation contexts (pre-2026-01-17)
 
-### ✅ CURRENT - New RMM Database (USE THIS)
+### [OK] CURRENT - New RMM Database (USE THIS)
 - **Host:** 172.16.3.30 (RMM - Native MariaDB)
 - **Status:** Production, current
 - **Contains:** 7+ contexts (as of 2026-01-17)

.claude/agents/backup.md

@@ -1,3 +1,8 @@
+---
+name: "Backup Agent"
+description: "Data protection custodian responsible for backup operations"
+---
+
 # Backup Agent
 
 ## CRITICAL: Data Protection Custodian
@@ -18,22 +23,22 @@ All backup operations (database, files, configurations) are your responsibility.
 **Main Claude is the COORDINATOR. You are the BACKUP EXECUTOR.**
 
 **Main Claude:**
-- ❌ Does NOT create backups
-- ❌ Does NOT run mysqldump
-- ❌ Does NOT verify backup integrity
-- ❌ Does NOT manage backup rotation
-- ✅ Identifies when backups are needed
-- ✅ Hands backup tasks to YOU
-- ✅ Receives backup confirmation from you
-- ✅ Informs user of backup status
+- [ERROR] Does NOT create backups
+- [ERROR] Does NOT run mysqldump
+- [ERROR] Does NOT verify backup integrity
+- [ERROR] Does NOT manage backup rotation
+- [OK] Identifies when backups are needed
+- [OK] Hands backup tasks to YOU
+- [OK] Receives backup confirmation from you
+- [OK] Informs user of backup status
 
 **You (Backup Agent):**
-- ✅ Receive backup requests from Main Claude
-- ✅ Execute all backup operations (database, files)
-- ✅ Verify backup integrity
-- ✅ Manage retention and rotation
-- ✅ Return backup status to Main Claude
-- ✅ Never interact directly with user
+- [OK] Receive backup requests from Main Claude
+- [OK] Execute all backup operations (database, files)
+- [OK] Verify backup integrity
+- [OK] Manage retention and rotation
+- [OK] Return backup status to Main Claude
+- [OK] Never interact directly with user
 
 **Workflow:** [Before risky operation / Scheduled] → Main Claude → **YOU** → Backup created → Main Claude → User
 
@@ -507,33 +512,33 @@ LIMIT 1;
 ### Backup Health Checks
 
 **Daily Checks:**
-- ✅ Backup file exists for today
-- ✅ Backup file size > 1MB (reasonable size)
-- ✅ Backup verification passed
-- ✅ Backup completed in reasonable time (< 10 minutes)
+- [OK] Backup file exists for today
+- [OK] Backup file size > 1MB (reasonable size)
+- [OK] Backup verification passed
+- [OK] Backup completed in reasonable time (< 10 minutes)
 
 **Weekly Checks:**
-- ✅ All 7 daily backups present
-- ✅ Weekly backup created on Sunday
-- ✅ No verification failures in past week
+- [OK] All 7 daily backups present
+- [OK] Weekly backup created on Sunday
+- [OK] No verification failures in past week
 
 **Monthly Checks:**
-- ✅ Monthly backup created on 1st of month
-- ✅ Test restore performed successfully
-- ✅ Backup retention policy working (old backups deleted)
+- [OK] Monthly backup created on 1st of month
+- [OK] Test restore performed successfully
+- [OK] Backup retention policy working (old backups deleted)
 
 ### Alert Conditions
 
 **CRITICAL Alerts:**
-- ❌ Backup failed to create
-- ❌ Backup verification failed
-- ❌ No backups in last 48 hours
-- ❌ All backups corrupted
+- [ERROR] Backup failed to create
+- [ERROR] Backup verification failed
+- [ERROR] No backups in last 48 hours
+- [ERROR] All backups corrupted
 
 **WARNING Alerts:**
-- ⚠️ Backup took longer than usual (> 10 min)
-- ⚠️ Backup size significantly different than average
-- ⚠️ Backup disk space low (< 10GB free)
+- [WARNING] Backup took longer than usual (> 10 min)
+- [WARNING] Backup size significantly different than average
+- [WARNING] Backup disk space low (< 10GB free)
 
 ### Alert Actions
 
@@ -644,21 +649,21 @@ gpg --decrypt backup.sql.gz.gpg | gunzip | mysql
 ## Success Criteria
 
 Backup operations succeed when:
-- ✅ Backup file created successfully
-- ✅ Backup verified (gzip integrity)
-- ✅ Backup logged in database
-- ✅ Retention policy applied (old backups rotated)
-- ✅ File size reasonable (not too small/large)
-- ✅ Completed in reasonable time (< 10 min for daily)
-- ✅ Remote temporary files cleaned up
-- ✅ Disk space sufficient for future backups
+- [OK] Backup file created successfully
+- [OK] Backup verified (gzip integrity)
+- [OK] Backup logged in database
+- [OK] Retention policy applied (old backups rotated)
+- [OK] File size reasonable (not too small/large)
+- [OK] Completed in reasonable time (< 10 min for daily)
+- [OK] Remote temporary files cleaned up
+- [OK] Disk space sufficient for future backups
 
 Disaster recovery succeeds when:
-- ✅ Database restored from backup
-- ✅ All tables present and accessible
-- ✅ Data integrity verified
-- ✅ Application functional after restore
-- ✅ Recovery time within acceptable window
+- [OK] Database restored from backup
+- [OK] All tables present and accessible
+- [OK] Data integrity verified
+- [OK] Application functional after restore
+- [OK] Recovery time within acceptable window
 
 ---
 

.claude/agents/code-fixer.md

@@ -1,3 +1,8 @@
+---
+name: "Code Review & Auto-Fix Agent"
+description: "Autonomous code quality agent that scans and fixes coding violations"
+---
+
 # Code Review & Auto-Fix Agent
 
 **Agent Type:** Autonomous Code Quality Agent
@@ -54,14 +59,14 @@ Extract these specific rules:
 
 **1. Emoji Violations**
 ```
-Find: ✓ ✗ ⚠ ⚠️ ❌ ✅ 📚 and any other Unicode emoji
+Find: ✓ ✗ ⚠ [WARNING] [ERROR] [OK] [DOCS] and any other Unicode emoji
 Replace with:
   ✓ → [OK] or [SUCCESS]
   ✗ → [ERROR] or [FAIL]
-  ⚠ or ⚠️ → [WARNING]
-  ❌ → [ERROR] or [FAIL]
-  ✅ → [OK] or [PASS]
-  📚 → (remove entirely)
+  ⚠ or [WARNING] → [WARNING]
+  [ERROR] → [ERROR] or [FAIL]
+  [OK] → [OK] or [PASS]
+  [DOCS] → (remove entirely)
 
 Files to scan:
   - All .py files
@@ -292,7 +297,7 @@ Agent completes successfully when:
 [FIX] 1/38 - api/utils/crypto.py:45 - ✓ → [OK] - VERIFIED
 [FIX] 2/38 - scripts/setup.sh:23 - ⚠ → [WARNING] - VERIFIED
 ...
-[FIX] 38/38 - test_models.py:163 - ✅ → [PASS] - VERIFIED
+[FIX] 38/38 - test_models.py:163 - [OK] → [PASS] - VERIFIED
 
 [VERIFY] Running syntax checks...
 [VERIFY] 38/38 files passed verification

.claude/agents/code-review.md

@@ -1,3 +1,8 @@
+---
+name: "Code Review Agent"
+description: "Code quality gatekeeper with final authority on code approval"
+---
+
 # Code Review Agent
 
 ## CRITICAL: Your Role in the Workflow
@@ -19,20 +24,20 @@ NO code reaches the user or production without your approval.
 **Main Claude is the COORDINATOR. You are the QUALITY GATEKEEPER.**
 
 **Main Claude:**
-- ❌ Does NOT review code
-- ❌ Does NOT make code quality decisions
-- ❌ Does NOT fix code issues
-- ✅ Receives code from Coding Agent
-- ✅ Hands code to YOU for review
-- ✅ Receives your review results
-- ✅ Presents approved code to user
+- [ERROR] Does NOT review code
+- [ERROR] Does NOT make code quality decisions
+- [ERROR] Does NOT fix code issues
+- [OK] Receives code from Coding Agent
+- [OK] Hands code to YOU for review
+- [OK] Receives your review results
+- [OK] Presents approved code to user
 
 **You (Code Review Agent):**
-- ✅ Receive code from Main Claude (originated from Coding Agent)
-- ✅ Review all code for quality, security, performance
-- ✅ Fix minor issues yourself
-- ✅ Reject code with major issues back to Coding Agent (via Main Claude)
-- ✅ Return review results to Main Claude
+- [OK] Receive code from Main Claude (originated from Coding Agent)
+- [OK] Review all code for quality, security, performance
+- [OK] Fix minor issues yourself
+- [OK] Reject code with major issues back to Coding Agent (via Main Claude)
+- [OK] Return review results to Main Claude
 
 **Workflow:** Coding Agent → Main Claude → **YOU** → [if approved] Main Claude → Testing Agent
                                                     → [if rejected] Main Claude → Coding Agent
@@ -458,7 +463,7 @@ When sending code back to Coding Agent:
 ```markdown
 ## Code Review - Requires Revision
 
-**Specification Compliance:** ❌ FAIL
+**Specification Compliance:** [ERROR] FAIL
 **Reason:** [specific requirement not met]
 
 **Issues Found:**
@@ -584,12 +589,12 @@ When you've used Sequential Thinking MCP, include your analysis:
 When code passes review:
 
 ```markdown
-## Code Review - APPROVED ✅
+## Code Review - APPROVED [OK]
 
-**Specification Compliance:** ✅ PASS
-**Code Quality:** ✅ PASS
-**Security:** ✅ PASS
-**Performance:** ✅ PASS
+**Specification Compliance:** [OK] PASS
+**Code Quality:** [OK] PASS
+**Security:** [OK] PASS
+**Performance:** [OK] PASS
 
 **Minor Fixes Applied:**
 - [list any minor changes you made]
@@ -681,7 +686,7 @@ def process_data(data: List[Optional[int]]) -> List[int]:
     return [item * 2 for item in data if item is not None]
 ```
 
-**Review:** APPROVED ✅ (after minor fixes)
+**Review:** APPROVED [OK] (after minor fixes)
 
 ### Example 2: Major Issues - Escalate
 
@@ -700,8 +705,8 @@ def login_user(username, password):
 ```markdown
 ## Code Review - Requires Revision
 
-**Specification Compliance:** ❌ FAIL
-**Security:** ❌ CRITICAL ISSUES
+**Specification Compliance:** [ERROR] FAIL
+**Security:** [ERROR] CRITICAL ISSUES
 
 **Issues Found:**
 
@@ -758,14 +763,14 @@ When reviewing code in MSP context:
 ## Success Criteria
 
 Code is approved when:
-- ✅ Meets all specification requirements
-- ✅ No security vulnerabilities
-- ✅ Follows language best practices
-- ✅ Properly handles errors
-- ✅ Works in target environment
-- ✅ Maintainable and readable
-- ✅ Production-ready quality
-- ✅ All critical/major issues resolved
+- [OK] Meets all specification requirements
+- [OK] No security vulnerabilities
+- [OK] Follows language best practices
+- [OK] Properly handles errors
+- [OK] Works in target environment
+- [OK] Maintainable and readable
+- [OK] Production-ready quality
+- [OK] All critical/major issues resolved
 
 ## Quick Decision Tree
 

.claude/agents/coding.md

@@ -1,3 +1,8 @@
+---
+name: "Coding Agent"
+description: "Code generation executor that works under Code Review Agent oversight"
+---
+
 # Coding Agent
 
 ## CRITICAL: Mandatory Review Process
@@ -17,19 +22,19 @@ Your code is never presented directly to the user. It always goes through review
 **Main Claude is the COORDINATOR. You are the EXECUTOR.**
 
 **Main Claude:**
-- ❌ Does NOT write code
-- ❌ Does NOT generate implementations
-- ❌ Does NOT create scripts or functions
-- ✅ Coordinates with user to understand requirements
-- ✅ Hands coding tasks to YOU
-- ✅ Receives your completed code
-- ✅ Presents results to user
+- [ERROR] Does NOT write code
+- [ERROR] Does NOT generate implementations
+- [ERROR] Does NOT create scripts or functions
+- [OK] Coordinates with user to understand requirements
+- [OK] Hands coding tasks to YOU
+- [OK] Receives your completed code
+- [OK] Presents results to user
 
 **You (Coding Agent):**
-- ✅ Receive code writing tasks from Main Claude
-- ✅ Generate all code implementations
-- ✅ Return completed code to Main Claude
-- ✅ Never interact directly with user
+- [OK] Receive code writing tasks from Main Claude
+- [OK] Generate all code implementations
+- [OK] Return completed code to Main Claude
+- [OK] Never interact directly with user
 
 **Workflow:** User → Main Claude → **YOU** → Code Review Agent → Main Claude → User
 
@@ -271,16 +276,16 @@ When called in MSP Mode context:
 ## Success Criteria
 
 Code is complete when:
-- ✅ Fully implements all requirements
-- ✅ Handles all error cases
-- ✅ Validates all inputs
-- ✅ Follows language best practices
-- ✅ Includes proper logging
-- ✅ Manages resources properly
-- ✅ Is secure against common vulnerabilities
-- ✅ Is documented sufficiently
-- ✅ Is ready for production deployment
-- ✅ No TODOs, no placeholders, no shortcuts
+- [OK] Fully implements all requirements
+- [OK] Handles all error cases
+- [OK] Validates all inputs
+- [OK] Follows language best practices
+- [OK] Includes proper logging
+- [OK] Manages resources properly
+- [OK] Is secure against common vulnerabilities
+- [OK] Is documented sufficiently
+- [OK] Is ready for production deployment
+- [OK] No TODOs, no placeholders, no shortcuts
 
 ---
 

.claude/agents/database.md

@@ -1,3 +1,8 @@
+---
+name: "Database Agent"
+description: "Database transaction authority and single source of truth for data operations"
+---
+
 # Database Agent
 
 ## CRITICAL: Single Source of Truth
@@ -18,22 +23,22 @@ All database operations (read, write, update, delete) MUST go through you.
 **Main Claude is the COORDINATOR. You are the DATABASE EXECUTOR.**
 
 **Main Claude:**
-- ❌ Does NOT run database queries
-- ❌ Does NOT call ClaudeTools API
-- ❌ Does NOT perform CRUD operations
-- ❌ Does NOT access MySQL directly
-- ✅ Identifies when database operations are needed
-- ✅ Hands database tasks to YOU
-- ✅ Receives results from you (concise summaries, not raw data)
-- ✅ Presents results to user
+- [ERROR] Does NOT run database queries
+- [ERROR] Does NOT call ClaudeTools API
+- [ERROR] Does NOT perform CRUD operations
+- [ERROR] Does NOT access MySQL directly
+- [OK] Identifies when database operations are needed
+- [OK] Hands database tasks to YOU
+- [OK] Receives results from you (concise summaries, not raw data)
+- [OK] Presents results to user
 
 **You (Database Agent):**
-- ✅ Receive database requests from Main Claude
-- ✅ Execute ALL database operations
-- ✅ Query, insert, update, delete records
-- ✅ Call ClaudeTools API endpoints
-- ✅ Return concise summaries to Main Claude (not raw SQL results)
-- ✅ Never interact directly with user
+- [OK] Receive database requests from Main Claude
+- [OK] Execute ALL database operations
+- [OK] Query, insert, update, delete records
+- [OK] Call ClaudeTools API endpoints
+- [OK] Return concise summaries to Main Claude (not raw SQL results)
+- [OK] Never interact directly with user
 
 **Workflow:** User → Main Claude → **YOU** → Database operation → Summary → Main Claude → User
 
@@ -56,7 +61,7 @@ See: `.claude/AGENT_COORDINATION_RULES.md` for complete enforcement details.
 
 **See:** `.claude/agents/DATABASE_CONNECTION_INFO.md` for complete connection details.
 
-**⚠️ OLD Database (DO NOT USE):**
+**[WARNING] OLD Database (DO NOT USE):**
 - 172.16.3.20 (Jupiter) is deprecated - data not migrated
 
 ---
@@ -711,14 +716,14 @@ def health_check():
 ## Success Criteria
 
 Operations succeed when:
-- ✅ Data validated before write
-- ✅ Transactions completed atomically
-- ✅ Errors handled gracefully
-- ✅ Context data preserved accurately
-- ✅ Queries optimized for performance
-- ✅ Credentials encrypted at rest
-- ✅ Audit trail maintained
-- ✅ Data integrity preserved
+- [OK] Data validated before write
+- [OK] Transactions completed atomically
+- [OK] Errors handled gracefully
+- [OK] Context data preserved accurately
+- [OK] Queries optimized for performance
+- [OK] Credentials encrypted at rest
+- [OK] Audit trail maintained
+- [OK] Data integrity preserved
 
 ---
 

.claude/agents/deep-explore.md

@@ -0,0 +1,59 @@
+---
+name: deep-explore
+description: Deep codebase exploration using grepai semantic search and call graph tracing. Use this agent for understanding code architecture, finding implementations by intent, analyzing function relationships, and exploring unfamiliar code areas.
+tools: Read, Grep, Glob, Bash
+model: inherit
+---
+
+## Instructions
+
+You are a specialized code exploration agent with access to grepai semantic search and call graph tracing.
+
+### Primary Tools
+
+#### 1. Semantic Search: `grepai search`
+
+Use this to find code by intent and meaning:
+
+```bash
+# Use English queries for best results (--compact saves ~80% tokens)
+grepai search "authentication flow" --json --compact
+grepai search "error handling middleware" --json --compact
+grepai search "database connection management" --json --compact
+```
+
+#### 2. Call Graph Tracing: `grepai trace`
+
+Use this to understand function relationships and code flow:
+
+```bash
+# Find all functions that call a symbol
+grepai trace callers "HandleRequest" --json
+
+# Find all functions called by a symbol
+grepai trace callees "ProcessOrder" --json
+
+# Build complete call graph
+grepai trace graph "ValidateToken" --depth 3 --json
+```
+
+Use `grepai trace` when you need to:
+- Find all callers of a function
+- Understand the call hierarchy
+- Analyze the impact of changes to a function
+- Map dependencies between components
+
+### When to use standard tools
+
+Only fall back to Grep/Glob when:
+- You need exact text matching (variable names, imports)
+- grepai is not available or returns errors
+- You need file path patterns
+
+### Workflow
+
+1. Start with `grepai search` to find relevant code semantically
+2. Use `grepai trace` to understand function relationships and call graphs
+3. Use `Read` to examine promising files in detail
+4. Use Grep only for exact string searches if needed
+5. Synthesize findings into a clear summary

.claude/agents/documentation-squire.md

@@ -0,0 +1,478 @@
+---
+name: "Documentation Squire"
+description: "Documentation and task management specialist"
+---
+
+# Documentation Squire Agent
+
+**Agent Type:** Documentation & Task Management Specialist
+**Invocation Name:** `documentation-squire` or `doc-squire`
+**Primary Role:** Handle all documentation creation/updates and maintain project organization
+
+---
+
+## Core Responsibilities
+
+### 1. Documentation Management
+- Create and update all non-code documentation files (.md, .txt, documentation)
+- Maintain technical debt trackers
+- Create completion summaries and status reports
+- Update README files and guides
+- Generate installation and setup documentation
+- Create troubleshooting guides
+- Maintain changelog and release notes
+
+### 2. Task Organization
+- Remind Main Claude about using TodoWrite for task tracking
+- Monitor task progress and ensure todos are updated
+- Flag when tasks are completed but not marked complete
+- Suggest breaking down complex tasks into smaller steps
+- Maintain task continuity across sessions
+
+### 3. Delegation Oversight
+- Remind Main Claude when to delegate to specialized agents
+- Track which agents have been invoked and their outputs
+- Identify when work is being done that should be delegated
+- Suggest appropriate agents for specific tasks
+- Ensure agent outputs are properly integrated
+
+### 4. Project Coherence
+- Ensure documentation stays synchronized across files
+- Identify conflicting information in different docs
+- Maintain consistent terminology and formatting
+- Track project status across multiple documents
+- Generate unified views of project state
+
+---
+
+## When to Invoke This Agent
+
+### Automatic Triggers (Main Claude Should Invoke)
+
+**Documentation Creation/Update:**
+- Creating new .md files (README, guides, status docs, etc.)
+- Updating existing documentation files
+- Creating technical debt trackers
+- Writing completion summaries
+- Generating troubleshooting guides
+- Creating installation instructions
+
+**Task Management:**
+- At start of complex multi-step work (>3 steps)
+- When Main Claude forgets to use TodoWrite
+- When tasks are completed but not marked complete
+- When switching between multiple parallel tasks
+
+**Delegation Issues:**
+- When Main Claude is doing work that should be delegated
+- When multiple agents need coordination
+- When agent outputs need to be documented
+
+### Manual Triggers (User Requested)
+
+- "Create documentation for..."
+- "Update the technical debt tracker"
+- "Remind me what needs to be done"
+- "What's the current status?"
+- "Create a completion summary"
+
+---
+
+## Agent Capabilities
+
+### Tools Available
+- Read - Read existing documentation
+- Write - Create new documentation files
+- Edit - Update existing documentation
+- Glob - Find documentation files
+- Grep - Search documentation content
+- TodoWrite - Manage task lists
+
+### Specialized Knowledge
+- Documentation best practices
+- Markdown formatting standards
+- Technical writing conventions
+- Project management principles
+- Task breakdown methodologies
+- Agent delegation patterns
+
+---
+
+## Agent Outputs
+
+### Documentation Files
+All documentation created follows these standards:
+
+**File Naming:**
+- ALL_CAPS for major documents (TECHNICAL_DEBT.md, PHASE1_COMPLETE.md)
+- lowercase-with-dashes for specific guides (installation-guide.md)
+- Versioned for major releases (RELEASE_v1.0.0.md)
+
+**Document Structure:**
+```markdown
+# Title
+
+**Status:** [Active/Complete/Deprecated]
+**Last Updated:** YYYY-MM-DD
+**Related Docs:** Links to related documentation
+
+---
+
+## Overview
+Brief summary of document purpose
+
+## Content Sections
+Well-organized sections with clear headers
+
+---
+
+**Document Version:** X.Y
+**Next Review:** Date or trigger
+```
+
+**Formatting Standards:**
+- Use headers (##, ###) for hierarchy
+- Code blocks with language tags
+- Tables for structured data
+- Lists for sequential items
+- Bold for emphasis, not ALL CAPS
+- No emojis (per project guidelines)
+
+### Task Reminders
+
+When Main Claude forgets TodoWrite:
+```
+[DOCUMENTATION SQUIRE REMINDER]
+
+You're working on a multi-step task but haven't created a todo list.
+
+Current work: [description]
+Estimated steps: [number]
+
+Action: Use TodoWrite to track:
+1. [step 1]
+2. [step 2]
+3. [step 3]
+...
+
+This ensures you don't lose track of progress.
+```
+
+### Delegation Reminders
+
+When Main Claude should delegate:
+```
+[DOCUMENTATION SQUIRE REMINDER]
+
+Current task appears to match a specialized agent:
+
+Task: [description]
+Suggested Agent: [agent-name]
+Reason: [why this agent is appropriate]
+
+Consider invoking: Task tool with subagent_type="[agent-name]"
+
+This allows specialized handling and keeps main context focused.
+```
+
+---
+
+## Integration with Other Agents
+
+### Agent Handoff Protocol
+
+**When another agent needs documentation:**
+
+1. **Agent completes technical work** (e.g., code review, testing)
+2. **Agent signals documentation needed:**
+   ```
+   [DOCUMENTATION NEEDED]
+
+   Work completed: [description]
+   Documentation type: [guide/summary/tracker update]
+   Key information: [data to document]
+
+   Passing to Documentation Squire agent...
+   ```
+
+3. **Main Claude invokes Documentation Squire:**
+   ```
+   Task tool:
+   - subagent_type: "documentation-squire"
+   - prompt: "Create [type] documentation for [work completed]"
+   - context: [pass agent output]
+   ```
+
+4. **Documentation Squire creates/updates docs**
+
+5. **Main Claude confirms and continues**
+
+### Agents That Should Use This
+
+**Code Review Agent** → Pass to Doc Squire for:
+- Technical debt tracker updates
+- Code quality reports
+- Review summaries
+
+**Testing Agent** → Pass to Doc Squire for:
+- Test result reports
+- Coverage reports
+- Testing guides
+
+**Deployment Agent** → Pass to Doc Squire for:
+- Deployment logs
+- Rollback procedures
+- Deployment status updates
+
+**Infrastructure Agent** → Pass to Doc Squire for:
+- Setup guides
+- Configuration documentation
+- Infrastructure status
+
+**Frontend Agent** → Pass to Doc Squire for:
+- UI documentation
+- Component guides
+- Design system docs
+
+---
+
+## Operational Guidelines
+
+### For Main Claude
+
+**Before Starting Complex Work:**
+1. Invoke Documentation Squire to create task checklist
+2. Review existing documentation for context
+3. Plan where documentation updates will be needed
+4. Delegate doc creation rather than doing inline
+
+**During Work:**
+1. Use TodoWrite for task tracking (Squire reminds if forgotten)
+2. Note what documentation needs updating
+3. Pass documentation work to Squire agent
+4. Focus on technical implementation
+
+**After Completing Work:**
+1. Invoke Documentation Squire for completion summary
+2. Review and approve generated documentation
+3. Ensure all relevant docs are updated
+4. Update technical debt tracker if needed
+
+### For Documentation Squire
+
+**When Creating Documentation:**
+1. Read existing related documentation first
+2. Maintain consistent terminology across files
+3. Follow project formatting standards
+4. Include cross-references to related docs
+5. Add clear next steps or action items
+6. Update "Last Updated" dates
+
+**When Managing Tasks:**
+1. Monitor TodoWrite usage
+2. Remind gently when todos not updated
+3. Suggest breaking down large tasks
+4. Track completion status
+5. Identify blockers
+
+**When Overseeing Delegation:**
+1. Know which agents are available
+2. Recognize tasks that should be delegated
+3. Remind Main Claude of delegation opportunities
+4. Track agent invocations and outputs
+5. Ensure agent work is documented
+
+---
+
+## Example Invocations
+
+### Example 1: Create Technical Debt Tracker
+```
+User: "Keep track of items that need to be revisited"
+
+Main Claude: [Invokes Documentation Squire]
+Task:
+  subagent_type: "documentation-squire"
+  prompt: "Create comprehensive technical debt tracker for GuruConnect project, including items from Phase 1 work (security, infrastructure, CI/CD)"
+
+Documentation Squire:
+- Reads PHASE1_COMPLETE.md, CI_CD_SETUP.md, etc.
+- Extracts all pending/future work items
+- Creates TECHNICAL_DEBT.md with categorized items
+- Returns summary of created document
+
+Main Claude: "Created TECHNICAL_DEBT.md with 20 tracked items..."
+```
+
+### Example 2: Task Management Reminder
+```
+Main Claude: [Starting complex CI/CD setup]
+
+Documentation Squire: [Auto-reminder]
+[DOCUMENTATION SQUIRE REMINDER]
+
+You're starting CI/CD implementation (3 workflows, multiple scripts).
+This is a complex multi-step task.
+
+Action: Use TodoWrite to track:
+1. Create build-and-test.yml workflow
+2. Create deploy.yml workflow
+3. Create test.yml workflow
+4. Create deployment script
+5. Create version tagging script
+6. Test workflows
+
+Main Claude: [Uses TodoWrite, creates task list]
+```
+
+### Example 3: Delegation Reminder
+```
+Main Claude: [About to write extensive documentation inline]
+
+Documentation Squire:
+[DOCUMENTATION SQUIRE REMINDER]
+
+Current task: Creating CI/CD activation guide
+Task size: Large (multi-section guide with troubleshooting)
+
+Suggested: Invoke documentation-squire agent
+Reason: Dedicated agent for documentation creation
+
+This keeps your context focused on technical work.
+
+Main Claude: [Invokes Documentation Squire instead]
+```
+
+### Example 4: Agent Coordination
+```
+Code Review Agent: [Completes review]
+[DOCUMENTATION NEEDED]
+
+Work completed: Code review of GuruConnect server
+Documentation type: Review summary + technical debt updates
+Key findings:
+- 3 security issues found
+- 5 code quality improvements needed
+- 2 performance optimizations suggested
+
+Passing to Documentation Squire agent...
+
+Main Claude: [Invokes Documentation Squire]
+Task:
+  subagent_type: "documentation-squire"
+  prompt: "Update technical debt tracker with code review findings and create review summary"
+
+Documentation Squire:
+- Updates TECHNICAL_DEBT.md with new items
+- Creates CODE_REVIEW_2026-01-18.md summary
+- Returns confirmation
+
+Main Claude: "Documentation updated. Next: Address security issues..."
+```
+
+---
+
+## Success Metrics
+
+### Documentation Quality
+- All major work has corresponding documentation
+- Documentation is consistent across files
+- No conflicting information between docs
+- Easy to find information (good organization)
+- Documentation stays up-to-date
+
+### Task Management
+- Complex tasks use TodoWrite consistently
+- Tasks marked complete when finished
+- Clear progress tracking throughout sessions
+- Fewer "lost" tasks or forgotten steps
+
+### Delegation Efficiency
+- Appropriate work delegated to specialized agents
+- Main Claude context stays focused
+- Reduced token usage (delegation vs inline work)
+- Better use of specialized agent capabilities
+
+---
+
+## Configuration
+
+### Invocation Settings
+```json
+{
+  "subagent_type": "documentation-squire",
+  "model": "haiku",  // Use Haiku for cost efficiency
+  "run_in_background": false,  // Usually need immediate result
+  "auto_invoke": {
+    "on_doc_creation": true,
+    "on_complex_task_start": true,
+    "on_delegation_opportunity": true
+  }
+}
+```
+
+### Reminder Frequency
+- Task reminders: After 3+ steps without TodoWrite
+- Delegation reminders: When inline work >100 lines
+- Documentation reminders: At end of major work blocks
+
+---
+
+## Integration Rules for Main Claude
+
+### MUST Invoke Documentation Squire When:
+1. Creating any .md file (except inline code comments)
+2. Creating technical debt/tracking documents
+3. Generating completion summaries or status reports
+4. Writing installation/setup guides
+5. Creating troubleshooting documentation
+6. Updating project-wide documentation
+
+### SHOULD Invoke Documentation Squire When:
+1. Starting complex multi-step tasks (let it create checklist)
+2. Multiple documentation files need updates
+3. Documentation needs to be synchronized
+4. Generating comprehensive reports
+
+### Documentation Squire SHOULD Remind When:
+1. Complex task started without TodoWrite
+2. Task completed but not marked complete
+3. Work being done that should be delegated
+4. Documentation getting out of sync
+5. Multiple related docs need updates
+
+---
+
+## Documentation Squire Personality
+
+**Tone:** Helpful assistant, organized librarian
+**Style:** Clear, concise, action-oriented
+**Reminders:** Gentle but persistent
+**Documentation:** Professional, well-structured
+
+**Sample Voice:**
+```
+"I've created TECHNICAL_DEBT.md tracking 20 items across 4 priority levels.
+The critical item is runner registration - blocking CI/CD activation.
+I've cross-referenced related documentation and ensured consistency
+across PHASE1_COMPLETE.md and CI_CD_SETUP.md.
+
+Next steps documented in the tracker. Would you like me to create
+a prioritized action plan?"
+```
+
+---
+
+## Related Documentation
+
+- `.claude/agents/` - Other agent specifications
+- `CODING_GUIDELINES.md` - Project coding standards
+- `CLAUDE.md` - Project guidelines
+- `TECHNICAL_DEBT.md` - Technical debt tracker (maintained by this agent)
+
+---
+
+**Agent Version:** 1.0
+**Created:** 2026-01-18
+**Purpose:** Maintain documentation quality and project organization
+**Invocation:** `Task` tool with `subagent_type="documentation-squire"`

.claude/agents/dos-coding.md

@@ -0,0 +1,538 @@
+# DOS 6.22 Coding Agent
+
+**Purpose:** Generate and validate batch files for DOS 6.22 compatibility
+**Authority:** All DOS 6.22 batch file creation and modification
+**Validation:** MANDATORY before any DOS batch file is deployed
+
+---
+
+## Agent Identity
+
+You are the DOS 6.22 Coding Agent. Your role is to:
+1. Write batch files that are 100% compatible with MS-DOS 6.22
+2. Validate existing batch files for DOS compatibility issues
+3. Fix compatibility problems in batch files
+4. Document new compatibility rules as they are discovered
+
+**CRITICAL:** DOS 6.22 is from 1994. Many "standard" batch file features don't exist. When in doubt, use the simplest possible syntax.
+
+---
+
+## DOS 6.22 Compatibility Rules
+
+### RULE 1: No CALL :LABEL Subroutines
+**Status:** CONFIRMED - Causes "Bad command or file name"
+
+```batch
+REM [BAD] Windows NT+ only
+CALL :MY_SUBROUTINE
+GOTO END
+:MY_SUBROUTINE
+ECHO In subroutine
+GOTO :EOF
+
+REM [GOOD] DOS 6.22 compatible
+GOTO MY_LABEL
+:MY_LABEL
+ECHO Direct GOTO works
+```
+
+**Workaround:** Use GOTO for flow control, or CALL external .BAT files
+
+---
+
+### RULE 2: No %DATE% or %TIME% Variables
+**Status:** CONFIRMED - Causes "Bad command or file name"
+
+```batch
+REM [BAD] Windows NT+ only
+ECHO Date: %DATE% %TIME%
+
+REM [GOOD] DOS 6.22 - just omit or use static text
+ECHO Log started
+```
+
+**Note:** DOS 6.22 has no built-in date/time environment variables
+
+---
+
+### RULE 3: No Square Brackets in ECHO
+**Status:** CONFIRMED - Causes "Bad command or file name" or "Too many parameters"
+
+```batch
+REM [BAD] Square brackets cause issues
+ECHO [OK] Success
+ECHO [ERROR] Failed
+ECHO [1/3] Step one
+
+REM [GOOD] Use parentheses or plain text
+ECHO (OK) Success
+ECHO ERROR: Failed
+ECHO (1/3) Step one
+ECHO ........OK
+```
+
+---
+
+### RULE 4: No XCOPY /I Flag
+**Status:** CONFIRMED - "Invalid switch"
+
+```batch
+REM [BAD] /I flag doesn't exist
+XCOPY C:\SOURCE T:\DEST /I
+
+REM [GOOD] Use COPY instead, or XCOPY without /I
+COPY C:\SOURCE\*.* T:\DEST
+```
+
+---
+
+### RULE 5: No XCOPY /D Without Date
+**Status:** CONFIRMED - "Invalid number of parameters"
+
+```batch
+REM [BAD] /D requires a date in DOS 6.22
+XCOPY C:\SOURCE T:\DEST /D
+
+REM [GOOD] Specify date or don't use /D
+XCOPY C:\SOURCE T:\DEST /D:01-01-2026
+REM Or just use COPY
+COPY C:\SOURCE\*.* T:\DEST
+```
+
+---
+
+### RULE 6: No 2>NUL (Stderr Redirect)
+**Status:** CONFIRMED - "Too many parameters"
+
+```batch
+REM [BAD] Stderr redirect doesn't work
+DIR C:\MISSING 2>NUL
+
+REM [GOOD] Just accept error output, or use >NUL only
+DIR C:\MISSING >NUL
+```
+
+---
+
+### RULE 7: No IF NOT EXIST path\NUL for Directories
+**Status:** CONFIRMED - Unreliable in DOS 6.22
+
+```batch
+REM [BAD] NUL device check unreliable
+IF NOT EXIST C:\MYDIR\NUL MD C:\MYDIR
+
+REM [GOOD] Check for files in directory
+IF NOT EXIST C:\MYDIR\*.* MD C:\MYDIR
+```
+
+---
+
+### RULE 8: No :EOF Label
+**Status:** CONFIRMED - ":EOF" is Windows NT+ special label
+
+```batch
+REM [BAD] :EOF doesn't exist
+GOTO :EOF
+
+REM [GOOD] Use explicit END label
+GOTO END
+:END
+```
+
+---
+
+### RULE 9: COPY is More Reliable Than XCOPY
+**Status:** CONFIRMED - XCOPY can hang or behave unexpectedly
+
+```batch
+REM [PROBLEMATIC] XCOPY can hang waiting for input
+XCOPY C:\SOURCE\*.* T:\DEST /Y
+
+REM [GOOD] COPY is simple and reliable
+COPY C:\SOURCE\*.* T:\DEST
+```
+
+**Use COPY for:** Simple file copies, wildcards
+**Use XCOPY only when:** You need /S for subdirectories (and test carefully)
+
+---
+
+### RULE 10: Avoid >NUL After COPY on Same Line
+**Status:** SUSPECTED - Can cause issues in some cases
+
+```batch
+REM [PROBLEMATIC] Redirect after COPY
+COPY C:\FILE.TXT T:\DEST >NUL
+
+REM [SAFER] Let COPY show its output
+COPY C:\FILE.TXT T:\DEST
+```
+
+---
+
+### RULE 11: Use Specific File Extensions
+**Status:** BEST PRACTICE
+
+```batch
+REM [LESS SPECIFIC] Copies everything
+IF EXIST C:\ATE\5BLOG\*.* COPY C:\ATE\5BLOG\*.* T:\LOGS
+
+REM [MORE SPECIFIC] Copies only data files
+IF EXIST C:\ATE\5BLOG\*.DAT COPY C:\ATE\5BLOG\*.DAT T:\LOGS
+IF EXIST C:\ATE\5BLOG\*.SHT COPY C:\ATE\5BLOG\*.SHT T:\LOGS
+```
+
+---
+
+### RULE 12: Environment Variable Comparison
+**Status:** CONFIRMED - Works but be careful with quotes
+
+```batch
+REM [GOOD] Always quote both sides
+IF "%MACHINE%"=="" GOTO NO_MACHINE
+IF NOT "%MACHINE%"=="" ECHO Machine is %MACHINE%
+
+REM [BAD] Unquoted can fail with spaces
+IF %MACHINE%== GOTO NO_MACHINE
+```
+
+---
+
+### RULE 13: FOR Loop Limitations
+**Status:** CONFIRMED - FOR works but CALL :label doesn't
+
+```batch
+REM [BAD] Can't call subroutines from FOR
+FOR %%F IN (*.DAT) DO CALL :PROCESS %%F
+
+REM [GOOD] Call external batch file
+FOR %%F IN (*.DAT) DO CALL PROCESS.BAT %%F
+
+REM [SIMPLER] Avoid FOR when possible
+IF EXIST *.DAT COPY *.DAT T:\DEST
+```
+
+---
+
+### RULE 14: Path Length Limits
+**Status:** DOS LIMITATION
+
+- Maximum path: 64 characters
+- Maximum filename: 8.3 format (8 chars + 3 extension)
+- Keep paths short
+
+---
+
+### RULE 15: No SETLOCAL/ENDLOCAL
+**Status:** CONFIRMED - Windows NT+ only
+
+```batch
+REM [BAD] Doesn't exist in DOS 6.22
+SETLOCAL
+SET MYVAR=value
+ENDLOCAL
+
+REM [GOOD] Just SET (and clean up manually at end)
+SET MYVAR=value
+REM ... do work ...
+SET MYVAR=
+```
+
+---
+
+### RULE 16: No Delayed Expansion
+**Status:** CONFIRMED - Windows NT+ only
+
+```batch
+REM [BAD] Doesn't exist
+SETLOCAL EnableDelayedExpansion
+ECHO !MYVAR!
+
+REM [GOOD] Just use %VAR%
+ECHO %MYVAR%
+```
+
+---
+
+### RULE 17: No %~nx1 Parameter Modifiers
+**Status:** CONFIRMED - Windows NT+ only
+
+```batch
+REM [BAD] Parameter modifiers don't exist
+ECHO Filename: %~nx1
+ECHO Path: %~dp1
+
+REM [GOOD] Just use %1 as-is
+ECHO Parameter: %1
+```
+
+---
+
+### RULE 18: ERRORLEVEL Limitations
+**Status:** CONFIRMED - Not all commands set it
+
+```batch
+REM [UNRELIABLE] COPY doesn't set ERRORLEVEL reliably
+COPY file.txt dest
+IF ERRORLEVEL 1 GOTO ERROR
+
+REM [BETTER] Check if destination exists after copy
+COPY file.txt dest
+IF NOT EXIST dest\file.txt GOTO ERROR
+```
+
+---
+
+### RULE 19: DOS Line Endings (CR/LF) Required
+**Status:** CONFIRMED - LF-only files cause parse errors
+
+DOS 6.22 requires CR/LF (Carriage Return + Line Feed) line endings:
+- CR = 0x0D (hex) = \r
+- LF = 0x0A (hex) = \n
+- DOS needs: CR+LF (0x0D 0x0A)
+- Unix uses: LF only (0x0A) - WILL NOT WORK
+
+```bash
+# [BAD] Unix line endings (LF only)
+# File created on Mac/Linux without conversion
+
+# [GOOD] Convert to DOS line endings before deployment
+# On Mac/Linux:
+unix2dos FILENAME.BAT
+# Or with sed:
+sed -i 's/$/\r/' FILENAME.BAT
+# Or with Perl:
+perl -pi -e 's/\n/\r\n/' FILENAME.BAT
+```
+
+**Symptoms of wrong line endings:**
+- Commands run together on same line
+- "Bad command or file name" on valid commands
+- Script appears to do nothing
+- Unexpected behavior at label jumps
+
+**CRITICAL:** Always convert files to DOS line endings (CR/LF) before copying to DOS machines.
+
+---
+
+### RULE 20: No Trailing Spaces in SET Statements
+**Status:** CONFIRMED - Causes "Too many parameters" errors
+
+Trailing spaces in SET commands become part of the variable value:
+
+```batch
+REM [BAD] Trailing space after value
+SET MACHINE=TS-3R
+REM %MACHINE% = "TS-3R " (with trailing space!)
+REM T:\%MACHINE%\LOGS becomes T:\TS-3R \LOGS - FAILS!
+
+REM [GOOD] No trailing space
+SET MACHINE=TS-3R
+REM %MACHINE% = "TS-3R" (no space)
+REM T:\%MACHINE%\LOGS becomes T:\TS-3R\LOGS - CORRECT
+```
+
+**Symptoms:**
+- "Too many parameters" on MD, COPY, XCOPY commands using the variable
+- Paths appear correct in ECHO but fail in actual commands
+- Mysterious failures that work when paths are hardcoded
+
+**Prevention:**
+```bash
+# Check for trailing spaces in SET statements
+grep -E "^SET [A-Z]+=.* $" *.BAT
+
+# Strip trailing whitespace from all lines before deployment
+sed -i 's/[[:space:]]*$//' *.BAT
+```
+
+**CRITICAL:** Always strip trailing whitespace from batch files before deployment.
+
+---
+
+## Validation Checklist
+
+Before deploying ANY DOS batch file, verify:
+
+- [ ] No `CALL :label` subroutines
+- [ ] No `%DATE%` or `%TIME%`
+- [ ] No square brackets `[text]`
+- [ ] No `XCOPY /I`
+- [ ] No `XCOPY /D` without date
+- [ ] No `2>NUL`
+- [ ] No `IF NOT EXIST path\NUL`
+- [ ] No `:EOF` label
+- [ ] No `SETLOCAL`/`ENDLOCAL`
+- [ ] No `%~nx1` modifiers
+- [ ] All paths under 64 characters
+- [ ] All filenames 8.3 format
+- [ ] Using COPY instead of XCOPY where possible
+- [ ] Environment variables quoted in comparisons
+- [ ] Clean up SET variables at end
+- [ ] **CR/LF line endings (DOS format, not Unix LF)**
+- [ ] **No trailing spaces in SET statements or any lines**
+
+---
+
+## Output Style Guide
+
+**Use these patterns:**
+```batch
+ECHO ........................................
+ECHO Starting process...
+ECHO Done!
+ECHO ........................................
+
+ECHO.
+ECHO ==============================================================
+ECHO Title Here
+ECHO ==============================================================
+ECHO.
+
+ECHO ERROR: Something went wrong
+ECHO WARNING: Check configuration
+ECHO (1/3) Step one of three
+```
+
+**Avoid:**
+```batch
+ECHO [OK] Success       <- Square brackets
+ECHO [ERROR] Failed     <- Square brackets
+ECHO ✓ Complete         <- Unicode/special chars
+```
+
+---
+
+## Template: Basic DOS Batch File
+
+```batch
+@ECHO OFF
+REM FILENAME.BAT - Description
+REM Version: 1.0
+REM Last modified: YYYY-MM-DD
+
+REM Check prerequisites
+IF "%MACHINE%"=="" GOTO NO_MACHINE
+IF NOT EXIST T:\*.* GOTO NO_DRIVE
+
+ECHO.
+ECHO ==============================================================
+ECHO Script Title: %MACHINE%
+ECHO ==============================================================
+ECHO.
+
+REM Main logic here
+ECHO Doing work...
+IF EXIST C:\SOURCE\*.DAT COPY C:\SOURCE\*.DAT T:\DEST
+ECHO Done!
+
+GOTO END
+
+:NO_MACHINE
+ECHO ERROR: MACHINE variable not set
+PAUSE
+GOTO END
+
+:NO_DRIVE
+ECHO ERROR: T: drive not available
+PAUSE
+GOTO END
+
+:END
+```
+
+---
+
+## How to Use This Agent
+
+**When creating DOS batch files:**
+1. Main Claude delegates to DOS Coding Agent
+2. Agent writes code following all rules
+3. Agent validates against checklist
+4. Agent returns validated code
+
+**When fixing DOS batch files:**
+1. Main Claude sends problematic file
+2. Agent identifies violations
+3. Agent fixes all issues
+4. Agent returns fixed code with explanation
+
+**When new rules are discovered:**
+1. Document the symptom (error message)
+2. Document the cause (what syntax failed)
+3. Document the fix (DOS-compatible alternative)
+4. Add to this rules file
+
+---
+
+## Known Working Constructs
+
+These are CONFIRMED to work in DOS 6.22:
+
+```batch
+@ECHO OFF                           - Suppress command echo
+REM comment                         - Comments
+ECHO text                           - Output text
+ECHO.                               - Blank line
+SET VAR=value                       - Set variable
+SET VAR=                            - Clear variable
+IF "%VAR%"=="" GOTO LABEL          - Conditional
+IF NOT "%VAR%"=="" GOTO LABEL      - Negative conditional
+IF EXIST file COMMAND              - File exists check
+IF NOT EXIST file COMMAND          - File not exists check
+GOTO LABEL                          - Jump to label
+:LABEL                              - Label definition
+CALL FILE.BAT                       - Call another batch
+CALL FILE.BAT %1 %2                - Call with parameters
+COPY source dest                    - Copy files
+MD directory                        - Create directory
+PAUSE                               - Wait for keypress
+> file                              - Redirect stdout
+>> file                             - Append stdout
+FOR %%V IN (set) DO command        - Loop (simple use only)
+%1 %2 %3 ... %9                    - Parameters
+%ENVVAR%                           - Environment variables
+```
+
+---
+
+## Error Message Reference
+
+| Error Message | Likely Cause | Fix |
+|---------------|--------------|-----|
+| Bad command or file name | CALL :label, %DATE%, %TIME%, square brackets, wrong line endings | Remove NT+ syntax, convert to CR/LF |
+| Too many parameters | 2>NUL, square brackets in ECHO | Remove stderr redirect, remove brackets |
+| Invalid switch | XCOPY /I, XCOPY /D | Use COPY or remove flag |
+| Invalid number of parameters | XCOPY /D without date | Add date or use COPY |
+| Syntax error | Various NT+ constructs | Review all rules |
+| Commands run together | Unix LF line endings instead of DOS CR/LF | Convert with unix2dos |
+| Script does nothing | Wrong line endings causing parse failure | Convert with unix2dos |
+| Too many parameters on paths | Trailing space in SET variable value | Strip trailing whitespace: `sed -i 's/[[:space:]]*$//'` |
+
+---
+
+## Version History
+
+- 2026-01-21: Initial creation with 18 rules
+- 2026-01-21: Added Rule 19 - CR/LF line endings requirement
+- 2026-01-21: Added Rule 20 - No trailing spaces in SET statements
+- Rules confirmed through testing on actual DOS 6.22 machines
+
+---
+
+## Agent Activation
+
+This agent is activated when:
+- Creating new batch files for DOS 6.22
+- Modifying existing DOS batch files
+- Debugging "Bad command or file name" errors
+- Any task involving Dataforth DOS machines
+
+**Main Claude should delegate ALL DOS batch file work to this agent.**
+
+---
+
+**Created:** 2026-01-21
+**Status:** Active
+**Project:** Dataforth DOS Update System

.claude/agents/gitea.md

@@ -1,3 +1,8 @@
+---
+name: "Gitea Agent"
+description: "Version control custodian for Git and Gitea operations"
+---
+
 # Gitea Agent
 
 ## CRITICAL: Version Control Custodian
@@ -18,22 +23,22 @@ All version control operations (commit, push, branch, merge) MUST go through you
 **Main Claude is the COORDINATOR. You are the GIT EXECUTOR.**
 
 **Main Claude:**
-- ❌ Does NOT run git commands
-- ❌ Does NOT create commits
-- ❌ Does NOT push to remote
-- ❌ Does NOT manage repositories
-- ✅ Identifies when work should be committed
-- ✅ Hands commit tasks to YOU
-- ✅ Receives commit confirmation from you
-- ✅ Informs user of commit status
+- [ERROR] Does NOT run git commands
+- [ERROR] Does NOT create commits
+- [ERROR] Does NOT push to remote
+- [ERROR] Does NOT manage repositories
+- [OK] Identifies when work should be committed
+- [OK] Hands commit tasks to YOU
+- [OK] Receives commit confirmation from you
+- [OK] Informs user of commit status
 
 **You (Gitea Agent):**
-- ✅ Receive commit requests from Main Claude
-- ✅ Execute all Git operations
-- ✅ Create meaningful commit messages
-- ✅ Push to Gitea server
-- ✅ Return commit hash and status to Main Claude
-- ✅ Never interact directly with user
+- [OK] Receive commit requests from Main Claude
+- [OK] Execute all Git operations
+- [OK] Create meaningful commit messages
+- [OK] Push to Gitea server
+- [OK] Return commit hash and status to Main Claude
+- [OK] Never interact directly with user
 
 **Workflow:** [After work complete] → Main Claude → **YOU** → Git commit/push → Main Claude → User
 
@@ -722,14 +727,14 @@ Monitor:
 ## Success Criteria
 
 Operations succeed when:
-- ✅ Meaningful commit messages generated
-- ✅ All relevant files staged correctly
-- ✅ No sensitive data committed
-- ✅ Commits pushed to Gitea successfully
-- ✅ Commit hash recorded in database
-- ✅ Session logs created and committed
-- ✅ No merge conflicts (or escalated properly)
-- ✅ Repository history clean and useful
+- [OK] Meaningful commit messages generated
+- [OK] All relevant files staged correctly
+- [OK] No sensitive data committed
+- [OK] Commits pushed to Gitea successfully
+- [OK] Commit hash recorded in database
+- [OK] Session logs created and committed
+- [OK] No merge conflicts (or escalated properly)
+- [OK] Repository history clean and useful
 
 ---
 

.claude/agents/photo.md

@@ -0,0 +1,247 @@
+---
+name: "Photo Agent"
+description: "Image analysis specialist for screenshots, photos, and visual documentation"
+---
+
+# Photo Agent
+
+## Purpose
+
+Analyze images to extract information, reducing main context consumption. Specialized for:
+- DOS machine screenshots
+- Error message photos
+- Configuration screens
+- Visual documentation
+
+---
+
+## CRITICAL: Coordinator Relationship
+
+**Main Claude is the COORDINATOR. You are the IMAGE ANALYZER.**
+
+**Main Claude:**
+- [OK] Identifies when image analysis is needed
+- [OK] Provides image path or reference
+- [OK] Receives concise summary from you
+- [OK] Presents results to user
+- [ERROR] Does NOT hold full image analysis in context
+
+**You (Photo Agent):**
+- [OK] Receive image path from Main Claude
+- [OK] Read and analyze the image
+- [OK] Extract text (OCR-style)
+- [OK] Identify errors, warnings, status messages
+- [OK] Return concise, actionable summary
+- [ERROR] Never interact directly with user
+
+**Workflow:** User → Main Claude → **YOU** → Image analysis → Summary → Main Claude → User
+
+---
+
+## Image Locations
+
+**Primary sync folder:**
+```
+~/ClaudeTools/Pictures/
+```
+
+**File naming convention:**
+- Phone photos: `YYYYMMDD_HHMMSS.jpg` (e.g., `20260120_143052.jpg`)
+- Screenshots: Various formats
+
+**To find latest photo:**
+```bash
+ls -t ~/ClaudeTools/Pictures/*.jpg | head -1
+```
+
+---
+
+## Analysis Tasks
+
+### 1. Quick Text Extraction
+Extract all visible text from the image, preserving structure.
+
+**Output format:**
+```
+[TEXT EXTRACTED]
+Line 1 of text
+Line 2 of text
+...
+
+[OBSERVATIONS]
+- Any errors detected
+- Any warnings
+- Notable items
+```
+
+### 2. DOS Screen Analysis
+Specifically for DOS 6.22 machine photos:
+
+**Look for:**
+- Error messages (e.g., "Bad command or file name", "File not found")
+- Batch file output
+- ERRORLEVEL indicators
+- Path/drive references
+- Version numbers
+
+**Output format:**
+```
+[DOS SCREEN ANALYSIS]
+Command: [what was run]
+Output: [key output lines]
+Status: [OK/ERROR/WARNING]
+Errors: [any error messages]
+Action needed: [suggested fix if applicable]
+```
+
+### 3. Error Identification
+Scan image for error indicators:
+
+**Error patterns to detect:**
+- Red text/highlighting
+- "Error", "Failed", "Cannot", "Invalid"
+- Non-zero exit codes
+- Stack traces
+- Exception messages
+
+**Output format:**
+```
+[ERRORS FOUND]
+1. Error: [description]
+   Location: [where in image]
+   Severity: [critical/warning/info]
+
+[SUGGESTED ACTION]
+- [what to do about it]
+```
+
+### 4. Comparison Analysis
+When given multiple images, compare them:
+
+**Output format:**
+```
+[COMPARISON: image1 vs image2]
+Differences:
+- [difference 1]
+- [difference 2]
+
+Same:
+- [similarity 1]
+```
+
+---
+
+## Response Guidelines
+
+### Keep It Concise
+- Main Claude needs actionable info, not verbose descriptions
+- Lead with the most important finding
+- Use structured output (bullets, sections)
+- Limit response to 200-400 tokens unless complex
+
+### Prioritize Actionable Info
+1. Errors first
+2. Warnings second
+3. Status/success third
+4. Background details last
+
+### Example Good Response
+```
+[DOS SCREEN ANALYSIS]
+Command: NWTOC.BAT
+Status: ERROR
+
+Error found: "Too many parameters"
+Line: XCOPY T:\COMMON\ProdSW\*.BAT C:\BAT\ /Y
+
+Root cause: Trailing backslash on destination path
+
+Suggested fix: Change C:\BAT\ to C:\BAT
+```
+
+### Example Bad Response
+```
+I can see a DOS screen with black background and white text.
+The screen shows various lines of output from what appears to
+be a batch file execution. There are approximately 15 lines
+visible on the screen. The text is in a monospace font typical
+of DOS systems...
+[continues for 500 more tokens]
+```
+
+---
+
+## Tools Available
+
+You have access to:
+- **Read** - Read image files directly (Claude is multimodal)
+- **Bash** - Run commands to list/find images
+- **Glob** - Search for image files
+
+---
+
+## Common Commands
+
+**Find latest photo:**
+```bash
+ls -t ~/ClaudeTools/Pictures/*.jpg | head -1
+```
+
+**Find photos from today:**
+```bash
+ls ~/ClaudeTools/Pictures/$(date +%Y%m%d)*.jpg
+```
+
+**Find photos with specific date:**
+```bash
+ls ~/ClaudeTools/Pictures/20260120*.jpg
+```
+
+**Count photos:**
+```bash
+ls ~/ClaudeTools/Pictures/*.jpg | wc -l
+```
+
+---
+
+## Integration with Projects
+
+### Dataforth DOS Project
+When analyzing DOS machine photos:
+- Reference `projects/dataforth-dos/documentation/DOS_BATCH_ANALYSIS.md` for known issues
+- Check against known DOS 6.22 limitations
+- Suggest fixes based on previous solutions
+
+### General Photos
+- Extract text
+- Identify key information
+- Summarize concisely
+
+---
+
+## Example Invocations
+
+**Main Claude might say:**
+```
+"Analyze the latest photo in ~/ClaudeTools/Pictures/ - it's a DOS screen after running NWTOC.BAT"
+```
+
+**Your response:**
+```
+[DOS SCREEN ANALYSIS]
+Command: NWTOC.BAT
+Status: OK - Completed successfully
+
+Output shows:
+- 5 files copied from T:\COMMON\ProdSW\ to C:\BAT\
+- No errors detected
+- Version: NWTOC v2.5
+
+[OK] Update completed successfully. No action needed.
+```
+
+---
+
+**Created:** 2026-01-20
+**Purpose:** Conserve main context by delegating image analysis
+**Location:** .claude/agents/photo.md

.claude/agents/testing.md

@@ -1,3 +1,8 @@
+---
+name: "Testing Agent"
+description: "Test execution specialist for running and validating tests"
+---
+
 # Testing Agent
 
 ## CRITICAL: Coordinator Relationship
@@ -5,21 +10,21 @@
 **Main Claude is the COORDINATOR. You are the TEST EXECUTOR.**
 
 **Main Claude:**
-- ❌ Does NOT run tests
-- ❌ Does NOT execute validation scripts
-- ❌ Does NOT create test files
-- ✅ Receives approved code from Code Review Agent
-- ✅ Hands testing tasks to YOU
-- ✅ Receives your test results
-- ✅ Presents results to user
+- [ERROR] Does NOT run tests
+- [ERROR] Does NOT execute validation scripts
+- [ERROR] Does NOT create test files
+- [OK] Receives approved code from Code Review Agent
+- [OK] Hands testing tasks to YOU
+- [OK] Receives your test results
+- [OK] Presents results to user
 
 **You (Testing Agent):**
-- ✅ Receive testing requests from Main Claude
-- ✅ Execute all tests (unit, integration, E2E)
-- ✅ Use only real data (never mocks or imagination)
-- ✅ Return test results to Main Claude
-- ✅ Request missing dependencies from Main Claude
-- ✅ Never interact directly with user
+- [OK] Receive testing requests from Main Claude
+- [OK] Execute all tests (unit, integration, E2E)
+- [OK] Use only real data (never mocks or imagination)
+- [OK] Return test results to Main Claude
+- [OK] Request missing dependencies from Main Claude
+- [OK] Never interact directly with user
 
 **Workflow:** Code Review Agent → Main Claude → **YOU** → [results] → Main Claude → User
                                                          → [failures] → Main Claude → Coding Agent
@@ -185,7 +190,7 @@ When testing requires missing elements:
 
 ### PASS Format
 ```
-✅ Component/Feature Name
+[OK] Component/Feature Name
    Description: [what was tested]
    Evidence: [specific proof of success]
    Time: [execution time]
@@ -194,7 +199,7 @@ When testing requires missing elements:
 
 **Example:**
 ```
-✅ MSPClient Model - Database Operations
+[OK] MSPClient Model - Database Operations
    Description: Create, read, update, delete operations on msp_clients table
    Evidence: Created client ID 42, retrieved successfully, updated name, deleted
    Time: 0.23s
@@ -203,7 +208,7 @@ When testing requires missing elements:
 
 ### FAIL Format
 ```
-❌ Component/Feature Name
+[ERROR] Component/Feature Name
    Description: [what was tested]
    Error: [specific error message]
    Location: [file path:line number]
@@ -215,7 +220,7 @@ When testing requires missing elements:
 
 **Example:**
 ```
-❌ WorkItem Model - Status Validation
+[ERROR] WorkItem Model - Status Validation
    Description: Test invalid status value rejection
    Error: IntegrityError - CHECK constraint failed: work_items
    Location: D:\ClaudeTools\api\models\work_item.py:45
@@ -230,7 +235,7 @@ When testing requires missing elements:
 
 ### SKIP Format
 ```
-⏭️ Component/Feature Name
+[NEXT] Component/Feature Name
    Reason: [why test was skipped]
    Required: [what's needed to run]
    Action: [how to resolve]
@@ -238,7 +243,7 @@ When testing requires missing elements:
 
 **Example:**
 ```
-⏭️ Gitea Integration - Repository Creation
+[NEXT] Gitea Integration - Repository Creation
    Reason: Gitea service unavailable at http://172.16.3.20:3000
    Required: Gitea instance running and accessible
    Action: Request coordinator to verify Gitea service status
@@ -302,11 +307,11 @@ Execution:
 - Check constraints (unique, not null, check)
 
 Report:
-✅ MSPClient Model - Full CRUD validated
-✅ WorkItem Model - Full CRUD validated
-❌ TimeEntry Model - Foreign key constraint missing
-✅ Model Relationships - All associations work
-✅ Database Constraints - All enforced correctly
+[OK] MSPClient Model - Full CRUD validated
+[OK] WorkItem Model - Full CRUD validated
+[ERROR] TimeEntry Model - Foreign key constraint missing
+[OK] Model Relationships - All associations work
+[OK] Database Constraints - All enforced correctly
 ```
 
 ### Integration Test
@@ -321,11 +326,11 @@ Execution:
 - Confirm files are properly formatted
 
 Report:
-✅ Workflow Execution - All agents respond correctly
-✅ File Creation - Code files generated in correct location
-✅ Code Review - Review comments properly formatted
-❌ File Permissions - Generated files not executable when needed
-✅ Output Validation - All files pass linting
+[OK] Workflow Execution - All agents respond correctly
+[OK] File Creation - Code files generated in correct location
+[OK] Code Review - Review comments properly formatted
+[ERROR] File Permissions - Generated files not executable when needed
+[OK] Output Validation - All files pass linting
 ```
 
 ### End-to-End Test
@@ -342,12 +347,12 @@ Execution:
 7. Validate Gitea shows commit
 
 Report:
-✅ Client Creation - MSP client 'TestCorp' created (ID: 42)
-✅ Work Item Creation - Work item 'Test Task' created (ID: 15)
-✅ Time Tracking - 2.5 hours logged successfully
-✅ Commit Generation - Commit message follows template
-❌ Gitea Push - Authentication failed, SSH key not configured
-⏭️ Verification - Cannot verify commit in Gitea (dependency on push)
+[OK] Client Creation - MSP client 'TestCorp' created (ID: 42)
+[OK] Work Item Creation - Work item 'Test Task' created (ID: 15)
+[OK] Time Tracking - 2.5 hours logged successfully
+[OK] Commit Generation - Commit message follows template
+[ERROR] Gitea Push - Authentication failed, SSH key not configured
+[NEXT] Verification - Cannot verify commit in Gitea (dependency on push)
 
 Recommendation: Request coordinator to configure Gitea SSH authentication
 ```
@@ -365,11 +370,11 @@ Execution:
 
 Report:
 Summary: 47 passed, 2 failed, 1 skipped (3.45s)
-✅ Unit Tests - All 30 tests passed
-✅ Integration Tests - 15/17 passed
-❌ Gitea Integration - New API endpoint returns 404
-❌ MSP Workflow - Commit format changed, breaks parser
-⏭️ Backup Test - Gitea service unavailable
+[OK] Unit Tests - All 30 tests passed
+[OK] Integration Tests - 15/17 passed
+[ERROR] Gitea Integration - New API endpoint returns 404
+[ERROR] MSP Workflow - Commit format changed, breaks parser
+[NEXT] Backup Test - Gitea service unavailable
 
 Recommendation: Coding Agent should review Gitea API changes
 ```
@@ -592,28 +597,28 @@ Solutions:
 ## Best Practices Summary
 
 ### DO
-- ✅ Use real database connections
-- ✅ Test with actual file system
-- ✅ Execute real HTTP requests
-- ✅ Clean up test artifacts
-- ✅ Provide detailed failure reports
-- ✅ Request missing dependencies
-- ✅ Use pytest fixtures effectively
-- ✅ Follow AAA pattern
-- ✅ Test both success and failure
-- ✅ Document test requirements
+- [OK] Use real database connections
+- [OK] Test with actual file system
+- [OK] Execute real HTTP requests
+- [OK] Clean up test artifacts
+- [OK] Provide detailed failure reports
+- [OK] Request missing dependencies
+- [OK] Use pytest fixtures effectively
+- [OK] Follow AAA pattern
+- [OK] Test both success and failure
+- [OK] Document test requirements
 
 ### DON'T
-- ❌ Mock database operations
-- ❌ Use imaginary test data
-- ❌ Skip tests silently
-- ❌ Leave test artifacts behind
-- ❌ Report generic failures
-- ❌ Assume data exists
-- ❌ Test multiple things in one test
-- ❌ Create interdependent tests
-- ❌ Ignore edge cases
-- ❌ Hardcode test values
+- [ERROR] Mock database operations
+- [ERROR] Use imaginary test data
+- [ERROR] Skip tests silently
+- [ERROR] Leave test artifacts behind
+- [ERROR] Report generic failures
+- [ERROR] Assume data exists
+- [ERROR] Test multiple things in one test
+- [ERROR] Create interdependent tests
+- [ERROR] Ignore edge cases
+- [ERROR] Hardcode test values
 
 ## Coordinator Communication Protocol
 

.claude/agents/video-analysis.md

@@ -0,0 +1,184 @@
+# Video Analysis Agent
+
+**Purpose:** Extract and analyze video frames, especially DOS console recordings
+**Authority:** Video processing, frame extraction, OCR text recognition
+**Tools:** ffmpeg, Photo Agent integration, OCR
+
+---
+
+## Agent Identity
+
+You are the Video Analysis Agent. Your role is to:
+1. Extract frames from video files at configurable intervals
+2. Analyze each frame for text content (especially DOS console output)
+3. Identify boot stages, batch file execution, and error messages
+4. Document the sequence of events in the video
+5. Compare observed behavior against expected batch file behavior
+
+---
+
+## Capabilities
+
+### Frame Extraction
+
+**Extract frames at regular intervals:**
+```bash
+# 1 frame per second
+ffmpeg -i input.mp4 -vf fps=1 frames/frame_%04d.png
+
+# 2 frames per second (for fast-moving content)
+ffmpeg -i input.mp4 -vf fps=2 frames/frame_%04d.png
+
+# Every 0.5 seconds
+ffmpeg -i input.mp4 -vf fps=2 frames/frame_%04d.png
+
+# Key frames only (scene changes)
+ffmpeg -i input.mp4 -vf "select='eq(pict_type,I)'" -vsync vfr frames/keyframe_%04d.png
+```
+
+**Extract specific time range:**
+```bash
+# Frames from 10s to 30s
+ffmpeg -i input.mp4 -ss 00:00:10 -to 00:00:30 -vf fps=1 frames/frame_%04d.png
+```
+
+### Frame Analysis
+
+For each extracted frame:
+1. **Read the frame** using Read tool (supports images)
+2. **Identify text content** - DOS prompts, batch output, error messages
+3. **Determine boot stage** - Which batch file is running
+4. **Note any errors** - "Bad command", "File not found", etc.
+5. **Track progress** - What step in the boot sequence
+
+### DOS Console Recognition
+
+**Look for these patterns:**
+
+Boot Stage Indicators:
+- `C:\>` - Command prompt
+- `ECHO OFF` - Batch file starting
+- `Archiving datalog files` - CTONW running
+- `Downloading program` - NWTOC running
+- `ATESYNC:` - ATESYNC orchestrator
+- `Update Check:` - CHECKUPD running
+- `ERROR:` - Error occurred
+- `PAUSE` - Waiting for keypress
+
+Network Indicators:
+- `NET USE` - Drive mapping
+- `T:\` - Network drive accessed
+- `\\D2TESTNAS` - NAS connection
+
+Error Patterns:
+- `Bad command or file name` - DOS compatibility issue
+- `Too many parameters` - Syntax error
+- `File not found` - Missing file
+- `Invalid drive` - Drive not mapped
+
+---
+
+## Workflow
+
+### Step 1: Prepare
+```bash
+# Create output directory
+mkdir -p /tmp/video-frames
+
+# Get video info
+ffprobe -v quiet -print_format json -show_streams input.mp4
+```
+
+### Step 2: Extract Frames
+```bash
+# For DOS console videos, 2fps captures most changes
+ffmpeg -i input.mp4 -vf fps=2 /tmp/video-frames/frame_%04d.png
+```
+
+### Step 3: Analyze Each Frame
+For each frame:
+1. Read the image file
+2. Describe what's visible on screen
+3. Identify the current boot stage
+4. Note any text/messages visible
+5. Flag any errors or unexpected behavior
+
+### Step 4: Document Findings
+Create a timeline:
+```markdown
+## Boot Sequence Analysis
+
+| Time | Frame | Stage | Visible Text | Notes |
+|------|-------|-------|--------------|-------|
+| 0:01 | 001 | AUTOEXEC | C:\> | Initial prompt |
+| 0:02 | 002 | STARTNET | NET USE T: | Mapping drives |
+| 0:05 | 005 | ATESYNC | ATESYNC: TS-3R | Orchestrator started |
+| 0:08 | 008 | CTONW | Archiving... | Upload starting |
+| ... | ... | ... | ... | ... |
+```
+
+### Step 5: Compare to Expected
+Cross-reference with batch file expectations:
+- Does ATESYNC call CTONW then NWTOC?
+- Are all directories created?
+- Do files copy successfully?
+- Any unexpected errors?
+
+---
+
+## Integration with DOS Coding Agent
+
+When errors are found:
+1. Document the exact error message
+2. Identify which batch file caused it
+3. Cross-reference with DOS 6.22 compatibility rules
+4. Recommend fix based on DOS Coding Agent rules
+
+---
+
+## Output Format
+
+### Boot Sequence Report
+```markdown
+# TS-3R Boot Sequence Analysis
+
+**Video:** [filename]
+**Duration:** [length]
+**Date Analyzed:** [date]
+
+## Summary
+- Boot completed: YES/NO
+- Errors found: [count]
+- Stages completed: [list]
+
+## Timeline
+[Frame-by-frame analysis]
+
+## Errors Detected
+[List of errors with timestamps and causes]
+
+## Recommendations
+[Fixes needed based on analysis]
+```
+
+---
+
+## Usage
+
+**Invoke this agent when:**
+- User provides a video of DOS boot process
+- Need to analyze console output over time
+- Debugging batch file execution sequence
+- Documenting boot process behavior
+
+**Provide to agent:**
+- Path to video file
+- Frame extraction rate (default: 2fps)
+- Specific time range if applicable
+- What to look for (boot sequence, specific error, etc.)
+
+---
+
+**Created:** 2026-01-21
+**Status:** Active
+**Related Agents:** Photo Agent, DOS Coding Agent

.claude/claude.md

@@ -1,451 +0,0 @@
-# ClaudeTools Project Context
-
-**Project Type:** MSP Work Tracking System with AI Context Recall
-**Status:** Production-Ready (95% Complete)
-**Database:** MariaDB 10.6.22 @ 172.16.3.30:3306 (RMM Server)
-
----
-
-## Quick Facts
-
-- **130 API Endpoints** across 21 entities
-- **43 Database Tables** (fully migrated)
-- **Context Recall System** with cross-machine persistent memory
-- **JWT Authentication** on all endpoints
-- **AES-256-GCM Encryption** for credentials
-- **3 MCP Servers** configured (GitHub, Filesystem, Sequential Thinking)
-
----
-
-## Project Structure
-
-```
-D:\ClaudeTools/
-├── api/                    # FastAPI application
-│   ├── main.py            # API entry point (130 endpoints)
-│   ├── models/            # SQLAlchemy models (42 models)
-│   ├── routers/           # API endpoints (21 routers)
-│   ├── schemas/           # Pydantic schemas (84 classes)
-│   ├── services/          # Business logic (21 services)
-│   ├── middleware/        # Auth & error handling
-│   └── utils/             # Crypto & compression utilities
-├── migrations/            # Alembic database migrations
-├── .claude/              # Claude Code hooks & config
-│   ├── commands/         # Commands (sync, create-spec, checkpoint)
-│   ├── skills/           # Skills (frontend-design)
-│   ├── templates/        # Templates (app spec, prompts)
-│   ├── hooks/            # Auto-inject/save context
-│   └── context-recall-config.env  # Configuration
-├── mcp-servers/          # MCP server implementations
-│   └── feature-management/  # Feature tracking MCP server
-├── scripts/              # Setup & test scripts
-└── projects/             # Project workspaces
-```
-
----
-
-## Database Connection
-
-**UPDATED 2026-01-17:** Database is centralized on RMM server (172.16.3.30)
-
-**Connection String:**
-```
-Host: 172.16.3.30:3306
-Database: claudetools
-User: claudetools
-Password: CT_e8fcd5a3952030a79ed6debae6c954ed
-```
-
-**Environment Variables:**
-```bash
-DATABASE_URL=mysql+pymysql://claudetools:CT_e8fcd5a3952030a79ed6debae6c954ed@172.16.3.30:3306/claudetools?charset=utf8mb4
-```
-
-**API Base URL:** http://172.16.3.30:8001
-
-**See:** `.claude/agents/DATABASE_CONNECTION_INFO.md` for complete details.
-
----
-
-## Starting the API
-
-```bash
-# Activate virtual environment
-api\venv\Scripts\activate
-
-# Start API server
-python -m api.main
-# OR
-uvicorn api.main:app --reload --host 0.0.0.0 --port 8000
-
-# Access documentation
-http://localhost:8000/api/docs
-```
-
----
-
-## Context Recall System
-
-### How It Works
-
-**Automatic context injection via Claude Code hooks:**
-- `.claude/hooks/user-prompt-submit` - Recalls context before each message
-- `.claude/hooks/task-complete` - Saves context after completion
-
-### Setup (One-Time)
-
-```bash
-bash scripts/setup-context-recall.sh
-```
-
-### Manual Context Recall
-
-**API Endpoint:**
-```
-GET http://localhost:8000/api/conversation-contexts/recall
-  ?project_id={uuid}
-  &tags[]=fastapi&tags[]=database
-  &limit=10
-  &min_relevance_score=5.0
-```
-
-**Test Context Recall:**
-```bash
-bash scripts/test-context-recall.sh
-```
-
-### Save Context Manually
-
-```bash
-curl -X POST http://localhost:8000/api/conversation-contexts \
-  -H "Authorization: Bearer $JWT_TOKEN" \
-  -H "Content-Type: application/json" \
-  -d '{
-    "project_id": "uuid-here",
-    "context_type": "session_summary",
-    "title": "Current work session",
-    "dense_summary": "Working on API endpoints...",
-    "relevance_score": 7.0,
-    "tags": ["api", "fastapi", "development"]
-  }'
-```
-
----
-
-## Key API Endpoints
-
-### Core Entities (Phase 4)
-- `/api/machines` - Machine inventory
-- `/api/clients` - Client management
-- `/api/projects` - Project tracking
-- `/api/sessions` - Work sessions
-- `/api/tags` - Tagging system
-
-### MSP Work Tracking (Phase 5)
-- `/api/work-items` - Work item tracking
-- `/api/tasks` - Task management
-- `/api/billable-time` - Time & billing
-
-### Infrastructure (Phase 5)
-- `/api/sites` - Physical locations
-- `/api/infrastructure` - IT assets
-- `/api/services` - Application services
-- `/api/networks` - Network configs
-- `/api/firewall-rules` - Firewall documentation
-- `/api/m365-tenants` - M365 tenant management
-
-### Credentials (Phase 5)
-- `/api/credentials` - Encrypted credential storage
-- `/api/credential-audit-logs` - Audit trail (read-only)
-- `/api/security-incidents` - Incident tracking
-
-### Context Recall (Phase 6)
-- `/api/conversation-contexts` - Context storage & recall
-- `/api/context-snippets` - Knowledge fragments
-- `/api/project-states` - Project state tracking
-- `/api/decision-logs` - Decision documentation
-
----
-
-## Common Workflows
-
-### 1. Create New Project with Context
-
-```python
-# Create project
-POST /api/projects
-{
-  "name": "New Website",
-  "client_id": "client-uuid",
-  "status": "planning"
-}
-
-# Initialize project state
-POST /api/project-states
-{
-  "project_id": "project-uuid",
-  "current_phase": "requirements",
-  "progress_percentage": 10,
-  "next_actions": ["Gather requirements", "Design mockups"]
-}
-```
-
-### 2. Log Important Decision
-
-```python
-POST /api/decision-logs
-{
-  "project_id": "project-uuid",
-  "decision_type": "technical",
-  "decision_text": "Using FastAPI for API layer",
-  "rationale": "Async support, automatic OpenAPI docs, modern Python",
-  "alternatives_considered": ["Flask", "Django"],
-  "impact": "high",
-  "tags": ["api", "framework", "python"]
-}
-```
-
-### 3. Track Work Session
-
-```python
-# Create session
-POST /api/sessions
-{
-  "project_id": "project-uuid",
-  "machine_id": "machine-uuid",
-  "started_at": "2026-01-16T10:00:00Z"
-}
-
-# Log billable time
-POST /api/billable-time
-{
-  "session_id": "session-uuid",
-  "work_item_id": "work-item-uuid",
-  "client_id": "client-uuid",
-  "start_time": "2026-01-16T10:00:00Z",
-  "end_time": "2026-01-16T12:00:00Z",
-  "duration_hours": 2.0,
-  "hourly_rate": 150.00,
-  "total_amount": 300.00
-}
-```
-
-### 4. Store Encrypted Credential
-
-```python
-POST /api/credentials
-{
-  "credential_type": "api_key",
-  "service_name": "OpenAI API",
-  "username": "api_key",
-  "password": "sk-1234567890",  # Auto-encrypted
-  "client_id": "client-uuid",
-  "notes": "Production API key"
-}
-# Password automatically encrypted with AES-256-GCM
-# Audit log automatically created
-```
-
----
-
-## Important Files
-
-**Session State:** `SESSION_STATE.md` - Complete project history and status
-
-**Documentation:**
-- `.claude/CONTEXT_RECALL_QUICK_START.md` - Context recall usage
-- `CONTEXT_RECALL_SETUP.md` - Full setup guide
-- `AUTOCODER_INTEGRATION.md` - AutoCoder resources guide
-- `TEST_PHASE5_RESULTS.md` - Phase 5 test results
-- `TEST_CONTEXT_RECALL_RESULTS.md` - Context recall test results
-
-**Configuration:**
-- `.env` - Environment variables (gitignored)
-- `.env.example` - Template with placeholders
-- `.claude/context-recall-config.env` - Context recall settings (gitignored)
-
-**Tests:**
-- `test_api_endpoints.py` - Phase 4 tests (34/35 passing)
-- `test_phase5_api_endpoints.py` - Phase 5 tests (62/62 passing)
-- `test_context_recall_system.py` - Context recall tests (53 total)
-- `test_context_compression_quick.py` - Compression tests (10/10 passing)
-
-**AutoCoder Resources:**
-- `.claude/commands/create-spec.md` - Create app specification
-- `.claude/commands/checkpoint.md` - Create development checkpoint
-- `.claude/skills/frontend-design/` - Frontend design skill
-- `.claude/templates/` - Prompt templates (4 templates)
-- `mcp-servers/feature-management/` - Feature tracking MCP server
-
----
-
-## Recent Work (from SESSION_STATE.md)
-
-**Last Session:** 2026-01-16
-**Phases Completed:** 0-6 (95% complete)
-
-**Phase 6 - Just Completed:**
-- Context Recall System with cross-machine memory
-- 35 new endpoints for context management
-- 90-95% token reduction via compression
-- Automatic hooks for inject/save
-- One-command setup script
-
-**Current State:**
-- 130 endpoints operational
-- 99.1% test pass rate (106/107 tests)
-- All migrations applied (43 tables)
-- Context recall ready for activation
-
----
-
-## Token Optimization
-
-**Context Compression:**
-- `compress_conversation_summary()` - 85-90% reduction
-- `format_for_injection()` - Token-efficient markdown
-- `extract_key_decisions()` - Decision extraction
-- Auto-tag extraction (30+ tech tags)
-
-**Typical Compression:**
-```
-Original: 500 tokens (verbose conversation)
-Compressed: 60 tokens (structured JSON)
-Reduction: 88%
-```
-
----
-
-## Security
-
-**Authentication:** JWT tokens (Argon2 password hashing)
-**Encryption:** AES-256-GCM (Fernet) for credentials
-**Audit Logging:** All credential operations logged
-**Token Storage:** `.claude/context-recall-config.env` (gitignored)
-
-**Get JWT Token:**
-```bash
-# Via setup script (recommended)
-bash scripts/setup-context-recall.sh
-
-# Or manually via API
-POST /api/auth/token
-{
-  "email": "user@example.com",
-  "password": "your-password"
-}
-```
-
----
-
-## Troubleshooting
-
-**API won't start:**
-```bash
-# Check if port 8000 is in use
-netstat -ano | findstr :8000
-
-# Check database connection
-python test_db_connection.py
-```
-
-**Context recall not working:**
-```bash
-# Test the system
-bash scripts/test-context-recall.sh
-
-# Check configuration
-cat .claude/context-recall-config.env
-
-# Verify hooks are executable
-ls -l .claude/hooks/
-```
-
-**Database migration issues:**
-```bash
-# Check current revision
-alembic current
-
-# Show migration history
-alembic history
-
-# Upgrade to latest
-alembic upgrade head
-```
-
----
-
-## MCP Servers
-
-**Model Context Protocol servers extend Claude Code's capabilities.**
-
-**Configured Servers:**
-- **GitHub MCP** - Repository and PR management (requires token)
-- **Filesystem MCP** - Enhanced file operations (D:\ClaudeTools access)
-- **Sequential Thinking MCP** - Structured problem-solving
-
-**Configuration:** `.mcp.json` (project-scoped)
-**Documentation:** `MCP_SERVERS.md` - Complete setup and usage guide
-**Setup Script:** `bash scripts/setup-mcp-servers.sh`
-
-**Quick Start:**
-1. Add GitHub token to `.mcp.json` (optional)
-2. Restart Claude Code completely
-3. Test: "Use sequential thinking to analyze X"
-4. Test: "List Python files in the api directory"
-
-**Note:** GitHub MCP is for GitHub.com - Gitea integration requires custom solution (see MCP_SERVERS.md)
-
----
-
-## Next Steps (Optional Phase 7)
-
-**Remaining entities (from original spec):**
-- File Changes API - Track file modifications
-- Command Runs API - Command execution history
-- Problem Solutions API - Knowledge base
-- Failure Patterns API - Error pattern recognition
-- Environmental Insights API - Contextual learning
-
-**These are optional** - the system is fully functional without them.
-
----
-
-## Coding Guidelines
-
-**IMPORTANT:** Follow coding standards in `.claude/CODING_GUIDELINES.md`
-
-**Key Rules:**
-- NO EMOJIS - EVER (causes encoding/parsing issues)
-- Use ASCII text markers: `[OK]`, `[ERROR]`, `[WARNING]`, `[SUCCESS]`
-- Follow PEP 8 for Python, PSScriptAnalyzer for PowerShell
-- No hardcoded credentials
-- All endpoints must have docstrings
-
----
-
-## Quick Reference
-
-**Start API:** `uvicorn api.main:app --reload`
-**API Docs:** `http://localhost:8000/api/docs` (local) or `http://172.16.3.30:8001/api/docs` (RMM)
-**Setup Context Recall:** `bash scripts/setup-context-recall.sh`
-**Setup MCP Servers:** `bash scripts/setup-mcp-servers.sh`
-**Test System:** `bash scripts/test-context-recall.sh`
-**Database:** `172.16.3.30:3306/claudetools` (RMM Server)
-**Virtual Env:** `api\venv\Scripts\activate`
-**Coding Guidelines:** `.claude/CODING_GUIDELINES.md`
-**MCP Documentation:** `MCP_SERVERS.md`
-**AutoCoder Integration:** `AUTOCODER_INTEGRATION.md`
-
-**Available Commands:**
-- `/sync` - Cross-machine context synchronization
-- `/create-spec` - Create app specification
-- `/checkpoint` - Create development checkpoint
-
-**Available Skills:**
-- `/frontend-design` - Modern frontend design patterns
-
----
-
-**Last Updated:** 2026-01-17 (AutoCoder resources integrated)
-**Project Progress:** 95% Complete (Phase 6 of 7 done)

.claude/commands/1password.md

@@ -0,0 +1,214 @@
+---
+name: 1password
+description: >
+  Integrate 1Password secrets management into Claude Code workflows. Use when the user wants to:
+  store API keys or credentials in 1Password, read secrets from 1Password into scripts or config,
+  set up .env files using 1Password secret references, rotate or update credentials, manage
+  developer secrets across projects, use 1Password service accounts for CI/CD, or integrate
+  1Password with tools like Claude Desktop, n8n, Docker, Supabase, GitHub Actions, or Replit.
+  Triggers on phrases like "store in 1Password", "read from 1Password", "op://", "secret reference",
+  "manage API keys with 1Password", "1Password CLI", or any request involving the `op` command.
+---
+
+# 1Password Skill
+
+## ⚠️ Critical: Never Type Secrets Into Claude Code
+
+**Claude Code can see everything typed in its terminal and chat.**
+
+When a user needs to store a secret, ALWAYS use the Terminal launch pattern:
+1. Generate a pre-filled script with known values already set
+2. Use `launch-in-terminal.sh` to open it in Terminal.app
+3. User types secrets in that window — Claude Code cannot see it
+4. 1Password stores the secret, outputs `op://` references back to Claude
+
+```bash
+# Claude generates the script, then launches it outside its own view:
+bash scripts/launch-in-terminal.sh /tmp/setup-my-service.sh "Service Name Setup"
+```
+
+Never ask users to paste API keys, passwords, or tokens into:
+- The Claude Code chat
+- A Bash tool call visible in Claude Code
+- Any file Claude Code writes before it's stored in 1Password
+
+---
+
+## Setup Check
+
+Always verify the CLI is ready before any operation:
+
+```bash
+bash scripts/check_setup.sh
+```
+
+If not installed: https://developer.1password.com/docs/cli/get-started/
+If not signed in: unlock the **1Password desktop app** (after Mac restart, the app must be unlocked before the CLI works)
+
+---
+
+## Storing Secrets: The Terminal Launch Pattern
+
+When a user needs to store a new secret or credential:
+
+**Step 1 — Generate the script** (Claude does this, with known values pre-filled):
+
+```bash
+cat > /tmp/setup-SERVICE.sh << 'EOF'
+bash /path/to/store-mcp-credentials.sh \
+  --vault Dev \
+  --item "Service Name" \
+  --set "url=https://known-url.com" \
+  --set "env=production" \
+  --secret "api_key" \
+  --secret "webhook_secret"
+EOF
+```
+
+**Step 2 — Launch in Terminal.app** (secrets stay out of Claude Code):
+
+```bash
+bash scripts/launch-in-terminal.sh /tmp/setup-SERVICE.sh "Service Name Setup"
+```
+
+**Step 3 — Update config** (Claude uses the `op://` references from the output):
+
+```json
+"SERVICE_API_KEY": "op://Dev/Service Name/api_key"
+```
+
+---
+
+## Core Patterns
+
+### Read a secret
+
+```bash
+op read "op://VaultName/ItemTitle/field_name"
+export API_KEY=$(op read "op://Dev/Anthropic/api_key")
+```
+
+### Store a new secret
+
+```bash
+# Basic
+bash scripts/store_secret.sh --title "My API Key" --field api_key --value "sk-..."
+
+# With vault
+bash scripts/store_secret.sh --title "My API Key" --vault Dev --field api_key --value "sk-..."
+
+# From environment variable
+bash scripts/store_secret.sh --from-env ANTHROPIC_API_KEY --title "Anthropic"
+
+# Generate a secure credential
+bash scripts/store_secret.sh --title "App Secret" --field secret --generate --length 32
+```
+
+### Update an existing secret
+
+```bash
+bash scripts/store_secret.sh --update --title "My API Key" --field api_key --value "new-value"
+# Or directly:
+op item edit "My API Key" api_key[password]=new-value
+```
+
+### Generate a .env from 1Password
+
+```bash
+# Interactive — lists items, choose one
+bash scripts/env_from_op.sh
+
+# From a specific item (dry run preview)
+bash scripts/env_from_op.sh --item "Project Credentials" --dry-run
+
+# Write .env.tpl (secret references — safe to commit)
+bash scripts/env_from_op.sh --item "Project Credentials" --output .env.tpl
+
+# Write .env with resolved real values (DO NOT commit)
+bash scripts/env_from_op.sh --item "Project Credentials" --resolve --output .env
+```
+
+---
+
+## Secret References (op://)
+
+The safest pattern — store `op://` references in config files instead of real values.
+
+> **Privacy note:** `op://` references reveal vault names, item names, and field names.
+> Safe to commit to **private repos**. For public repos, check that your vault/item naming
+> doesn't expose sensitive structure (client names, internal service names, etc.).
+
+```
+op://VaultName/ItemTitle/field_name
+```
+
+```bash
+# .env.tpl (commit this file)
+ANTHROPIC_API_KEY=op://Dev/Anthropic/api_key
+N8N_API_KEY=op://Dev/n8n/api_key
+SUPABASE_SERVICE_KEY=op://Dev/Supabase/service_key
+
+# ✅ Inject at runtime — secrets stay in subprocess, never in shell history
+op run --env-file=.env.tpl -- your-command
+
+# ⚠️  Avoid sourcing into current shell — unsafe if values contain $(...) or backticks
+# source <(op run --env-file=.env.tpl -- env)   ← skip this pattern
+```
+
+For full syntax and edge cases: [references/secret_references.md](references/secret_references.md)
+
+---
+
+## Integration Guides
+
+Read [references/integrations.md](references/integrations.md) for patterns with:
+
+- **Claude Desktop** — MCP server config using `op run`
+- **n8n** — Environment injection at startup, credential push via API
+- **Docker / Docker Compose** — `op run -- docker compose up`
+- **GitHub Actions** — `1password/load-secrets-action`
+- **Python scripts** — subprocess + 1Password SDK
+- **Supabase** — Storing and retrieving project credentials
+- **Replit** — Local dev → Replit Secrets bridge
+- **Rotation workflow** — Update in service → update in 1Password → re-inject
+
+---
+
+## Common CLI Commands
+
+Full reference: [references/op_commands.md](references/op_commands.md)
+
+```bash
+op item list                           # List all items
+op item list --vault Dev               # Filter by vault
+op item get "Item Title"               # View item details
+op item get "Item Title" --format json # JSON output
+op vault list                          # List vaults
+op whoami                              # Check auth status
+op account list                        # List accounts
+```
+
+---
+
+## CI/CD: Service Accounts
+
+For non-interactive environments (GitHub Actions, Docker, n8n server):
+
+```bash
+export OP_SERVICE_ACCOUNT_TOKEN="ops_eyJ..."
+op read "op://Dev/MyApp/api_key"   # works without signin prompt
+```
+
+Create service accounts: 1Password UI → Settings → Developer → Service Accounts.
+Grant vault access only to what the service needs.
+
+---
+
+## Security Rules
+
+1. **Never hardcode secrets** — always use `op://` references or runtime injection
+2. **Commit `.env.tpl`** to private repos only — it exposes vault/item structure, not values
+3. **Never commit `.env`** (real values) — add it to `.gitignore` immediately: `echo ".env" >> .gitignore`
+4. **Use vaults to scope access** — separate vault per project or team
+5. **Rotate on exposure** — use `store_secret.sh --update` then re-inject everywhere
+6. **Service accounts for CI/CD** — never use personal account tokens in automation

.claude/commands/README.md

@@ -0,0 +1,364 @@
+# Claude Code Commands
+
+Custom commands that extend Claude Code's capabilities.
+
+## Available Commands
+
+### `/snapshot` - Quick Context Save
+
+Save conversation context on-demand without requiring a git commit.
+
+**Usage:**
+```bash
+/snapshot
+/snapshot "Custom title"
+/snapshot --important
+/snapshot --offline
+```
+
+**When to use:**
+- Save progress without committing code
+- Capture important discussions
+- Remember exploratory changes
+- Switching contexts/machines
+- Multiple times per hour
+
+**Documentation:** `snapshot.md`
+**Quick Start:** `.claude/SNAPSHOT_QUICK_START.md`
+
+---
+
+### `/checkpoint` - Full Git + Context Save
+
+Create git commit AND save context to database.
+
+**Usage:**
+```bash
+/checkpoint
+```
+
+**When to use:**
+- Code is ready to commit
+- Reached stable milestone
+- Completed feature/fix
+- End of work session
+- Once or twice per feature
+
+**Documentation:** `checkpoint.md`
+
+---
+
+### `/sync` - Cross-Machine Context Sync
+
+Synchronize queued contexts across machines.
+
+**Usage:**
+```bash
+/sync
+```
+
+**When to use:**
+- Manually trigger sync
+- After offline work
+- Before switching machines
+- Check queue status
+
+**Documentation:** `sync.md`
+
+---
+
+### `/create-spec` - App Specification
+
+Create comprehensive application specification for AutoCoder.
+
+**Usage:**
+```bash
+/create-spec
+```
+
+**When to use:**
+- Starting new project
+- Documenting existing app
+- Preparing for AutoCoder
+- Architecture planning
+
+**Documentation:** `create-spec.md`
+
+---
+
+## Command Comparison
+
+| Command | Git Commit | Context Save | Speed | Use Case |
+|---------|-----------|-------------|-------|----------|
+| `/snapshot` | No | Yes | Fast | Save progress |
+| `/checkpoint` | Yes | Yes | Slower | Save code + context |
+| `/sync` | No | No | Fast | Sync contexts |
+| `/create-spec` | No | No | Medium | Create spec |
+
+## Common Workflows
+
+### Daily Development
+
+```
+Morning:
+  - Start work
+  - /snapshot Research phase
+
+Mid-day:
+  - Complete feature
+  - /checkpoint
+
+Afternoon:
+  - More work
+  - /snapshot Progress update
+
+End of day:
+  - /checkpoint
+  - /sync
+```
+
+### Research Heavy
+
+```
+Research:
+  - /snapshot multiple times
+  - Capture decisions
+
+Implementation:
+  - /checkpoint for features
+  - Link code to research
+```
+
+### New Project
+
+```
+Planning:
+  - /create-spec
+  - /snapshot Architecture decisions
+
+Development:
+  - /snapshot frequently
+  - /checkpoint for milestones
+```
+
+## Setup
+
+**Required for context commands:**
+```bash
+bash scripts/setup-context-recall.sh
+```
+
+This configures:
+- JWT authentication token
+- API endpoint URL
+- Project ID
+- Context recall settings
+
+**Configuration file:** `.claude/context-recall-config.env`
+
+## Documentation
+
+**Quick References:**
+- `.claude/SNAPSHOT_QUICK_START.md` - Snapshot guide
+- `.claude/SNAPSHOT_VS_CHECKPOINT.md` - When to use which
+- `.claude/CONTEXT_RECALL_QUICK_START.md` - Context recall system
+
+**Full Documentation:**
+- `snapshot.md` - Complete snapshot docs
+- `checkpoint.md` - Complete checkpoint docs
+- `sync.md` - Complete sync docs
+- `create-spec.md` - Complete spec creation docs
+
+**Implementation:**
+- `SNAPSHOT_IMPLEMENTATION.md` - Technical details
+
+## Testing
+
+**Test snapshot:**
+```bash
+bash scripts/test-snapshot.sh
+```
+
+**Test context recall:**
+```bash
+bash scripts/test-context-recall.sh
+```
+
+**Test sync:**
+```bash
+bash .claude/hooks/sync-contexts
+```
+
+## Troubleshooting
+
+**Commands not working:**
+```bash
+# Check configuration
+cat .claude/context-recall-config.env
+
+# Verify executable
+ls -l .claude/commands/
+
+# Make executable
+chmod +x .claude/commands/*
+```
+
+**Context not saving:**
+```bash
+# Check API connection
+curl -I http://172.16.3.30:8001/api/health
+
+# Regenerate token
+bash scripts/setup-context-recall.sh
+
+# Check logs
+tail -f .claude/context-queue/sync.log
+```
+
+**Project ID issues:**
+```bash
+# Set manually
+git config --local claude.projectid "$(uuidgen)"
+
+# Verify
+git config --local claude.projectid
+```
+
+## Adding Custom Commands
+
+**Structure:**
+```
+.claude/commands/
+├── command-name           # Executable bash script
+└── command-name.md        # Documentation
+```
+
+**Template:**
+```bash
+#!/bin/bash
+# Command description
+
+set -euo pipefail
+
+# Load configuration
+source .claude/context-recall-config.env
+
+# Command logic here
+echo "Hello from custom command"
+```
+
+**Make executable:**
+```bash
+chmod +x .claude/commands/command-name
+```
+
+**Test:**
+```bash
+bash .claude/commands/command-name
+```
+
+**Use in Claude Code:**
+```
+/command-name
+```
+
+## Command Best Practices
+
+**Snapshot:**
+- Use frequently (multiple per hour)
+- Descriptive titles
+- Don't over-snapshot (meaningful moments)
+- Tag auto-extraction works best with good context
+
+**Checkpoint:**
+- Only checkpoint clean state
+- Good commit messages
+- Group related changes
+- Don't checkpoint too often
+
+**Sync:**
+- Run before switching machines
+- Run after offline work
+- Check queue status periodically
+- Auto-syncs on most operations
+
+**Create-spec:**
+- Run once per project
+- Update when architecture changes
+- Include all important details
+- Use for AutoCoder integration
+
+## Advanced Usage
+
+**Snapshot with importance:**
+```bash
+/snapshot --important "Critical architecture decision"
+```
+
+**Offline snapshot:**
+```bash
+/snapshot --offline "Working without network"
+```
+
+**Checkpoint with message:**
+```bash
+/checkpoint
+# Follow prompts for commit message
+```
+
+**Sync specific project:**
+```bash
+# Edit sync script to filter by project
+bash .claude/hooks/sync-contexts
+```
+
+## Integration
+
+**With Context Recall:**
+- Commands save to database
+- Automatic recall in future sessions
+- Cross-machine continuity
+- Searchable knowledge base
+
+**With AutoCoder:**
+- `/create-spec` generates AutoCoder input
+- Commands track project state
+- Context feeds AutoCoder sessions
+- Complete audit trail
+
+**With Git:**
+- `/checkpoint` creates commits
+- `/snapshot` preserves git state
+- No conflicts with git workflow
+- Clean separation of concerns
+
+## Support
+
+**Questions:**
+- Check documentation in this directory
+- See `.claude/CLAUDE.md` for project overview
+- Review test scripts for examples
+
+**Issues:**
+- Verify configuration
+- Check API connectivity
+- Review error messages
+- Test with provided scripts
+
+**Updates:**
+- Update via git pull
+- Regenerate config if needed
+- Test after updates
+- Check for breaking changes
+
+---
+
+**Quick command reference:**
+- `/snapshot` - Quick save (no commit)
+- `/checkpoint` - Full save (with commit)
+- `/sync` - Sync contexts
+- `/create-spec` - Create app spec
+
+**Setup:** `bash scripts/setup-context-recall.sh`
+**Test:** `bash scripts/test-snapshot.sh`
+**Docs:** Read the `.md` file for each command

.claude/commands/checkpoint.md

@@ -1,8 +1,8 @@
 ---
-description: Create commit with detailed comment and save session context to database
+description: Create detailed git commit with comprehensive commit message
 ---
 
-Please create a comprehensive checkpoint that captures BOTH git changes AND session context with the following steps:
+Please create a comprehensive git checkpoint with the following steps:
 
 ## Part 1: Git Checkpoint
 
@@ -34,139 +34,29 @@ Please create a comprehensive checkpoint that captures BOTH git changes AND sess
 
 5. **Execute the commit**: Create the commit with the properly formatted message following this repository's conventions.
 
-## Part 2: Database Context Save
+## Part 2: Verify Git Checkpoint
 
-6. **Save session context to database**:
+6. **Verify commit**:
+   - Confirm git commit succeeded by running `git log -1`
+   - Report commit status to user
 
-   After the commit is complete, save the session context to the ClaudeTools database for cross-machine recall.
+## Part 3: Refresh Directives (MANDATORY)
 
-   **API Endpoint**: `POST http://172.16.3.30:8001/api/conversation-contexts`
+7. **Refresh directives** (MANDATORY):
+   - After checkpoint completion, auto-invoke `/refresh-directives`
+   - Re-read `directives.md` to prevent shortcut-taking
+   - Perform self-assessment for any violations
+   - Confirm commitment to agent coordination rules
+   - Report directives refreshed to user
 
-   **Payload Structure**:
-   ```json
-   {
-     "project_id": "<project-uuid>",
-     "context_type": "checkpoint",
-     "title": "Checkpoint: <commit-summary>",
-     "dense_summary": "<comprehensive-session-summary>",
-     "relevance_score": 8.0,
-     "tags": ["<extracted-tags>"],
-     "metadata": {
-       "git_commit": "<commit-hash>",
-       "git_branch": "<branch-name>",
-       "files_changed": ["<file-list>"],
-       "commit_message": "<full-commit-message>"
-     }
-   }
-   ```
+## Benefits of Git Checkpoint
 
-   **Authentication**: Use JWT token from `.claude/context-recall-config.env`
-
-   **How to construct the payload**:
-
-   a. **Project ID**: Get from git config or environment
-      ```bash
-      PROJECT_ID=$(git config --local claude.projectid 2>/dev/null)
-      ```
-
-   b. **Title**: Use commit summary line
-      ```
-      "Checkpoint: feat: Add Sequential Thinking to Code Review Agent"
-      ```
-
-   c. **Dense Summary**: Create compressed summary including:
-      - What was accomplished (from commit message body)
-      - Key files modified (from git diff --name-only)
-      - Important decisions or technical details
-      - Context for future sessions
-
-      Example:
-      ```
-      Enhanced code-review.md with Sequential Thinking MCP integration.
-
-      Changes:
-      - Added trigger conditions for 2+ rejections and 3+ critical issues
-      - Created enhanced escalation format with root cause analysis
-      - Added UI_VALIDATION_CHECKLIST.md (462 lines)
-      - Updated frontend-design skill for automatic invocation
-
-      Files: .claude/agents/code-review.md, .claude/skills/frontend-design/SKILL.md,
-      .claude/skills/frontend-design/UI_VALIDATION_CHECKLIST.md
-
-      Decision: Use Sequential Thinking MCP for complex review issues to break
-      rejection cycles and provide comprehensive feedback.
-
-      Commit: a1b2c3d on branch main
-      ```
-
-   d. **Tags**: Extract relevant tags from context (4-8 tags)
-      ```json
-      ["code-review", "sequential-thinking", "frontend-validation", "ui", "documentation"]
-      ```
-
-   e. **Metadata**: Include git info for reference
-      ```json
-      {
-        "git_commit": "a1b2c3d4e5f",
-        "git_branch": "main",
-        "files_changed": [
-          ".claude/agents/code-review.md",
-          ".claude/skills/frontend-design/SKILL.md"
-        ],
-        "commit_message": "feat: Add Sequential Thinking to Code Review Agent\n\n..."
-      }
-      ```
-
-   **Implementation**:
-   ```bash
-   # Load config
-   source .claude/context-recall-config.env
-
-   # Get git info
-   COMMIT_HASH=$(git rev-parse --short HEAD)
-   BRANCH=$(git rev-parse --abbrev-ref HEAD)
-   COMMIT_MSG=$(git log -1 --pretty=%B)
-   FILES=$(git diff --name-only HEAD~1 | tr '\n' ',' | sed 's/,$//')
-
-   # Create payload and POST to API
-   curl -X POST http://172.16.3.30:8001/api/conversation-contexts \
-     -H "Authorization: Bearer $JWT_TOKEN" \
-     -H "Content-Type: application/json" \
-     -d '{
-       "project_id": "'$CLAUDE_PROJECT_ID'",
-       "context_type": "checkpoint",
-       "title": "Checkpoint: <commit-summary>",
-       "dense_summary": "<comprehensive-summary>",
-       "relevance_score": 8.0,
-       "tags": ["<tags>"],
-       "metadata": {
-         "git_commit": "'$COMMIT_HASH'",
-         "git_branch": "'$BRANCH'",
-         "files_changed": ["'$FILES'"],
-         "commit_message": "'$COMMIT_MSG'"
-       }
-     }'
-   ```
-
-7. **Verify both checkpoints**:
-   - Confirm git commit succeeded (git log -1)
-   - Confirm database save succeeded (check API response)
-   - Report both statuses to user
-
-## Benefits of Dual Checkpoint
-
-**Git Checkpoint:**
+**Git Checkpoint provides:**
 - Code versioning
 - Change history
 - Rollback capability
-
-**Database Context:**
-- Cross-machine recall
-- Semantic search
-- Session continuity
-- Context for future work
-
-**Together:** Complete project memory across time and machines
+- Complete project memory over time
+- Collaboration support through detailed commit messages
 
 ## IMPORTANT
 
@@ -174,6 +64,3 @@ Please create a comprehensive checkpoint that captures BOTH git changes AND sess
 - Make the commit message descriptive enough that someone reviewing the git log can understand what was accomplished
 - Follow the project's existing commit message conventions (check git log first)
 - Include the Claude Code co-author attribution in the commit message
-- Ensure database context save includes enough detail for future recall
-- Use relevance_score 8.0 for checkpoints (important milestones)
-- Extract meaningful tags (4-8 tags) for search/filtering

.claude/commands/context.md

@@ -0,0 +1,53 @@
+The user is referencing previous work. ALWAYS check session logs and credentials.md for context before asking.
+
+## Steps
+
+### 1. Search Session Logs
+Search `session-logs/` directory for relevant keywords from user's message:
+- Use grep to find matches in all .md files
+- Check most recent session log first
+- Look for credentials, IPs, hostnames, configuration details
+
+### 2. Check credentials.md
+The `credentials.md` file contains centralized credentials for all infrastructure:
+- Read credentials.md for server access details
+- Find connection methods, ports, passwords
+- Get API tokens and authentication information
+
+### 3. Common Searches
+Based on user reference, search for:
+- **Credentials/API keys:** "token", "password", "API", "key", service names
+- **Servers:** IP addresses, hostnames, "jupiter", "saturn", "AD2", "D2TESTNAS", port numbers
+- **Services:** "gitea", "docker", "MariaDB", container names
+- **Previous work:** Project names, feature names, error messages
+- **Database:** Connection strings, table names, migration files
+
+### 4. Summarize Findings
+Report what was found:
+- Relevant credentials and connection details
+- What was done previously
+- Pending/incomplete tasks
+- Key decisions that were made
+
+### 5. Apply Context
+Use the discovered information to:
+- Connect to correct servers/services
+- Use correct credentials
+- Continue incomplete work
+- Avoid re-asking for information already provided
+
+## Important
+
+- NEVER ask user for information that's in session logs or credentials.md
+- Session logs and credentials.md are the source of truth
+- If information isn't in logs, it may need to be obtained and saved
+- For ClaudeTools: Also check SESSION_STATE.md for project history
+
+## ClaudeTools Specific Context
+
+For ClaudeTools project, also check:
+- SESSION_STATE.md - Complete project history and current phase
+- .claude/claude.md - Project overview and recent work
+- credentials.md - All infrastructure and service credentials
+- Database: 172.16.3.30:3306/claudetools (MariaDB)
+- API: http://172.16.3.30:8001 (production)

.claude/commands/refresh-directives.md

@@ -0,0 +1,306 @@
+# /refresh-directives Command
+
+**Purpose:** Re-read and internalize operational directives to prevent shortcut-taking and ensure proper agent coordination.
+
+---
+
+## When to Use
+
+**Automatic triggers (I should invoke this):**
+- After conversation compaction/summarization
+- After completing a large task
+- When detecting directive violations (database queries, emoji use, etc.)
+- At start of new work session
+- After extended conversation (>100 exchanges)
+
+**Manual invocation:**
+- User types: `/refresh-directives`
+- User says: "refresh your directives" or "read your rules again"
+
+---
+
+## What This Command Does
+
+1. **Reads directives.md** - Full file from project root
+2. **Self-assessment** - Checks recent actions for violations
+3. **Commitment** - Explicitly commits to following directives
+4. **Reports to user** - Confirms directives internalized
+
+---
+
+## Execution Steps
+
+### Step 1: Read Directives File
+```
+Read tool → D:\ClaudeTools\directives.md
+```
+
+**Must read entire file** - All sections are mandatory:
+- My Identity
+- Core Operating Principle
+- What I DO / DO NOT DO
+- Agent Coordination Rules
+- Coding Standards (NO EMOJIS)
+- Enforcement Checklist
+
+### Step 2: Self-Assessment
+
+**Check recent conversation for violations:**
+
+**Database Operations:**
+- [ ] Did I query database directly? (Violation)
+- [ ] Did I use ssh/mysql/curl to ClaudeTools API? (Violation)
+- [ ] Did I delegate to Database Agent? (Correct)
+
+**Code Generation:**
+- [ ] Did I write production code myself? (Violation)
+- [ ] Did I delegate to Coding Agent? (Correct)
+
+**Emoji Usage:**
+- [ ] Did I use emojis in code/output? (Violation)
+- [ ] Did I use ASCII markers [OK]/[ERROR]? (Correct)
+
+**Agent Coordination:**
+- [ ] Did I execute operations directly? (Violation)
+- [ ] Did I coordinate via agents? (Correct)
+
+### Step 3: Commit to Directives
+
+**Explicit commitment statement:**
+
+"I have read and internalized directives.md. I commit to:
+- Coordinating via agents, not executing directly
+- Using Database Agent for ALL database operations
+- Using ASCII markers, NEVER emojis
+- Preserving my context by delegating
+- Following the enforcement checklist before every action"
+
+### Step 4: Report to User
+
+**Format:**
+```markdown
+## Directives Refreshed
+
+I've re-read and internalized my operational directives from `directives.md`.
+
+**Key commitments:**
+- [OK] Coordinate via agents (not execute directly)
+- [OK] Database Agent handles ALL database operations
+- [OK] ASCII markers only (no emojis: [OK], [ERROR], [WARNING])
+- [OK] Preserve context by delegating operations >500 tokens
+- [OK] Auto-invoke frontend-design skill for UI changes
+
+**Self-assessment:** [Clean / X violations detected]
+
+**Status:** Ready to coordinate effectively.
+```
+
+---
+
+## Integration Points
+
+### With /checkpoint Command
+
+**After git commit + database save:**
+```
+1. Execute checkpoint (git + database)
+2. Verify both succeeded
+3. Auto-invoke /refresh-directives
+4. Confirm directives refreshed
+```
+
+### With /save Command
+
+**After creating session log:**
+```
+1. Create/append session log
+2. Commit to repository
+3. Auto-invoke /refresh-directives
+4. Confirm directives refreshed
+```
+
+### With Session Start
+
+**When conversation begins:**
+```
+1. If directives.md exists → Read it immediately
+2. If starting new project → Create directives.md first
+3. Confirm directives internalized before proceeding
+```
+
+### After Large Tasks
+
+**When completing major work:**
+- Multi-agent coordination (3+ agents)
+- Complex problem-solving with Sequential Thinking
+- Database migrations or schema changes
+- Large code refactoring
+
+**Trigger:** Auto-invoke /refresh-directives
+
+---
+
+## Violation Detection
+
+**If I detect violations during self-assessment:**
+
+1. **Acknowledge violations:**
+   ```
+   [WARNING] Detected X directive violations in recent conversation:
+   - Violation 1: Direct database query at [timestamp]
+   - Violation 2: Emoji usage in output at [timestamp]
+   ```
+
+2. **Commit to correction:**
+   ```
+   [OK] Corrective actions:
+   - Will use Database Agent for all future database operations
+   - Will use ASCII markers [OK]/[ERROR] instead of emojis
+   ```
+
+3. **Reset behavior:**
+   ```
+   [SUCCESS] Directives re-internalized. Proceeding with proper coordination.
+   ```
+
+---
+
+## Example Usage
+
+### User-Invoked
+```
+User: /refresh-directives
+
+Claude:
+[Reads directives.md]
+[Performs self-assessment]
+[Commits to directives]
+
+## Directives Refreshed
+
+I've re-read my operational directives.
+
+**Key commitments:**
+- [OK] Coordinate via agents, not execute
+- [OK] Database Agent for ALL data operations
+- [OK] ASCII markers only (no emojis)
+- [OK] Preserve context by delegating
+
+**Self-assessment:** Clean - no violations detected
+
+**Status:** Ready to coordinate effectively.
+```
+
+### Auto-Invoked After Checkpoint
+```
+Claude: [Completes /checkpoint command]
+Claude: [Auto-invokes /refresh-directives]
+Claude: [Reads directives.md]
+Claude: [Confirms directives internalized]
+
+Checkpoint complete. Directives refreshed. Ready for next task.
+```
+
+### Auto-Invoked After Conversation Compaction
+```
+System: [Conversation compacted]
+Claude: [Detects compaction occurred]
+Claude: [Auto-invokes /refresh-directives]
+Claude: [Reads directives.md]
+Claude: [Confirms ready to proceed]
+
+Context compacted. Directives re-internalized. Continuing coordination.
+```
+
+---
+
+## Technical Implementation
+
+### Hook Integration
+
+**Create hook:** `.claude/hooks/refresh-directives`
+
+```bash
+#!/bin/bash
+# Hook: Refresh Directives
+# Triggers: session-start, post-checkpoint, post-compaction
+
+echo "[INFO] Triggering directives refresh..."
+echo "Reading: D:/ClaudeTools/directives.md"
+echo "[OK] Directives file available for refresh"
+```
+
+### Command Recognition
+
+**User input patterns:**
+- `/refresh-directives`
+- `/refresh`
+- "refresh your directives"
+- "read your rules again"
+- "re-read directives"
+
+**Auto-trigger patterns:**
+- After `/checkpoint` success
+- After `/save` success
+- After conversation compaction (detect via system messages)
+- Every 50 tool uses (counter-based)
+
+---
+
+## Benefits
+
+### Prevents Shortcut-Taking
+- Reminds me not to query database directly
+- Reinforces agent coordination model
+- Stops emoji usage before it happens
+
+### Context Recovery
+- Restores operational mode after compaction
+- Ensures consistency across sessions
+- Maintains coordination principles
+
+### Self-Correction
+- Detects violations automatically
+- Commits to corrective behavior
+- Provides accountability
+
+### User Visibility
+- User sees when directives refreshed
+- Transparency in operational changes
+- Builds trust in coordination model
+
+---
+
+## Enforcement
+
+**Mandatory refresh points:**
+1. [OK] Session start (if directives.md exists)
+2. [OK] After conversation compaction
+3. [OK] After /checkpoint command
+4. [OK] After /save command
+5. [OK] When user requests: /refresh-directives
+6. [OK] After completing large tasks (3+ agents)
+
+**Optional refresh points:**
+- Every 50 tool uses (counter-based)
+- When detecting potential violations
+- Before critical operations (migrations, deployments)
+
+---
+
+## Summary
+
+**This command ensures I:**
+- Never forget my role as Coordinator
+- Always delegate to appropriate agents
+- Use ASCII markers, never emojis
+- Follow enforcement checklist
+- Maintain proper agent architecture
+
+**Result:** Consistent, rule-following behavior across all sessions and contexts.
+
+---
+
+**Created:** 2026-01-19
+**Purpose:** Enforce directives.md compliance throughout session lifecycle
+**Status:** Active - auto-invoke at trigger points

.claude/commands/save.md

@@ -0,0 +1,115 @@
+Save a COMPREHENSIVE session log to appropriate session-logs/ directory. This is critical for context recovery.
+
+## Determine Correct Location
+
+**IMPORTANT: Save to project-specific or general session-logs based on work context**
+
+### Project-Specific Logs
+If working on a specific project, save to project folder:
+- Dataforth DOS work → `projects/dataforth-dos/session-logs/YYYY-MM-DD-session.md`
+- ClaudeTools API work → `projects/claudetools-api/session-logs/YYYY-MM-DD-session.md`
+- Client-specific work → `clients/[client-name]/session-logs/YYYY-MM-DD-session.md`
+
+### General/Mixed Work
+If working across multiple projects or general tasks:
+- Use root `session-logs/YYYY-MM-DD-session.md`
+
+## Filename
+Use format `YYYY-MM-DD-session.md` (today's date) in appropriate folder
+
+## If file exists
+Append a new section with timestamp header (## Update: HH:MM), don't overwrite
+
+## MANDATORY Content to Include
+
+### 1. Session Summary
+- What was accomplished in this session
+- Key decisions made and rationale
+- Problems encountered and how they were solved
+
+### 2. ALL Credentials & Secrets (UNREDACTED)
+**CRITICAL: Store credentials completely - these are needed for future sessions**
+- API keys and tokens (full values)
+- Usernames and passwords
+- Database credentials
+- JWT secrets
+- SSH keys/passphrases if relevant
+- Any authentication information used or discovered
+
+Format credentials as:
+```
+### Credentials
+- Service Name: username / password
+- API Token: full_token_value
+```
+
+### 3. Infrastructure & Servers
+- All IPs, hostnames, ports used
+- Container names and configurations
+- DNS records added or modified
+- SSL certificates created
+- Any network/firewall changes
+
+### 4. Commands & Outputs
+- Important commands run (especially complex ones)
+- Key outputs and results
+- Error messages and their resolutions
+
+### 5. Configuration Changes
+- Files created or modified (with paths)
+- Settings changed
+- Environment variables set
+
+### 6. Pending/Incomplete Tasks
+- What still needs to be done
+- Blockers or issues awaiting resolution
+- Next steps for future sessions
+
+### 7. Reference Information
+- URLs, endpoints, ports
+- File paths that may be needed again
+- Any technical details that might be forgotten
+
+## After Saving
+
+1. Commit with message: "Session log: [brief description of work done]"
+2. Push to gitea remote (if configured)
+3. Confirm push was successful
+4. **Refresh directives** (MANDATORY):
+   - Auto-invoke `/refresh-directives`
+   - Re-read `directives.md` to prevent shortcut-taking
+   - Perform self-assessment for violations
+   - Confirm commitment to coordination rules
+   - Report directives refreshed
+
+## Purpose
+
+This log MUST contain enough detail to fully restore context if this conversation is summarized or a new session starts. When in doubt, include MORE information rather than less. Future Claude instances will search these logs to find credentials and context.
+
+## Project-Specific Requirements
+
+### Dataforth DOS Project
+Save to: `projects/dataforth-dos/session-logs/`
+Include:
+- DOS batch file changes and versions
+- Deployment script updates
+- Infrastructure changes (AD2, D2TESTNAS)
+- Test results from TS-XX machines
+- Documentation files created
+
+### ClaudeTools API Project
+Save to: `projects/claudetools-api/session-logs/`
+Include:
+- Database connection details (172.16.3.30:3306/claudetools)
+- API endpoints created or modified
+- Migration files created
+- Test results and coverage
+- Any infrastructure changes (servers, networks, clients)
+
+### Client Work
+Save to: `clients/[client-name]/session-logs/`
+Include:
+- Issues resolved
+- Services provided
+- Support tickets/cases
+- Client-specific infrastructure changes

.claude/commands/scc.md

@@ -0,0 +1,37 @@
+# /scc - Save, Commit, and Push
+
+Quick command to save session log, stage everything, and push to Gitea in one shot.
+
+## Steps
+
+1. **Save session log** - Create/update session log for today using the /save skill logic:
+   - Determine correct location based on work context (project-specific or general `session-logs/`)
+   - Use format `YYYY-MM-DD-session.md`
+   - If file exists, append with `## Update: HH:MM` header
+   - Include: summary, credentials (unredacted), infrastructure, commands, files changed, pending tasks
+
+2. **Stage all changes** - Run `git add -A` to stage everything including the new session log
+
+3. **Commit** - Auto-commit with message:
+   ```
+   scc: Session save and push from [hostname] at [timestamp]
+
+   Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
+   ```
+
+4. **Push to Gitea** - Run `git push origin main`
+
+5. **Report** - Confirm what was saved, committed, and pushed
+
+6. **Reaffirm roles** - After push, briefly restate:
+   - You are a COORDINATOR, not an executor
+   - Delegate: DB -> Database Agent, code -> Coding Agent, git -> Gitea Agent, tests -> Testing Agent
+   - Do yourself: simple responses, reading 1-2 files, planning, decisions
+   - >500 tokens of work = delegate. Code or database = ALWAYS delegate.
+   - NO EMOJIS. Use ASCII markers: `[OK]`, `[ERROR]`, `[WARNING]`, `[SUCCESS]`, `[INFO]`
+
+## Important
+- This is a FAST command - no lengthy analysis, just save and ship
+- Do NOT invoke /refresh-directives afterward (unlike /sync)
+- Do NOT read behavioral guidelines beyond the role reaffirmation above
+- Just save, commit, push, reaffirm, report

.claude/commands/sync.md

@@ -1,260 +1,504 @@
-# /sync Command
+# /sync - Bidirectional ClaudeTools Sync
 
-Synchronize ClaudeTools configuration from Gitea repository.
-
-## Purpose
-
-Pull the latest system configuration, agent definitions, and workflows from the Gitea repository to ensure you're working with the most up-to-date ClaudeTools system.
-
-## What It Does
-
-1. **Connects to Gitea repository** - `azcomputerguru/claudetools`
-2. **Pulls latest changes** - Via Gitea Agent
-3. **Updates local files**:
-   - `.claude/agents/` - Agent definitions
-   - `.claude/commands/` - Custom commands
-   - `.claude/*.md` - Workflow documentation
-   - `README.md` - System overview
-4. **Handles conflicts** - Stashes local changes if needed
-5. **Reports changes** - Shows what was updated
-
-## Usage
-
-```
-/sync
-```
-
-Or:
-```
-Claude, sync the settings
-Claude, pull latest from Gitea
-Claude, update claudetools config
-```
-
-## When to Use
-
-- **After repository updates** - When changes pushed to Gitea
-- **On new machine** - After cloning repository
-- **Periodic checks** - Weekly sync to stay current
-- **Team updates** - When other team members update agents/workflows
-- **Before important work** - Ensure latest configurations
-
-## What Gets Updated
-
-✅ **System Configuration:**
-- `.claude/agents/*.md` - Agent definitions
-- `.claude/commands/*.md` - Custom commands
-- `.claude/*.md` - Workflow documentation
-
-✅ **Documentation:**
-- `README.md` - System overview
-- `.gitignore` - Git ignore rules
-
-❌ **NOT Updated (Local Only):**
-- `.claude/settings.local.json` - Machine-specific settings
-- `backups/` - Local backups
-- `clients/` - Client work (separate repos)
-- `projects/` - Projects (separate repos)
-
-## Execution Flow
-
-```
-User: "/sync"
-  ↓
-Main Claude: Invokes Gitea Agent
-  ↓
-Gitea Agent:
-  1. cd D:\ClaudeTools
-  2. git fetch origin main
-  3. Check for local changes
-  4. If clean: git pull origin main
-  5. If dirty: git stash && git pull && git stash pop
-  6. Report results
-  ↓
-Main Claude: Shows summary to user
-```
-
-## Example Output
-
-```markdown
-## Sync Complete ✅
-
-**Repository:** azcomputerguru/claudetools
-**Branch:** main
-**Changes:** 3 files updated
-
-### Files Updated:
-- `.claude/agents/coding.md` - Updated coding standards
-- `.claude/CODE_WORKFLOW.md` - Added exception handling notes
-- `README.md` - Updated backup strategy documentation
-
-### Status:
-- No conflicts
-- Local changes preserved (if any)
-- Ready to continue work
-
-**Last sync:** 2026-01-15 15:30:00
-```
-
-## Conflict Handling
-
-**If local changes conflict with remote:**
-
-1. **Stash local changes**
-   ```bash
-   git stash save "Auto-stash before /sync command"
-   ```
-
-2. **Pull remote changes**
-   ```bash
-   git pull origin main
-   ```
-
-3. **Attempt to restore local changes**
-   ```bash
-   git stash pop
-   ```
-
-4. **If conflicts remain:**
-   ```markdown
-   ## Sync - Manual Intervention Required ⚠️
-
-   **Conflict detected in:**
-   - `.claude/agents/coding.md`
-
-   **Action required:**
-   1. Open conflicted file
-   2. Resolve conflict markers (<<<<<<, ======, >>>>>>)
-   3. Run: git add .claude/agents/coding.md
-   4. Run: git stash drop
-   5. Or ask Claude to help resolve conflict
-
-   **Local changes stashed** - Run `git stash list` to see
-   ```
-
-## Error Handling
-
-### Network Error
-```markdown
-## Sync Failed - Network Issue ❌
-
-Could not connect to git.azcomputerguru.com
-
-**Possible causes:**
-- VPN not connected
-- Network connectivity issue
-- Gitea server down
-
-**Solution:**
-- Check VPN connection
-- Retry: /sync
-```
-
-### Authentication Error
-```markdown
-## Sync Failed - Authentication ❌
-
-SSH key authentication failed
-
-**Possible causes:**
-- SSH key not loaded
-- Incorrect permissions on key file
-
-**Solution:**
-- Verify SSH key: C:\Users\MikeSwanson\.ssh\id_ed25519
-- Test connection: ssh git@git.azcomputerguru.com
-```
-
-### Uncommitted Changes Warning
-```markdown
-## Sync Warning - Uncommitted Changes ⚠️
-
-You have uncommitted local changes:
-- `.claude/agents/custom-agent.md` (new file)
-- `.claude/CUSTOM_NOTES.md` (modified)
-
-**Options:**
-1. Commit changes first: `/commit` or ask Claude to commit
-2. Stash and sync: /sync will auto-stash
-3. Discard changes: git reset --hard (WARNING: loses changes)
-
-**Recommended:** Commit your changes first, then sync.
-```
-
-## Integration with Gitea Agent
-
-**Sync operation delegated to Gitea Agent:**
-
-```python
-# Main Claude (Orchestrator) calls:
-Gitea_Agent.sync_from_remote(
-    repository="azcomputerguru/claudetools",
-    base_path="D:/ClaudeTools/",
-    branch="main",
-    handle_conflicts="auto-stash"
-)
-
-# Gitea Agent performs:
-# 1. git fetch
-# 2. Check status
-# 3. Stash if needed
-# 4. Pull
-# 5. Pop stash if stashed
-# 6. Report results
-```
-
-## Safety Features
-
-- **No data loss** - Local changes stashed, not discarded
-- **Conflict detection** - User notified if manual resolution needed
-- **Rollback possible** - `git stash list` shows saved changes
-- **Dry-run option** - `git fetch` previews changes before pulling
-
-## Related Commands
-
-- `/commit` - Commit local changes before sync
-- `/status` - Check git status without syncing
-
-## Technical Implementation
-
-**Gitea Agent receives:**
-```json
-{
-  "operation": "sync_from_remote",
-  "repository": "azcomputerguru/claudetools",
-  "base_path": "D:/ClaudeTools/",
-  "branch": "main",
-  "handle_conflicts": "auto-stash"
-}
-```
-
-**Gitea Agent returns:**
-```json
-{
-  "success": true,
-  "operation": "sync_from_remote",
-  "files_updated": [
-    ".claude/agents/coding.md",
-    ".claude/CODE_WORKFLOW.md",
-    "README.md"
-  ],
-  "files_count": 3,
-  "conflicts": false,
-  "local_changes_stashed": false,
-  "commit_before": "a3f5b92c...",
-  "commit_after": "e7d9c1a4...",
-  "sync_timestamp": "2026-01-15T15:30:00Z"
-}
-```
-
-## Best Practices
-
-1. **Sync regularly** - Weekly or before important work
-2. **Commit before sync** - Cleaner workflow, easier conflict resolution
-3. **Review changes** - Check what was updated after sync
-4. **Test after sync** - Verify agents/workflows work as expected
-5. **Keep local settings separate** - Use `.claude/settings.local.json` for machine-specific config
+Synchronize ClaudeTools configuration, session data, and context bidirectionally with Gitea. Ensures all machines stay perfectly in sync for seamless cross-machine workflow.
 
 ---
 
-**This command ensures you always have the latest ClaudeTools configuration and agent definitions.**
+## IMPORTANT: Use Automated Sync Script
+
+**CRITICAL:** When user invokes `/sync`, execute the automated sync script instead of manual steps.
+
+**Windows:**
+```bash
+bash .claude/scripts/sync.sh
+```
+OR
+```cmd
+.claude\scripts\sync.bat
+```
+
+**Mac/Linux:**
+```bash
+bash .claude/scripts/sync.sh
+```
+
+**Why use the script:**
+- Ensures PULL happens BEFORE PUSH (prevents missing remote changes)
+- Consistent behavior across all machines
+- Proper error handling and conflict detection
+- Automated timestamping and machine identification
+- No steps can be accidentally skipped
+
+**The script automatically:**
+1. Checks for local changes
+2. Commits local changes (if any)
+3. **Fetches and pulls remote changes FIRST**
+4. Pushes local changes
+5. Reports sync status
+
+---
+
+## What Gets Synced
+
+**FROM Local TO Gitea (PUSH):**
+- Session logs: `session-logs/*.md`
+- Project session logs: `projects/*/session-logs/*.md`
+- Credentials: `credentials.md` (private repo - safe to sync)
+- Project state: `SESSION_STATE.md`
+- Commands: `.claude/commands/*.md`
+- Directives: `directives.md`
+- File placement guide: `.claude/FILE_PLACEMENT_GUIDE.md`
+- Behavioral guidelines:
+  - `.claude/CODING_GUIDELINES.md` (NO EMOJIS, ASCII markers, standards)
+  - `.claude/AGENT_COORDINATION_RULES.md` (delegation guidelines)
+  - `.claude/agents/*.md` (agent-specific documentation)
+  - `.claude/CLAUDE.md` (project context and instructions)
+  - Any other `.claude/*.md` operational files
+- Any other tracked changes
+
+**FROM Gitea TO Local (PULL):**
+- All of the above from other machines
+- Latest commands and configurations
+- Updated session logs from other sessions
+- Project-specific work and documentation
+
+---
+
+## Execution Steps
+
+### Phase 1: Prepare Local Changes
+
+1. **Navigate to ClaudeTools repo:**
+   ```bash
+   cd ~/ClaudeTools  # or D:\ClaudeTools on Windows
+   ```
+
+2. **Check repository status:**
+   ```bash
+   git status
+   ```
+   Report number of changed/new files to user
+
+3. **Stage all changes:**
+   ```bash
+   git add -A
+   ```
+   This includes:
+   - New/modified session logs
+   - Updated credentials.md
+   - SESSION_STATE.md changes
+   - Command updates
+   - Directive changes
+   - Behavioral guidelines (CODING_GUIDELINES.md, AGENT_COORDINATION_RULES.md, etc.)
+   - Agent documentation
+   - Project documentation
+
+4. **Auto-commit local changes with timestamp:**
+   ```bash
+   git commit -m "sync: Auto-sync from [machine-name] at [timestamp]
+
+   Synced files:
+   - Session logs updated
+   - Latest context and credentials
+   - Command/directive updates
+
+   Machine: [hostname]
+   Timestamp: [YYYY-MM-DD HH:MM:SS]
+
+   Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>"
+   ```
+
+   **Note:** Only commit if there are changes. If working tree is clean, skip to Phase 2.
+
+---
+
+### Phase 2: Sync with Gitea
+
+5. **Pull latest changes from Gitea:**
+   ```bash
+   git pull origin main --rebase
+   ```
+
+   **Handle conflicts if any:**
+   - Session logs: Keep both versions (rename conflicting file with timestamp)
+   - credentials.md: Manual merge required - report to user
+   - Other files: Use standard git conflict resolution
+
+   Report what was pulled from remote
+
+6. **Push local changes to Gitea:**
+   ```bash
+   git push origin main
+   ```
+
+   Confirm push succeeded
+
+---
+
+### Phase 3: Apply Configuration Locally
+
+7. **Copy commands to global Claude directory:**
+   ```bash
+   mkdir -p ~/.claude/commands
+   cp -r ~/ClaudeTools/.claude/commands/* ~/.claude/commands/
+   ```
+   These slash commands are now available globally
+
+8. **Apply global settings if available:**
+   ```bash
+   if [ -f ~/ClaudeTools/.claude/settings.json ]; then
+     cp ~/ClaudeTools/.claude/settings.json ~/.claude/settings.json
+   fi
+   ```
+
+9. **Sync project settings:**
+   ```bash
+   if [ -f ~/ClaudeTools/.claude/settings.local.json ]; then
+     # Read and note any project-specific settings
+   fi
+   ```
+
+---
+
+### Phase 4: Context Recovery
+
+10. **Find and read most recent session logs:**
+
+    Check all locations:
+    - `~/ClaudeTools/session-logs/*.md` (general)
+    - `~/ClaudeTools/projects/*/session-logs/*.md` (project-specific)
+
+    Report the 3 most recent logs found:
+    - File name and location
+    - Last modified date
+    - Brief summary of what was worked on (from first 5 lines)
+
+11. **Read behavioral guidelines and directives:**
+    ```bash
+    cat ~/ClaudeTools/directives.md
+    cat ~/ClaudeTools/.claude/CODING_GUIDELINES.md
+    cat ~/ClaudeTools/.claude/AGENT_COORDINATION_RULES.md
+    ```
+    Internalize operational directives and behavioral rules to ensure:
+    - Proper coordination mode (delegate vs execute)
+    - NO EMOJIS rule enforcement
+    - Agent delegation patterns
+    - Coding standards compliance
+
+---
+
+### Phase 5: Report Sync Status
+
+12. **Summarize what was synced:**
+
+    ```
+    ## Sync Complete
+
+    [OK] Local changes pushed to Gitea:
+    - X session logs updated
+    - credentials.md synced
+    - SESSION_STATE.md updated
+    - Y command files
+
+    [OK] Remote changes pulled from Gitea:
+    - Z files updated from other machines
+    - Latest session: [most recent log]
+
+    [OK] Configuration applied:
+    - Commands available: /checkpoint, /context, /save, /sync, etc.
+    - Directives internalized (coordination mode, delegation rules)
+    - Behavioral guidelines internalized (NO EMOJIS, ASCII markers, coding standards)
+    - Agent coordination rules applied
+    - Global settings applied
+
+    Recent work (last 3 sessions):
+    1. [date] - [project] - [brief summary]
+    2. [date] - [project] - [brief summary]
+    3. [date] - [project] - [brief summary]
+
+    **Status:** All machines in sync. Ready to continue work.
+    ```
+
+13. **Refresh directives (auto-invoke):**
+
+    Automatically invoke `/refresh-directives` to internalize all synced behavioral guidelines:
+    - Re-read directives.md
+    - Re-read CODING_GUIDELINES.md
+    - Re-read AGENT_COORDINATION_RULES.md
+    - Perform self-assessment for violations
+    - Commit to following all behavioral rules
+
+    **Why this is critical:**
+    - Ensures latest behavioral rules are active
+    - Prevents shortcut-taking after sync
+    - Maintains coordination discipline
+    - Enforces NO EMOJIS and ASCII marker rules
+    - Ensures proper agent delegation
+
+---
+
+## Conflict Resolution
+
+### Session Log Conflicts
+If both machines created session logs with same date:
+1. Keep both versions
+2. Rename to: `YYYY-MM-DD-session-[machine].md`
+3. Report conflict to user
+
+### credentials.md Conflicts
+If credentials.md has conflicts:
+1. Do NOT auto-merge
+2. Report conflict to user
+3. Show conflicting sections
+4. Ask user which version to keep or how to merge
+
+### Other File Conflicts
+Standard git conflict markers:
+1. Report files with conflicts
+2. Show conflict sections
+3. Ask user to resolve manually or provide guidance
+
+---
+
+## Machine Detection
+
+Automatically detect machine name for commit messages:
+
+**Windows:**
+```powershell
+$env:COMPUTERNAME
+```
+
+**Mac/Linux:**
+```bash
+hostname
+```
+
+**Timestamp format:**
+```bash
+date "+%Y-%m-%d %H:%M:%S"
+```
+
+---
+
+## Benefits
+
+### Seamless Multi-Machine Workflow
+- Start work on one machine, continue on another
+- All session context automatically synchronized
+- Credentials available everywhere (private repo)
+- Commands and directives stay consistent
+- Behavioral rules enforced identically (NO EMOJIS, delegation patterns, coding standards)
+
+### Complete Context Preservation
+- Never lose session data
+- Full history across all machines
+- Searchable via git log
+- Rollback capability if needed
+
+### Zero Manual Sync
+- One command syncs everything
+- Auto-commit prevents forgotten changes
+- Push/pull happens automatically
+- Conflicts handled gracefully
+
+---
+
+## Usage Examples
+
+### Standard Sync (Most Common)
+```
+User: /sync
+
+Claude:
+[Commits local changes]
+[Pulls from Gitea]
+[Pushes to Gitea]
+[Applies configuration]
+[Reports status]
+[Auto-invokes /refresh-directives]
+
+Sync complete. 3 session logs pushed, 2 updates pulled.
+Directives refreshed. Ready to continue work.
+```
+
+### Sync Before Important Work
+```
+User: "I'm switching to my other machine. /sync"
+
+Claude:
+[Syncs everything]
+Report: Latest work on Dataforth DOS dashboard pushed to Gitea.
+All session logs and credentials synced.
+You can now pull on the other machine to continue.
+```
+
+### Daily Morning Sync
+```
+User: /sync
+
+Claude:
+[Pulls overnight changes from other machines]
+[Auto-invokes /refresh-directives]
+Report: Found 2 new sessions from yesterday evening.
+Latest: GuruRMM dashboard redesign completed.
+Context recovered. Directives refreshed. Ready for today's work.
+```
+
+---
+
+## Error Handling
+
+### Network Issues
+If git pull/push fails:
+1. Report connection error
+2. Show what was committed locally
+3. Suggest retry or manual sync
+4. Changes are safe (committed locally)
+
+### Authentication Issues
+If Gitea authentication fails:
+1. Report auth error
+2. Check SSH keys or credentials
+3. Provide troubleshooting steps
+4. Manual push may be needed
+
+### Merge Conflicts
+If automatic merge fails:
+1. Report which files have conflicts
+2. Show conflict markers
+3. Ask for user guidance
+4. Offer to abort merge if needed
+
+---
+
+## Security Notes
+
+**credentials.md Syncing:**
+- Private repository on Gitea (https://git.azcomputerguru.com)
+- Only accessible to authorized user
+- Encrypted in transit (HTTPS/SSH)
+- Safe to sync sensitive credentials
+- Enables cross-machine access
+
+**What's NOT synced:**
+- `.env` files (gitignored)
+- API virtual environment (api/venv/)
+- Database files (local development)
+- Temporary files (*.tmp, *.log)
+- node_modules/ directories
+
+---
+
+## Integration with Other Commands
+
+### After /checkpoint
+User can run `/sync` after `/checkpoint` to push the checkpoint to Gitea:
+```
+User: /checkpoint
+Claude: [Creates git commit]
+
+User: /sync
+Claude: [Pushes checkpoint to Gitea]
+```
+
+### Before /save
+User can sync first to see latest context:
+```
+User: /sync
+Claude: [Shows latest session logs]
+
+User: /save
+Claude: [Creates session log with full context]
+```
+
+### With /context
+Syncing ensures `/context` has complete history:
+```
+User: /sync
+Claude: [Syncs all session logs]
+
+User: /context Dataforth
+Claude: [Searches complete session log history including other machines]
+```
+
+### Auto-invokes /refresh-directives
+**IMPORTANT:** `/sync` automatically invokes `/refresh-directives` at the end:
+```
+User: /sync
+Claude:
+[Phase 1: Commits local changes]
+[Phase 2: Pulls/pushes to Gitea]
+[Phase 3: Applies configuration]
+[Phase 4: Recovers context]
+[Phase 5: Reports status]
+[Auto-invokes /refresh-directives]
+[Confirms directives internalized]
+
+Sync complete. Directives refreshed. Ready to coordinate.
+```
+
+**Why automatic:**
+- Ensures latest behavioral rules are active after pulling changes
+- Prevents using outdated directives from previous sync
+- Maintains coordination discipline across all machines
+- Enforces NO EMOJIS rule after any directive updates
+- Critical after conversation compaction or multi-machine sync
+
+---
+
+## Frequency Recommendations
+
+**Daily:** Start of work day
+- Pull overnight changes
+- See what was done on other machines
+- Recover latest context
+
+**After Major Work:** End of coding session
+- Push session logs
+- Share context across machines
+- Backup to Gitea
+
+**Before Switching Machines:**
+- Push all local changes
+- Ensure other machine can pull
+- Seamless transition
+
+**Weekly:** General maintenance
+- Keep repos in sync
+- Review session log history
+- Clean up if needed
+
+---
+
+## Troubleshooting
+
+### "Already up to date" but files seem out of sync
+```bash
+# Force status check
+cd ~/ClaudeTools
+git fetch origin
+git status
+```
+
+### "Divergent branches" error
+```bash
+# Rebase local changes on top of remote
+git pull origin main --rebase
+```
+
+### Lost uncommitted changes
+```bash
+# Check stash
+git stash list
+
+# Recover if needed
+git stash pop
+```
+
+---
+
+**Created:** 2026-01-21
+**Purpose:** Bidirectional sync for seamless multi-machine ClaudeTools workflow
+**Repository:** https://git.azcomputerguru.com/azcomputerguru/claudetools.git
+**Status:** Active - comprehensive sync with context preservation

.claude/hooks/EXAMPLES.md

@@ -30,7 +30,7 @@ Real-world examples of how the Context Recall System works.
 
 **System:** Automatically recalls context:
 ```markdown
-## 📚 Previous Context
+## [DOCS] Previous Context
 
 ### 1. Session: 2025-01-13T14:30:00Z (Score: 8.5/10)
 *Type: session_summary*
@@ -69,7 +69,7 @@ Branch: feature/auth
 
 **System:** Recalls context:
 ```markdown
-## 📚 Previous Context
+## [DOCS] Previous Context
 
 ### 1. Database Technology Decision (Score: 9.0/10)
 *Type: technical_decision*
@@ -109,7 +109,7 @@ evaluating both options.
 
 **System:** Recalls:
 ```markdown
-## 📚 Previous Context
+## [DOCS] Previous Context
 
 ### 1. Bug Fix: Authentication Timeouts (Score: 8.0/10)
 *Type: bug_fix*
@@ -314,7 +314,7 @@ Here's what you actually see in Claude Code when context is recalled:
 ```markdown
 <!-- Context Recall: Retrieved 3 relevant context(s) -->
 
-## 📚 Previous Context
+## [DOCS] Previous Context
 
 The following context has been automatically recalled from previous sessions:
 

.claude/hooks/INSTALL.md

@@ -218,6 +218,6 @@ If issues persist after following this guide:
 - [ ] Test script passes (`bash scripts/test-context-recall.sh`)
 - [ ] Hooks execute manually without errors
 
-If all items checked: **Installation is complete!** ✅
+If all items checked: **Installation is complete!** [OK]
 
 Start using Claude Code and enjoy automatic context recall!

.claude/hooks/README.md

@@ -26,7 +26,7 @@ This system provides seamless context continuity across Claude Code sessions by:
 
 **Example output:**
 ```markdown
-## 📚 Previous Context
+## [DOCS] Previous Context
 
 The following context has been automatically recalled from previous sessions:
 

.claude/hooks/periodic-context-save

@@ -1,226 +0,0 @@
-#!/bin/bash
-#
-# Periodic Context Save Hook
-# Runs as a background daemon to save context every 5 minutes of active time
-#
-# Usage: bash .claude/hooks/periodic-context-save start
-#        bash .claude/hooks/periodic-context-save stop
-#        bash .claude/hooks/periodic-context-save status
-#
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-CLAUDE_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
-PID_FILE="$CLAUDE_DIR/.periodic-save.pid"
-STATE_FILE="$CLAUDE_DIR/.periodic-save-state"
-CONFIG_FILE="$CLAUDE_DIR/context-recall-config.env"
-
-# Load configuration
-if [ -f "$CONFIG_FILE" ]; then
-    source "$CONFIG_FILE"
-fi
-
-# Configuration
-SAVE_INTERVAL_SECONDS=300  # 5 minutes
-CHECK_INTERVAL_SECONDS=60  # Check every minute
-API_URL="${CLAUDE_API_URL:-http://172.16.3.30:8001}"
-
-# Detect project ID
-detect_project_id() {
-    # Try git config first
-    PROJECT_ID=$(git config --local claude.projectid 2>/dev/null)
-
-    if [ -z "$PROJECT_ID" ]; then
-        # Try to derive from git remote URL
-        GIT_REMOTE=$(git config --get remote.origin.url 2>/dev/null)
-        if [ -n "$GIT_REMOTE" ]; then
-            PROJECT_ID=$(echo -n "$GIT_REMOTE" | md5sum | cut -d' ' -f1)
-        fi
-    fi
-
-    echo "$PROJECT_ID"
-}
-
-# Check if Claude Code is active (not idle)
-is_claude_active() {
-    # Check if there are recent Claude Code processes or activity
-    # This is a simple heuristic - can be improved
-
-    # On Windows with Git Bash, check for claude process
-    if command -v tasklist.exe >/dev/null 2>&1; then
-        tasklist.exe 2>/dev/null | grep -i claude >/dev/null 2>&1
-        return $?
-    fi
-
-    # Assume active if we can't detect
-    return 0
-}
-
-# Get active time from state file
-get_active_time() {
-    if [ -f "$STATE_FILE" ]; then
-        cat "$STATE_FILE" | grep "^active_seconds=" | cut -d'=' -f2
-    else
-        echo "0"
-    fi
-}
-
-# Update active time in state file
-update_active_time() {
-    local active_seconds=$1
-    echo "active_seconds=$active_seconds" > "$STATE_FILE"
-    echo "last_update=$(date -u +"%Y-%m-%dT%H:%M:%SZ")" >> "$STATE_FILE"
-}
-
-# Save context to database
-save_periodic_context() {
-    local project_id=$(detect_project_id)
-
-    # Generate context summary
-    local title="Periodic Save - $(date +"%Y-%m-%d %H:%M")"
-    local summary="Auto-saved context after 5 minutes of active work. Session in progress on project: ${project_id:-unknown}"
-
-    # Create JSON payload
-    local payload=$(cat <<EOF
-{
-    "context_type": "session_summary",
-    "title": "$title",
-    "dense_summary": "$summary",
-    "relevance_score": 5.0,
-    "tags": "[\"auto-save\", \"periodic\", \"active-session\"]"
-}
-EOF
-)
-
-    # POST to API
-    if [ -n "$JWT_TOKEN" ]; then
-        curl -s -X POST "${API_URL}/api/conversation-contexts" \
-            -H "Authorization: Bearer ${JWT_TOKEN}" \
-            -H "Content-Type: application/json" \
-            -d "$payload" >/dev/null 2>&1
-
-        if [ $? -eq 0 ]; then
-            echo "[$(date)] Context saved successfully" >&2
-        else
-            echo "[$(date)] Failed to save context" >&2
-        fi
-    else
-        echo "[$(date)] No JWT token - cannot save context" >&2
-    fi
-}
-
-# Main monitoring loop
-monitor_loop() {
-    local active_seconds=0
-
-    echo "[$(date)] Periodic context save daemon started (PID: $$)" >&2
-    echo "[$(date)] Will save context every ${SAVE_INTERVAL_SECONDS}s of active time" >&2
-
-    while true; do
-        # Check if Claude is active
-        if is_claude_active; then
-            # Increment active time
-            active_seconds=$((active_seconds + CHECK_INTERVAL_SECONDS))
-            update_active_time $active_seconds
-
-            # Check if we've reached the save interval
-            if [ $active_seconds -ge $SAVE_INTERVAL_SECONDS ]; then
-                echo "[$(date)] ${SAVE_INTERVAL_SECONDS}s of active time reached - saving context" >&2
-                save_periodic_context
-
-                # Reset timer
-                active_seconds=0
-                update_active_time 0
-            fi
-        else
-            echo "[$(date)] Claude Code inactive - not counting time" >&2
-        fi
-
-        # Wait before next check
-        sleep $CHECK_INTERVAL_SECONDS
-    done
-}
-
-# Start daemon
-start_daemon() {
-    if [ -f "$PID_FILE" ]; then
-        local pid=$(cat "$PID_FILE")
-        if kill -0 $pid 2>/dev/null; then
-            echo "Periodic context save daemon already running (PID: $pid)"
-            return 1
-        fi
-    fi
-
-    # Start in background
-    nohup bash "$0" _monitor >> "$CLAUDE_DIR/periodic-save.log" 2>&1 &
-    local pid=$!
-    echo $pid > "$PID_FILE"
-
-    echo "Started periodic context save daemon (PID: $pid)"
-    echo "Logs: $CLAUDE_DIR/periodic-save.log"
-}
-
-# Stop daemon
-stop_daemon() {
-    if [ ! -f "$PID_FILE" ]; then
-        echo "Periodic context save daemon not running"
-        return 1
-    fi
-
-    local pid=$(cat "$PID_FILE")
-    if kill $pid 2>/dev/null; then
-        echo "Stopped periodic context save daemon (PID: $pid)"
-        rm -f "$PID_FILE"
-        rm -f "$STATE_FILE"
-    else
-        echo "Failed to stop daemon (PID: $pid) - may not be running"
-        rm -f "$PID_FILE"
-    fi
-}
-
-# Check status
-check_status() {
-    if [ -f "$PID_FILE" ]; then
-        local pid=$(cat "$PID_FILE")
-        if kill -0 $pid 2>/dev/null; then
-            local active_seconds=$(get_active_time)
-            echo "Periodic context save daemon is running (PID: $pid)"
-            echo "Active time: ${active_seconds}s / ${SAVE_INTERVAL_SECONDS}s"
-            return 0
-        else
-            echo "Daemon PID file exists but process not running"
-            rm -f "$PID_FILE"
-            return 1
-        fi
-    else
-        echo "Periodic context save daemon not running"
-        return 1
-    fi
-}
-
-# Command dispatcher
-case "$1" in
-    start)
-        start_daemon
-        ;;
-    stop)
-        stop_daemon
-        ;;
-    status)
-        check_status
-        ;;
-    _monitor)
-        # Internal command - run monitor loop
-        monitor_loop
-        ;;
-    *)
-        echo "Usage: $0 {start|stop|status}"
-        echo ""
-        echo "Periodic context save daemon - saves context every 5 minutes of active time"
-        echo ""
-        echo "Commands:"
-        echo "  start   - Start the background daemon"
-        echo "  stop    - Stop the daemon"
-        echo "  status  - Check daemon status"
-        exit 1
-        ;;
-esac

.claude/hooks/periodic_context_save.py

@@ -1,429 +0,0 @@
-#!/usr/bin/env python3
-"""
-Periodic Context Save Daemon
-
-Monitors Claude Code activity and saves context every 5 minutes of active time.
-Runs as a background process that tracks when Claude is actively working.
-
-Usage:
-    python .claude/hooks/periodic_context_save.py start
-    python .claude/hooks/periodic_context_save.py stop
-    python .claude/hooks/periodic_context_save.py status
-"""
-
-import os
-import sys
-import time
-import json
-import signal
-import subprocess
-from datetime import datetime, timezone
-from pathlib import Path
-
-# FIX BUG #1: Set UTF-8 encoding for stdout/stderr on Windows
-os.environ['PYTHONIOENCODING'] = 'utf-8'
-
-import requests
-
-# Configuration
-SCRIPT_DIR = Path(__file__).parent
-CLAUDE_DIR = SCRIPT_DIR.parent
-PID_FILE = CLAUDE_DIR / ".periodic-save.pid"
-STATE_FILE = CLAUDE_DIR / ".periodic-save-state.json"
-LOG_FILE = CLAUDE_DIR / "periodic-save.log"
-CONFIG_FILE = CLAUDE_DIR / "context-recall-config.env"
-
-SAVE_INTERVAL_SECONDS = 300  # 5 minutes
-CHECK_INTERVAL_SECONDS = 60  # Check every minute
-
-
-def log(message):
-    """Write log message to file and stderr (encoding-safe)"""
-    timestamp = datetime.now().strftime("%Y-%m-%d %H:%M:%S")
-    log_message = f"[{timestamp}] {message}\n"
-
-    # Write to log file with UTF-8 encoding to handle Unicode characters
-    try:
-        with open(LOG_FILE, "a", encoding="utf-8") as f:
-            f.write(log_message)
-    except Exception:
-        pass  # Silent fail on log file write errors
-
-    # FIX BUG #5: Safe stderr printing (handles encoding errors)
-    try:
-        print(log_message.strip(), file=sys.stderr)
-    except UnicodeEncodeError:
-        # Fallback: encode with error handling
-        safe_message = log_message.encode('ascii', errors='replace').decode('ascii')
-        print(safe_message.strip(), file=sys.stderr)
-
-
-def load_config():
-    """Load configuration from context-recall-config.env"""
-    config = {
-        "api_url": "http://172.16.3.30:8001",
-        "jwt_token": None,
-        "project_id": None,  # FIX BUG #2: Add project_id to config
-    }
-
-    if CONFIG_FILE.exists():
-        with open(CONFIG_FILE) as f:
-            for line in f:
-                line = line.strip()
-                if line.startswith("CLAUDE_API_URL=") or line.startswith("API_BASE_URL="):
-                    config["api_url"] = line.split("=", 1)[1]
-                elif line.startswith("JWT_TOKEN="):
-                    config["jwt_token"] = line.split("=", 1)[1]
-                elif line.startswith("CLAUDE_PROJECT_ID="):
-                    config["project_id"] = line.split("=", 1)[1]
-
-    return config
-
-
-def detect_project_id():
-    """Detect project ID from git config"""
-    try:
-        # Try git config first
-        result = subprocess.run(
-            ["git", "config", "--local", "claude.projectid"],
-            capture_output=True,
-            text=True,
-            check=False,
-            timeout=5,  # Prevent hung processes
-        )
-        if result.returncode == 0 and result.stdout.strip():
-            return result.stdout.strip()
-
-        # Try to derive from git remote URL
-        result = subprocess.run(
-            ["git", "config", "--get", "remote.origin.url"],
-            capture_output=True,
-            text=True,
-            check=False,
-            timeout=5,  # Prevent hung processes
-        )
-        if result.returncode == 0 and result.stdout.strip():
-            import hashlib
-            return hashlib.md5(result.stdout.strip().encode()).hexdigest()
-
-    except Exception:
-        pass
-
-    return None
-
-
-def is_claude_active():
-    """
-    Check if Claude Code is actively running.
-
-    Returns True if:
-    - Claude Code process is running
-    - Recent file modifications in project directory
-    - Not waiting for user input (heuristic)
-    """
-    try:
-        # Check for Claude process on Windows
-        if sys.platform == "win32":
-            result = subprocess.run(
-                ["tasklist.exe"],
-                capture_output=True,
-                text=True,
-                check=False,
-                timeout=5,  # Prevent hung processes
-            )
-            if "claude" in result.stdout.lower() or "node" in result.stdout.lower():
-                return True
-
-        # Check for recent file modifications (within last 2 minutes)
-        cwd = Path.cwd()
-        two_minutes_ago = time.time() - 120
-
-        for file in cwd.rglob("*"):
-            if file.is_file() and file.stat().st_mtime > two_minutes_ago:
-                # Recent activity detected
-                return True
-
-    except Exception as e:
-        log(f"Error checking activity: {e}")
-
-    # Default to inactive if we can't detect
-    return False
-
-
-def load_state():
-    """Load state from state file"""
-    if STATE_FILE.exists():
-        try:
-            with open(STATE_FILE) as f:
-                return json.load(f)
-        except Exception:
-            pass
-
-    return {
-        "active_seconds": 0,
-        "last_update": None,
-        "last_save": None,
-    }
-
-
-def save_state(state):
-    """Save state to state file"""
-    state["last_update"] = datetime.now(timezone.utc).isoformat()
-    with open(STATE_FILE, "w") as f:
-        json.dump(state, f, indent=2)
-
-
-def save_periodic_context(config, project_id):
-    """Save context to database via API"""
-    # FIX BUG #7: Validate before attempting save
-    if not config["jwt_token"]:
-        log("[ERROR] No JWT token - cannot save context")
-        return False
-
-    if not project_id:
-        log("[ERROR] No project_id - cannot save context")
-        return False
-
-    title = f"Periodic Save - {datetime.now().strftime('%Y-%m-%d %H:%M')}"
-    summary = f"Auto-saved context after 5 minutes of active work. Session in progress on project: {project_id}"
-
-    # FIX BUG #2: Include project_id in payload
-    payload = {
-        "project_id": project_id,
-        "context_type": "session_summary",
-        "title": title,
-        "dense_summary": summary,
-        "relevance_score": 5.0,
-        "tags": json.dumps(["auto-save", "periodic", "active-session"]),
-    }
-
-    try:
-        url = f"{config['api_url']}/api/conversation-contexts"
-        headers = {
-            "Authorization": f"Bearer {config['jwt_token']}",
-            "Content-Type": "application/json",
-        }
-
-        response = requests.post(url, json=payload, headers=headers, timeout=10)
-
-        if response.status_code in [200, 201]:
-            context_id = response.json().get('id', 'unknown')
-            log(f"[SUCCESS] Context saved (ID: {context_id}, Project: {project_id})")
-            return True
-        else:
-            # FIX BUG #4: Improved error logging with full details
-            error_detail = response.text[:200] if response.text else "No error detail"
-            log(f"[ERROR] Failed to save context: HTTP {response.status_code}")
-            log(f"[ERROR] Response: {error_detail}")
-            return False
-
-    except Exception as e:
-        # FIX BUG #4: More detailed error logging
-        log(f"[ERROR] Exception saving context: {type(e).__name__}: {e}")
-        return False
-
-
-def monitor_loop():
-    """Main monitoring loop"""
-    log("Periodic context save daemon started")
-    log(f"Will save context every {SAVE_INTERVAL_SECONDS}s of active time")
-
-    config = load_config()
-    state = load_state()
-
-    # FIX BUG #7: Validate configuration on startup
-    if not config["jwt_token"]:
-        log("[WARNING] No JWT token found in config - saves will fail")
-
-    # Determine project_id (config takes precedence over git detection)
-    project_id = config["project_id"]
-    if not project_id:
-        project_id = detect_project_id()
-        if project_id:
-            log(f"[INFO] Detected project_id from git: {project_id}")
-        else:
-            log("[WARNING] No project_id found - saves will fail")
-
-    # Reset state on startup
-    state["active_seconds"] = 0
-    save_state(state)
-
-    while True:
-        try:
-            # Check if Claude is active
-            if is_claude_active():
-                # Increment active time
-                state["active_seconds"] += CHECK_INTERVAL_SECONDS
-                save_state(state)
-
-                log(f"Active: {state['active_seconds']}s / {SAVE_INTERVAL_SECONDS}s")
-
-                # Check if we've reached the save interval
-                if state["active_seconds"] >= SAVE_INTERVAL_SECONDS:
-                    log(f"{SAVE_INTERVAL_SECONDS}s of active time reached - saving context")
-
-                    # Try to save context
-                    save_success = save_periodic_context(config, project_id)
-
-                    if save_success:
-                        state["last_save"] = datetime.now(timezone.utc).isoformat()
-
-                    # FIX BUG #3: Always reset timer in finally block (see below)
-
-            else:
-                log("Claude Code inactive - not counting time")
-
-            # Wait before next check
-            time.sleep(CHECK_INTERVAL_SECONDS)
-
-        except KeyboardInterrupt:
-            log("Daemon stopped by user")
-            break
-        except Exception as e:
-            # FIX BUG #4: Better exception logging
-            log(f"[ERROR] Exception in monitor loop: {type(e).__name__}: {e}")
-            time.sleep(CHECK_INTERVAL_SECONDS)
-        finally:
-            # FIX BUG #3: Reset counter in finally block to prevent infinite save attempts
-            if state["active_seconds"] >= SAVE_INTERVAL_SECONDS:
-                state["active_seconds"] = 0
-                save_state(state)
-
-
-def start_daemon():
-    """Start the daemon as a background process"""
-    if PID_FILE.exists():
-        with open(PID_FILE) as f:
-            pid = int(f.read().strip())
-
-        # Check if process is running
-        try:
-            os.kill(pid, 0)  # Signal 0 checks if process exists
-            print(f"Periodic context save daemon already running (PID: {pid})")
-            return 1
-        except OSError:
-            # Process not running, remove stale PID file
-            PID_FILE.unlink()
-
-    # Start daemon process
-    if sys.platform == "win32":
-        # On Windows, use subprocess.Popen with DETACHED_PROCESS
-        import subprocess
-        CREATE_NO_WINDOW = 0x08000000
-
-        process = subprocess.Popen(
-            [sys.executable, __file__, "_monitor"],
-            creationflags=subprocess.DETACHED_PROCESS | CREATE_NO_WINDOW,
-            stdout=subprocess.DEVNULL,
-            stderr=subprocess.DEVNULL,
-        )
-    else:
-        # On Unix, fork
-        import subprocess
-        process = subprocess.Popen(
-            [sys.executable, __file__, "_monitor"],
-            stdout=subprocess.DEVNULL,
-            stderr=subprocess.DEVNULL,
-        )
-
-    # Save PID
-    with open(PID_FILE, "w") as f:
-        f.write(str(process.pid))
-
-    print(f"Started periodic context save daemon (PID: {process.pid})")
-    print(f"Logs: {LOG_FILE}")
-    return 0
-
-
-def stop_daemon():
-    """Stop the daemon"""
-    if not PID_FILE.exists():
-        print("Periodic context save daemon not running")
-        return 1
-
-    with open(PID_FILE) as f:
-        pid = int(f.read().strip())
-
-    try:
-        if sys.platform == "win32":
-            # On Windows, use taskkill
-            subprocess.run(["taskkill", "/F", "/PID", str(pid)], check=True, timeout=10)  # Prevent hung processes
-        else:
-            # On Unix, use kill
-            os.kill(pid, signal.SIGTERM)
-
-        print(f"Stopped periodic context save daemon (PID: {pid})")
-        PID_FILE.unlink()
-
-        if STATE_FILE.exists():
-            STATE_FILE.unlink()
-
-        return 0
-
-    except Exception as e:
-        print(f"Failed to stop daemon (PID: {pid}): {e}")
-        PID_FILE.unlink()
-        return 1
-
-
-def check_status():
-    """Check daemon status"""
-    if not PID_FILE.exists():
-        print("Periodic context save daemon not running")
-        return 1
-
-    with open(PID_FILE) as f:
-        pid = int(f.read().strip())
-
-    # Check if process is running
-    try:
-        os.kill(pid, 0)
-    except OSError:
-        print("Daemon PID file exists but process not running")
-        PID_FILE.unlink()
-        return 1
-
-    state = load_state()
-    active_seconds = state.get("active_seconds", 0)
-
-    print(f"Periodic context save daemon is running (PID: {pid})")
-    print(f"Active time: {active_seconds}s / {SAVE_INTERVAL_SECONDS}s")
-
-    if state.get("last_save"):
-        print(f"Last save: {state['last_save']}")
-
-    return 0
-
-
-def main():
-    """Main entry point"""
-    if len(sys.argv) < 2:
-        print("Usage: python periodic_context_save.py {start|stop|status}")
-        print()
-        print("Periodic context save daemon - saves context every 5 minutes of active time")
-        print()
-        print("Commands:")
-        print("  start   - Start the background daemon")
-        print("  stop    - Stop the daemon")
-        print("  status  - Check daemon status")
-        return 1
-
-    command = sys.argv[1]
-
-    if command == "start":
-        return start_daemon()
-    elif command == "stop":
-        return stop_daemon()
-    elif command == "status":
-        return check_status()
-    elif command == "_monitor":
-        # Internal command - run monitor loop
-        monitor_loop()
-        return 0
-    else:
-        print(f"Unknown command: {command}")
-        return 1
-
-
-if __name__ == "__main__":
-    sys.exit(main())

.claude/hooks/periodic_save_check.py

@@ -1,315 +0,0 @@
-#!/usr/bin/env python3
-"""
-Periodic Context Save - Windows Task Scheduler Version
-
-This script is designed to be called every minute by Windows Task Scheduler.
-It tracks active time and saves context every 5 minutes of activity.
-
-Usage:
-    Schedule this to run every minute via Task Scheduler:
-    python .claude/hooks/periodic_save_check.py
-"""
-
-import os
-import sys
-import json
-import subprocess
-from datetime import datetime, timezone
-from pathlib import Path
-
-# FIX BUG #1: Set UTF-8 encoding for stdout/stderr on Windows
-os.environ['PYTHONIOENCODING'] = 'utf-8'
-
-import requests
-
-# Configuration
-SCRIPT_DIR = Path(__file__).parent
-CLAUDE_DIR = SCRIPT_DIR.parent
-PROJECT_ROOT = CLAUDE_DIR.parent
-STATE_FILE = CLAUDE_DIR / ".periodic-save-state.json"
-LOG_FILE = CLAUDE_DIR / "periodic-save.log"
-CONFIG_FILE = CLAUDE_DIR / "context-recall-config.env"
-LOCK_FILE = CLAUDE_DIR / ".periodic-save.lock"  # Mutex lock to prevent overlaps
-
-SAVE_INTERVAL_SECONDS = 300  # 5 minutes
-
-
-def log(message):
-    """Write log message (encoding-safe)"""
-    timestamp = datetime.now().strftime("%Y-%m-%d %H:%M:%S")
-    log_message = f"[{timestamp}] {message}\n"
-
-    try:
-        with open(LOG_FILE, "a", encoding="utf-8") as f:
-            f.write(log_message)
-    except Exception:
-        pass  # Silent fail if can't write log
-
-    # FIX BUG #5: Safe stderr printing (handles encoding errors)
-    try:
-        print(log_message.strip(), file=sys.stderr)
-    except UnicodeEncodeError:
-        # Fallback: encode with error handling
-        safe_message = log_message.encode('ascii', errors='replace').decode('ascii')
-        print(safe_message.strip(), file=sys.stderr)
-
-
-def load_config():
-    """Load configuration from context-recall-config.env"""
-    config = {
-        "api_url": "http://172.16.3.30:8001",
-        "jwt_token": None,
-        "project_id": None,  # FIX BUG #2: Add project_id to config
-    }
-
-    if CONFIG_FILE.exists():
-        with open(CONFIG_FILE) as f:
-            for line in f:
-                line = line.strip()
-                if line.startswith("CLAUDE_API_URL=") or line.startswith("API_BASE_URL="):
-                    config["api_url"] = line.split("=", 1)[1]
-                elif line.startswith("JWT_TOKEN="):
-                    config["jwt_token"] = line.split("=", 1)[1]
-                elif line.startswith("CLAUDE_PROJECT_ID="):
-                    config["project_id"] = line.split("=", 1)[1]
-
-    return config
-
-
-def detect_project_id():
-    """Detect project ID from git config"""
-    try:
-        os.chdir(PROJECT_ROOT)
-
-        # Try git config first
-        result = subprocess.run(
-            ["git", "config", "--local", "claude.projectid"],
-            capture_output=True,
-            text=True,
-            check=False,
-            cwd=PROJECT_ROOT,
-            timeout=5,  # Prevent hung processes
-        )
-        if result.returncode == 0 and result.stdout.strip():
-            return result.stdout.strip()
-
-        # Try to derive from git remote URL
-        result = subprocess.run(
-            ["git", "config", "--get", "remote.origin.url"],
-            capture_output=True,
-            text=True,
-            check=False,
-            cwd=PROJECT_ROOT,
-            timeout=5,  # Prevent hung processes
-        )
-        if result.returncode == 0 and result.stdout.strip():
-            import hashlib
-            return hashlib.md5(result.stdout.strip().encode()).hexdigest()
-
-    except Exception:
-        pass
-
-    return None
-
-
-def is_claude_active():
-    """Check if Claude Code is actively running"""
-    try:
-        # Check for Claude Code process
-        result = subprocess.run(
-            ["tasklist.exe"],
-            capture_output=True,
-            text=True,
-            check=False,
-            timeout=5,  # Prevent hung processes
-        )
-
-        # Look for claude, node, or other indicators
-        output_lower = result.stdout.lower()
-        if any(proc in output_lower for proc in ["claude", "node.exe", "code.exe"]):
-            # Also check for recent file modifications
-            import time
-            two_minutes_ago = time.time() - 120
-
-            # Check a few common directories for recent activity
-            for check_dir in [PROJECT_ROOT, PROJECT_ROOT / "api", PROJECT_ROOT / ".claude"]:
-                if check_dir.exists():
-                    for file in check_dir.rglob("*"):
-                        if file.is_file():
-                            try:
-                                if file.stat().st_mtime > two_minutes_ago:
-                                    return True
-                            except:
-                                continue
-
-    except Exception as e:
-        log(f"Error checking activity: {e}")
-
-    return False
-
-
-def acquire_lock():
-    """Acquire execution lock to prevent overlapping runs"""
-    try:
-        # Check if lock file exists and is recent (< 60 seconds old)
-        if LOCK_FILE.exists():
-            lock_age = datetime.now().timestamp() - LOCK_FILE.stat().st_mtime
-            if lock_age < 60:  # Lock is fresh, another instance is running
-                log("[INFO] Another instance is running, skipping")
-                return False
-
-        # Create/update lock file
-        LOCK_FILE.touch()
-        return True
-    except Exception as e:
-        log(f"[WARNING] Lock acquisition failed: {e}")
-        return True  # Proceed anyway if lock fails
-
-
-def release_lock():
-    """Release execution lock"""
-    try:
-        if LOCK_FILE.exists():
-            LOCK_FILE.unlink()
-    except Exception:
-        pass  # Ignore errors on cleanup
-
-
-def load_state():
-    """Load state from state file"""
-    if STATE_FILE.exists():
-        try:
-            with open(STATE_FILE) as f:
-                return json.load(f)
-        except Exception:
-            pass
-
-    return {
-        "active_seconds": 0,
-        "last_check": None,
-        "last_save": None,
-    }
-
-
-def save_state(state):
-    """Save state to state file"""
-    state["last_check"] = datetime.now(timezone.utc).isoformat()
-    try:
-        with open(STATE_FILE, "w") as f:
-            json.dump(state, f, indent=2)
-    except:
-        pass  # Silent fail
-
-
-def save_periodic_context(config, project_id):
-    """Save context to database via API"""
-    # FIX BUG #7: Validate before attempting save
-    if not config["jwt_token"]:
-        log("[ERROR] No JWT token - cannot save context")
-        return False
-
-    if not project_id:
-        log("[ERROR] No project_id - cannot save context")
-        return False
-
-    title = f"Periodic Save - {datetime.now().strftime('%Y-%m-%d %H:%M')}"
-    summary = f"Auto-saved context after {SAVE_INTERVAL_SECONDS // 60} minutes of active work. Session in progress on project: {project_id}"
-
-    # FIX BUG #2: Include project_id in payload
-    payload = {
-        "project_id": project_id,
-        "context_type": "session_summary",
-        "title": title,
-        "dense_summary": summary,
-        "relevance_score": 5.0,
-        "tags": json.dumps(["auto-save", "periodic", "active-session", project_id]),
-    }
-
-    try:
-        url = f"{config['api_url']}/api/conversation-contexts"
-        headers = {
-            "Authorization": f"Bearer {config['jwt_token']}",
-            "Content-Type": "application/json",
-        }
-
-        response = requests.post(url, json=payload, headers=headers, timeout=10)
-
-        if response.status_code in [200, 201]:
-            context_id = response.json().get('id', 'unknown')
-            log(f"[SUCCESS] Context saved (ID: {context_id}, Active time: {SAVE_INTERVAL_SECONDS}s)")
-            return True
-        else:
-            # FIX BUG #4: Improved error logging with full details
-            error_detail = response.text[:200] if response.text else "No error detail"
-            log(f"[ERROR] Failed to save: HTTP {response.status_code}")
-            log(f"[ERROR] Response: {error_detail}")
-            return False
-
-    except Exception as e:
-        # FIX BUG #4: More detailed error logging
-        log(f"[ERROR] Exception saving context: {type(e).__name__}: {e}")
-        return False
-
-
-def main():
-    """Main entry point - called every minute by Task Scheduler"""
-    # Acquire lock to prevent overlapping executions
-    if not acquire_lock():
-        return 0  # Another instance is running, exit gracefully
-
-    try:
-        config = load_config()
-        state = load_state()
-
-        # FIX BUG #7: Validate configuration
-        if not config["jwt_token"]:
-            log("[WARNING] No JWT token found in config")
-
-        # Determine project_id (config takes precedence over git detection)
-        project_id = config["project_id"]
-        if not project_id:
-            project_id = detect_project_id()
-            if not project_id:
-                log("[WARNING] No project_id found")
-
-        # Check if Claude is active
-        if is_claude_active():
-            # Increment active time (60 seconds per check)
-            state["active_seconds"] += 60
-
-            # Check if we've reached the save interval
-            if state["active_seconds"] >= SAVE_INTERVAL_SECONDS:
-                log(f"{SAVE_INTERVAL_SECONDS}s active time reached - saving context")
-
-                save_success = save_periodic_context(config, project_id)
-
-                if save_success:
-                    state["last_save"] = datetime.now(timezone.utc).isoformat()
-
-                # FIX BUG #3: Always reset counter in finally block (see below)
-
-            save_state(state)
-        else:
-            # Not active - don't increment timer but save state
-            save_state(state)
-
-        return 0
-    except Exception as e:
-        # FIX BUG #4: Better exception logging
-        log(f"[ERROR] Fatal error: {type(e).__name__}: {e}")
-        return 1
-    finally:
-        # FIX BUG #3: Reset counter in finally block to prevent infinite save attempts
-        if state["active_seconds"] >= SAVE_INTERVAL_SECONDS:
-            state["active_seconds"] = 0
-            save_state(state)
-        # Always release lock, even if error occurs
-        release_lock()
-
-
-if __name__ == "__main__":
-    try:
-        sys.exit(main())
-    except Exception as e:
-        log(f"Fatal error: {e}")
-        sys.exit(1)

.claude/hooks/periodic_save_windows.bat

@@ -1,11 +0,0 @@
-@echo off
-REM Windows wrapper for periodic context save
-REM Can be run from Task Scheduler every minute
-
-cd /d D:\ClaudeTools
-
-REM Run the check-and-save script
-python .claude\hooks\periodic_save_check.py
-
-REM Exit silently
-exit /b 0

.claude/hooks/setup_periodic_save.ps1

@@ -1,69 +0,0 @@
-# Setup Periodic Context Save - Windows Task Scheduler
-# This script creates a scheduled task to run periodic_save_check.py every minute
-# Uses pythonw.exe to run without console window
-
-$TaskName = "ClaudeTools - Periodic Context Save"
-$ScriptPath = "D:\ClaudeTools\.claude\hooks\periodic_save_check.py"
-$WorkingDir = "D:\ClaudeTools"
-
-# Use pythonw.exe instead of python.exe to run without console window
-$PythonExe = (Get-Command python).Source
-$PythonDir = Split-Path $PythonExe -Parent
-$PythonwPath = Join-Path $PythonDir "pythonw.exe"
-
-# Fallback to python.exe if pythonw.exe doesn't exist (shouldn't happen)
-if (-not (Test-Path $PythonwPath)) {
-    Write-Warning "pythonw.exe not found at $PythonwPath, falling back to python.exe"
-    $PythonwPath = $PythonExe
-}
-
-# Check if task already exists
-$ExistingTask = Get-ScheduledTask -TaskName $TaskName -ErrorAction SilentlyContinue
-
-if ($ExistingTask) {
-    Write-Host "Task '$TaskName' already exists. Removing old task..."
-    Unregister-ScheduledTask -TaskName $TaskName -Confirm:$false
-}
-
-# Create action to run Python script with pythonw.exe (no console window)
-$Action = New-ScheduledTaskAction -Execute $PythonwPath `
-    -Argument $ScriptPath `
-    -WorkingDirectory $WorkingDir
-
-# Create trigger to run every 5 minutes (indefinitely) - Reduced from 1min to prevent zombie accumulation
-$Trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 5)
-
-# Create settings - Hidden and DisallowStartIfOnBatteries set to false
-$Settings = New-ScheduledTaskSettingsSet `
-    -AllowStartIfOnBatteries `
-    -DontStopIfGoingOnBatteries `
-    -StartWhenAvailable `
-    -ExecutionTimeLimit (New-TimeSpan -Minutes 5) `
-    -Hidden
-
-# Create principal (run as current user, no window)
-$Principal = New-ScheduledTaskPrincipal -UserId "$env:USERDOMAIN\$env:USERNAME" -LogonType S4U
-
-# Register the task
-Register-ScheduledTask -TaskName $TaskName `
-    -Action $Action `
-    -Trigger $Trigger `
-    -Settings $Settings `
-    -Principal $Principal `
-    -Description "Automatically saves Claude Code context every 5 minutes of active work"
-
-Write-Host "[SUCCESS] Scheduled task created successfully!"
-Write-Host ""
-Write-Host "Task Name: $TaskName"
-Write-Host "Runs: Every 5 minutes (HIDDEN - no console window)"
-Write-Host "Action: Checks activity and saves context every 5 minutes"
-Write-Host "Executable: $PythonwPath (pythonw.exe = no window)"
-Write-Host ""
-Write-Host "To verify task is hidden:"
-Write-Host "  Get-ScheduledTask -TaskName '$TaskName' | Select-Object -ExpandProperty Settings"
-Write-Host ""
-Write-Host "To remove:"
-Write-Host "  Unregister-ScheduledTask -TaskName '$TaskName' -Confirm:`$false"
-Write-Host ""
-Write-Host "View logs:"
-Write-Host '  Get-Content D:\ClaudeTools\.claude\periodic-save.log -Tail 20'

.claude/hooks/sync-contexts

@@ -1,110 +0,0 @@
-#!/bin/bash
-#
-# Sync Queued Contexts to Database
-# Uploads any locally queued contexts to the central API
-# Can be run manually or called automatically by hooks
-#
-# Usage: bash .claude/hooks/sync-contexts
-#
-
-# Load configuration
-CLAUDE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-CONFIG_FILE="$CLAUDE_DIR/context-recall-config.env"
-
-if [ -f "$CONFIG_FILE" ]; then
-    source "$CONFIG_FILE"
-fi
-
-# Default values
-API_URL="${CLAUDE_API_URL:-http://172.16.3.30:8001}"
-QUEUE_DIR="$CLAUDE_DIR/context-queue"
-PENDING_DIR="$QUEUE_DIR/pending"
-UPLOADED_DIR="$QUEUE_DIR/uploaded"
-FAILED_DIR="$QUEUE_DIR/failed"
-
-# Exit if no JWT token
-if [ -z "$JWT_TOKEN" ]; then
-    echo "ERROR: No JWT token available" >&2
-    exit 1
-fi
-
-# Create directories if they don't exist
-mkdir -p "$PENDING_DIR" "$UPLOADED_DIR" "$FAILED_DIR" 2>/dev/null
-
-# Check if there are any pending files
-PENDING_COUNT=$(find "$PENDING_DIR" -type f -name "*.json" 2>/dev/null | wc -l)
-
-if [ "$PENDING_COUNT" -eq 0 ]; then
-    # No pending contexts to sync
-    exit 0
-fi
-
-echo "==================================="
-echo "Syncing Queued Contexts"
-echo "==================================="
-echo "Found $PENDING_COUNT pending context(s)"
-echo ""
-
-# Process each pending file
-SUCCESS_COUNT=0
-FAIL_COUNT=0
-
-for QUEUE_FILE in "$PENDING_DIR"/*.json; do
-    # Skip if no files match
-    [ -e "$QUEUE_FILE" ] || continue
-
-    FILENAME=$(basename "$QUEUE_FILE")
-    echo "Processing: $FILENAME"
-
-    # Read the payload
-    PAYLOAD=$(cat "$QUEUE_FILE")
-
-    # Determine endpoint based on filename
-    if [[ "$FILENAME" == *"_state.json" ]]; then
-        ENDPOINT="${API_URL}/api/project-states"
-    else
-        ENDPOINT="${API_URL}/api/conversation-contexts"
-    fi
-
-    # Try to POST to API
-    RESPONSE=$(curl -s --max-time 10 -w "\n%{http_code}" \
-        -X POST "$ENDPOINT" \
-        -H "Authorization: Bearer ${JWT_TOKEN}" \
-        -H "Content-Type: application/json" \
-        -d "$PAYLOAD" 2>/dev/null)
-
-    HTTP_CODE=$(echo "$RESPONSE" | tail -n1)
-
-    if [ "$HTTP_CODE" = "200" ] || [ "$HTTP_CODE" = "201" ]; then
-        # Success - move to uploaded directory
-        mv "$QUEUE_FILE" "$UPLOADED_DIR/"
-        echo "  [OK] Uploaded successfully"
-        ((SUCCESS_COUNT++))
-    else
-        # Failed - move to failed directory for manual review
-        mv "$QUEUE_FILE" "$FAILED_DIR/"
-        echo "  [ERROR] Upload failed (HTTP $HTTP_CODE) - moved to failed/"
-        ((FAIL_COUNT++))
-    fi
-done
-
-echo ""
-echo "==================================="
-echo "Sync Complete"
-echo "==================================="
-echo "Successful: $SUCCESS_COUNT"
-echo "Failed: $FAIL_COUNT"
-echo ""
-
-# Clean up old uploaded files (keep last 100)
-UPLOADED_COUNT=$(find "$UPLOADED_DIR" -type f -name "*.json" 2>/dev/null | wc -l)
-if [ "$UPLOADED_COUNT" -gt 100 ]; then
-    echo "Cleaning up old uploaded contexts (keeping last 100)..."
-    find "$UPLOADED_DIR" -type f -name "*.json" -printf '%T@ %p\n' | \
-        sort -n | \
-        head -n -100 | \
-        cut -d' ' -f2- | \
-        xargs rm -f
-fi
-
-exit 0

.claude/hooks/task-complete

@@ -1,182 +0,0 @@
-#!/bin/bash
-#
-# Claude Code Hook: task-complete (v2 - with offline support)
-# Runs AFTER a task is completed
-# Saves conversation context to the database for future recall
-# FALLBACK: Queues locally when API is unavailable, syncs later
-#
-# Expected environment variables:
-#   CLAUDE_PROJECT_ID - UUID of the current project
-#   JWT_TOKEN - Authentication token for API
-#   CLAUDE_API_URL - API base URL (default: http://172.16.3.30:8001)
-#   CONTEXT_RECALL_ENABLED - Set to "false" to disable (default: true)
-#   TASK_SUMMARY - Summary of completed task (auto-generated by Claude)
-#   TASK_FILES - Files modified during task (comma-separated)
-#
-
-# Load configuration if exists
-CONFIG_FILE="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)/context-recall-config.env"
-if [ -f "$CONFIG_FILE" ]; then
-    source "$CONFIG_FILE"
-fi
-
-# Default values
-API_URL="${CLAUDE_API_URL:-http://172.16.3.30:8001}"
-ENABLED="${CONTEXT_RECALL_ENABLED:-true}"
-
-# Local storage paths
-CLAUDE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-QUEUE_DIR="$CLAUDE_DIR/context-queue"
-PENDING_DIR="$QUEUE_DIR/pending"
-UPLOADED_DIR="$QUEUE_DIR/uploaded"
-
-# Exit early if disabled
-if [ "$ENABLED" != "true" ]; then
-    exit 0
-fi
-
-# Detect project ID (same logic as user-prompt-submit)
-if [ -z "$CLAUDE_PROJECT_ID" ]; then
-    PROJECT_ID=$(git config --local claude.projectid 2>/dev/null)
-
-    if [ -z "$PROJECT_ID" ]; then
-        GIT_REMOTE=$(git config --get remote.origin.url 2>/dev/null)
-        if [ -n "$GIT_REMOTE" ]; then
-            PROJECT_ID=$(echo -n "$GIT_REMOTE" | md5sum | cut -d' ' -f1)
-        fi
-    fi
-else
-    PROJECT_ID="$CLAUDE_PROJECT_ID"
-fi
-
-# Exit if no project ID
-if [ -z "$PROJECT_ID" ]; then
-    exit 0
-fi
-
-# Create queue directories if they don't exist
-mkdir -p "$PENDING_DIR" "$UPLOADED_DIR" 2>/dev/null
-
-# Gather task information
-TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
-TIMESTAMP_FILENAME=$(date -u +"%Y%m%d_%H%M%S")
-GIT_BRANCH=$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo "unknown")
-GIT_COMMIT=$(git rev-parse --short HEAD 2>/dev/null || echo "none")
-
-# Get recent git changes
-CHANGED_FILES=$(git diff --name-only HEAD~1 2>/dev/null | head -10 | tr '\n' ',' | sed 's/,$//')
-if [ -z "$CHANGED_FILES" ]; then
-    CHANGED_FILES="${TASK_FILES:-}"
-fi
-
-# Create task summary
-if [ -z "$TASK_SUMMARY" ]; then
-    # Generate basic summary from git log if no summary provided
-    TASK_SUMMARY=$(git log -1 --pretty=format:"%s" 2>/dev/null || echo "Task completed")
-fi
-
-# Build context payload
-CONTEXT_TITLE="Session: ${TIMESTAMP}"
-CONTEXT_TYPE="session_summary"
-RELEVANCE_SCORE=7.0
-
-# Create dense summary
-DENSE_SUMMARY="Task completed on branch '${GIT_BRANCH}' (commit: ${GIT_COMMIT}).
-
-Summary: ${TASK_SUMMARY}
-
-Modified files: ${CHANGED_FILES:-none}
-
-Timestamp: ${TIMESTAMP}"
-
-# Escape JSON strings
-escape_json() {
-    echo "$1" | python3 -c "import sys, json; print(json.dumps(sys.stdin.read())[1:-1])"
-}
-
-ESCAPED_TITLE=$(escape_json "$CONTEXT_TITLE")
-ESCAPED_SUMMARY=$(escape_json "$DENSE_SUMMARY")
-
-# Save context to database
-CONTEXT_PAYLOAD=$(cat <<EOF
-{
-    "project_id": "${PROJECT_ID}",
-    "context_type": "${CONTEXT_TYPE}",
-    "title": ${ESCAPED_TITLE},
-    "dense_summary": ${ESCAPED_SUMMARY},
-    "relevance_score": ${RELEVANCE_SCORE},
-    "metadata": {
-        "git_branch": "${GIT_BRANCH}",
-        "git_commit": "${GIT_COMMIT}",
-        "files_modified": "${CHANGED_FILES}",
-        "timestamp": "${TIMESTAMP}"
-    }
-}
-EOF
-)
-
-# Update project state
-PROJECT_STATE_PAYLOAD=$(cat <<EOF
-{
-    "project_id": "${PROJECT_ID}",
-    "state_data": {
-        "last_task_completion": "${TIMESTAMP}",
-        "last_git_commit": "${GIT_COMMIT}",
-        "last_git_branch": "${GIT_BRANCH}",
-        "recent_files": "${CHANGED_FILES}"
-    },
-    "state_type": "task_completion"
-}
-EOF
-)
-
-# Try to POST to API if we have a JWT token
-API_SUCCESS=false
-if [ -n "$JWT_TOKEN" ]; then
-    RESPONSE=$(curl -s --max-time 5 -w "\n%{http_code}" \
-        -X POST "${API_URL}/api/conversation-contexts" \
-        -H "Authorization: Bearer ${JWT_TOKEN}" \
-        -H "Content-Type: application/json" \
-        -d "$CONTEXT_PAYLOAD" 2>/dev/null)
-
-    HTTP_CODE=$(echo "$RESPONSE" | tail -n1)
-    RESPONSE_BODY=$(echo "$RESPONSE" | sed '$d')
-
-    if [ "$HTTP_CODE" = "200" ] || [ "$HTTP_CODE" = "201" ]; then
-        API_SUCCESS=true
-
-        # Also update project state
-        curl -s --max-time 5 \
-            -X POST "${API_URL}/api/project-states" \
-            -H "Authorization: Bearer ${JWT_TOKEN}" \
-            -H "Content-Type: application/json" \
-            -d "$PROJECT_STATE_PAYLOAD" 2>/dev/null >/dev/null
-    fi
-fi
-
-# If API call failed, queue locally
-if [ "$API_SUCCESS" = "false" ]; then
-    # Save context to pending queue
-    QUEUE_FILE="$PENDING_DIR/${PROJECT_ID}_${TIMESTAMP_FILENAME}_context.json"
-    echo "$CONTEXT_PAYLOAD" > "$QUEUE_FILE"
-
-    # Save project state to pending queue
-    STATE_QUEUE_FILE="$PENDING_DIR/${PROJECT_ID}_${TIMESTAMP_FILENAME}_state.json"
-    echo "$PROJECT_STATE_PAYLOAD" > "$STATE_QUEUE_FILE"
-
-    echo "[WARNING] Context queued locally (API unavailable) - will sync when online" >&2
-
-    # Try to sync (opportunistic) - Changed from background (&) to synchronous to prevent zombie processes
-    if [ -n "$JWT_TOKEN" ]; then
-        bash "$(dirname "${BASH_SOURCE[0]}")/sync-contexts" >/dev/null 2>&1
-    fi
-else
-    echo "[OK] Context saved to database" >&2
-
-    # Trigger sync of any queued items - Changed from background (&) to synchronous to prevent zombie processes
-    if [ -n "$JWT_TOKEN" ]; then
-        bash "$(dirname "${BASH_SOURCE[0]}")/sync-contexts" >/dev/null 2>&1
-    fi
-fi
-
-exit 0

.claude/hooks/task-complete-v2

@@ -1,182 +0,0 @@
-#!/bin/bash
-#
-# Claude Code Hook: task-complete (v2 - with offline support)
-# Runs AFTER a task is completed
-# Saves conversation context to the database for future recall
-# FALLBACK: Queues locally when API is unavailable, syncs later
-#
-# Expected environment variables:
-#   CLAUDE_PROJECT_ID - UUID of the current project
-#   JWT_TOKEN - Authentication token for API
-#   CLAUDE_API_URL - API base URL (default: http://172.16.3.30:8001)
-#   CONTEXT_RECALL_ENABLED - Set to "false" to disable (default: true)
-#   TASK_SUMMARY - Summary of completed task (auto-generated by Claude)
-#   TASK_FILES - Files modified during task (comma-separated)
-#
-
-# Load configuration if exists
-CONFIG_FILE="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)/context-recall-config.env"
-if [ -f "$CONFIG_FILE" ]; then
-    source "$CONFIG_FILE"
-fi
-
-# Default values
-API_URL="${CLAUDE_API_URL:-http://172.16.3.30:8001}"
-ENABLED="${CONTEXT_RECALL_ENABLED:-true}"
-
-# Local storage paths
-CLAUDE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-QUEUE_DIR="$CLAUDE_DIR/context-queue"
-PENDING_DIR="$QUEUE_DIR/pending"
-UPLOADED_DIR="$QUEUE_DIR/uploaded"
-
-# Exit early if disabled
-if [ "$ENABLED" != "true" ]; then
-    exit 0
-fi
-
-# Detect project ID (same logic as user-prompt-submit)
-if [ -z "$CLAUDE_PROJECT_ID" ]; then
-    PROJECT_ID=$(git config --local claude.projectid 2>/dev/null)
-
-    if [ -z "$PROJECT_ID" ]; then
-        GIT_REMOTE=$(git config --get remote.origin.url 2>/dev/null)
-        if [ -n "$GIT_REMOTE" ]; then
-            PROJECT_ID=$(echo -n "$GIT_REMOTE" | md5sum | cut -d' ' -f1)
-        fi
-    fi
-else
-    PROJECT_ID="$CLAUDE_PROJECT_ID"
-fi
-
-# Exit if no project ID
-if [ -z "$PROJECT_ID" ]; then
-    exit 0
-fi
-
-# Create queue directories if they don't exist
-mkdir -p "$PENDING_DIR" "$UPLOADED_DIR" 2>/dev/null
-
-# Gather task information
-TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
-TIMESTAMP_FILENAME=$(date -u +"%Y%m%d_%H%M%S")
-GIT_BRANCH=$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo "unknown")
-GIT_COMMIT=$(git rev-parse --short HEAD 2>/dev/null || echo "none")
-
-# Get recent git changes
-CHANGED_FILES=$(git diff --name-only HEAD~1 2>/dev/null | head -10 | tr '\n' ',' | sed 's/,$//')
-if [ -z "$CHANGED_FILES" ]; then
-    CHANGED_FILES="${TASK_FILES:-}"
-fi
-
-# Create task summary
-if [ -z "$TASK_SUMMARY" ]; then
-    # Generate basic summary from git log if no summary provided
-    TASK_SUMMARY=$(git log -1 --pretty=format:"%s" 2>/dev/null || echo "Task completed")
-fi
-
-# Build context payload
-CONTEXT_TITLE="Session: ${TIMESTAMP}"
-CONTEXT_TYPE="session_summary"
-RELEVANCE_SCORE=7.0
-
-# Create dense summary
-DENSE_SUMMARY="Task completed on branch '${GIT_BRANCH}' (commit: ${GIT_COMMIT}).
-
-Summary: ${TASK_SUMMARY}
-
-Modified files: ${CHANGED_FILES:-none}
-
-Timestamp: ${TIMESTAMP}"
-
-# Escape JSON strings
-escape_json() {
-    echo "$1" | python3 -c "import sys, json; print(json.dumps(sys.stdin.read())[1:-1])"
-}
-
-ESCAPED_TITLE=$(escape_json "$CONTEXT_TITLE")
-ESCAPED_SUMMARY=$(escape_json "$DENSE_SUMMARY")
-
-# Save context to database
-CONTEXT_PAYLOAD=$(cat <<EOF
-{
-    "project_id": "${PROJECT_ID}",
-    "context_type": "${CONTEXT_TYPE}",
-    "title": ${ESCAPED_TITLE},
-    "dense_summary": ${ESCAPED_SUMMARY},
-    "relevance_score": ${RELEVANCE_SCORE},
-    "metadata": {
-        "git_branch": "${GIT_BRANCH}",
-        "git_commit": "${GIT_COMMIT}",
-        "files_modified": "${CHANGED_FILES}",
-        "timestamp": "${TIMESTAMP}"
-    }
-}
-EOF
-)
-
-# Update project state
-PROJECT_STATE_PAYLOAD=$(cat <<EOF
-{
-    "project_id": "${PROJECT_ID}",
-    "state_data": {
-        "last_task_completion": "${TIMESTAMP}",
-        "last_git_commit": "${GIT_COMMIT}",
-        "last_git_branch": "${GIT_BRANCH}",
-        "recent_files": "${CHANGED_FILES}"
-    },
-    "state_type": "task_completion"
-}
-EOF
-)
-
-# Try to POST to API if we have a JWT token
-API_SUCCESS=false
-if [ -n "$JWT_TOKEN" ]; then
-    RESPONSE=$(curl -s --max-time 5 -w "\n%{http_code}" \
-        -X POST "${API_URL}/api/conversation-contexts" \
-        -H "Authorization: Bearer ${JWT_TOKEN}" \
-        -H "Content-Type: application/json" \
-        -d "$CONTEXT_PAYLOAD" 2>/dev/null)
-
-    HTTP_CODE=$(echo "$RESPONSE" | tail -n1)
-    RESPONSE_BODY=$(echo "$RESPONSE" | sed '$d')
-
-    if [ "$HTTP_CODE" = "200" ] || [ "$HTTP_CODE" = "201" ]; then
-        API_SUCCESS=true
-
-        # Also update project state
-        curl -s --max-time 5 \
-            -X POST "${API_URL}/api/project-states" \
-            -H "Authorization: Bearer ${JWT_TOKEN}" \
-            -H "Content-Type: application/json" \
-            -d "$PROJECT_STATE_PAYLOAD" 2>/dev/null >/dev/null
-    fi
-fi
-
-# If API call failed, queue locally
-if [ "$API_SUCCESS" = "false" ]; then
-    # Save context to pending queue
-    QUEUE_FILE="$PENDING_DIR/${PROJECT_ID}_${TIMESTAMP_FILENAME}_context.json"
-    echo "$CONTEXT_PAYLOAD" > "$QUEUE_FILE"
-
-    # Save project state to pending queue
-    STATE_QUEUE_FILE="$PENDING_DIR/${PROJECT_ID}_${TIMESTAMP_FILENAME}_state.json"
-    echo "$PROJECT_STATE_PAYLOAD" > "$STATE_QUEUE_FILE"
-
-    echo "[WARNING] Context queued locally (API unavailable) - will sync when online" >&2
-
-    # Try to sync in background (opportunistic)
-    if [ -n "$JWT_TOKEN" ]; then
-        bash "$(dirname "${BASH_SOURCE[0]}")/sync-contexts" >/dev/null 2>&1 &
-    fi
-else
-    echo "[OK] Context saved to database" >&2
-
-    # Trigger background sync of any queued items
-    if [ -n "$JWT_TOKEN" ]; then
-        bash "$(dirname "${BASH_SOURCE[0]}")/sync-contexts" >/dev/null 2>&1 &
-    fi
-fi
-
-exit 0

.claude/hooks/task-complete.v1.backup

@@ -1,140 +0,0 @@
-#!/bin/bash
-#
-# Claude Code Hook: task-complete
-# Runs AFTER a task is completed
-# Saves conversation context to the database for future recall
-#
-# Expected environment variables:
-#   CLAUDE_PROJECT_ID - UUID of the current project
-#   JWT_TOKEN - Authentication token for API
-#   CLAUDE_API_URL - API base URL (default: http://localhost:8000)
-#   CONTEXT_RECALL_ENABLED - Set to "false" to disable (default: true)
-#   TASK_SUMMARY - Summary of completed task (auto-generated by Claude)
-#   TASK_FILES - Files modified during task (comma-separated)
-#
-
-# Load configuration if exists
-CONFIG_FILE="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)/context-recall-config.env"
-if [ -f "$CONFIG_FILE" ]; then
-    source "$CONFIG_FILE"
-fi
-
-# Default values
-API_URL="${CLAUDE_API_URL:-http://localhost:8000}"
-ENABLED="${CONTEXT_RECALL_ENABLED:-true}"
-
-# Exit early if disabled
-if [ "$ENABLED" != "true" ]; then
-    exit 0
-fi
-
-# Detect project ID (same logic as user-prompt-submit)
-if [ -z "$CLAUDE_PROJECT_ID" ]; then
-    PROJECT_ID=$(git config --local claude.projectid 2>/dev/null)
-
-    if [ -z "$PROJECT_ID" ]; then
-        GIT_REMOTE=$(git config --get remote.origin.url 2>/dev/null)
-        if [ -n "$GIT_REMOTE" ]; then
-            PROJECT_ID=$(echo -n "$GIT_REMOTE" | md5sum | cut -d' ' -f1)
-        fi
-    fi
-else
-    PROJECT_ID="$CLAUDE_PROJECT_ID"
-fi
-
-# Exit if no project ID or JWT token
-if [ -z "$PROJECT_ID" ] || [ -z "$JWT_TOKEN" ]; then
-    exit 0
-fi
-
-# Gather task information
-TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
-GIT_BRANCH=$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo "unknown")
-GIT_COMMIT=$(git rev-parse --short HEAD 2>/dev/null || echo "none")
-
-# Get recent git changes
-CHANGED_FILES=$(git diff --name-only HEAD~1 2>/dev/null | head -10 | tr '\n' ',' | sed 's/,$//')
-if [ -z "$CHANGED_FILES" ]; then
-    CHANGED_FILES="${TASK_FILES:-}"
-fi
-
-# Create task summary
-if [ -z "$TASK_SUMMARY" ]; then
-    # Generate basic summary from git log if no summary provided
-    TASK_SUMMARY=$(git log -1 --pretty=format:"%s" 2>/dev/null || echo "Task completed")
-fi
-
-# Build context payload
-CONTEXT_TITLE="Session: ${TIMESTAMP}"
-CONTEXT_TYPE="session_summary"
-RELEVANCE_SCORE=7.0
-
-# Create dense summary
-DENSE_SUMMARY="Task completed on branch '${GIT_BRANCH}' (commit: ${GIT_COMMIT}).
-
-Summary: ${TASK_SUMMARY}
-
-Modified files: ${CHANGED_FILES:-none}
-
-Timestamp: ${TIMESTAMP}"
-
-# Escape JSON strings
-escape_json() {
-    echo "$1" | python3 -c "import sys, json; print(json.dumps(sys.stdin.read())[1:-1])"
-}
-
-ESCAPED_TITLE=$(escape_json "$CONTEXT_TITLE")
-ESCAPED_SUMMARY=$(escape_json "$DENSE_SUMMARY")
-
-# Save context to database
-CONTEXT_PAYLOAD=$(cat <<EOF
-{
-    "project_id": "${PROJECT_ID}",
-    "context_type": "${CONTEXT_TYPE}",
-    "title": ${ESCAPED_TITLE},
-    "dense_summary": ${ESCAPED_SUMMARY},
-    "relevance_score": ${RELEVANCE_SCORE},
-    "metadata": {
-        "git_branch": "${GIT_BRANCH}",
-        "git_commit": "${GIT_COMMIT}",
-        "files_modified": "${CHANGED_FILES}",
-        "timestamp": "${TIMESTAMP}"
-    }
-}
-EOF
-)
-
-# POST to conversation-contexts endpoint
-RESPONSE=$(curl -s --max-time 5 \
-    -X POST "${API_URL}/api/conversation-contexts" \
-    -H "Authorization: Bearer ${JWT_TOKEN}" \
-    -H "Content-Type: application/json" \
-    -d "$CONTEXT_PAYLOAD" 2>/dev/null)
-
-# Update project state
-PROJECT_STATE_PAYLOAD=$(cat <<EOF
-{
-    "project_id": "${PROJECT_ID}",
-    "state_data": {
-        "last_task_completion": "${TIMESTAMP}",
-        "last_git_commit": "${GIT_COMMIT}",
-        "last_git_branch": "${GIT_BRANCH}",
-        "recent_files": "${CHANGED_FILES}"
-    },
-    "state_type": "task_completion"
-}
-EOF
-)
-
-curl -s --max-time 5 \
-    -X POST "${API_URL}/api/project-states" \
-    -H "Authorization: Bearer ${JWT_TOKEN}" \
-    -H "Content-Type: application/json" \
-    -d "$PROJECT_STATE_PAYLOAD" 2>/dev/null >/dev/null
-
-# Log success (optional - comment out for silent operation)
-if [ -n "$RESPONSE" ]; then
-    echo "✓ Context saved to database" >&2
-fi
-
-exit 0

.claude/hooks/update_to_invisible.ps1

@@ -1,85 +0,0 @@
-# Quick Update - Make Existing Periodic Save Task Invisible
-# This script updates the existing task to run without showing a window
-
-$TaskName = "ClaudeTools - Periodic Context Save"
-
-Write-Host "Updating task '$TaskName' to run invisibly..."
-Write-Host ""
-
-# Check if task exists
-$Task = Get-ScheduledTask -TaskName $TaskName -ErrorAction SilentlyContinue
-if (-not $Task) {
-    Write-Host "ERROR: Task '$TaskName' not found."
-    Write-Host "Run setup_periodic_save.ps1 to create it first."
-    exit 1
-}
-
-# Find pythonw.exe path
-$PythonExe = (Get-Command python).Source
-$PythonDir = Split-Path $PythonExe -Parent
-$PythonwPath = Join-Path $PythonDir "pythonw.exe"
-
-if (-not (Test-Path $PythonwPath)) {
-    Write-Host "ERROR: pythonw.exe not found at $PythonwPath"
-    Write-Host "Please reinstall Python to get pythonw.exe"
-    exit 1
-}
-
-Write-Host "Found pythonw.exe at: $PythonwPath"
-
-# Update the action to use pythonw.exe
-$NewAction = New-ScheduledTaskAction -Execute $PythonwPath `
-    -Argument "D:\ClaudeTools\.claude\hooks\periodic_save_check.py" `
-    -WorkingDirectory "D:\ClaudeTools"
-
-# Update settings to be hidden
-$NewSettings = New-ScheduledTaskSettingsSet `
-    -AllowStartIfOnBatteries `
-    -DontStopIfGoingOnBatteries `
-    -StartWhenAvailable `
-    -ExecutionTimeLimit (New-TimeSpan -Minutes 5) `
-    -Hidden
-
-# Update principal to run in background (S4U = Service-For-User)
-$NewPrincipal = New-ScheduledTaskPrincipal -UserId "$env:USERDOMAIN\$env:USERNAME" -LogonType S4U
-
-# Get existing trigger (preserve it)
-$ExistingTrigger = $Task.Triggers
-
-# Update the task
-Set-ScheduledTask -TaskName $TaskName `
-    -Action $NewAction `
-    -Settings $NewSettings `
-    -Principal $NewPrincipal `
-    -Trigger $ExistingTrigger | Out-Null
-
-Write-Host ""
-Write-Host "[SUCCESS] Task updated successfully!"
-Write-Host ""
-Write-Host "Changes made:"
-Write-Host "  1. Changed executable: python.exe -> pythonw.exe"
-Write-Host "  2. Set task to Hidden"
-Write-Host "  3. Changed LogonType: Interactive -> S4U (background)"
-Write-Host ""
-Write-Host "Verification:"
-
-# Show current settings
-$UpdatedTask = Get-ScheduledTask -TaskName $TaskName
-$Settings = $UpdatedTask.Settings
-$Action = $UpdatedTask.Actions[0]
-$Principal = $UpdatedTask.Principal
-
-Write-Host "  Executable: $($Action.Execute)"
-Write-Host "  Hidden: $($Settings.Hidden)"
-Write-Host "  LogonType: $($Principal.LogonType)"
-Write-Host ""
-
-if ($Settings.Hidden -and $Action.Execute -like "*pythonw.exe" -and $Principal.LogonType -eq "S4U") {
-    Write-Host "[OK] All settings correct - task will run invisibly!"
-} else {
-    Write-Host "[WARNING] Some settings may not be correct - please verify manually"
-}
-
-Write-Host ""
-Write-Host "The task will now run invisibly without showing any console window."
-Write-Host ""

.claude/hooks/user-prompt-submit

@@ -1,163 +0,0 @@
-#!/bin/bash
-#
-# Claude Code Hook: user-prompt-submit (v2 - with offline support)
-# Runs BEFORE each user message is processed
-# Injects relevant context from the database into the conversation
-# FALLBACK: Uses local cache when API is unavailable
-#
-# Expected environment variables:
-#   CLAUDE_PROJECT_ID - UUID of the current project
-#   JWT_TOKEN - Authentication token for API
-#   CLAUDE_API_URL - API base URL (default: http://172.16.3.30:8001)
-#   CONTEXT_RECALL_ENABLED - Set to "false" to disable (default: true)
-#   MIN_RELEVANCE_SCORE - Minimum score for context (default: 5.0)
-#   MAX_CONTEXTS - Maximum number of contexts to retrieve (default: 10)
-#
-
-# Load configuration if exists
-CONFIG_FILE="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)/context-recall-config.env"
-if [ -f "$CONFIG_FILE" ]; then
-    source "$CONFIG_FILE"
-fi
-
-# Default values
-API_URL="${CLAUDE_API_URL:-http://172.16.3.30:8001}"
-ENABLED="${CONTEXT_RECALL_ENABLED:-true}"
-MIN_SCORE="${MIN_RELEVANCE_SCORE:-5.0}"
-MAX_ITEMS="${MAX_CONTEXTS:-10}"
-
-# Local storage paths
-CLAUDE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-CACHE_DIR="$CLAUDE_DIR/context-cache"
-QUEUE_DIR="$CLAUDE_DIR/context-queue"
-
-# Exit early if disabled
-if [ "$ENABLED" != "true" ]; then
-    exit 0
-fi
-
-# Detect project ID from git repo if not set
-if [ -z "$CLAUDE_PROJECT_ID" ]; then
-    # Try to get from git config
-    PROJECT_ID=$(git config --local claude.projectid 2>/dev/null)
-
-    if [ -z "$PROJECT_ID" ]; then
-        # Try to derive from git remote URL
-        GIT_REMOTE=$(git config --get remote.origin.url 2>/dev/null)
-        if [ -n "$GIT_REMOTE" ]; then
-            # Hash the remote URL to create a consistent ID
-            PROJECT_ID=$(echo -n "$GIT_REMOTE" | md5sum | cut -d' ' -f1)
-        fi
-    fi
-else
-    PROJECT_ID="$CLAUDE_PROJECT_ID"
-fi
-
-# Exit if no project ID available
-if [ -z "$PROJECT_ID" ]; then
-    # Silent exit - no context available
-    exit 0
-fi
-
-# Create cache directory if it doesn't exist
-PROJECT_CACHE_DIR="$CACHE_DIR/$PROJECT_ID"
-mkdir -p "$PROJECT_CACHE_DIR" 2>/dev/null
-
-# Try to sync any queued contexts first (opportunistic)
-# NOTE: Changed from background (&) to synchronous to prevent zombie processes
-if [ -d "$QUEUE_DIR/pending" ] && [ -n "$JWT_TOKEN" ]; then
-    bash "$(dirname "${BASH_SOURCE[0]}")/sync-contexts" >/dev/null 2>&1
-fi
-
-# Build API request URL
-RECALL_URL="${API_URL}/api/conversation-contexts/recall"
-QUERY_PARAMS="project_id=${PROJECT_ID}&limit=${MAX_ITEMS}&min_relevance_score=${MIN_SCORE}"
-
-# Try to fetch context from API (with timeout and error handling)
-API_AVAILABLE=false
-if [ -n "$JWT_TOKEN" ]; then
-    CONTEXT_RESPONSE=$(curl -s --max-time 3 \
-        "${RECALL_URL}?${QUERY_PARAMS}" \
-        -H "Authorization: Bearer ${JWT_TOKEN}" \
-        -H "Accept: application/json" 2>/dev/null)
-
-    if [ $? -eq 0 ] && [ -n "$CONTEXT_RESPONSE" ]; then
-        # Check if response is valid JSON (not an error)
-        echo "$CONTEXT_RESPONSE" | python3 -c "import sys, json; json.load(sys.stdin)" 2>/dev/null
-        if [ $? -eq 0 ]; then
-            API_AVAILABLE=true
-            # Save to cache for offline use
-            echo "$CONTEXT_RESPONSE" > "$PROJECT_CACHE_DIR/latest.json"
-            echo "$(date -u +"%Y-%m-%dT%H:%M:%SZ")" > "$PROJECT_CACHE_DIR/last_updated"
-        fi
-    fi
-fi
-
-# Fallback to local cache if API unavailable
-if [ "$API_AVAILABLE" = "false" ]; then
-    if [ -f "$PROJECT_CACHE_DIR/latest.json" ]; then
-        CONTEXT_RESPONSE=$(cat "$PROJECT_CACHE_DIR/latest.json")
-        CACHE_AGE="unknown"
-        if [ -f "$PROJECT_CACHE_DIR/last_updated" ]; then
-            CACHE_AGE=$(cat "$PROJECT_CACHE_DIR/last_updated")
-        fi
-        echo "<!-- Using cached context (API unavailable) - Last updated: $CACHE_AGE -->" >&2
-    else
-        # No cache available, exit silently
-        exit 0
-    fi
-fi
-
-# Parse and format context
-CONTEXT_COUNT=$(echo "$CONTEXT_RESPONSE" | grep -o '"id"' | wc -l)
-
-if [ "$CONTEXT_COUNT" -gt 0 ]; then
-    if [ "$API_AVAILABLE" = "true" ]; then
-        echo "<!-- Context Recall: Retrieved $CONTEXT_COUNT relevant context(s) from API -->"
-    else
-        echo "<!-- Context Recall: Retrieved $CONTEXT_COUNT relevant context(s) from LOCAL CACHE (offline mode) -->"
-    fi
-    echo ""
-    echo "## Previous Context"
-    echo ""
-    if [ "$API_AVAILABLE" = "false" ]; then
-        echo "[WARNING] **Offline Mode** - Using cached context (API unavailable)"
-        echo ""
-    fi
-    echo "The following context has been automatically recalled:"
-    echo ""
-
-    # Extract and format each context entry
-    echo "$CONTEXT_RESPONSE" | python3 -c "
-import sys, json
-try:
-    contexts = json.load(sys.stdin)
-    if isinstance(contexts, list):
-        for i, ctx in enumerate(contexts, 1):
-            title = ctx.get('title', 'Untitled')
-            summary = ctx.get('dense_summary', '')
-            score = ctx.get('relevance_score', 0)
-            ctx_type = ctx.get('context_type', 'unknown')
-
-            print(f'### {i}. {title} (Score: {score}/10)')
-            print(f'*Type: {ctx_type}*')
-            print()
-            print(summary)
-            print()
-            print('---')
-            print()
-except:
-    pass
-" 2>/dev/null
-
-    echo ""
-    if [ "$API_AVAILABLE" = "true" ]; then
-        echo "*Context automatically injected to maintain continuity across sessions.*"
-    else
-        echo "*Context from local cache - new context will sync when API is available.*"
-    fi
-    echo ""
-fi
-
-# Exit successfully
-exit 0

.claude/hooks/user-prompt-submit-v2

@@ -1,162 +0,0 @@
-#!/bin/bash
-#
-# Claude Code Hook: user-prompt-submit (v2 - with offline support)
-# Runs BEFORE each user message is processed
-# Injects relevant context from the database into the conversation
-# FALLBACK: Uses local cache when API is unavailable
-#
-# Expected environment variables:
-#   CLAUDE_PROJECT_ID - UUID of the current project
-#   JWT_TOKEN - Authentication token for API
-#   CLAUDE_API_URL - API base URL (default: http://172.16.3.30:8001)
-#   CONTEXT_RECALL_ENABLED - Set to "false" to disable (default: true)
-#   MIN_RELEVANCE_SCORE - Minimum score for context (default: 5.0)
-#   MAX_CONTEXTS - Maximum number of contexts to retrieve (default: 10)
-#
-
-# Load configuration if exists
-CONFIG_FILE="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)/context-recall-config.env"
-if [ -f "$CONFIG_FILE" ]; then
-    source "$CONFIG_FILE"
-fi
-
-# Default values
-API_URL="${CLAUDE_API_URL:-http://172.16.3.30:8001}"
-ENABLED="${CONTEXT_RECALL_ENABLED:-true}"
-MIN_SCORE="${MIN_RELEVANCE_SCORE:-5.0}"
-MAX_ITEMS="${MAX_CONTEXTS:-10}"
-
-# Local storage paths
-CLAUDE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-CACHE_DIR="$CLAUDE_DIR/context-cache"
-QUEUE_DIR="$CLAUDE_DIR/context-queue"
-
-# Exit early if disabled
-if [ "$ENABLED" != "true" ]; then
-    exit 0
-fi
-
-# Detect project ID from git repo if not set
-if [ -z "$CLAUDE_PROJECT_ID" ]; then
-    # Try to get from git config
-    PROJECT_ID=$(git config --local claude.projectid 2>/dev/null)
-
-    if [ -z "$PROJECT_ID" ]; then
-        # Try to derive from git remote URL
-        GIT_REMOTE=$(git config --get remote.origin.url 2>/dev/null)
-        if [ -n "$GIT_REMOTE" ]; then
-            # Hash the remote URL to create a consistent ID
-            PROJECT_ID=$(echo -n "$GIT_REMOTE" | md5sum | cut -d' ' -f1)
-        fi
-    fi
-else
-    PROJECT_ID="$CLAUDE_PROJECT_ID"
-fi
-
-# Exit if no project ID available
-if [ -z "$PROJECT_ID" ]; then
-    # Silent exit - no context available
-    exit 0
-fi
-
-# Create cache directory if it doesn't exist
-PROJECT_CACHE_DIR="$CACHE_DIR/$PROJECT_ID"
-mkdir -p "$PROJECT_CACHE_DIR" 2>/dev/null
-
-# Try to sync any queued contexts first (opportunistic)
-if [ -d "$QUEUE_DIR/pending" ] && [ -n "$JWT_TOKEN" ]; then
-    bash "$(dirname "${BASH_SOURCE[0]}")/sync-contexts" >/dev/null 2>&1 &
-fi
-
-# Build API request URL
-RECALL_URL="${API_URL}/api/conversation-contexts/recall"
-QUERY_PARAMS="project_id=${PROJECT_ID}&limit=${MAX_ITEMS}&min_relevance_score=${MIN_SCORE}"
-
-# Try to fetch context from API (with timeout and error handling)
-API_AVAILABLE=false
-if [ -n "$JWT_TOKEN" ]; then
-    CONTEXT_RESPONSE=$(curl -s --max-time 3 \
-        "${RECALL_URL}?${QUERY_PARAMS}" \
-        -H "Authorization: Bearer ${JWT_TOKEN}" \
-        -H "Accept: application/json" 2>/dev/null)
-
-    if [ $? -eq 0 ] && [ -n "$CONTEXT_RESPONSE" ]; then
-        # Check if response is valid JSON (not an error)
-        echo "$CONTEXT_RESPONSE" | python3 -c "import sys, json; json.load(sys.stdin)" 2>/dev/null
-        if [ $? -eq 0 ]; then
-            API_AVAILABLE=true
-            # Save to cache for offline use
-            echo "$CONTEXT_RESPONSE" > "$PROJECT_CACHE_DIR/latest.json"
-            echo "$(date -u +"%Y-%m-%dT%H:%M:%SZ")" > "$PROJECT_CACHE_DIR/last_updated"
-        fi
-    fi
-fi
-
-# Fallback to local cache if API unavailable
-if [ "$API_AVAILABLE" = "false" ]; then
-    if [ -f "$PROJECT_CACHE_DIR/latest.json" ]; then
-        CONTEXT_RESPONSE=$(cat "$PROJECT_CACHE_DIR/latest.json")
-        CACHE_AGE="unknown"
-        if [ -f "$PROJECT_CACHE_DIR/last_updated" ]; then
-            CACHE_AGE=$(cat "$PROJECT_CACHE_DIR/last_updated")
-        fi
-        echo "<!-- Using cached context (API unavailable) - Last updated: $CACHE_AGE -->" >&2
-    else
-        # No cache available, exit silently
-        exit 0
-    fi
-fi
-
-# Parse and format context
-CONTEXT_COUNT=$(echo "$CONTEXT_RESPONSE" | grep -o '"id"' | wc -l)
-
-if [ "$CONTEXT_COUNT" -gt 0 ]; then
-    if [ "$API_AVAILABLE" = "true" ]; then
-        echo "<!-- Context Recall: Retrieved $CONTEXT_COUNT relevant context(s) from API -->"
-    else
-        echo "<!-- Context Recall: Retrieved $CONTEXT_COUNT relevant context(s) from LOCAL CACHE (offline mode) -->"
-    fi
-    echo ""
-    echo "## Previous Context"
-    echo ""
-    if [ "$API_AVAILABLE" = "false" ]; then
-        echo "[WARNING] **Offline Mode** - Using cached context (API unavailable)"
-        echo ""
-    fi
-    echo "The following context has been automatically recalled:"
-    echo ""
-
-    # Extract and format each context entry
-    echo "$CONTEXT_RESPONSE" | python3 -c "
-import sys, json
-try:
-    contexts = json.load(sys.stdin)
-    if isinstance(contexts, list):
-        for i, ctx in enumerate(contexts, 1):
-            title = ctx.get('title', 'Untitled')
-            summary = ctx.get('dense_summary', '')
-            score = ctx.get('relevance_score', 0)
-            ctx_type = ctx.get('context_type', 'unknown')
-
-            print(f'### {i}. {title} (Score: {score}/10)')
-            print(f'*Type: {ctx_type}*')
-            print()
-            print(summary)
-            print()
-            print('---')
-            print()
-except:
-    pass
-" 2>/dev/null
-
-    echo ""
-    if [ "$API_AVAILABLE" = "true" ]; then
-        echo "*Context automatically injected to maintain continuity across sessions.*"
-    else
-        echo "*Context from local cache - new context will sync when API is available.*"
-    fi
-    echo ""
-fi
-
-# Exit successfully
-exit 0

.claude/hooks/user-prompt-submit.v1.backup

@@ -1,119 +0,0 @@
-#!/bin/bash
-#
-# Claude Code Hook: user-prompt-submit
-# Runs BEFORE each user message is processed
-# Injects relevant context from the database into the conversation
-#
-# Expected environment variables:
-#   CLAUDE_PROJECT_ID - UUID of the current project
-#   JWT_TOKEN - Authentication token for API
-#   CLAUDE_API_URL - API base URL (default: http://localhost:8000)
-#   CONTEXT_RECALL_ENABLED - Set to "false" to disable (default: true)
-#   MIN_RELEVANCE_SCORE - Minimum score for context (default: 5.0)
-#   MAX_CONTEXTS - Maximum number of contexts to retrieve (default: 10)
-#
-
-# Load configuration if exists
-CONFIG_FILE="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)/context-recall-config.env"
-if [ -f "$CONFIG_FILE" ]; then
-    source "$CONFIG_FILE"
-fi
-
-# Default values
-API_URL="${CLAUDE_API_URL:-http://localhost:8000}"
-ENABLED="${CONTEXT_RECALL_ENABLED:-true}"
-MIN_SCORE="${MIN_RELEVANCE_SCORE:-5.0}"
-MAX_ITEMS="${MAX_CONTEXTS:-10}"
-
-# Exit early if disabled
-if [ "$ENABLED" != "true" ]; then
-    exit 0
-fi
-
-# Detect project ID from git repo if not set
-if [ -z "$CLAUDE_PROJECT_ID" ]; then
-    # Try to get from git config
-    PROJECT_ID=$(git config --local claude.projectid 2>/dev/null)
-
-    if [ -z "$PROJECT_ID" ]; then
-        # Try to derive from git remote URL
-        GIT_REMOTE=$(git config --get remote.origin.url 2>/dev/null)
-        if [ -n "$GIT_REMOTE" ]; then
-            # Hash the remote URL to create a consistent ID
-            PROJECT_ID=$(echo -n "$GIT_REMOTE" | md5sum | cut -d' ' -f1)
-        fi
-    fi
-else
-    PROJECT_ID="$CLAUDE_PROJECT_ID"
-fi
-
-# Exit if no project ID available
-if [ -z "$PROJECT_ID" ]; then
-    # Silent exit - no context available
-    exit 0
-fi
-
-# Exit if no JWT token
-if [ -z "$JWT_TOKEN" ]; then
-    exit 0
-fi
-
-# Build API request URL
-RECALL_URL="${API_URL}/api/conversation-contexts/recall"
-QUERY_PARAMS="project_id=${PROJECT_ID}&limit=${MAX_ITEMS}&min_relevance_score=${MIN_SCORE}"
-
-# Fetch context from API (with timeout and error handling)
-CONTEXT_RESPONSE=$(curl -s --max-time 3 \
-    "${RECALL_URL}?${QUERY_PARAMS}" \
-    -H "Authorization: Bearer ${JWT_TOKEN}" \
-    -H "Accept: application/json" 2>/dev/null)
-
-# Check if request was successful
-if [ $? -ne 0 ] || [ -z "$CONTEXT_RESPONSE" ]; then
-    # Silent failure - API unavailable
-    exit 0
-fi
-
-# Parse and format context (expects JSON array of context objects)
-# Example response: [{"title": "...", "dense_summary": "...", "relevance_score": 8.5}, ...]
-CONTEXT_COUNT=$(echo "$CONTEXT_RESPONSE" | grep -o '"id"' | wc -l)
-
-if [ "$CONTEXT_COUNT" -gt 0 ]; then
-    echo "<!-- Context Recall: Retrieved $CONTEXT_COUNT relevant context(s) -->"
-    echo ""
-    echo "## 📚 Previous Context"
-    echo ""
-    echo "The following context has been automatically recalled from previous sessions:"
-    echo ""
-
-    # Extract and format each context entry
-    # Note: This uses simple text parsing. For production, consider using jq if available.
-    echo "$CONTEXT_RESPONSE" | python3 -c "
-import sys, json
-try:
-    contexts = json.load(sys.stdin)
-    if isinstance(contexts, list):
-        for i, ctx in enumerate(contexts, 1):
-            title = ctx.get('title', 'Untitled')
-            summary = ctx.get('dense_summary', '')
-            score = ctx.get('relevance_score', 0)
-            ctx_type = ctx.get('context_type', 'unknown')
-
-            print(f'### {i}. {title} (Score: {score}/10)')
-            print(f'*Type: {ctx_type}*')
-            print()
-            print(summary)
-            print()
-            print('---')
-            print()
-except:
-    pass
-" 2>/dev/null
-
-    echo ""
-    echo "*This context was automatically injected to help maintain continuity across sessions.*"
-    echo ""
-fi
-
-# Exit successfully
-exit 0

.claude/machines/LINUX_PC_ONBOARDING.md

@@ -0,0 +1,375 @@
+# Linux PC Onboarding Guide for Claude Code
+
+**Purpose:** This document helps Claude Code understand how to operate correctly in the ClaudeTools environment after a fresh Linux install.
+
+**Read this FIRST** before doing any work.
+
+---
+
+## TL;DR - Critical Rules
+
+1. **You are a COORDINATOR, not an executor** - delegate significant work to agents
+2. **NO EMOJIS** - Use `[OK]`, `[ERROR]`, `[WARNING]`, `[SUCCESS]`, `[INFO]`
+3. **Never query databases directly** - Use Database Agent
+4. **Never write production code yourself** - Use Coding Agent
+5. **Always run `/sync` first** to get latest context from Gitea
+
+---
+
+## Step 1: Initial Setup
+
+### Run These Commands First
+
+```bash
+# 1. Navigate to ClaudeTools
+cd ~/ClaudeTools  # or wherever you cloned it
+
+# 2. Pull latest from Gitea
+git pull origin main
+
+# 3. Check GrepAI status (semantic code search)
+grepai status
+
+# 4. If GrepAI watcher isn't running:
+grepai watch --background
+
+# 5. Check Ollama is running (local AI)
+curl -s http://localhost:11434/api/tags | jq '.models[].name'
+```
+
+### Required Models for Ollama
+
+Pull these if not present:
+```bash
+ollama pull qwen3:14b        # General tasks
+ollama pull codestral:22b    # Code tasks
+ollama pull nomic-embed-text # Embeddings for GrepAI
+```
+
+---
+
+## Step 2: Understand Your Identity
+
+### You Are a Coordinator
+
+You preserve your context window by delegating work. You do NOT:
+- Query databases directly (no SSH/mysql/curl to API)
+- Write production code yourself
+- Run tests yourself
+- Commit/push yourself
+
+You DO:
+- Plan and make decisions
+- Read 1-2 files for quick answers
+- Present results to the user
+- Coordinate specialized agents
+
+### Delegation Rules
+
+| Task | Delegate To |
+|------|-------------|
+| Database queries/inserts/updates | Database Agent |
+| Production code generation | Coding Agent |
+| Code review (MANDATORY after changes) | Code Review Agent |
+| Test execution | Testing Agent |
+| Git commits/push/branch | Gitea Agent |
+| Backups/restore | Backup Agent |
+| File exploration (broad) | Explore Agent |
+| Semantic code search | deep-explore Agent |
+| Complex reasoning | General-purpose + Sequential Thinking |
+
+**Rule of thumb:** If work exceeds 500 tokens = delegate. If it touches code or database = ALWAYS delegate.
+
+---
+
+## Step 3: Key Infrastructure
+
+### Database
+- **Host:** 172.16.3.30:3306
+- **Database:** claudetools
+- **User:** claudetools
+- **Password:** CT_e8fcd5a3952030a79ed6debae6c954ed
+- **DO NOT** connect directly - use Database Agent
+
+### API
+- **URL:** http://172.16.3.30:8001
+- **Docs:** http://172.16.3.30:8001/api/docs
+- **Auth:** JWT Bearer Token
+
+### Gitea
+- **URL:** https://git.azcomputerguru.com
+- **Repo:** azcomputerguru/claudetools
+
+---
+
+## Step 4: Available Commands
+
+These are slash commands you can invoke:
+
+| Command | Purpose |
+|---------|---------|
+| `/sync` | Sync with Gitea, pull latest, push local changes |
+| `/checkpoint` | Git commit + database context snapshot |
+| `/save` | Create comprehensive session log |
+| `/context` | Search session logs and credentials for previous work |
+| `/refresh-directives` | Re-read behavioral rules (do after sync) |
+
+### First Thing Every Session
+
+```
+/sync
+```
+
+This pulls latest changes from other machines and pushes your local changes.
+
+---
+
+## Step 5: ASCII Markers (NO EMOJIS!)
+
+**Never use emojis.** They cause encoding issues across platforms.
+
+Use these instead:
+
+| Marker | Use For |
+|--------|---------|
+| `[OK]` | Success, completed |
+| `[SUCCESS]` | Task completed successfully |
+| `[ERROR]` | Failure, problem |
+| `[WARNING]` | Caution, potential issue |
+| `[INFO]` | Informational message |
+| `[CRITICAL]` | Severe error |
+
+**Bad:**
+```
+✓ Task completed!
+⚠ Warning: check config
+```
+
+**Good:**
+```
+[OK] Task completed!
+[WARNING] Check config
+```
+
+---
+
+## Step 6: Local AI (Ollama)
+
+Ollama runs locally for tasks that don't need Claude-level reasoning.
+
+### When to Use Ollama
+
+**Good for:**
+- Bulk/repetitive tasks (summarizing 50 logs)
+- Boilerplate code generation
+- Data extraction/classification
+- Draft content you'll review
+
+**Bad for (use Claude):**
+- Architectural decisions
+- Security-sensitive code
+- Multi-step planning
+- Final production output
+
+### How to Call Ollama
+
+```bash
+# Simple prompt
+curl -s http://localhost:11434/api/generate \
+  -d '{"model":"qwen3:14b","prompt":"Summarize: ...","stream":false}' \
+  | jq -r '.response'
+
+# Code tasks
+curl -s http://localhost:11434/api/chat \
+  -d '{"model":"codestral:22b","messages":[{"role":"user","content":"..."}],"stream":false}' \
+  | jq -r '.message.content'
+```
+
+### Review Policy for Ollama Output
+
+| Impact Level | Review Required | Examples |
+|--------------|-----------------|----------|
+| Critical | ALWAYS verify against source | Auth, security, encryption, DB migrations |
+| High | Review for correctness | API logic, business rules, infra scripts |
+| Medium | Skim for obvious errors | Internal docs, session summaries, boilerplate |
+| Low | Trust without review | Classification, reformatting, placeholders |
+
+---
+
+## Step 7: GrepAI (Semantic Search)
+
+GrepAI indexes the codebase for natural language search.
+
+### When to Use GrepAI vs Grep
+
+**Use GrepAI for:**
+- "How does authentication work?"
+- "Find implementations related to user sessions"
+- Exploring unfamiliar code areas
+- Context recovery from session logs
+
+**Use regular Grep for:**
+- Exact text matches
+- Known function/class names
+- Simple pattern matching
+
+### Commands
+
+```bash
+# Search
+grepai search "how does JWT auth work" --json
+
+# Call graph tracing
+grepai trace callers "get_db"
+grepai trace callees "create_user"
+
+# Start watcher (if not running)
+grepai watch --background
+
+# Restart watcher (if results seem stale)
+grepai watch --stop && grepai watch --background
+```
+
+---
+
+## Step 8: File Organization
+
+### Where to Put Things
+
+| Content Type | Location |
+|--------------|----------|
+| ClaudeTools API code | `api/`, `migrations/` |
+| Client work | `clients/[client-name]/` |
+| Project work | `projects/[project-name]/` |
+| Session logs | `session-logs/` or project-specific `session-logs/` |
+| Scripts | Project-specific `scripts/` folder |
+| Machine specs | `.claude/machines/` |
+
+### Key Files to Know
+
+- `credentials.md` - All infrastructure credentials (NEVER ask user for these)
+- `SESSION_STATE.md` - Project history
+- `.claude/CLAUDE.md` - Main behavioral rules (auto-loaded)
+- `.claude/CODING_GUIDELINES.md` - Coding standards
+- `.claude/agents/*.md` - Agent definitions
+
+---
+
+## Step 9: Context Recovery
+
+When the user references previous work:
+
+1. **Use `/context` command** to search session logs
+2. **Check `credentials.md`** for infrastructure details
+3. **Search session-logs/** for recent work
+4. **Never ask user** for info that's in these files
+
+### Session Log Locations
+
+```
+session-logs/                    # General logs
+projects/*/session-logs/         # Project-specific
+clients/*/session-logs/          # Client-specific
+```
+
+---
+
+## Step 10: Automatic Behaviors
+
+These happen automatically - don't forget them:
+
+1. **After UI changes** (HTML/CSS/JSX) -> Auto-invoke `/frontend-design`
+2. **Complex problems** (3+ issues, rejection loops) -> Use Sequential Thinking MCP
+3. **After code changes** -> Code Review Agent reviews (MANDATORY)
+4. **Complex tasks** (>3 steps) -> Create todo list with TodoWrite
+
+---
+
+## Step 11: SSH Configuration
+
+On Linux, use system OpenSSH:
+
+```bash
+# Standard SSH
+ssh user@host
+
+# Never use paramiko or other SSH libraries when system SSH works
+```
+
+---
+
+## Step 12: Self-Check After Setup
+
+Run `/sync` and verify:
+
+- [ ] Git pull successful
+- [ ] Latest session logs visible
+- [ ] GrepAI watcher running (`pgrep -f "grepai watch"`)
+- [ ] Ollama responding (`curl http://localhost:11434/api/tags`)
+- [ ] Can read credentials.md
+- [ ] Understand delegation model
+
+---
+
+## Quick Reference Card
+
+```
+IDENTITY:       Coordinator (not executor)
+EMOJIS:         NEVER (use [OK], [ERROR], etc.)
+DATABASE:       Always delegate to Database Agent
+CODE:           Always delegate to Coding Agent
+FIRST COMMAND:  /sync
+CONTEXT:        Check credentials.md and session-logs/
+LOCAL AI:       Ollama for bulk tasks, review output
+SEARCH:         GrepAI for intent, Grep for exact text
+```
+
+---
+
+## Other Machines in This Environment
+
+Check `.claude/machines/` for specs on:
+- `mikes-macbook-air.md` - M4 MacBook Air (this doc was created there)
+- (Add your machine spec after setup)
+
+---
+
+## Troubleshooting
+
+### GrepAI Not Working
+```bash
+grepai watch --stop
+grepai watch --background
+```
+
+### Ollama Not Responding
+```bash
+sudo systemctl status ollama
+sudo systemctl restart ollama
+```
+
+### Git Push Rejected
+```bash
+git pull origin main --rebase
+git push origin main
+```
+
+### Permission Issues
+```bash
+sudo chown -R $USER:$USER ~/ClaudeTools
+```
+
+---
+
+## First Task After Reading This
+
+1. Run `/sync` to pull latest
+2. Run `/refresh-directives` to internalize rules
+3. Create your machine spec file in `.claude/machines/`
+4. You're ready to work!
+
+---
+
+**Created:** 2026-03-20
+**Created By:** Claude on Mikes-MacBook-Air.local
+**Purpose:** Help fresh Linux installs understand ClaudeTools behavioral expectations

.claude/machines/acg-guru-5070.md

@@ -0,0 +1,91 @@
+# Machine: acg-guru-5070
+
+**Hostname:** acg-guru-5070
+**Last Updated:** 2026-03-21
+
+---
+
+## Hardware Specs
+
+| Spec | Value |
+|------|-------|
+| Model | Lenovo Legion Pro 7 16IAX10H (DMI: 83F5) |
+| CPU | Intel Core Ultra 9 275HX (24 cores, up to 5.4 GHz) |
+| Memory | 32 GB DDR5 |
+| GPU | NVIDIA GeForce RTX 5070 Ti Laptop GPU (12 GB VRAM) |
+| Storage 1 | 954 GB NVMe (SK Hynix) - CachyOS root, btrfs |
+| Storage 2 | 954 GB NVMe (SK Hynix) - /home, ext4 |
+
+---
+
+## Software
+
+| Spec | Value |
+|------|-------|
+| OS | CachyOS Linux (Arch-based) |
+| Kernel | 6.19.9-1-cachyos |
+| DE | KDE Plasma 6.6.3 (Wayland) |
+| NVIDIA Driver | 595.45.04 (open kernel module) |
+| CUDA | 13.2 |
+| Python | 3.14 |
+
+---
+
+## Claude Code Environment
+
+- **Working Directory:** /home/guru/ClaudeTools
+- **User:** guru
+- **Shell:** fish
+- **Git:** Configured for Gitea (git.azcomputerguru.com)
+
+---
+
+## Network
+
+| Interface | Address |
+|-----------|---------|
+| WiFi (wlan0) | 10.3.36.218 |
+| Tailscale | 100.95.216.79 |
+
+---
+
+## Capabilities
+
+- [x] Git operations
+- [x] SSH access to infrastructure
+- [x] GrepAI semantic search (watcher running)
+- [x] Ollama local AI (qwen3:14b, codestral:22b, nomic-embed-text)
+- [x] MCP servers available
+- [x] NVIDIA GPU (CUDA compute)
+- [x] Claude Code CLI
+
+---
+
+## Known Issues
+
+### GPU Firmware Bug (RTX 5070 Ti)
+
+The RTX 5070 Ti enters an error state (NVRM rpcSendMessage 0x00000062) after ~3-5 minutes of sustained GPU compute. This is a known Blackwell/RTX 50-series GSP firmware bug on Linux (NVIDIA bug #5953411). Affects all tested drivers (580.x, 590.x, 595.x).
+
+**Impact:** GPU-accelerated ML workloads (Whisper transcription, etc.) cannot complete. GPU enters full ERR! state requiring hard power-off (warm reboot hangs with spinning symbol).
+
+**Workarounds tried (none effective):**
+- Disable Runtime D3 power management
+- Enable persistence mode
+- Lock GPU clocks
+- Power cap reduction
+
+**Status:** Waiting for NVIDIA driver fix. Heavy GPU compute delegated to Mac (M4).
+
+### Custom Kernel for Audio
+
+Running a custom-patched CachyOS kernel with the `nadimkobeissi/16iax10h-linux-sound-saga` patch for Awinic AW88399 smart amplifier support. Stock kernel has terrible speaker output. Patch is not upstreamed.
+
+---
+
+## Notes
+
+- Primary development workstation
+- GPU works fine for display, light compute, Ollama inference — only fails under sustained heavy compute (Whisper, training)
+- Sudo: NOPASSWD configured for guru user
+- Old btrfs @home subvolume on nvme0n1 (from initial install before /home was moved to nvme1n1)

.claude/machines/guru-beast-rog.md

@@ -0,0 +1,69 @@
+# Machine: GURU-BEAST-ROG
+
+**Hostname:** GURU-BEAST-ROG
+**Last Updated:** 2026-03-24
+
+---
+
+## Hardware Specs
+
+| Spec | Value |
+|------|-------|
+| Model | ASUS Desktop (ROG) |
+| CPU | Intel Core i9-14900K (24 cores / 32 threads, up to 6.0 GHz) |
+| Memory | 128 GB DDR5 |
+| GPU | NVIDIA GeForce RTX 4090 (24 GB VRAM) |
+| Storage | 2 TB NVMe (WD_BLACK SN7100) |
+
+---
+
+## Software
+
+| Spec | Value |
+|------|-------|
+| OS | Windows 11 Pro (26200) |
+| Python | 3.x (installed) |
+| Node.js | v24.14.0 |
+| Ollama | v0.18.2 |
+| Git | Installed (Git for Windows) |
+
+---
+
+## Claude Code Environment
+
+- **Working Directory:** C:\Users\guru\ClaudeTools
+- **User:** guru
+- **Shell:** bash (Git for Windows)
+- **Git:** Configured for Gitea (git.azcomputerguru.com)
+
+---
+
+## Network
+
+| Interface | Address |
+|-----------|---------|
+| Wi-Fi | 10.2.51.228 |
+| LAN (Local Area Connection) | 192.168.2.3 |
+
+---
+
+## Capabilities
+
+- [x] Git operations
+- [x] SSH access to infrastructure
+- [x] GrepAI semantic search (watcher running)
+- [x] Ollama local AI (nomic-embed-text installed; qwen3:14b, codestral:22b pulling)
+- [x] MCP servers configured (filesystem, sequential-thinking, grepai)
+- [x] NVIDIA RTX 4090 GPU (CUDA compute)
+- [x] Claude Code CLI
+- [x] Bypass permissions mode (settings.json configured)
+
+---
+
+## Notes
+
+- Powerhouse desktop -- best GPU and most RAM across all workstations
+- RTX 4090 does NOT have the GSP firmware bug that affects the 5070 Ti on Linux
+- OpenVPN Connect adapter present (VPN capable)
+- credentials.md present and populated
+- Settings.json has permissions.defaultMode: bypassPermissions

.claude/machines/mikes-macbook-air.md

@@ -0,0 +1,54 @@
+# Machine: Mike's MacBook Air
+
+**Hostname:** Mikes-MacBook-Air.local
+**Last Updated:** 2026-03-20
+
+---
+
+## Hardware Specs
+
+| Spec | Value |
+|------|-------|
+| Model | MacBook Air (Mac16,12) |
+| Model Number | MC6T4LL/A |
+| Chip | Apple M4 |
+| CPU Cores | 10 (4 Performance + 6 Efficiency) |
+| Memory | 16 GB |
+| Serial | J1607PM6LD |
+
+---
+
+## Software
+
+| Spec | Value |
+|------|-------|
+| OS | macOS 26.3.1 (25D2128) |
+| Kernel | Darwin 25.3.0 |
+| Boot Volume | Macintosh HD |
+
+---
+
+## Claude Code Environment
+
+- **Working Directory:** /Users/azcomputerguru/ClaudeTools
+- **User:** azcomputerguru
+- **Shell:** zsh
+- **Git:** Configured for Gitea (git.azcomputerguru.com)
+
+---
+
+## Capabilities
+
+- [x] Git operations
+- [x] SSH access to infrastructure
+- [x] GrepAI semantic search (watcher running)
+- [x] Ollama local AI (qwen3:14b, codestral:22b, nomic-embed-text)
+- [x] MCP servers available
+
+---
+
+## Notes
+
+- Primary mobile development machine
+- M4 chip provides good local AI inference performance
+- Used for radio show prep, documentation, light development

.claude/memory/MEMORY.md

@@ -0,0 +1,25 @@
+# Memory Index
+
+## Reference
+- [Community Forum (Flarum)](reference_community_forum.md) - Flarum forum at community.azcomputerguru.com, API access, database, posting workflow
+- [Radio Show Website](reference_radio_website.md) - Astro static site at radio.azcomputerguru.com on IX server
+- [IX Server SSH Access](reference_ix_server_ssh.md) - SSH access notes, no key auth from CachyOS workstation yet
+- [IX Access via Tailscale](reference_ix_access_tailscale.md) - IX server accessible with Tailscale on, no VPN needed
+- [Neptune Access via D2TESTNAS](reference_neptune_access_d2testnas.md) - Neptune must be routed through D2TESTNAS
+- [CachyOS Workstation Setup](reference_workstation_setup.md) - Dual NVMe, autostart apps, key fixes applied, old home location
+- [Matomo Analytics](reference_matomo_analytics.md) - Self-hosted analytics at analytics.azcomputerguru.com, site IDs, tracking for all 3 sites
+- [Dataforth Contact - AJ](reference_dataforth_contact.md) - AJ at Dataforth, dataforthgit@ email forwarding to him
+
+## Feedback
+- [D2TESTNAS SSH Access](feedback_d2testnas_ssh.md) - Use root@192.168.0.9 with Paper123!@#, not sysadmin
+- [Bypass Permissions Setting](feedback_bypass_permissions_setting.md) - Set permissions.defaultMode to bypassPermissions in settings.json on all machines
+
+## Machine
+- [Windows GURU-BEAST-ROG Setup](machine_windows_guru_setup_status.md) - Fully configured: Node.js, Ollama (qwen3:14b, nomic-embed-text), GrepAI, MCP servers. Pending: codestral:22b pull
+
+## Project
+- [Audio Processor Architecture](project_audio_processor_architecture.md) - Segment-first pipeline: detect breaks before transcription for complete content capture
+- [Neptune Email Routing Issues](project_email_routing_neptune.md) - Multiple clients (devcon, Sorensen/rieussetcorp) have email not routing properly from Neptune
+- [Neptune SBR Email Routing Setup](project_neptune_sbr_email_routing.md) - Full SBR routing chain, config file locations, MailProtector integration, access methods
+- [Dataforth Test Datasheet Pipeline](project_datasheet_pipeline.md) - Full pipeline rebuilt 2026-03-27. Server-side generation replaces DFWDS/Uploader. Website upload still broken.
+- [Dataforth Security Incident](project_dataforth_incident_2026-03-27.md) - DF-JOEL2 compromised, MFA deployed, IC3 filed. CA policies enforce April 4.

.claude/memory/feedback_bypass_permissions_setting.md

@@ -0,0 +1,20 @@
+---
+name: Bypass Permissions Persistent Setting
+description: Configure settings.json on all machines to persist bypass permissions mode across context compressions
+type: feedback
+---
+
+Always set `permissions.defaultMode` to `"bypassPermissions"` in `~/.claude/settings.json` on all workstations.
+
+**Why:** The `--dangerously-skip-permissions` CLI flag is not preserved when Claude Code compresses context or resumes sessions -- the new process starts without the flag, causing unexpected permission prompts mid-session. This is a known bug (GitHub issue #21974).
+
+**How to apply:** On any new machine setup, ensure `~/.claude/settings.json` includes:
+```json
+{
+  "permissions": {
+    "defaultMode": "bypassPermissions"
+  },
+  "skipDangerousModePermissionPrompt": true
+}
+```
+This makes bypass mode the default without needing the CLI flag. Both keys are needed -- `defaultMode` sets the mode, `skipDangerousModePermissionPrompt` suppresses the warning dialog.

.claude/memory/feedback_d2testnas_ssh.md

@@ -0,0 +1,11 @@
+---
+name: D2TESTNAS SSH Access
+description: D2TESTNAS SSH is root@192.168.0.9 with Paper123!@#, not sysadmin
+type: feedback
+---
+
+D2TESTNAS SSH: use `root@192.168.0.9` with password `Paper123!@#`. The `sysadmin` user does not work for SSH. CachyOS workstation (acg-guru-5070) now has an ed25519 key authorized on D2TESTNAS for root.
+
+**Why:** Credentials in credentials.md listed sysadmin as SSH user, which was incorrect and caused multiple failed attempts.
+
+**How to apply:** When SSHing to D2TESTNAS, always use root@192.168.0.9. The SSH key at ~/.ssh/id_ed25519 (guru@acg-guru-5070) should work without password.

.claude/memory/machine_windows_guru_setup_status.md

@@ -0,0 +1,44 @@
+---
+name: Windows GURU-BEAST-ROG Setup Status
+description: Windows workstation setup completion status - Ollama, GrepAI, MCP, Node.js all configured
+type: reference
+---
+
+# Windows Machine Setup Status (GURU-BEAST-ROG)
+
+**Created:** 2026-03-23
+**Updated:** 2026-03-24
+**Machine:** GURU-BEAST-ROG (Windows 11 Pro, i9-14900K, 128GB DDR5, RTX 4090)
+
+## Software Status
+
+| Software | Version | Path | Status |
+|----------|---------|------|--------|
+| Python | 3.12.10 | system PATH | [OK] |
+| Git | 2.52.0.windows.1 | system PATH | [OK] |
+| Windows OpenSSH | system | C:\Windows\System32\OpenSSH\ssh.exe | [OK] |
+| Node.js | v24.14.0 | C:\Program Files\nodejs | [OK] |
+| Ollama | v0.18.2 | C:\Users\guru\AppData\Local\Programs\Ollama\ollama.exe | [OK] |
+| GrepAI | v0.35.0 | C:\Users\guru\ClaudeTools\grepai.exe | [OK] |
+| credentials.md | -- | repo root | [OK] |
+
+## Ollama Models
+
+| Model | Size | Status |
+|-------|------|--------|
+| nomic-embed-text | 274 MB | [OK] |
+| qwen3:14b | 9.3 GB | [OK] |
+| codestral:22b | ~12 GB | [PENDING] - download interrupted, not pulled |
+
+## Configuration
+
+- **.mcp.json:** filesystem, sequential-thinking, grepai servers configured
+- **GrepAI:** Initialized, watcher configured, Ollama backend with nomic-embed-text
+- **Bypass permissions:** `permissions.defaultMode: "bypassPermissions"` in ~/.claude/settings.json
+- **In-repo memory:** .claude/memory/ (syncs via Gitea)
+
+## Notes
+
+- Ollama not in Git Bash PATH -- use full path or open new terminal
+- GrepAI watcher may need restart after reboot: `./grepai.exe watch --background`
+- Machine registered at `.claude/machines/guru-beast-rog.md`

.claude/memory/project_audio_processor_architecture.md

@@ -0,0 +1,32 @@
+---
+name: Audio Processor - Segment-First Architecture
+description: Revised pipeline architecture - detect breaks and split into segments BEFORE transcription for complete content capture
+type: project
+---
+
+## Revised Pipeline Architecture (decided 2026-03-22)
+
+Shows are almost always 4 segments per hour (8 total for a 2-hour show). Extra breaks are rare.
+
+**Old approach:** Transcribe full episode -> truncate to fit LLM context -> analyze (loses content)
+
+**New approach:** Detect breaks first (audio-only) -> split into ~8 segments -> transcribe each -> analyze each with full context -> cross-segment synthesis
+
+### Pipeline Order
+
+1. **Audio-level break detection** (no transcript needed) — loudness/compression jumps, silence gaps, known bumper fingerprints, HR1/HR2 boundary
+2. **Split into segments** — ~7-15 min each, complete audio chunks
+3. **Transcribe each segment** — smaller files, complete content, no truncation
+4. **Analyze each segment** — full transcript fits in LLM context window easily
+5. **Cross-segment synthesis** — detect topics spanning segments, callbacks ("going back to what we said before the break"), narrative arc
+6. **Generate content** — blog posts, forum posts, episode summary from complete analysis
+
+### Key Insights
+
+- 4 segments/hour is a strong structural prior for break detection — if 12-18 min into a segment and audio signatures appear, almost certainly a break. At 5 min, probably not.
+- Each segment transcript is ~5-10K chars — fits in any LLM context with room for detailed prompts
+- Cross-segment synthesis pass is new and essential for catching callbacks and recurring topics
+
+**Why:** Solves the context window truncation problem that loses show content. Each segment gets complete analysis.
+
+**How to apply:** This is the architecture direction for all future audio processor work. The existing Stage 3 segment detector needs to work without transcript input (audio-only signals). Stage 6 analyzer needs per-segment + synthesis passes.

.claude/memory/project_dataforth_incident_2026-03-27.md

@@ -0,0 +1,37 @@
+---
+name: Dataforth Security Incident 2026-03-27
+description: DF-JOEL2 compromised via ScreenConnect social engineering. MFA deployed. IC3 filed. C2 IPs blocked. Full remediation completed.
+type: project
+---
+
+## Incident
+Joel Lohr's workstation (DF-JOEL2, 192.168.0.143) compromised via phishing email to personal Yahoo account. Attacker "Angel Raya" deployed ScreenConnect C2 backdoors. M365 account also compromised from Turkey/UK/Germany.
+
+## Attacker
+- C2: 80.76.49.18 and 45.88.91.99 (AS399486, Virtuo, Montreal QC) - SUSPENDED by host
+- Cloud relay: instance-wlb9ga-relay.screenconnect.com
+- ConnectWise case: 03464184
+- IC3 complaint: 1c32ade367084be9acd548f23705736f
+
+## Remediation
+- C2 IPs blocked at UDM firewall (iptables - need permanent rules in UniFi UI)
+- 3 rogue ScreenConnect clients uninstalled
+- jlohr AD password reset, M365 sessions revoked
+- 32 machines scanned clean, 28 unreachable (offline)
+- No lateral movement detected
+
+## MFA Rollout
+- 3 CA policies deployed (report-only until April 4, 2026):
+  - Require MFA (skip from office IP 67.206.163.122)
+  - Block foreign sign-ins (US only, MFA-Travel-Bypass group for exceptions)
+  - Block legacy auth
+- 19/38 users MFA-ready, 19 need to register
+- MFA notice sent to all users, deadline April 4
+
+## Joel Lohr
+- Retiring March 31, 2026
+- Auto-reply directs contacts to Dan Center (dcenter@dataforth.com)
+- Account should be disabled after retirement
+
+**Why:** Active security incident requiring immediate response.
+**How to apply:** Monitor CA policies in report-only mode, enforce April 4. Check 28 offline machines when available. Add C2 IPs to permanent UDM block list.

.claude/memory/project_datasheet_pipeline.md

@@ -0,0 +1,73 @@
+---
+name: Dataforth Test Datasheet Pipeline - Rebuilt 2026-03-27
+description: Full pipeline from DOS test stations to website. New server-side generation replaces DFWDS/Uploader. 72/73 Quatronix datasheets generated. AD2 crypto wipe recovery.
+type: project
+---
+
+## Background
+AD2 (192.168.0.6) was wiped in a crypto/ransomware attack months ago. The test datasheet pipeline was broken. Customer Quatronix (China) blocking shipment of 328 modules (whittled to 54) without datasheets.
+
+## Pipeline (5 stages, rebuilt 2026-03-27)
+
+### Stage 1: DOS Test Stations (64 stations)
+- QuickBASIC programs generate test data -> C:\STAGE on each DOS PC
+- DAT files (raw test data) + TXT files (formatted datasheets)
+- CTONW.BAT copies DAT files to NAS (working)
+- CTONWTXT.BAT copies TXT files (NOT called in current AUTOEXEC v4.1 since 2026-03-12)
+- TXT files piling up in C:\STAGE since Sept 2025
+
+### Stage 2: NAS <-> AD2 Sync
+- Script: C:\Shares\test\scripts\Sync-FromNAS-rsync.ps1 (every 15 min, WORKING)
+- Rsync daemon on NAS: port 873, module "test", user rsync / IQ203s32119
+- PULL: DAT files from NAS -> AD2, triggers database import
+- PUSH: Software updates from AD2 -> NAS for DOS machines
+
+### Stage 3: TestDataDB (Node.js/SQLite, WORKING)
+- App: C:\Shares\testdatadb\ (Windows service "testdatadb", auto-start)
+- API: http://192.168.0.6:3000
+- Database: C:\Shares\testdatadb\database\testdata.db (2.27M records)
+- Import: database/import.js (post-import hook calls export)
+- **NEW: Spec parser** (parsers/spec-reader.js) - reads binary spec DATs, 1470 models
+- **NEW: Exact-match formatter** (templates/datasheet-exact.js) - reverse-engineered from QB
+- **NEW: Auto-export** (database/export-datasheets.js) - generates TXT to X:\For_Web
+
+### Stage 4: WebShare (X: = \\ad2\webshare = C:\Shares\webshare)
+- X:\Test_Datasheets - incoming (staging for old DFWDS)
+- X:\For_Web - validated datasheets (501K+ files, pre-2026 archived to year subfolders)
+- X:\For_Web_PDF - PDF versions (4.7K files)
+- X:\Bad_Datasheets - invalid files (18K)
+- X:\Datasheets_Log - DFWDS logs
+
+### Stage 5: Website Upload (BROKEN)
+- Old endpoints: dataforth.com/Services/{Uploader,DirectoryManifest,DeleteFile}.aspx - ALL 404
+- Credentials: DataforthWebShare / Data6277
+- TestDataSheetUploader (VB.NET, Hoffman) - not running, config pointed to dev paths
+- Legacy site: legacy.dataforth.com/TestDataReport_Print.aspx (still works, no auth)
+- New site: dataforth.com/TestDataReport (requires OIDC login)
+
+## What Was Eliminated by Rebuild
+- CTONWTXT.BAT (DOS TXT transfer) - no longer needed, server generates from DAT data
+- DFWDS.exe (VB6 filename decoder) - no longer needed
+- TestDataSheetUploader (VB.NET web uploader) - endpoints dead anyway
+
+## Key File Encoding
+H-prefix decode: A=10, B=11, C=12, D=13, E=14, F=15, G=16, H=17, I=18, J=19
+Example: H8601-6.TXT -> serial 178601-6
+New pipeline extracts SN from DAT record data directly, not filenames.
+
+## Open Items
+1. Website upload replacement (old ASP.NET endpoints dead)
+2. 7B datasheet formatting (specs loaded, needs 7B-specific layout, ~830K records)
+3. SCM5B49 spec file empty - need from John Lehman
+4. Service permissions (runs as SYSTEM, causes SHM/WAL conflicts)
+5. New product lines: MAQ20/PWRM (XLS), 10D (JSON, ~May 2026), DSCMHV
+
+## Key Contacts
+- John Lehman (jlehman@dataforth.com) - Engineering, QB code, specs
+- Peter Iliya (pIliya@dataforth.com) - Applications Engineer, manual datasheet retrieval
+- Ken Hoffman - TestDataSheetUploader author (VB.NET), DFWDS author, unresponsive
+- Georg Haubner (ghaubner@dataforth.com) - D: drive has pre-crypto backup of network shares
+- Ginger (gy@quatronix-cn.com) - Quatronix China, customer requesting datasheets
+
+**Why:** Critical business issue - customer refusing shipments without datasheets.
+**How to apply:** Pipeline is mostly rebuilt. Priority: website upload replacement, then 7B support.

.claude/memory/project_email_routing_neptune.md

@@ -0,0 +1,11 @@
+---
+name: Neptune Email Routing Issues
+description: Multiple clients (devcon, Sorensen/rieussetcorp) have email not routing properly from Neptune
+type: project
+---
+
+Sorensen (rieussetcorp) and devcon both have the same email routing issue from Neptune — emails not routing properly.
+
+**Why:** Recurring issue affecting multiple clients, likely a shared configuration or Neptune platform problem rather than isolated incidents.
+
+**How to apply:** When troubleshooting email routing for any client on Neptune, check if the fix applied to one client needs to be replicated for others. Track as a systemic Neptune issue, not individual client problems.

.claude/memory/project_neptune_sbr_email_routing.md

@@ -0,0 +1,49 @@
+---
+name: Neptune SBR Email Routing Setup
+description: How outbound email routing works on Neptune Exchange - SBR agent, MailProtector smarthost, send connectors, and common fix for new clients
+type: project
+---
+
+## Neptune Outbound Email Routing Chain
+
+1. User sends mail from Exchange mailbox on Neptune (172.16.3.11)
+2. **Microsoft.Exchange.SBR** transport agent (Priority 12) fires on OnResolved event
+3. SBR reads config files at `C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\agents\Custom\`:
+   - `Microsoft.Exchange.SBR.InternalDomains.config` — list of domains SBR handles
+   - `Microsoft.Exchange.SBR.OverrideSettings.config` — maps `domain.com;domain.sbr` for routing
+   - `Microsoft.Exchange.SBR.IgnoreAuthAs.config` — exclusions
+4. SBR rewrites recipient routing to `.sbr` domain (e.g., `rieussetcorp.sbr`)
+5. Exchange matches `.sbr` address space to the corresponding Send Connector (e.g., `Outbound.Sorensen`)
+6. Send connector smarthosts through MailProtector: `domain-com.outbound.emailservice.io`
+7. MailProtector relays to final destination
+
+There is also a **messageconcept ExSBR** agent at Priority 11 (`C:\Program Files\messageconcept\ExSBR\`).
+
+## Common Issue: New client or server move
+
+When Neptune's IP changes or a new domain is added, MailProtector must have the sending server IP authorized. Without this, MailProtector accepts the relay but drops/rejects the message.
+
+**Fix (2026-03-22 for rieussetcorp.com):** Added 67.206.163.124 and 67.206.163.122 to MailProtector's authorized sender IPs.
+
+## Neptune Location
+
+Neptune physically moved from ACG office (72.194.62.7) to Dataforth (67.206.163.124 inbound, 67.206.163.122 outbound). SNAT rule on Dataforth UDM (`/data/on_boot.d/10-neptune-snat.sh`) should force outbound to use .124.
+
+## Access
+
+- WinRM: `172.16.3.11`, ACG\administrator, via pywinrm with NTLM
+- Exchange PS: Connect via `New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri http://neptune.acg.local/PowerShell/ -Authentication Kerberos`
+- Requires Tailscale route through D2TESTNAS (192.168.0.9) for 172.16.0.0/22
+
+## Known Issues (as of 2026-03-22)
+
+- 67.206.163.122 has no PTR record and is blacklisted by some providers
+- SNAT rule may not be active — outbound was going as .122 not .124 on 3/16. Need to check UDM (192.168.0.254) — couldn't auth via SSH tonight, check in morning
+- MAIL transport server still exists in Exchange config but server is decommissioned
+- Spam queues with junk domains (wwwyamaha666.ru, bestspatulas.com, etc.)
+- Tailscale 172.16.0.0/22 route moved from ACG pfSense to D2TESTNAS — may need permanent solution
+- UDM SSH password (Paper123!@#-unifi) was rejected — may have changed
+
+## Resolved (2026-03-22)
+
+- rieussetcorp.com outbound: Added 67.206.163.124 and .122 to MailProtector authorized IPs — mail now flowing

.claude/memory/reference_community_forum.md

@@ -0,0 +1,48 @@
+---
+name: Community Forum (Flarum)
+description: Flarum forum at community.azcomputerguru.com - platform details, API access, database credentials, and posting workflow
+type: reference
+---
+
+## Community Forum - Flarum
+
+- **URL:** https://community.azcomputerguru.com
+- **Platform:** Flarum 1.8.14
+- **Server:** IX server (172.16.3.10), cPanel account `azcomputerguru`
+- **Document Root:** `/home/azcomputerguru/public_html/community/public`
+- **PHP Version:** 8.1.33
+
+### Database
+- **Host:** localhost (on IX server)
+- **Database:** `azcompu_flarum`
+- **User:** `azcompu_flarum`
+- **Password:** `Fl@rum2026!CGS`
+
+### API
+- **API Key:** `581b6c8c162a383ba87757f41b4381e9bf8db61d71bd578ee97fe32b7aeac046` (admin user, ID 1)
+- **API Base:** `https://community.azcomputerguru.com/api`
+- **Note:** Cloudflare blocks external API access. Must either:
+  1. Use `--resolve` with `curl -k` from IX server localhost
+  2. Use direct PHP/database script on IX server (preferred, more reliable)
+
+### Forum Tags (Categories)
+| ID | Name | Slug |
+|----|------|------|
+| 1 | General | general |
+| 2 | Tech News | tech-news |
+| 3 | Security & Privacy | security-privacy |
+| 4 | Artificial Intelligence | artificial-intelligence |
+| 5 | Space Tech | space-tech |
+| 6 | Gadgets & Hardware | gadgets-hardware |
+| 7 | How-Tos & Tips | how-tos-tips |
+| 8 | Show Discussion | show-discussion |
+| 9 | Off-Topic | off-topic |
+
+### Posting Workflow
+Cloudflare blocks the Flarum REST API from external requests. To create posts programmatically:
+1. Write a PHP script that inserts directly into the database (discussions + posts + discussion_tag tables)
+2. SCP the script and JSON payload to IX server `/tmp/`
+3. Execute via `php /tmp/script.php` over SSH
+4. Clean up temp files
+
+**How to apply:** Use this when the user asks to create forum posts or manage the community forum.

.claude/memory/reference_dataforth_contact.md

@@ -0,0 +1,7 @@
+---
+name: Dataforth Contact - AJ
+description: AJ at Dataforth - email forwarding setup needed for dataforthgit@ address
+type: reference
+---
+
+AJ at Dataforth needs messages sent to the dataforthgit@ email address to forward to him.

.claude/memory/reference_ix_access_tailscale.md

@@ -0,0 +1,7 @@
+---
+name: IX Server Access via Tailscale
+description: IX server (ix.azcomputerguru.com) is accessible with Tailscale on, no VPN needed
+type: reference
+---
+
+IX server (ix.azcomputerguru.com / 172.16.3.10) can be accessed directly when Tailscale is on. No separate VPN connection required.

.claude/memory/reference_ix_server_ssh.md

@@ -0,0 +1,18 @@
+---
+name: IX Server SSH Access
+description: SSH access notes for IX server - key auth not set up on CachyOS workstation, must use sshpass with password
+type: reference
+---
+
+## IX Server SSH from CachyOS Workstation
+
+- **Host:** 172.16.3.10 (ix.azcomputerguru.com)
+- **User:** root
+- **Password:** See credentials.md
+- **SSH Key Auth:** NOT configured on CachyOS workstation (acg-guru-5070)
+- **Must use:** `sshpass -p 'PASSWORD' ssh -o StrictHostKeyChecking=no -o PubkeyAuthentication=no root@172.16.3.10`
+- **Suppress warnings:** Pipe through `grep -v WARNING | grep -v 'not using'` or `tail`
+
+**Why:** The SSH key from this machine hasn't been added to IX server's authorized_keys yet. The old WSL key (guru@wsl) was authorized but this is a new CachyOS install.
+
+**How to apply:** When running commands on IX server, use sshpass approach. Consider setting up SSH key auth to simplify future access.

.claude/memory/reference_matomo_analytics.md

@@ -0,0 +1,40 @@
+---
+name: Matomo Analytics
+description: Self-hosted Matomo analytics at analytics.azcomputerguru.com - credentials, site IDs, tracking setup for all 3 sites
+type: reference
+---
+
+## Matomo Analytics
+
+- **URL:** https://analytics.azcomputerguru.com
+- **Platform:** Matomo 5.8.0 (PHP)
+- **Server:** IX server (172.16.3.10), cPanel account `azcomputerguru`
+- **Document Root:** `/home/azcomputerguru/public_html/analytics/`
+
+### Login
+- **User:** MikeSwanson
+- **Password:** Mat0mo2026!CGS
+- **Email:** mike@azcomputerguru.com
+
+### Database
+- **Host:** localhost (on IX server)
+- **Database:** `azcompu_matomo`
+- **User:** `azcompu_matomo`
+- **Password:** `Mat0mo2026!CGS`
+
+### Tracked Sites
+| Site ID | Name | URL | Tracking Method |
+|---------|------|-----|-----------------|
+| 1 | AZ Computer Guru | https://azcomputerguru.com | WordPress mu-plugin (`wp-content/mu-plugins/matomo-tracking.php`) |
+| 2 | Community Forum | https://community.azcomputerguru.com | Flarum `custom_header` DB setting |
+| 3 | Radio Show | https://radio.azcomputerguru.com | Injected into HTML files before `</head>` |
+
+### Cron
+- Archiving cron runs every 5 minutes as `azcomputerguru` user
+- Command: `php /home/azcomputerguru/public_html/analytics/console core:archive`
+
+### Cloudflare
+- DNS record points to 72.194.62.5, proxied (orange cloud)
+- Was previously pointing to wrong IP (52.52.94.202), fixed 2026-03-20
+
+**How to apply:** Use this when managing analytics, adding new sites to track, or troubleshooting tracking code.

.claude/memory/reference_neptune_access_d2testnas.md

@@ -0,0 +1,7 @@
+---
+name: Neptune Access via D2TESTNAS
+description: Neptune Exchange server must be accessed by routing through D2TESTNAS (not direct VPN)
+type: reference
+---
+
+Neptune (neptune.acghosting.com / 172.16.3.11) must be accessed by routing through D2TESTNAS, not via direct VPN connection.

.claude/memory/reference_radio_website.md

@@ -0,0 +1,23 @@
+---
+name: Radio Show Website
+description: The Computer Guru Show website at radio.azcomputerguru.com - Astro static site on IX server cPanel
+type: reference
+---
+
+## Radio Show Website
+
+- **URL:** https://radio.azcomputerguru.com
+- **Platform:** Astro 6.0.4 (static site generator)
+- **Server:** IX server (172.16.3.10), cPanel account `azcomputerguru`
+- **Document Root:** `/home/azcomputerguru/public_html/radio`
+- **Source Code:** `projects/radio-show/website/` in ClaudeTools repo
+- **Build:** `cd projects/radio-show/website && npm run build` produces `dist/` folder
+- **Deploy:** rsync/SCP `dist/` contents to document root on IX server
+
+### Community Link
+- The community page (`/community`) links to:
+  - Discord server (placeholder, WidgetBot)
+  - Flarum forum at https://community.azcomputerguru.com
+  - Newsletter signup (placeholder)
+
+**How to apply:** Use when deploying website updates or managing the radio show project.

.claude/memory/reference_workstation_setup.md

@@ -0,0 +1,35 @@
+---
+name: CachyOS Workstation Setup
+description: Current workstation config - CachyOS on ASUS laptop, dual NVMe, autostart apps, old home btrfs subvolume location
+type: reference
+---
+
+## Workstation: acg-guru-5070
+
+- **OS:** CachyOS (Arch-based), kernel 6.19.x
+- **DE:** KDE Plasma 6 (Wayland)
+- **CPU/GPU:** Intel Arrow Lake-S + NVIDIA RTX 5070 Ti Mobile
+- **Tailscale IP:** 100.95.216.79
+
+### Storage
+- **nvme0n1:** 954GB btrfs - CachyOS install (OS, root)
+- **nvme1n1:** 954GB ext4 - `/home` (formatted from old Windows drive)
+- **Old home:** btrfs `@home` subvolume on nvme0n1, mount with: `sudo mount -o subvol=@home UUID=8a8b1d34-99fb-470f-82ca-b5d08e43ec32 /mnt/old-home`
+
+### Autostart Apps (~/.config/autostart/)
+- `arch-update-tray.desktop` (pre-existing)
+- `cachyos-hello.desktop` (pre-existing)
+- `discord.desktop` (added, starts minimized)
+- `tailscale-systray.desktop` (added)
+- ScreenConnect: autostart removed (on-demand only via URI scheme handler from web UI)
+
+### Known Issues
+- **Warm reboot hangs:** Rebooting (e.g. for GPU issues) causes system to hang with spinning symbol — requires hard power-off. Observed multiple times. Likely NVIDIA driver not unloading cleanly during shutdown.
+
+### Key Fixes Applied
+- **Tailscale:** `--accept-routes`, systemd-resolved + NetworkManager DNS config
+- **Brightness:** Hide nvidia_0 backlight via udev rule, KDE controls intel_backlight only
+- **ScreenConnect:** dpkg + full JRE + Wayland patch (GDK_BACKEND=x11)
+- **Sudo:** NOPASSWD for guru user
+
+**How to apply:** Reference when troubleshooting workstation issues or setting up additional services.

.claude/scripts/sync.bat

@@ -0,0 +1,5 @@
+@echo off
+REM ClaudeTools Sync - Windows Wrapper
+REM Calls the bash sync script via Git Bash
+
+bash "%~dp0sync.sh"

.claude/scripts/sync.sh

@@ -0,0 +1,118 @@
+#!/bin/bash
+# ClaudeTools Bidirectional Sync Script
+# Ensures proper pull BEFORE push on all machines
+
+set -e  # Exit on error
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m' # No Color
+
+# Detect machine name
+if [ -n "$COMPUTERNAME" ]; then
+    MACHINE="$COMPUTERNAME"
+else
+    MACHINE=$(hostname)
+fi
+
+# Timestamp
+TIMESTAMP=$(date "+%Y-%m-%d %H:%M:%S")
+
+echo -e "${GREEN}[OK]${NC} Starting ClaudeTools sync from $MACHINE at $TIMESTAMP"
+
+# Navigate to ClaudeTools directory
+if [ -d "$HOME/ClaudeTools" ]; then
+    cd "$HOME/ClaudeTools"
+elif [ -d "/d/ClaudeTools" ]; then
+    cd "/d/ClaudeTools"
+elif [ -d "D:/ClaudeTools" ]; then
+    cd "D:/ClaudeTools"
+else
+    echo -e "${RED}[ERROR]${NC} ClaudeTools directory not found"
+    exit 1
+fi
+
+echo -e "${GREEN}[OK]${NC} Working directory: $(pwd)"
+
+# Phase 1: Check and commit local changes
+echo ""
+echo "=== Phase 1: Local Changes ==="
+
+if ! git diff-index --quiet HEAD -- 2>/dev/null; then
+    echo -e "${YELLOW}[INFO]${NC} Local changes detected"
+
+    # Show status
+    git status --short
+
+    # Stage all changes
+    echo -e "${GREEN}[OK]${NC} Staging all changes..."
+    git add -A
+
+    # Commit with timestamp
+    COMMIT_MSG="sync: Auto-sync from $MACHINE at $TIMESTAMP
+
+Synced files:
+- Session logs updated
+- Latest context and credentials
+- Command/directive updates
+
+Machine: $MACHINE
+Timestamp: $TIMESTAMP
+
+Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>"
+
+    git commit -m "$COMMIT_MSG"
+    echo -e "${GREEN}[OK]${NC} Changes committed"
+else
+    echo -e "${GREEN}[OK]${NC} No local changes to commit"
+fi
+
+# Phase 2: Sync with remote (CRITICAL: Pull BEFORE Push)
+echo ""
+echo "=== Phase 2: Remote Sync (Pull + Push) ==="
+
+# Fetch to see what's available
+echo -e "${GREEN}[OK]${NC} Fetching from remote..."
+git fetch origin
+
+# Check if remote has updates
+LOCAL=$(git rev-parse main)
+REMOTE=$(git rev-parse origin/main)
+
+if [ "$LOCAL" != "$REMOTE" ]; then
+    echo -e "${YELLOW}[INFO]${NC} Remote has updates, pulling..."
+
+    # Pull with rebase
+    if git pull origin main --rebase; then
+        echo -e "${GREEN}[OK]${NC} Successfully pulled remote changes"
+        git log --oneline "$LOCAL..origin/main"
+    else
+        echo -e "${RED}[ERROR]${NC} Pull failed - may have conflicts"
+        echo -e "${YELLOW}[INFO]${NC} Resolve conflicts and run sync again"
+        exit 1
+    fi
+else
+    echo -e "${GREEN}[OK]${NC} Already up to date with remote"
+fi
+
+# Push local changes
+echo ""
+echo -e "${GREEN}[OK]${NC} Pushing local changes to remote..."
+if git push origin main; then
+    echo -e "${GREEN}[OK]${NC} Successfully pushed to remote"
+else
+    echo -e "${RED}[ERROR]${NC} Push failed"
+    exit 1
+fi
+
+# Phase 3: Report final status
+echo ""
+echo "=== Sync Complete ==="
+echo -e "${GREEN}[OK]${NC} Local branch: $(git rev-parse --abbrev-ref HEAD)"
+echo -e "${GREEN}[OK]${NC} Current commit: $(git log -1 --oneline)"
+echo -e "${GREEN}[OK]${NC} Remote status: $(git status -sb | head -1)"
+
+echo ""
+echo -e "${GREEN}[SUCCESS]${NC} All machines in sync. Ready to continue work."

.claude/skills/1password/references/integrations.md

@@ -0,0 +1,222 @@
+# 1Password Integration Patterns
+
+Common patterns for integrating 1Password with developer tools and AI workflows.
+
+## Claude Code / Claude Desktop
+
+### Claude Desktop MCP Config
+
+Store API keys securely and reference them in `claude_desktop_config.json`:
+
+```bash
+# Store the key
+op item create --category API_CREDENTIAL --title "My MCP Server" \
+  --vault Dev api_key[password]=your-key-here
+
+# Get the secret reference
+# op://Dev/My MCP Server/api_key
+```
+
+```json
+{
+  "mcpServers": {
+    "my-server": {
+      "command": "op",
+      "args": ["run", "--", "node", "/path/to/server.js"],
+      "env": {
+        "API_KEY": "op://Dev/My MCP Server/api_key"
+      }
+    }
+  }
+}
+```
+
+### Claude Code Shell Environment
+
+```bash
+# .env.tpl (safe to commit — no real secrets)
+ANTHROPIC_API_KEY=op://Dev/Anthropic/api_key
+OPENAI_API_KEY=op://Dev/OpenAI/api_key
+
+# ✅ Wrap claude with op run — secrets injected into subprocess only
+op run --env-file=.env.tpl -- claude
+
+# ✅ Or export individually for interactive shell use
+export ANTHROPIC_API_KEY=$(op read "op://Dev/Anthropic/api_key")
+claude
+```
+
+### In CLAUDE.md (project secrets reference)
+
+```markdown
+## Secrets Setup
+Secrets are managed via 1Password. Run before working:
+```bash
+op run --env-file=.env.tpl -- claude
+```
+Do NOT commit `.env` — commit `.env.tpl` only.
+```
+
+## n8n
+
+### Environment Injection at Startup
+
+```bash
+# n8n.env.tpl (commit this)
+N8N_ENCRYPTION_KEY=op://Dev/n8n/encryption_key
+DB_POSTGRESDB_PASSWORD=op://Dev/n8n-postgres/password
+N8N_BASIC_AUTH_PASSWORD=op://Dev/n8n/basic_auth_password
+
+# docker-compose.yml startup
+op run --env-file=n8n.env.tpl -- docker compose up -d n8n
+```
+
+### n8n Credential Storage via API
+
+Use n8n's credential API to push secrets from 1Password into n8n:
+
+```bash
+# Get secret from 1Password
+API_KEY=$(op read "op://Dev/Some Service/api_key")
+
+# Push to n8n credential (HTTP Request)
+curl -s -X POST "https://n8n.example.com/api/v1/credentials" \
+  -H "X-N8N-API-KEY: $(op read 'op://Dev/n8n/api_key')" \
+  -H "Content-Type: application/json" \
+  -d "{\"name\": \"Service Credential\", \"type\": \"httpHeaderAuth\", \"data\": {\"name\": \"Authorization\", \"value\": \"Bearer $API_KEY\"}}"
+```
+
+## Docker / Docker Compose
+
+```yaml
+# docker-compose.yml
+services:
+  app:
+    image: myapp:latest
+    environment:
+      DATABASE_URL: ${DATABASE_URL}
+      API_KEY: ${API_KEY}
+```
+
+```bash
+# .env.tpl
+DATABASE_URL=op://Dev/Postgres/connection_string
+API_KEY=op://Dev/MyApp/api_key
+
+# Start with injection
+op run --env-file=.env.tpl -- docker compose up
+```
+
+## Python Scripts
+
+```python
+import subprocess
+
+def get_secret(reference: str) -> str:
+    """Read a secret from 1Password using a secret reference."""
+    result = subprocess.run(
+        ["op", "read", reference],
+        capture_output=True, text=True, check=True
+    )
+    return result.stdout.strip()
+
+# Usage
+api_key = get_secret("op://Dev/Anthropic/api_key")
+```
+
+Or using the 1Password Python SDK (if available):
+```bash
+pip install onepassword-sdk
+```
+
+```python
+import asyncio
+import onepassword
+
+async def main():
+    client = await onepassword.Client.authenticate(
+        auth=os.environ["OP_SERVICE_ACCOUNT_TOKEN"],
+        integration_name="My Script",
+        integration_version="1.0.0",
+    )
+    secret = await client.secrets.resolve("op://Dev/Anthropic/api_key")
+```
+
+## GitHub Actions / CI
+
+```yaml
+# .github/workflows/deploy.yml
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: 1password/load-secrets-action@v2
+        with:
+          export-env: true
+        env:
+          OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
+          ANTHROPIC_API_KEY: op://Dev/Anthropic/api_key
+          DEPLOY_KEY: op://Dev/Deploy/private_key
+
+      - run: deploy-script.sh  # ANTHROPIC_API_KEY is available
+```
+
+## Shell / .zshrc Auto-Load
+
+```bash
+# ~/.zshrc
+# Auto-load common dev secrets on shell start (optional — only if you trust your machine)
+load_dev_secrets() {
+  if command -v op &>/dev/null && op whoami &>/dev/null 2>&1; then
+    source <(op run --env-file=~/.config/dev.env.tpl -- env 2>/dev/null) && \
+      echo "✅ Dev secrets loaded from 1Password"
+  fi
+}
+
+# Call explicitly when needed:
+alias load-secrets='load_dev_secrets'
+```
+
+## Supabase
+
+```bash
+# Store Supabase credentials
+op item create --category API_CREDENTIAL --title "Supabase - My Project" \
+  --vault Dev \
+  url[text]=https://myproject.supabase.co \
+  anon_key[password]=eyJ... \
+  service_key[password]=eyJ...
+
+# Use in scripts
+SUPABASE_URL=$(op read "op://Dev/Supabase - My Project/url")
+SUPABASE_KEY=$(op read "op://Dev/Supabase - My Project/service_key")
+```
+
+## Replit
+
+Replit has its own Secrets manager, but for local dev before deploying:
+
+```bash
+# Generate a .env from 1Password, then paste values into Replit Secrets UI
+op run --env-file=.env.tpl -- env | grep -E "^(ANTHROPIC|SUPABASE|N8N)"
+# Copy output values → paste into Replit Secrets one by one
+```
+
+## Rotation Workflow
+
+When rotating a credential:
+
+```bash
+# 1. Update in the service (get new key)
+NEW_KEY="new-key-from-service"
+
+# 2. Update in 1Password
+op item edit "Service Name" api_key[password]="$NEW_KEY"
+
+# 3. Verify
+op read "op://Dev/Service Name/api_key"
+
+# 4. Re-inject wherever used
+source <(op run --env-file=.env.tpl -- env)
+# Or restart services that use the key
+```

.claude/skills/1password/references/op_commands.md

@@ -0,0 +1,171 @@
+# 1Password CLI (op) Command Reference
+
+## Authentication
+
+```bash
+# Sign in (interactive)
+op signin
+
+# Sign in to specific account
+op signin --account team-name.1password.com
+
+# Check who you're signed in as
+op whoami
+
+# List accounts
+op account list
+
+# Service account (CI/CD — set env var, no signin needed)
+export OP_SERVICE_ACCOUNT_TOKEN="your-token"
+```
+
+## Items
+
+```bash
+# List items
+op item list
+op item list --vault Dev
+op item list --categories API_CREDENTIAL
+
+# Get item details
+op item get "Item Title"
+op item get "Item Title" --vault Dev
+op item get "Item Title" --format json
+
+# Get a specific field
+op item get "Item Title" --fields api_key
+op item get "Item Title" --fields label=api_key
+
+# Read using secret reference (most common)
+op read "op://Dev/Item Title/api_key"
+
+# Create item
+op item create --category API_CREDENTIAL --title "My API Key" api_key[password]=sk-abc123
+op item create --category LOGIN --title "Service Account" --vault Dev \
+  username[text]=myuser password[password]=mypass
+
+# Edit/update item
+op item edit "Item Title" api_key[password]=new-value
+op item edit "Item Title" --vault Dev new_field[text]=value
+
+# Delete item
+op item delete "Item Title"
+op item delete "Item Title" --vault Dev
+
+# Move item to different vault
+op item move "Item Title" --current-vault Dev --destination-vault Personal
+```
+
+## Vaults
+
+```bash
+# List vaults
+op vault list
+op vault list --format json
+
+# Create vault
+op vault create "New Vault"
+
+# Get vault details
+op vault get "Vault Name"
+```
+
+## Secrets Injection
+
+```bash
+# Run command with secrets from .env template (RECOMMENDED)
+op run --env-file=.env.tpl -- your-command arg1 arg2
+
+# Inject into Docker
+op run --env-file=.env.tpl -- docker compose up
+
+# Inject a single reference via env var (op run picks up op:// values automatically)
+export API_KEY="op://Dev/MyApp/api_key"
+op run -- node app.js   # API_KEY is resolved at runtime
+
+# ⚠️  AVOID: sourcing op run output into the current shell
+# source <(op run --env-file=.env.tpl -- env)   ← UNSAFE
+# If secret values contain $(...) or backticks, they execute as shell code.
+# Use 'op run -- your-command' instead (secrets stay in subprocess only).
+```
+
+## Password Generation
+
+```bash
+# Generate at item creation time (no standalone command)
+op item create --category PASSWORD --title "Generated Secret" \
+  --generate-password='letters,digits,symbols,32'
+
+# Generate with custom recipe
+op item create --category LOGIN --title "My Login" \
+  --generate-password='letters,digits,20'
+
+# Or use openssl for scripted generation
+openssl rand -base64 32 | tr -d '=+/'
+```
+
+## Document / File Management
+
+```bash
+# Store a file
+op document create ./private-key.pem --title "SSH Private Key" --vault Dev
+
+# Get a file
+op document get "SSH Private Key" --output ./private-key.pem
+
+# List documents
+op document list
+```
+
+## Service Accounts (CI/CD)
+
+```bash
+# Create service account (in 1Password UI: Settings → Developer → Service Accounts)
+# Then set token as env var:
+export OP_SERVICE_ACCOUNT_TOKEN="ops_eyJ..."
+
+# No signin needed — op commands work automatically
+op item list  # works with service account token
+op read "op://vault/item/field"
+```
+
+## Connect (Self-hosted, advanced)
+
+```bash
+# For teams running 1Password Connect server
+export OP_CONNECT_HOST="https://your-connect-server"
+export OP_CONNECT_TOKEN="your-connect-token"
+
+# Then op commands use Connect instead of 1Password.com
+op item get "Item Title"
+```
+
+## Output Formats
+
+Valid values: `json` or `human-readable` (default).
+
+```bash
+op item list --format=json           # Machine-readable JSON
+op item get "Item" --format=json     # Full item JSON
+op item list                         # Human-readable (default)
+op vault list --format=json          # Vaults as JSON
+```
+
+## Useful Patterns
+
+```bash
+# Find item by field value (search)
+op item list --format=json | \
+  python3 -c "import sys,json; [print(i['title']) for i in json.load(sys.stdin)]"
+
+# Export all items in a vault to JSON (backup)
+op item list --vault Dev --format=json | \
+  python3 -c "import sys,json; ids=[i['id'] for i in json.load(sys.stdin)]"
+# (then loop to get each)
+
+# Check if a specific item exists
+op item get "My Item" &>/dev/null && echo "exists" || echo "not found"
+
+# Get item ID (for scripting)
+op item get "My Item" --format=json | python3 -c "import sys,json; print(json.load(sys.stdin)['id'])"
+```

.claude/skills/1password/references/secret_references.md

@@ -0,0 +1,120 @@
+# 1Password Secret References
+
+Secret references are the safest way to use secrets — they point to 1Password without exposing actual values in code or config files.
+
+## Syntax
+
+```
+op://vault/item/field
+op://vault/item/section/field
+```
+
+**Examples:**
+```bash
+op://Dev/Anthropic/api_key
+op://Personal/AWS/access_key_id
+op://Dev/Supabase/section/service_key
+```
+
+## Reading a Secret Reference
+
+```bash
+# Single secret
+op read "op://Dev/Anthropic/api_key"
+
+# Into a variable
+export ANTHROPIC_API_KEY=$(op read "op://Dev/Anthropic/api_key")
+
+# Multiple secrets via op run
+op run --env-file=.env.tpl -- your-command
+```
+
+## .env Template Files
+
+Store references in a `.env.tpl` file (safe to commit to **private** repos):
+
+> **Privacy note:** `.env.tpl` contains your vault names, item names, and field names —
+> e.g. `op://Dev/Anthropic/api_key`. This reveals the structure of your 1Password vault
+> to anyone who can read the file. For **private repos**, this is fine. For **public repos**,
+> consider whether your vault/item naming reveals anything sensitive (client names, internal
+> service names, etc.). Real secret values are never exposed — only the structure.
+
+```bash
+# .env.tpl — commit this
+ANTHROPIC_API_KEY=op://Dev/Anthropic/api_key
+N8N_API_KEY=op://Dev/n8n/api_key
+SUPABASE_SERVICE_KEY=op://Dev/Supabase/service_key
+NOTION_TOKEN=op://Dev/Notion/api_token
+```
+
+Then inject at runtime:
+```bash
+# ✅ RECOMMENDED — run your command with secrets injected into subprocess only
+op run --env-file=.env.tpl -- npm start
+op run --env-file=.env.tpl -- node server.js
+op run --env-file=.env.tpl -- docker compose up
+
+# ✅ OK — read a single secret into a variable for immediate use
+export ANTHROPIC_API_KEY=$(op read "op://Dev/Anthropic/api_key")
+
+# ⚠️  AVOID — sourcing op run output exposes secrets in current shell
+# and is unsafe if any secret value contains shell metacharacters like $(...):
+# source <(op run --env-file=.env.tpl -- env)   ← DON'T DO THIS
+
+# ⚠️  AVOID — writing resolved secrets to disk (don't commit .env)
+# op run --env-file=.env.tpl -- env > .env       ← only if truly necessary
+```
+
+## In Config Files
+
+Claude Desktop (`claude_desktop_config.json`):
+```json
+{
+  "mcpServers": {
+    "my-server": {
+      "command": "op",
+      "args": ["run", "--", "node", "server.js"],
+      "env": {
+        "API_KEY": "op://Dev/MyServer/api_key"
+      }
+    }
+  }
+}
+```
+
+Docker Compose:
+```yaml
+services:
+  app:
+    image: myapp
+    environment:
+      - DATABASE_URL=op://Dev/Postgres/connection_string
+```
+Run with: `op run -- docker compose up`
+
+n8n (environment injection):
+```bash
+# In your n8n startup script
+op run --env-file=n8n.env.tpl -- docker compose up n8n
+```
+
+## Finding Field Names
+
+```bash
+# List all fields in an item
+op item get "Item Name" --format=json | \
+  python3 -c "import sys,json; [print(f['label']) for f in json.load(sys.stdin)['fields'] if f.get('value')]"
+
+# Or view interactively
+op item get "Item Name"
+```
+
+## Common Field Names by Category
+
+| Category | Common Fields |
+|----------|---------------|
+| API_CREDENTIAL | `api_key`, `credential`, `token` |
+| LOGIN | `username`, `password` |
+| DATABASE | `connection_string`, `host`, `port`, `username`, `password` |
+| SECURE_NOTE | `notesPlain` |
+| SERVER | `hostname`, `port`, `username`, `password` |

.claude/skills/1password/scripts/check_setup.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+# check_setup.sh — Verify 1Password CLI is installed and authenticated
+# Usage: bash check_setup.sh
+
+set -euo pipefail
+
+PASS=0
+FAIL=0
+
+check() {
+  local label="$1"
+  local cmd="$2"
+  if eval "$cmd" &>/dev/null; then
+    echo "  ✅ $label"
+    ((PASS++)) || true
+  else
+    echo "  ❌ $label"
+    ((FAIL++)) || true
+  fi
+}
+
+echo "=== 1Password CLI Setup Check ==="
+echo ""
+
+# 1. CLI installed
+check "op CLI installed" "command -v op"
+
+# 2. Version
+if command -v op &>/dev/null; then
+  echo "  ℹ️  Version: $(op --version)"
+fi
+
+echo ""
+echo "--- Authentication ---"
+
+# 3. Signed in
+check "Signed in to 1Password" "op account list 2>/dev/null | grep -q '.'"
+
+# 4. Can list vaults
+check "Can list vaults" "op vault list &>/dev/null"
+
+# Show accounts if authenticated
+if op account list &>/dev/null 2>&1; then
+  echo ""
+  echo "  Accounts:"
+  op account list 2>/dev/null | tail -n +2 | while read -r line; do
+    echo "    • $line"
+  done
+
+  echo ""
+  echo "  Vaults:"
+  op vault list --format=json 2>/dev/null | \
+    python3 -c "import sys,json; [print(f'    • {v[\"name\"]} ({v[\"id\"]})') for v in json.load(sys.stdin)]" 2>/dev/null || true
+fi
+
+echo ""
+echo "--- Environment ---"
+
+# 5. OP_SERVICE_ACCOUNT_TOKEN (CI/CD pattern)
+if [[ -n "${OP_SERVICE_ACCOUNT_TOKEN:-}" ]]; then
+  echo "  ✅ OP_SERVICE_ACCOUNT_TOKEN is set (service account mode)"
+else
+  echo "  ℹ️  OP_SERVICE_ACCOUNT_TOKEN not set (interactive/desktop app mode)"
+fi
+
+echo ""
+echo "==================================="
+if [[ $FAIL -eq 0 ]]; then
+  echo "✅ All checks passed. 1Password CLI is ready."
+else
+  echo "⚠️  $FAIL check(s) failed. See above."
+  echo ""
+  echo "Install: https://developer.1password.com/docs/cli/get-started/"
+  echo "Sign in: op signin"
+fi

.claude/skills/1password/scripts/env_from_op.sh

@@ -0,0 +1,142 @@
+#!/usr/bin/env bash
+# env_from_op.sh — Generate a .env file from 1Password items
+#
+# Usage:
+#   bash env_from_op.sh                        # Interactive: prompts for vault + items
+#   bash env_from_op.sh --vault Dev            # Use specific vault
+#   bash env_from_op.sh --item "My Project"    # Export all fields from one item
+#   bash env_from_op.sh --output .env          # Write to file (default: .env)
+#   bash env_from_op.sh --dry-run              # Print without writing
+#
+# Output format:
+#   FIELD_NAME=op://Vault/Item/field           # Secret references (safest)
+#   FIELD_NAME=actual_value                    # Resolved values (with --resolve)
+
+set -euo pipefail
+
+VAULT=""
+ITEM=""
+OUTPUT=".env"
+DRY_RUN=false
+RESOLVE=false
+
+# Parse args
+while [[ $# -gt 0 ]]; do
+  case $1 in
+    --vault) VAULT="$2"; shift 2 ;;
+    --item) ITEM="$2"; shift 2 ;;
+    --output) OUTPUT="$2"; shift 2 ;;
+    --dry-run) DRY_RUN=true; shift ;;
+    --resolve) RESOLVE=true; shift ;;
+    *) echo "Unknown option: $1"; exit 1 ;;
+  esac
+done
+
+# Check op is available
+if ! command -v op &>/dev/null; then
+  echo "❌ 1Password CLI (op) not found. Install: https://developer.1password.com/docs/cli/get-started/"
+  exit 1
+fi
+
+# If no item specified, list items and prompt
+if [[ -z "$ITEM" ]]; then
+  echo "Available items in vault '${VAULT:-all vaults}':"
+  if [[ -n "$VAULT" ]]; then
+    op item list --vault "$VAULT" --format=json | \
+      python3 -c "import sys,json; [print(f'  {i[\"title\"]}') for i in json.load(sys.stdin)]"
+  else
+    op item list --format=json | \
+      python3 -c "import sys,json; [print(f'  [{i[\"vault\"][\"name\"]}] {i[\"title\"]}') for i in json.load(sys.stdin)]"
+  fi
+  echo ""
+  read -rp "Enter item title: " ITEM
+fi
+
+echo "Fetching '${ITEM}' from 1Password..."
+
+# Get item as JSON
+if [[ -n "$VAULT" ]]; then
+  ITEM_JSON=$(op item get "$ITEM" --vault "$VAULT" --format=json)
+else
+  ITEM_JSON=$(op item get "$ITEM" --format=json)
+fi
+
+VAULT_NAME=$(echo "$ITEM_JSON" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['vault']['name'])")
+ITEM_TITLE=$(echo "$ITEM_JSON" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['title'])")
+
+# Build .env content
+ENV_CONTENT=$(echo "$ITEM_JSON" | python3 - <<'PYEOF'
+import sys, json, re
+
+data = json.load(sys.stdin)
+vault = data['vault']['name']
+title = data['title']
+lines = []
+
+SKIP_LABELS = {'username', 'password', 'notesPlain', 'notes'}
+SKIP_TYPES = {'CONCEALED'} if False else set()  # resolved mode: don't skip
+
+for field in data.get('fields', []):
+    label = field.get('label', '')
+    value = field.get('value', '')
+    field_id = field.get('id', '')
+    ftype = field.get('type', '')
+
+    # Skip empty, metadata, or UI-only fields
+    if not value or not label:
+        continue
+    if label.lower() in {'username', 'notesplain', 'notes', 'password'} and ftype not in {'CONCEALED', 'URL'}:
+        continue
+
+    # Convert label to ENV_VAR format
+    env_key = re.sub(r'[^A-Z0-9_]', '_', label.upper().replace(' ', '_').replace('-', '_'))
+    env_key = re.sub(r'_+', '_', env_key).strip('_')
+
+    # Use secret reference (safer than raw value)
+    ref = f"op://{vault}/{title}/{label}"
+    lines.append(f"{env_key}={ref}")
+
+print('\n'.join(lines))
+PYEOF
+)
+
+# Handle resolve flag — replace refs with real values
+if $RESOLVE; then
+  echo "⚠️  Writing resolved values (actual secrets). Handle carefully."
+  FINAL_CONTENT=""
+  while IFS= read -r line; do
+    if [[ "$line" =~ ^([A-Z_]+)=(op://.+)$ ]]; then
+      key="${BASH_REMATCH[1]}"
+      ref="${BASH_REMATCH[2]}"
+      value=$(op read "$ref" 2>/dev/null || echo "ERROR_READING")
+      FINAL_CONTENT+="${key}=${value}"$'\n'
+    else
+      FINAL_CONTENT+="$line"$'\n'
+    fi
+  done <<< "$ENV_CONTENT"
+  ENV_CONTENT="$FINAL_CONTENT"
+fi
+
+# Header
+HEADER="# Generated from 1Password: ${VAULT_NAME}/${ITEM_TITLE}
+# Generated: $(date -u +%Y-%m-%dT%H:%M:%SZ)
+# Load with: op run --env-file=.env -- <command>
+#            or: eval \$(op run --env-file=.env -- env | grep KEY)
+
+"
+
+FULL_CONTENT="${HEADER}${ENV_CONTENT}"
+
+if $DRY_RUN; then
+  echo ""
+  echo "--- .env preview ---"
+  echo "$FULL_CONTENT"
+  echo "--- end ---"
+else
+  echo "$FULL_CONTENT" > "$OUTPUT"
+  echo "✅ Written to $OUTPUT (${#ENV_CONTENT} chars, $(echo "$ENV_CONTENT" | grep -c '=' || true) vars)"
+  echo ""
+  echo "To use:"
+  echo "  op run --env-file=$OUTPUT -- your-command"
+  echo "  source <(op run --env-file=$OUTPUT -- env)"
+fi

.claude/skills/1password/scripts/launch-in-terminal.sh

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+# launch-in-terminal.sh — Open a script in a NEW Terminal.app window
+#
+# This is how the 1Password skill keeps secrets OUT of Claude Code.
+# Claude generates the script, then calls this launcher.
+# The script runs in Terminal.app — Claude never sees what you type.
+#
+# Usage:
+#   bash launch-in-terminal.sh /path/to/script.sh
+#   bash launch-in-terminal.sh /path/to/script.sh "window title"
+
+set -euo pipefail
+
+SCRIPT_PATH="${1:-}"
+TITLE="${2:-1Password Setup}"
+
+if [[ -z "$SCRIPT_PATH" ]]; then
+  echo "Usage: bash launch-in-terminal.sh /path/to/script.sh"
+  exit 1
+fi
+
+if [[ ! -f "$SCRIPT_PATH" ]]; then
+  echo "❌ Script not found: $SCRIPT_PATH"
+  exit 1
+fi
+
+chmod +x "$SCRIPT_PATH"
+
+echo ""
+echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+echo "  Opening Terminal.app to collect secrets"
+echo "  Script: $SCRIPT_PATH"
+echo ""
+echo "  ⚠️  Type your secrets in the Terminal"
+echo "     window that is about to open."
+echo "     Claude Code cannot see that window."
+echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+echo ""
+
+osascript <<APPLESCRIPT
+tell application "Terminal"
+  activate
+  set newTab to do script "echo '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━'; echo '  ${TITLE}'; echo '  Type secrets here — Claude Code cannot see this window'; echo '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━'; echo ''; bash ${SCRIPT_PATH}"
+end tell
+APPLESCRIPT
+
+echo "✅ Terminal.app opened. Complete the prompts there, then return here."
+echo "   (This window will wait for you to press Enter when done)"
+echo ""
+read -rp "Press Enter once you've finished in Terminal.app... "
+echo ""
+echo "Continuing..."

.claude/skills/1password/scripts/store-mcp-credentials.sh

@@ -0,0 +1,124 @@
+#!/usr/bin/env bash
+# store-mcp-credentials.sh — Store MCP server credentials in 1Password
+#
+# ⚠️  RUN THIS IN TERMINAL.APP — NOT IN CLAUDE CODE
+#     Claude Code can see everything typed in its terminal.
+#     Open Terminal.app separately, then run this script.
+#
+# Usage (Claude will generate a pre-filled version for you):
+#   bash store-mcp-credentials.sh \
+#     --vault Dev \
+#     --item "My MCP Server" \
+#     --set "url=https://api.example.com" \
+#     --set "log_level=error" \
+#     --secret "api_key" \
+#     --secret "webhook_secret"
+#
+# Options:
+#   --vault     1Password vault name (default: Dev)
+#   --item      Item title in 1Password
+#   --set       Non-secret field: key=value (pre-filled, visible)
+#   --secret    Secret field: prompted with hidden input
+#   --update    Update existing item instead of creating new
+
+set -euo pipefail
+
+VAULT="Dev"
+ITEM=""
+UPDATE=false
+declare -a SET_FIELDS=()
+declare -a SECRET_FIELDS=()
+
+while [[ $# -gt 0 ]]; do
+  case $1 in
+    --vault)   VAULT="$2";                    shift 2 ;;
+    --item)    ITEM="$2";                     shift 2 ;;
+    --set)     SET_FIELDS+=("$2");            shift 2 ;;
+    --secret)  SECRET_FIELDS+=("$2");         shift 2 ;;
+    --update)  UPDATE=true;                   shift   ;;
+    *) echo "Unknown option: $1"; exit 1 ;;
+  esac
+done
+
+if [[ -z "$ITEM" ]]; then
+  read -rp "Item title in 1Password: " ITEM
+fi
+
+echo ""
+echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+echo "  Storing: $ITEM"
+echo "  Vault:   $VAULT"
+echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+echo ""
+
+# Show pre-filled fields
+if [[ ${#SET_FIELDS[@]} -gt 0 ]]; then
+  echo "Pre-filled fields:"
+  for field in "${SET_FIELDS[@]}"; do
+    key="${field%%=*}"
+    val="${field#*=}"
+    echo "  $key = $val"
+  done
+  echo ""
+fi
+
+# Prompt for secret fields
+declare -a SECRET_VALUES=()
+if [[ ${#SECRET_FIELDS[@]} -gt 0 ]]; then
+  echo "Enter secret values (input is hidden):"
+  for field in "${SECRET_FIELDS[@]}"; do
+    read -rsp "  $field: " secret_val
+    echo ""
+    SECRET_VALUES+=("${field}[password]=${secret_val}")
+  done
+  echo ""
+fi
+
+# Build op field args for non-secret fields
+declare -a OP_FIELDS=()
+for field in "${SET_FIELDS[@]}"; do
+  key="${field%%=*}"
+  val="${field#*=}"
+  OP_FIELDS+=("${key}[text]=${val}")
+done
+
+# Combine all fields
+ALL_FIELDS=("${OP_FIELDS[@]+"${OP_FIELDS[@]}"}" "${SECRET_VALUES[@]+"${SECRET_VALUES[@]}"}")
+
+echo "Saving to 1Password..."
+
+if $UPDATE; then
+  op item edit "$ITEM" --vault "$VAULT" "${ALL_FIELDS[@]}"
+  echo ""
+  echo "✅ Updated '$ITEM' in vault '$VAULT'"
+else
+  # Try create, fall back to update if already exists
+  if op item get "$ITEM" --vault "$VAULT" &>/dev/null 2>&1; then
+    echo "  Item already exists — updating instead..."
+    op item edit "$ITEM" --vault "$VAULT" "${ALL_FIELDS[@]}"
+    echo ""
+    echo "✅ Updated '$ITEM' in vault '$VAULT'"
+  else
+    op item create \
+      --category API_CREDENTIAL \
+      --title "$ITEM" \
+      --vault "$VAULT" \
+      "${ALL_FIELDS[@]}"
+    echo ""
+    echo "✅ Created '$ITEM' in vault '$VAULT'"
+  fi
+fi
+
+echo ""
+echo "Secret references for your config:"
+for field in "${SET_FIELDS[@]}"; do
+  key="${field%%=*}"
+  echo "  op://${VAULT}/${ITEM}/${key}"
+done
+for field in "${SECRET_FIELDS[@]}"; do
+  echo "  op://${VAULT}/${ITEM}/${field}"
+done
+echo ""
+echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+echo "  Done. You can close this terminal."
+echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"

.claude/skills/1password/scripts/store_secret.sh

@@ -0,0 +1,91 @@
+#!/usr/bin/env bash
+# store_secret.sh — Store or update a secret in 1Password
+#
+# Usage:
+#   bash store_secret.sh --title "My API Key" --field "api_key" --value "sk-..."
+#   bash store_secret.sh --title "Project Creds" --vault Dev --category API_CREDENTIAL
+#   bash store_secret.sh --update --title "Existing Item" --field "api_key" --value "new-value"
+#   bash store_secret.sh --from-env MY_VAR   # Store from environment variable
+
+set -euo pipefail
+
+TITLE=""
+FIELD="credential"
+VALUE=""
+VAULT=""
+CATEGORY="API_CREDENTIAL"
+UPDATE=false
+FROM_ENV=""
+GENERATE=false
+GENERATE_LENGTH=32
+
+while [[ $# -gt 0 ]]; do
+  case $1 in
+    --title) TITLE="$2"; shift 2 ;;
+    --field) FIELD="$2"; shift 2 ;;
+    --value) VALUE="$2"; shift 2 ;;
+    --vault) VAULT="$2"; shift 2 ;;
+    --category) CATEGORY="$2"; shift 2 ;;
+    --update) UPDATE=true; shift ;;
+    --from-env) FROM_ENV="$2"; shift 2 ;;
+    --generate) GENERATE=true; shift ;;
+    --length) GENERATE_LENGTH="$2"; shift 2 ;;
+    *) echo "Unknown option: $1"; exit 1 ;;
+  esac
+done
+
+# Validate
+if [[ -z "$TITLE" ]]; then
+  read -rp "Item title: " TITLE
+fi
+
+# Get value from env var if requested
+if [[ -n "$FROM_ENV" ]]; then
+  VALUE="${!FROM_ENV:-}"
+  if [[ -z "$VALUE" ]]; then
+    echo "❌ Environment variable $FROM_ENV is not set or empty"
+    exit 1
+  fi
+  FIELD="${FROM_ENV}"
+  echo "Using value from \$$FROM_ENV"
+fi
+
+# Generate a secure credential if requested
+if $GENERATE; then
+  VALUE=$(openssl rand -base64 "$GENERATE_LENGTH" | tr -d '=+/' | head -c "$GENERATE_LENGTH")
+  echo "🔐 Generated secure credential ($GENERATE_LENGTH chars)"
+fi
+
+# Prompt for value if still empty
+if [[ -z "$VALUE" ]]; then
+  read -rsp "Value (hidden): " VALUE
+  echo ""
+fi
+
+VAULT_FLAG=""
+[[ -n "$VAULT" ]] && VAULT_FLAG="--vault $VAULT"
+
+if $UPDATE; then
+  echo "Updating '${FIELD}' in '${TITLE}'..."
+  op item edit "$TITLE" $VAULT_FLAG "${FIELD}[password]=${VALUE}"
+  echo "✅ Updated '${FIELD}' in '${TITLE}'"
+else
+  echo "Creating '${TITLE}' in 1Password..."
+  RESULT=$(op item create \
+    --category "$CATEGORY" \
+    --title "$TITLE" \
+    $VAULT_FLAG \
+    "${FIELD}[password]=${VALUE}" \
+    --format=json)
+
+  ITEM_ID=$(echo "$RESULT" | python3 -c "import sys,json; print(json.load(sys.stdin)['id'])")
+  VAULT_NAME=$(echo "$RESULT" | python3 -c "import sys,json; print(json.load(sys.stdin)['vault']['name'])")
+
+  echo "✅ Created '${TITLE}' (ID: ${ITEM_ID})"
+  echo ""
+  echo "Secret reference:"
+  echo "  op://${VAULT_NAME}/${TITLE}/${FIELD}"
+  echo ""
+  echo "Read it back:"
+  echo "  op read \"op://${VAULT_NAME}/${TITLE}/${FIELD}\""
+fi

.gitignore

@@ -61,3 +61,9 @@ api/.env
 
 # MCP Configuration (may contain secrets)
 .mcp.json
+Pictures/
+.grepai/
+# Radio processor
+projects/radio-show/audio-processor/test-data/*.mp3
+projects/radio-show/audio-processor/*.egg-info/
+

ANALYSIS_COMPLETE.md

@@ -0,0 +1,410 @@
+# DOS 6.22 UPDATE.BAT Analysis Complete
+
+## Executive Summary
+
+I have completed a comprehensive analysis of your Dataforth TS-4R DOS 6.22 batch file issues and created a complete solution package.
+
+## Problem Identified
+
+Your UPDATE.BAT script failed for two specific reasons:
+
+### 1. Machine Name Detection Failure
+- **Root Cause:** The batch file tried to use `%COMPUTERNAME%` environment variable
+- **Why it failed:** `%COMPUTERNAME%` does NOT exist in DOS 6.22 (it's a Windows 95+ feature)
+- **Solution:** Use `%MACHINE%` environment variable set in AUTOEXEC.BAT instead
+
+### 2. T: Drive Detection Failure
+- **Root Cause:** The batch file checked if an environment variable was set, not if the actual drive existed
+- **Why it failed:** Likely used `IF "%TDRIVE%"==""` or similar - checks variable, not drive
+- **Solution:** Use proper DOS 6.22 drive test: `T: 2>NUL` followed by `IF ERRORLEVEL 1`
+
+### 3. DOS 6.22 Compatibility Issues
+- **Problems:** Script likely used Windows CMD features not available in DOS 6.22
+  - `IF /I` (case-insensitive) - not in DOS 6.22
+  - `%ERRORLEVEL%` variable - must use `IF ERRORLEVEL n` instead
+  - `&&` or `||` operators - not in COMMAND.COM
+- **Solution:** Rewrote entire script using only DOS 6.22 compatible commands
+
+## Why Manual XCOPY Worked
+
+Your manual command succeeded:
+```
+XCOPY /S C:\*.* T:\TS-4R\BACKUP
+```
+
+Because you:
+1. Ran it AFTER network was already started (T: was mapped)
+2. Manually typed the machine name (TS-4R)
+3. Didn't need automatic detection or error checking
+
+UPDATE.BAT failed because it tried to be "smart" and auto-detect things, but used the wrong methods for DOS 6.22.
+
+## Solution Package Created
+
+I have created 10 files in `D:\ClaudeTools\`:
+
+### Batch Files (Deploy to DOS Machine)
+
+1. **UPDATE.BAT** - Fixed backup script
+   - Auto-detects machine from %MACHINE% variable
+   - Accepts command-line parameter as override
+   - Properly tests T: drive availability
+   - Comprehensive error handling
+   - DOS 6.22 compatible
+
+2. **AUTOEXEC.BAT** - Updated startup script
+   - Sets `MACHINE=TS-4R` environment variable
+   - Calls STARTNET.BAT for network
+   - Optional automatic backup (commented out)
+   - Shows network status
+
+3. **STARTNET.BAT** - Network initialization
+   - Starts Microsoft Network Client
+   - Maps T: and X: drives
+   - Error messages for each failure
+
+4. **DOSTEST.BAT** - Configuration test
+   - Tests all settings are correct
+   - Reports what needs fixing
+   - Run this BEFORE deploying UPDATE.BAT
+
+### Documentation Files (Reference)
+
+5. **README_DOS_FIX.md** - Main documentation (START HERE)
+   - 5-minute quick fix
+   - Deployment methods
+   - Testing procedures
+   - Troubleshooting
+
+6. **DOS_FIX_SUMMARY.md** - Executive summary
+   - Problem statement
+   - Root causes
+   - Solution overview
+   - Quick deployment
+
+7. **DOS_BATCH_ANALYSIS.md** - Technical deep-dive
+   - Complete DOS 6.22 boot sequence
+   - Why each issue occurred
+   - Detection strategies comparison
+   - DOS vs Windows differences
+
+8. **DOS_DEPLOYMENT_GUIDE.md** - Complete guide
+   - Phase-by-phase deployment
+   - Detailed testing procedures
+   - Comprehensive troubleshooting
+   - 25+ pages of step-by-step instructions
+
+9. **DEPLOYMENT_CHECKLIST.txt** - Printable checklist
+   - 9-phase deployment procedure
+   - Checkboxes for each step
+   - Troubleshooting log
+   - Sign-off section
+
+10. **DOS_FIX_INDEX.txt** - Package index
+    - Lists all files
+    - Quick reference
+    - Reading order recommendations
+
+## How to Use This Package
+
+### Quick Start (5 minutes)
+
+1. **Copy files to DOS machine:**
+   - UPDATE.BAT → C:\BATCH\UPDATE.BAT
+   - AUTOEXEC.BAT → C:\AUTOEXEC.BAT
+   - STARTNET.BAT → C:\NET\STARTNET.BAT
+   - DOSTEST.BAT → C:\DOSTEST.BAT
+
+2. **Edit AUTOEXEC.BAT on DOS machine:**
+   ```
+   EDIT C:\AUTOEXEC.BAT
+   ```
+   Find: `SET MACHINE=TS-4R`
+   Change to actual machine name if different
+   Save and exit
+
+3. **Reboot DOS machine:**
+   ```
+   Press Ctrl+Alt+Delete
+   ```
+
+4. **Test configuration:**
+   ```
+   DOSTEST
+   ```
+   Fix any [FAIL] results
+
+5. **Run backup:**
+   ```
+   UPDATE
+   ```
+   Should work automatically!
+
+### For Detailed Deployment
+
+Read these files in order:
+1. `README_DOS_FIX.md` - Overview and quick start
+2. `DEPLOYMENT_CHECKLIST.txt` - Follow step-by-step
+3. `DOS_DEPLOYMENT_GUIDE.md` - If problems occur
+
+## Key Features of Fixed UPDATE.BAT
+
+### Machine Detection
+```bat
+REM Checks MACHINE variable first
+IF NOT "%MACHINE%"=="" GOTO USE_ENV
+
+REM Falls back to command-line parameter
+IF NOT "%1"=="" GOTO USE_PARAM
+
+REM Clear error if both missing
+ECHO [ERROR] Machine name not specified
+```
+
+### T: Drive Detection
+```bat
+REM Actually test the drive
+T: 2>NUL
+IF ERRORLEVEL 1 GOTO NO_T_DRIVE
+
+REM Double-check with NUL device
+IF NOT EXIST T:\NUL GOTO NO_T_DRIVE
+
+REM Drive is accessible
+ECHO [OK] T: drive accessible
+```
+
+### Error Handling
+```bat
+REM XCOPY error levels
+IF ERRORLEVEL 5 GOTO DISK_ERROR
+IF ERRORLEVEL 4 GOTO INIT_ERROR
+IF ERRORLEVEL 2 GOTO USER_ABORT
+IF ERRORLEVEL 1 GOTO NO_FILES
+
+REM Success
+ECHO [OK] Backup completed successfully
+```
+
+### Console Output
+- Compact status messages (no scrolling)
+- Errors PAUSE so they're visible
+- Success messages don't pause
+- No |MORE pipes (cause issues)
+
+## Expected Results After Deployment
+
+### Boot Sequence
+```
+==============================================================
+  Dataforth Test Machine: TS-4R
+  DOS 6.22 with Network Client
+==============================================================
+
+Starting network client...
+
+[OK] Network client started
+[OK] T: mapped to \\D2TESTNAS\test
+[OK] X: mapped to \\D2TESTNAS\datasheets
+
+Network Drives:
+  T: = \\D2TESTNAS\test
+  X: = \\D2TESTNAS\datasheets
+
+System ready.
+
+Commands:
+  UPDATE       - Backup C: to T:\TS-4R\BACKUP
+
+C:\>
+```
+
+### Running UPDATE
+```
+C:\>UPDATE
+
+Checking network drive T:...
+[OK] T: drive accessible
+
+==============================================================
+Backup: Machine TS-4R
+==============================================================
+Source: C:\
+Target: T:\TS-4R\BACKUP
+
+[OK] Backup directory ready
+
+Starting backup...
+
+[OK] Backup completed successfully
+
+Files backed up to: T:\TS-4R\BACKUP
+
+C:\>
+```
+
+## DOS 6.22 Boot Sequence Traced
+
+```
+1. BIOS POST
+2. Load DOS kernel
+   - IO.SYS
+   - MSDOS.SYS
+   - COMMAND.COM
+3. Process CONFIG.SYS
+   - DEVICE=C:\NET\PROTMAN.DOS /I:C:\NET
+   - DEVICE=C:\NET\NE2000.DOS (or other NIC driver)
+   - DEVICE=C:\NET\NETBEUI.DOS
+4. Process AUTOEXEC.BAT
+   - SET MACHINE=TS-4R ← NEW: Machine identification
+   - SET PATH=C:\DOS;C:\NET;C:\BATCH;C:\
+   - CALL C:\NET\STARTNET.BAT
+5. STARTNET.BAT runs
+   - NET START
+   - NET USE T: \\D2TESTNAS\test /YES
+   - NET USE X: \\D2TESTNAS\datasheets /YES
+6. (Optional) CALL C:\BATCH\UPDATE.BAT
+7. DOS prompt ready: C:\>
+```
+
+## Environment After Boot
+
+**Environment variables:**
+```
+MACHINE=TS-4R              ← Set by AUTOEXEC.BAT
+PATH=C:\DOS;C:\NET;C:\BATCH;C:\
+PROMPT=$P$G
+TEMP=C:\TEMP
+TMP=C:\TEMP
+```
+
+**Network drives:**
+```
+T: = \\D2TESTNAS\test
+X: = \\D2TESTNAS\datasheets
+```
+
+**Commands available:**
+```
+UPDATE          - Run backup (uses MACHINE variable)
+UPDATE TS-4R    - Run backup (specify machine name)
+DOSTEST         - Test configuration
+```
+
+## Troubleshooting Quick Reference
+
+| Problem | Solution |
+|---------|----------|
+| "Bad command or file name" | `SET PATH=C:\DOS;C:\NET;C:\BATCH;C:\` |
+| MACHINE variable not set | Edit C:\AUTOEXEC.BAT, add `SET MACHINE=TS-4R` |
+| T: drive not accessible | Run `C:\NET\STARTNET.BAT` |
+| UPDATE runs but no error visible | Errors now PAUSE automatically |
+| Backup location wrong | Check `SET MACHINE` value matches expected |
+
+For complete troubleshooting, see `DOS_DEPLOYMENT_GUIDE.md`
+
+## Next Steps
+
+### Immediate Action
+1. Read `README_DOS_FIX.md` for overview
+2. Print `DEPLOYMENT_CHECKLIST.txt`
+3. Follow checklist to deploy to TS-4R machine
+4. Test with DOSTEST.BAT
+5. Run UPDATE to verify backup works
+
+### After First Machine Success
+1. Document the procedure worked
+2. Deploy to additional machines (TS-7A, TS-12B, etc.)
+3. Change MACHINE= line in each machine's AUTOEXEC.BAT
+4. (Optional) Enable automatic backup on boot
+
+### Long Term
+1. Keep documentation for future reference
+2. Use same approach for any other DOS machines
+3. Backup directory: T:\[MACHINE]\BACKUP
+
+## Files Ready for Deployment
+
+All files are in: `D:\ClaudeTools\`
+
+**Copy to network location:**
+```
+Option 1: T:\TS-4R\UPDATES\
+Option 2: Floppy disk
+Option 3: Use EDIT on DOS machine to create manually
+```
+
+**Files to deploy:**
+- UPDATE.BAT
+- AUTOEXEC.BAT
+- STARTNET.BAT
+- DOSTEST.BAT
+
+**Documentation (keep on Windows PC):**
+- README_DOS_FIX.md
+- DOS_FIX_SUMMARY.md
+- DOS_BATCH_ANALYSIS.md
+- DOS_DEPLOYMENT_GUIDE.md
+- DEPLOYMENT_CHECKLIST.txt
+- DOS_FIX_INDEX.txt
+
+## Testing Checklist
+
+After deployment, verify:
+
+- [ ] Machine boots to DOS
+- [ ] MACHINE variable set (`SET` command shows it)
+- [ ] T: drive accessible (`T:` then `DIR` works)
+- [ ] X: drive accessible (`X:` then `DIR` works)
+- [ ] UPDATE runs without parameters
+- [ ] Backup completes successfully
+- [ ] Files appear in T:\TS-4R\BACKUP\
+- [ ] Error messages visible if network unplugged
+
+## Technical Details
+
+**DOS 6.22 limitations addressed:**
+- No `IF /I` flag - use case-sensitive checks
+- No `%ERRORLEVEL%` variable - use `IF ERRORLEVEL n`
+- No `&&` or `||` operators - use `GOTO`
+- No `FOR /F` loops - use simple `FOR`
+- 8.3 filenames only
+- `COMMAND.COM` not `CMD.EXE`
+
+**Network environment:**
+- Microsoft Network Client 3.0 (or Workgroup Add-On)
+- NetBEUI protocol
+- SMB1 share access
+- WINS name resolution
+
+**Backup method:**
+- XCOPY with /D flag (incremental)
+- First run: copies all files
+- Subsequent runs: only newer files
+- Old files NOT deleted (not a mirror)
+
+## Support
+
+If you encounter issues:
+
+1. Run `DOSTEST.BAT` to diagnose
+2. Check `DOS_DEPLOYMENT_GUIDE.md` troubleshooting section
+3. Verify physical connections
+4. Test NAS from another machine
+5. Review PROTOCOL.INI configuration
+
+## Conclusion
+
+Your DOS 6.22 UPDATE.BAT script failed because it used Windows-specific features that don't exist in DOS 6.22. I have created a complete replacement that:
+
+1. **Works with DOS 6.22** - uses only compatible commands
+2. **Detects machine name** - via AUTOEXEC.BAT environment variable
+3. **Checks T: drive properly** - actually tests the drive, not just a variable
+4. **Shows errors clearly** - pauses on errors, compact on success
+5. **Is well documented** - 6 documentation files, 1 checklist, 1 test script
+
+The package is ready to deploy. Start with `README_DOS_FIX.md` for the 5-minute quick fix, or follow `DEPLOYMENT_CHECKLIST.txt` for a thorough deployment.
+
+All files are in: `D:\ClaudeTools\`
+
+Good luck with the deployment!

BEHAVIORAL_RULES_INTEGRATION_SUMMARY.md

@@ -0,0 +1,297 @@
+# Behavioral Rules Integration Summary
+
+**Date:** 2026-01-19
+**Task:** Integrate C: drive Claude behavioral rules into D:\ClaudeTools
+**Status:** COMPLETE
+
+---
+
+## What Was Done
+
+### 1. Created .claude/commands/ Directory Structure
+- **Location:** `D:\ClaudeTools\.claude\commands\`
+- **Purpose:** House custom Claude commands for consistent behavior
+
+### 2. Integrated Command Files
+
+#### /save Command (.claude/commands/save.md)
+**Source:** C:\Users\MikeSwanson\Claude\.claude\commands\save.md
+**Purpose:** Save comprehensive session logs for context recovery
+**Features:**
+- Mandatory content sections (session summary, credentials, infrastructure, commands, config changes, pending tasks)
+- Filename format: `session-logs/YYYY-MM-DD-session.md`
+- Append mode if file exists (don't overwrite)
+- ALL credentials stored UNREDACTED for future context recovery
+- Git commit and push after saving
+- ClaudeTools-specific additions: Database details, API endpoints, migration files
+
+#### /context Command (.claude/commands/context.md)
+**Source:** C:\Users\MikeSwanson\Claude\.claude\commands\context.md
+**Purpose:** Search previous work to avoid asking user for known information
+**Features:**
+- Searches session-logs/ directory for keywords
+- Reads credentials.md for infrastructure access details
+- Never asks user for information already in logs
+- Common searches: credentials, servers, services, database, previous work
+- ClaudeTools-specific additions: SESSION_STATE.md, .claude/claude.md references
+
+#### /sync Command (.claude/commands/sync.md)
+**Source:** Already existed in D:\ClaudeTools (kept comprehensive version)
+**Purpose:** Sync ClaudeTools configuration from Gitea repository
+**Features:**
+- Comprehensive Gitea integration with Gitea Agent
+- Auto-stash conflict handling
+- Safety features (no data loss, rollback possible)
+- Syncs .claude/ directory, documentation, README
+- Does NOT sync machine-specific settings (.claude/settings.local.json)
+
+### 3. Created Centralized Credentials File
+
+#### credentials.md
+**Location:** `D:\ClaudeTools\credentials.md`
+**Purpose:** Centralized, UNREDACTED credentials for context recovery
+**Sections:**
+- **Infrastructure - SSH Access**
+  - GuruRMM Server (172.16.3.30) - ClaudeTools database/API host
+  - Jupiter (172.16.3.20) - Unraid primary, Gitea server
+  - AD2 (192.168.0.6) - Dataforth production server
+  - D2TESTNAS (192.168.0.9) - Dataforth SMB1 proxy for DOS machines
+  - Dataforth DOS Machines (TS-XX) - ~30 MS-DOS 6.22 QC machines
+- **Services - Web Applications**
+  - Gitea (SSH, API, web interface)
+  - ClaudeTools API (endpoints, authentication, test user)
+- **Projects - ClaudeTools**
+  - Database connection details
+  - API authentication methods
+  - Encryption key information
+- **Projects - Dataforth DOS**
+  - Update workflow (AD2 → NAS → DOS)
+  - Key batch files (UPDATE.BAT, NWTOC.BAT, etc.)
+  - Folder structure (\\AD2\test\)
+- **Connection Testing**
+  - Test commands for each service
+  - Verification scripts
+
+**Security Note:** File is intentionally UNREDACTED for context recovery, must never be committed to public repositories
+
+### 4. Updated .claude/claude.md
+
+**Added Sections:**
+- **Context Recovery & Session Logs** (new major section)
+  - Session logs format and purpose
+  - Credentials file structure
+  - Context recovery workflow
+  - Example usage
+- **Important Files** (updated)
+  - Added credentials.md reference
+  - Added session-logs/ reference
+- **Available Commands** (updated)
+  - Added /save command
+  - Added /context command
+  - /sync already existed
+
+**Updated Last Modified:**
+- Changed from: "2026-01-18 (Context system removed, coordinator role enforced)"
+- Changed to: "2026-01-19 (Integrated C: drive behavioral rules, added context recovery system)"
+
+### 5. Configured Gitea Sync for Portability
+
+**Git Remote Configuration:**
+- **Origin:** ssh://git@172.16.3.20:2222/azcomputerguru/claudetools.git
+- **Gitea alias:** ssh://git@172.16.3.20:2222/azcomputerguru/claudetools.git
+
+**Changed from HTTPS to SSH:**
+- Previous: https://git.azcomputerguru.com/azcomputerguru/claudetools.git
+- Updated: ssh://git@172.16.3.20:2222/azcomputerguru/claudetools.git
+- Reason: SSH provides passwordless authentication with keys (more secure, more portable)
+
+---
+
+## What Still Needs Configuration
+
+### SSH Key Setup for Gitea
+**Status:** SSH authentication test failed (publickey error)
+**Required:** Set up SSH key for passwordless git operations
+
+**Steps to Complete:**
+1. **Generate SSH key** (if not exists):
+   ```bash
+   ssh-keygen -t ed25519 -C "mike@azcomputerguru.com" -f ~/.ssh/id_ed25519_gitea
+   ```
+
+2. **Add public key to Gitea:**
+   - Login to https://git.azcomputerguru.com/
+   - Go to Settings → SSH/GPG Keys
+   - Add new SSH key
+   - Paste contents of `~/.ssh/id_ed25519_gitea.pub`
+
+3. **Configure SSH client** (~/.ssh/config):
+   ```
+   Host git.azcomputerguru.com 172.16.3.20
+       HostName 172.16.3.20
+       Port 2222
+       User git
+       IdentityFile ~/.ssh/id_ed25519_gitea
+       IdentitiesOnly yes
+   ```
+
+4. **Test connection:**
+   ```bash
+   ssh -p 2222 git@172.16.3.20
+   # Should return: "Hi there! You've successfully authenticated..."
+   ```
+
+5. **Test git operation:**
+   ```bash
+   cd D:\ClaudeTools
+   git fetch gitea
+   ```
+
+---
+
+## Files Created/Modified
+
+### Created Files:
+1. `D:\ClaudeTools\.claude\commands\save.md` (2.3 KB)
+2. `D:\ClaudeTools\.claude\commands\context.md` (1.5 KB)
+3. `D:\ClaudeTools\credentials.md` (9.8 KB)
+4. `D:\ClaudeTools\session-logs\` (directory created)
+5. `D:\ClaudeTools\BEHAVIORAL_RULES_INTEGRATION_SUMMARY.md` (this file)
+
+### Modified Files:
+1. `D:\ClaudeTools\.claude\claude.md`
+   - Added "Context Recovery & Session Logs" section
+   - Updated "Important Files" section
+   - Updated "Available Commands" section
+   - Updated "Last Updated" timestamp
+
+### Git Configuration Modified:
+1. Remote "origin" URL changed from HTTPS to SSH
+2. Remote "gitea" alias added
+
+---
+
+## Benefits Achieved
+
+### 1. Context Recovery System
+- **Problem:** Context lost when conversation summarized or new session starts
+- **Solution:** Comprehensive session logs + centralized credentials file
+- **Result:** Future Claude sessions can recover ALL context without user input
+
+### 2. Consistent Behavioral Rules
+- **Problem:** ClaudeTools missing behavioral patterns from C: drive projects
+- **Solution:** Integrated /save and /context commands
+- **Result:** Consistent behavior across all Claude projects
+
+### 3. Portability via Gitea Sync
+- **Problem:** Work trapped on single machine, hard to switch machines
+- **Solution:** Git sync with SSH authentication
+- **Result:** Can work on ClaudeTools from any machine with git sync
+
+### 4. Never Ask for Known Information
+- **Problem:** User had to repeatedly provide same credentials/details
+- **Solution:** /context command searches logs before asking
+- **Result:** Faster workflow, less user frustration
+
+### 5. Complete Infrastructure Documentation
+- **Problem:** Credentials scattered across sessions, hard to find
+- **Solution:** credentials.md with ALL infrastructure details
+- **Result:** Single source of truth for all access credentials
+
+---
+
+## Usage Examples
+
+### Example 1: Start New Session
+```
+User: "Continue work on Dataforth DOS updates"
+
+Claude: (Uses /context command internally)
+Claude: Searches session-logs/ and credentials.md
+Claude: Finds: AD2 (192.168.0.6), D2TESTNAS (192.168.0.9), DOS update workflow
+Claude: "I found the Dataforth DOS infrastructure details. AD2 is at 192.168.0.6
+        with sync mechanism (scheduled task), and D2TESTNAS is the SMB1 proxy at
+        192.168.0.9. The update workflow is AD2 → NAS → DOS machines. What would
+        you like to work on?"
+```
+
+### Example 2: End of Session
+```
+User: "Save the session log"
+
+Claude: (Uses /save command)
+Claude: Creates/appends to session-logs/2026-01-19-session.md
+Claude: Includes:
+  - What was accomplished (DOS batch files created)
+  - ALL credentials used (AD2, NAS passwords)
+  - Infrastructure details (192.168.0.6, 192.168.0.9)
+  - Commands run (XCOPY, ssh, etc.)
+  - Files created (UPDATE.BAT, NWTOC.BAT, etc.)
+  - Next steps (Need to find AD2 sync mechanism)
+Claude: Commits to git: "Session log: Dataforth DOS update system integration"
+Claude: Pushes to gitea (if SSH configured)
+```
+
+### Example 3: Sync Across Machines
+```
+User: (on different machine) "/sync"
+
+Claude: (Uses Gitea Agent)
+Claude: git fetch gitea main
+Claude: git pull gitea main (auto-stash if needed)
+Claude: Reports: "Synced 3 files: .claude/claude.md, credentials.md, session-logs/2026-01-19-session.md"
+Claude: "Ready to continue work from where you left off on other machine"
+```
+
+---
+
+## Integration Status
+
+| Component | Status | Notes |
+|-----------|--------|-------|
+| /save command | COMPLETE | Integrated from C: drive, enhanced for ClaudeTools |
+| /context command | COMPLETE | Integrated from C: drive, enhanced for ClaudeTools |
+| /sync command | COMPLETE | Already existed, kept comprehensive version |
+| credentials.md | COMPLETE | Created with all infrastructure details |
+| session-logs/ | COMPLETE | Directory created, ready for use |
+| .claude/claude.md | COMPLETE | Updated with new sections and commands |
+| Git SSH config | NEEDS SETUP | SSH key not configured yet |
+| Gitea remote | COMPLETE | Configured, awaiting SSH key |
+
+---
+
+## Next Steps
+
+1. **User Action Required:** Set up SSH key for Gitea (see "What Still Needs Configuration")
+2. **Test /save command:** Create first session log
+3. **Test /context command:** Search for Dataforth information
+4. **Test /sync command:** Sync to/from Gitea (after SSH setup)
+5. **Optional:** Create .gitignore entries if credentials.md should remain local-only
+
+---
+
+## Best Practices Going Forward
+
+### When Starting New Session:
+1. Use `/context` to search for previous work
+2. Read credentials.md for infrastructure access
+3. Check SESSION_STATE.md for project status
+
+### During Work:
+1. Document all credentials discovered
+2. Note all infrastructure changes
+3. Record important commands and outputs
+
+### Before Ending Session:
+1. Use `/save` to create comprehensive session log
+2. Commit and push if significant work done
+3. Use `/sync` to ensure gitea has latest changes
+
+### When Switching Machines:
+1. Use `/sync` to pull latest changes
+2. Verify credentials.md is up to date
+3. Check session-logs/ for recent context
+
+---
+
+**This integration brings ClaudeTools to feature parity with C: drive Claude projects while maintaining ClaudeTools' superior structure and organization.**

CATALOG_CLIENTS.md

@@ -0,0 +1,997 @@
+# CLIENT CATALOG - MSP Infrastructure & Work Index
+
+**Generated:** 2026-01-26
+**Source Files:** 30 session logs from C:\Users\MikeSwanson\claude-projects\session-logs\ and D:\ClaudeTools\
+**Coverage:** December 2025 - January 2026
+
+**STATUS:** IN PROGRESS - 15/30 files processed initially. Additional details will be added as remaining files are reviewed.
+
+---
+
+## Table of Contents
+
+1. [AZ Computer Guru (Internal)](#az-computer-guru-internal)
+2. [BG Builders LLC](#bg-builders-llc)
+3. [CW Concrete LLC](#cw-concrete-llc)
+4. [Dataforth](#dataforth)
+5. [Glaztech Industries](#glaztech-industries)
+6. [Grabb & Durando](#grabb--durando)
+7. [Khalsa](#khalsa)
+8. [RRS Law Firm](#rrs-law-firm)
+9. [Scileppi Law Firm](#scileppi-law-firm)
+10. [Sonoran Green LLC](#sonoran-green-llc)
+11. [Valley Wide Plastering (VWP)](#valley-wide-plastering-vwp)
+12. [Infrastructure Summary](#infrastructure-summary)
+
+---
+
+## AZ Computer Guru (Internal)
+
+### Status
+**Active** - Internal operations and infrastructure
+
+### Infrastructure
+
+#### Servers
+| Server | IP | Role | OS | Credentials |
+|--------|-----|------|-----|-------------|
+| Jupiter | 172.16.3.20 | Unraid Primary, Containers | Unraid | root / Th1nk3r^99## |
+| Saturn | 172.16.3.21 | Unraid Secondary | Unraid | root / r3tr0gradE99 |
+| Build Server (gururmm) | 172.16.3.30 | GuruRMM, PostgreSQL | Ubuntu 22.04 | guru / Gptf*77ttb123!@#-rmm |
+| pfSense | 172.16.0.1 | Firewall, Tailscale Gateway | FreeBSD/pfSense 2.8.1 | admin / r3tr0gradE99!! |
+| WebSvr | websvr.acghosting.com | WHM/cPanel Hosting | - | root / r3tr0gradE99# |
+| IX | 172.16.3.10 | WHM/cPanel Hosting | - | Key auth |
+
+#### Network Configuration
+- **LAN Subnet:** 172.16.0.0/22
+- **Tailscale Network:** 100.x.x.x/32 (mesh VPN)
+  - pfSense: 100.119.153.74 (hostname: pfsense-2)
+  - ACG-M-L5090: 100.125.36.6
+- **WAN (Fiber):** 98.181.90.163/31
+- **Public IPs:** 72.194.62.2-10, 70.175.28.51-57
+
+#### Docker Containers (Jupiter)
+| Container | Port | Purpose |
+|-----------|------|---------|
+| gururmm-server | 3001 | GuruRMM API |
+| gururmm-db | 5432 | PostgreSQL 16 |
+| gitea | 3000, SSH 2222 | Git server |
+| gitea-db | 3306 | MySQL 8 |
+| npm | 1880 (HTTP), 18443 (HTTPS), 7818 (admin) | Nginx Proxy Manager |
+| seafile | - | File sync |
+| seafile-mysql | - | MySQL for Seafile |
+
+### Services & URLs
+
+#### Gitea (Git Server)
+- **URL:** https://git.azcomputerguru.com/
+- **Internal:** 172.16.3.20:3000
+- **SSH:** 172.16.3.20:2222 (external: git.azcomputerguru.com:2222)
+- **Credentials:** mike@azcomputerguru.com / Window123!@#-git
+- **API Token:** 9b1da4b79a38ef782268341d25a4b6880572063f
+
+#### GuruRMM (RMM Platform)
+- **Dashboard:** https://rmm-api.azcomputerguru.com
+- **API Internal:** http://172.16.3.30:3001
+- **Database:** PostgreSQL on 172.16.3.30
+  - DB: gururmm / 43617ebf7eb242e814ca9988cc4df5ad
+- **JWT Secret:** ZNzGxghru2XUdBVlaf2G2L1YUBVcl5xH0lr/Gpf/QmE=
+- **Dashboard Login:** admin@azcomputerguru.com / GuruRMM2025
+- **Site Codes:**
+  - AZ Computer Guru: SWIFT-CLOUD-6910
+  - Glaztech: DARK-GROVE-7839
+
+#### NPM (Nginx Proxy Manager)
+- **Admin URL:** http://172.16.3.20:7818
+- **Credentials:** mike@azcomputerguru.com / r3tr0gradE99!
+- **Cloudflare API Token:** U1UTbBOWA4a69eWEBiqIbYh0etCGzrpTU4XaKp7w
+
+#### Seafile (File Sync)
+- **URL:** https://sync.azcomputerguru.com
+- **Internal:** Saturn 172.16.3.21
+- **MySQL:** seafile / 64f2db5e-6831-48ed-a243-d4066fe428f9
+
+#### Syncro PSA/RMM
+- **API Base:** https://computerguru.syncromsp.com/api/v1
+- **API Key:** T259810e5c9917386b-52c2aeea7cdb5ff41c6685a73cebbeb3
+- **Subdomain:** computerguru
+- **Customers:** 5,064 (29 duplicates found)
+
+#### Autotask PSA
+- **API Zone:** webservices5.autotask.net
+- **API User:** dguyqap2nucge6r@azcomputerguru.com
+- **Password:** z*6G4fT#oM~8@9Hxy$2Y7K$ma
+- **Integration Code:** HYTYYZ6LA5HB5XK7IGNA7OAHQLH
+- **Companies:** 5,499 (19 exact duplicates, 30+ near-duplicates)
+
+#### CIPP (CyberDrain Partner Portal)
+- **URL:** https://cippcanvb.azurewebsites.net
+- **Tenant ID:** ce61461e-81a0-4c84-bb4a-7b354a9a356d
+- **App ID:** 420cb849-542d-4374-9cb2-3d8ae0e1835b
+- **Client Secret:** MOn8Q~otmxJPLvmL~_aCVTV8Va4t4~SrYrukGbJT
+
+### Work Performed
+
+#### 2025-12-12
+- **Tailscale Fix:** Re-authenticated Tailscale on pfSense after upgrade
+- **WebSvr Security:** Blocked 10 IPs attacking SSH via Imunify360
+- **Disk Cleanup:** Freed 58GB (86% → 80%) by truncating logs
+- **DNS Fix:** Added A record for data.grabbanddurando.com
+
+#### 2025-12-13
+- **Claude Code Setup:** Created desktop shortcuts and multi-machine deployment script
+
+#### 2025-12-14
+- **SSL Certificate:** Added rmm-api.azcomputerguru.com to NPM
+- **Session Logging:** Improved system to capture complete context with credentials
+- **Rust Installation:** Installed Rust toolchain on WSL
+- **SSH Keys:** Generated and distributed keys for infrastructure access
+
+#### 2025-12-16 (Multiple Sessions)
+- **GuruRMM Dashboard:** Deployed to build server, configured nginx
+- **Auto-Update System:** Implemented agent self-update with version scanner
+- **Binary Replacement:** Fixed Linux binary replacement bug (rename-then-copy)
+- **MailProtector:** Deployed outbound mail filtering on WebSvr and IX
+
+#### 2025-12-17
+- **Git Sync:** Fixed /s slash command, pulled 56 files from Gitea
+- **MailProtector Guide:** Created comprehensive admin documentation
+
+#### 2025-12-18
+- **MSP Credentials:** Added Syncro and Autotask API credentials
+- **Duplicate Analysis:** Found 19 exact duplicates in Autotask, 29 in Syncro
+- **GuruRMM Windows Build:** Attempted Windows agent build (VS issues)
+
+#### 2025-12-20 (Multiple Sessions)
+- **GuruRMM Tray Launcher:** Implemented Windows session enumeration
+- **Service Name Fix:** Corrected Windows service name in updater
+- **v0.5.0 Deployment:** Built and deployed Linux/Windows agents
+- **API Endpoint:** Added POST /api/agents/:id/update for pushing updates
+
+#### 2025-12-21 (Multiple Updates)
+- **Temperature Metrics:** Added CPU/GPU temp collection to agent v0.5.1
+- **SQLx Migration Fix:** Resolved checksum mismatch issues
+- **Windows Cross-Compile:** Set up mingw-w64 on build server
+- **CI/CD Pipeline:** Created webhook handler and automated build script
+- **Policy System:** Designed and implemented hierarchical policy system (Client → Site → Agent)
+- **Authorization System:** Implemented multi-tenant authorization (Phases 1-2)
+
+#### 2025-12-25
+- **Tailscale Firewall:** Added permanent firewall rules for Tailscale on pfSense
+- **Migration Monitoring:** Verified SeaFile and Scileppi data migrations
+- **pfSense Hardware Migration:** Migrated to Intel N100 hardware with igc NICs
+
+#### 2025-12-26
+- **Port Forwards:** Verified all working after pfSense migration
+- **Gitea SSH Fix:** Updated NAT from Docker internal (172.19.0.3) to Jupiter LAN (172.16.3.20)
+
+### Pending Tasks
+- GuruRMM agent architecture support (ARM, different OS versions)
+- Repository optimization (ensure all remotes point to Gitea)
+- Clean up old Tailscale entries from admin panel
+- Windows SSH keys for Jupiter and RS2212+ direct access
+- NPM proxy for rmm.azcomputerguru.com SSO dashboard
+
+### Important Dates
+- **2025-12-12:** Major security audit and cleanup
+- **2025-12-16:** GuruRMM auto-update system completed
+- **2025-12-21:** Policy and authorization systems implemented
+- **2025-12-25:** pfSense hardware migration to Intel N100
+
+---
+
+## BG Builders LLC
+
+### Status
+**Active** - Email security hardening completed December 2025
+
+### Company Information
+- **Domain:** bgbuildersllc.com
+- **Related Entity:** Sonoran Green LLC (same M365 tenant)
+
+### Microsoft 365
+
+#### Tenant Information
+- **Tenant ID:** ededa4fb-f6eb-4398-851d-5eb3e11fab27
+- **onmicrosoft.com:** sonorangreenllc.onmicrosoft.com
+- **Admin User:** sysadmin@bgbuildersllc.com
+- **Password:** Window123!@#-bgb
+
+#### Licenses
+- 8x Microsoft 365 Business Standard
+- 4x Exchange Online Plan 1
+- 1x Microsoft 365 Basic
+- **Security Gap:** No advanced security features (no conditional access, Intune, or Defender)
+- **Recommendation:** Upgrade to Business Premium
+
+#### Email Security (Configured 2025-12-19)
+| Record | Status | Details |
+|--------|--------|---------|
+| SPF | ✅ | `v=spf1 include:spf.protection.outlook.com -all` |
+| DMARC | ✅ | `v=DMARC1; p=reject; rua=mailto:sysadmin@bgbuildersllc.com` |
+| DKIM selector1 | ✅ | CNAME to selector1-bgbuildersllc-com._domainkey.sonorangreenllc.onmicrosoft.com |
+| DKIM selector2 | ✅ | CNAME to selector2-bgbuildersllc-com._domainkey.sonorangreenllc.onmicrosoft.com |
+| MX | ✅ | bgbuildersllc-com.mail.protection.outlook.com |
+
+### Network & Hosting
+
+#### Cloudflare
+- **Zone ID:** 156b997e3f7113ddbd9145f04aadb2df
+- **Nameservers:** amir.ns.cloudflare.com, mckinley.ns.cloudflare.com
+- **A Records:** 3.33.130.190, 15.197.148.33 (proxied) - GoDaddy Website Builder
+
+### Work Performed
+
+#### 2025-12-19 (Email Security Incident)
+- **Incident:** Phishing email spoofing shelly@bgbuildersllc.com
+- **Subject:** "Sonorangreenllc.com New Notice: All Employee Stipend..."
+- **Attachment:** Shelly_Bonus.pdf (52 KB)
+- **Investigation:** Account NOT compromised - external spoofing attack
+- **Root Cause:** Missing DMARC and DKIM records
+- **Response:**
+  - Verified no mailbox forwarding, inbox rules, or send-as permissions
+  - Added DMARC record with `p=reject` policy
+  - Configured DKIM selectors (selector1 and selector2)
+  - Email correctly routed to Junk folder by M365
+
+#### 2025-12-19 (Cloudflare Migration)
+- Migrated bgbuildersllc.com from GoDaddy to Cloudflare DNS
+- Recovered original A records from GoDaddy nameservers
+- Created 14 DNS records including M365 email records
+- Preserved GoDaddy zone file for reference
+
+### Pending Tasks
+- Create cPanel account for bgbuildersllc.com on IX server
+- Update Cloudflare A records to IX server IP (72.194.62.5) after account creation
+- Enable DKIM signing in M365 Defender
+- Consider migrating sonorangreenllc.com to Cloudflare
+
+### Important Dates
+- **2025-12-19:** Email security hardening completed
+- **2025-04-15:** Last password change for user accounts
+
+---
+
+## CW Concrete LLC
+
+### Status
+**Active** - Security assessment completed December 2025
+
+### Company Information
+- **Domain:** cwconcretellc.com
+
+### Microsoft 365
+
+#### Tenant Information
+- **Tenant ID:** dfee2224-93cd-4291-9b09-6c6ce9bb8711
+
+#### Licenses
+- 2x Microsoft 365 Business Standard
+- 2x Exchange Online Essentials
+- **Security Gap:** No advanced security features
+- **Recommendation:** Upgrade to Business Premium for Intune, conditional access, Defender
+
+### Work Performed
+
+#### 2025-12-23
+- **License Analysis:** Queried via CIPP API
+- **Security Assessment:** Identified lack of advanced security features
+- **Recommendation:** Business Premium upgrade for security
+
+---
+
+## Dataforth
+
+### Status
+**Active** - Ongoing support including RADIUS/VPN, Active Directory, M365 management
+
+### Company Information
+- **Domain:** dataforth.com, intranet.dataforth.com (AD domain: INTRANET)
+
+### Network Infrastructure
+
+#### Unifi Dream Machine (UDM)
+- **IP:** 192.168.0.254
+- **SSH:** root / Paper123!@#-unifi
+- **Web UI:** azcomputerguru / r3tr0gradE99! (2FA enabled)
+- **SSH Key:** claude-code key added
+- **VPN Endpoint:** 67.206.163.122:1194/TCP
+- **VPN Subnet:** 192.168.6.0/24
+
+#### Active Directory
+| Server | IP | Role |
+|--------|-----|------|
+| AD1 | 192.168.0.27 | Primary DC, NPS/RADIUS |
+| AD2 | 192.168.0.6 | Secondary DC |
+
+- **Domain:** INTRANET (DNS: intranet.dataforth.com)
+- **Admin:** INTRANET\sysadmin / Paper123!@#
+
+#### RADIUS/NPS Configuration
+- **Server:** 192.168.0.27 (AD1)
+- **Port:** 1812/UDP (auth), 1813/UDP (accounting)
+- **Shared Secret:** Gptf*77ttb!@#!@#
+- **RADIUS Client:** unifi (192.168.0.254)
+- **Network Policy:** Unifi - allows Domain Users 24/7
+- **Auth Methods:** All (PAP, CHAP, MS-CHAP, MS-CHAPv2, EAP)
+- **AuthAttributeRequired:** False (required for UniFi OpenVPN)
+
+#### OpenVPN Routes (Split Tunnel)
+- 192.168.0.0/24
+- 192.168.1.0/24
+- 192.168.4.0/24
+- 192.168.100.0/24
+- 192.168.200.0/24
+- 192.168.201.0/24
+
+### Microsoft 365
+
+#### Tenant Information
+- **Tenant ID:** 7dfa3ce8-c496-4b51-ab8d-bd3dcd78b584
+- **Admin:** sysadmin@dataforth.com / Paper123!@# (synced with AD)
+
+#### Entra App Registration (Claude-Code-M365)
+- **Purpose:** Silent Graph API access for automation
+- **App ID:** 7a8c0b2e-57fb-4d79-9b5a-4b88d21b1f29
+- **Client Secret:** tXo8Q~ZNG9zoBpbK9HwJTkzx.YEigZ9AynoSrca3
+- **Created:** 2025-12-22
+- **Expires:** 2027-12-22
+- **Permissions:** Calendars.ReadWrite, Contacts.ReadWrite, User.ReadWrite.All, Mail.ReadWrite, Directory.ReadWrite.All, Group.ReadWrite.All, Sites.ReadWrite.All, Files.ReadWrite.All, Reports.Read.All, AuditLog.Read.All, Application.ReadWrite.All, Device.ReadWrite.All, SecurityEvents.Read.All, IdentityRiskEvent.Read.All, Policy.Read.All, RoleManagement.ReadWrite.Directory
+
+### Work Performed
+
+#### 2025-12-20 (RADIUS/OpenVPN Setup)
+- **Problem:** VPN connections failing with RADIUS authentication
+- **Root Cause:** NPS required Message-Authenticator attribute, but UDM's pam_radius_auth doesn't send it
+- **Solution:**
+  - Set NPS RADIUS client AuthAttributeRequired to False
+  - Created comprehensive OpenVPN client profiles (.ovpn) for Windows and Linux
+  - Configured split tunnel (no redirect-gateway)
+  - Added proper DNS configuration
+- **Testing:** Successfully authenticated INTRANET\sysadmin via VPN
+- **Files Created:** dataforth-vpn.ovpn, dataforth-vpn-linux.ovpn
+
+#### 2025-12-22 (John Lehman Mailbox Cleanup)
+- **User:** jlehman@dataforth.com
+- **Problem:** Duplicate calendar events and contacts causing Outlook sync issues
+- **Investigation:** Created Entra app for persistent Graph API access
+- **Results:**
+  - Deleted 175 duplicate recurring calendar series (kept newest)
+  - Deleted 476 duplicate contacts
+  - Deleted 1 blank contact
+  - 11 series couldn't be deleted (John is attendee, not organizer)
+- **Cleanup Stats:**
+  - Contacts: 937 → 460 (477 removed)
+  - Recurring series: 279 → 104 (175 removed)
+- **Post-Cleanup Issues:**
+  - Calendar categories lost (colors) - awaiting John's preferences for re-application
+  - Focused Inbox ML model reset - created 12 "Other" overrides for bulk senders
+- **Follow-up:** Block New Outlook toggle via registry (HideNewOutlookToggle)
+
+### Pending Tasks
+- John Lehman needs to reset Outlook profile for fresh sync
+- Apply "Block New Outlook" registry fix on John's laptop
+- Re-apply calendar categories based on John's preferences
+- Test VPN client profiles on actual client machines
+
+### Important Dates
+- **2025-12-20:** RADIUS/VPN authentication successfully configured
+- **2025-12-22:** Major mailbox cleanup for John Lehman
+
+---
+
+## Glaztech Industries
+
+### Status
+**Active** - Active Directory planning, firewall hardening, GuruRMM deployment
+
+### Company Information
+- **Domain:** glaztech.com
+- **Subdomain (standalone):** slc.glaztech.com (planned migration to main domain)
+
+### Active Directory
+
+#### Migration Plan
+- **Current:** slc.glaztech.com standalone domain (~12 users/computers)
+- **Recommendation:** Manual migration to glaztech.com using OUs for site segmentation
+- **Reason:** Small environment, manual migration more reliable than ADMT for this size
+
+#### Firewall GPO Scripts (Created 2025-12-18)
+- **Purpose:** Ransomware protection via firewall segmentation
+- **Location:** `/home/guru/claude-projects/glaztech-firewall/`
+- **Files Created:**
+  - `Configure-WorkstationFirewall.ps1` - Blocks workstation-to-workstation traffic
+  - `Configure-ServerFirewall.ps1` - Restricts workstation access to servers
+  - `Configure-DCFirewall.ps1` - Secures Domain Controller access
+  - `Deploy-FirewallGPOs.ps1` - Creates and links GPOs
+  - `README.md` - Documentation
+
+### GuruRMM
+
+#### Agent Deployment
+- **Site Code:** DARK-GROVE-7839
+- **Agent Testing:** Deployed to Server 2008 R2 environment
+- **Compatibility Issue:** Legacy binary fails silently on 2008 R2 (missing VC++ Runtime or incompatible APIs)
+- **Likely Culprits:** sysinfo, local-ip-address crates using newer Windows APIs
+
+### Work Performed
+
+#### 2025-12-18
+- **AD Migration Planning:** Recommended manual migration approach
+- **Firewall GPO Scripts:** Created comprehensive ransomware protection scripts
+- **GuruRMM Testing:** Attempted legacy agent deployment on 2008 R2
+
+#### 2025-12-21
+- **GuruRMM Agent:** Site code DARK-GROVE-7839 configured
+
+### Pending Tasks
+- Plan slc.glaztech.com to glaztech.com AD migration
+- Deploy firewall GPO scripts after testing
+- Resolve GuruRMM agent 2008 R2 compatibility issues
+
+---
+
+## Grabb & Durando
+
+### Status
+**Active** - Database and calendar maintenance
+
+### Company Information
+- **Domain:** grabbanddurando.com
+- **Related:** grabblaw.com (cPanel account: grabblaw)
+
+### Hosting Infrastructure
+
+#### IX Server (WHM/cPanel)
+- **Internal IP:** 172.16.3.10
+- **Public IP:** 72.194.62.5
+- **cPanel Account:** grabblaw
+- **Database:** grabblaw_gdapp_data
+- **Database User:** grabblaw_gddata
+- **Password:** GrabbData2025
+
+### DNS Configuration
+
+#### data.grabbanddurando.com
+- **Record Type:** A
+- **Value:** 72.194.62.5
+- **TTL:** 600 seconds
+- **SSL:** Let's Encrypt via AutoSSL
+- **Issue Fixed:** Was missing from DNS zone, added 2025-12-12
+
+### Work Performed
+
+#### 2025-12-12 (DNS & SSL Fix)
+- **Problem:** data.grabbanddurando.com not resolving
+- **Solution:** Added A record via WHM API
+- **SSL Issue:** Wrong certificate being served (serveralias conflict)
+- **Resolution:**
+  - Removed conflicting serveralias from data.grabbanddurando.grabblaw.com vhost
+  - Added as proper subdomain to grabblaw cPanel account
+  - Ran AutoSSL to get Let's Encrypt cert
+  - Rebuilt Apache config and restarted
+
+#### 2025-12-12 (Database Sync from GoDaddy VPS)
+- **Problem:** DNS was pointing to old GoDaddy VPS, users updated data there Dec 10-11
+- **Old Server:** 208.109.235.224 (224.235.109.208.host.secureserver.net)
+- **Missing Records Found:**
+  - activity table: 4 records (18539 → 18543)
+  - gd_calendar_events: 1 record (14762 → 14763)
+  - gd_assign_users: 2 records (24299 → 24301)
+- **Solution:** Synced all missing records using mysqldump with --replace option
+- **Verification:** All tables now match between servers
+
+#### 2025-12-16 (Calendar Event Creation Fix)
+- **Problem:** Calendar event creation failing due to MySQL strict mode
+- **Root Cause:** Empty strings for auto-increment columns
+- **Solution:** Replaced empty strings with NULL for MySQL strict mode compliance
+
+### Important Dates
+- **2025-12-10 to 2025-12-11:** Data divergence period (users on old GoDaddy VPS)
+- **2025-12-12:** Data sync and DNS fix completed
+- **2025-12-16:** Calendar fix applied
+
+---
+
+## Khalsa
+
+### Status
+**Active** - VPN and RDP troubleshooting completed December 2025
+
+### Network Infrastructure
+
+#### UCG (UniFi Cloud Gateway)
+- **Management IP:** 192.168.0.1
+- **Alternate IP:** 172.16.50.1 (br2 interface)
+- **SSH:** root / Paper123!@#-camden
+- **SSH Key:** ~/.ssh/khalsa_ucg (guru@wsl-khalsa)
+- **Public Key:** ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAUQgIFvwD2EBGXu95UVt543pNNNOW6EH9m4OTnwqeAi
+
+#### Network Topology
+| Network | Subnet | Interface | Role |
+|---------|--------|-----------|------|
+| Primary LAN | 192.168.0.0/24 | br0 | Main network |
+| Alternate Subnet | 172.16.50.0/24 | br2 | Secondary devices |
+| VPN | 192.168.1.0/24 | tun1 (OpenVPN) | Remote access |
+
+- **External IP:** 98.175.181.20
+- **OpenVPN Port:** 1194/TCP
+
+#### OpenVPN Routes
+```
+--push "route 192.168.0.0 255.255.255.0"
+--push "route 172.16.50.0 255.255.255.0"
+```
+
+#### Switch
+- **User:** 8WfY8
+- **Password:** tI3evTNBZMlnngtBc
+
+### Accountant Machine (KMS-QB)
+- **IP:** 172.16.50.168 (dual-homed on both subnets)
+- **Hostname:** KMS-QB
+- **User:** accountant / Paper123!@#-accountant
+- **Local Admin:** localadmin / r3tr0gradE99!
+- **RDP:** Enabled (accountant added to Remote Desktop Users)
+- **WinRM:** Enabled
+
+### Work Performed
+
+#### 2025-12-22 (VPN RDP Access Fix)
+- **Problem:** VPN clients couldn't RDP to 172.16.50.168
+- **Root Causes Identified:**
+  1. RDP not enabled (TermService not listening)
+  2. Windows Firewall blocking RDP from VPN subnet (192.168.1.0/24)
+  3. Required services not running (UmRdpService, SessionEnv)
+- **Solution:**
+  1. Added SSH key to UCG for remote management
+  2. Verified OpenVPN pushing correct routes
+  3. Enabled WinRM on target machine
+  4. Added firewall rule for RDP from VPN subnet
+  5. Started required services (UmRdpService, SessionEnv)
+  6. Rebooted machine to fully enable RDP listener
+  7. Added 'accountant' user to Remote Desktop Users group
+- **Testing:** RDP access confirmed working from VPN
+
+### Important Dates
+- **2025-12-22:** VPN RDP access fully configured and tested
+
+---
+
+## RRS Law Firm
+
+### Status
+**Active** - Email DNS configuration completed December 2025
+
+### Company Information
+- **Domain:** rrs-law.com
+
+### Hosting
+- **Server:** IX (172.16.3.10)
+- **Public IP:** 72.194.62.5
+
+### Microsoft 365 Email DNS
+
+#### Records Added (2025-12-19)
+| Record | Type | Value |
+|--------|------|-------|
+| _dmarc.rrs-law.com | TXT | `v=DMARC1; p=quarantine; rua=mailto:admin@rrs-law.com` |
+| selector1._domainkey | CNAME | selector1-rrslaw-com0i._domainkey.rrslaw.d-v1.dkim.mail.microsoft |
+| selector2._domainkey | CNAME | selector2-rrslaw-com0i._domainkey.rrslaw.d-v1.dkim.mail.microsoft |
+
+#### Final Email DNS Status
+- MX → M365: ✅
+- SPF (includes M365): ✅
+- DMARC: ✅
+- Autodiscover: ✅
+- DKIM selector1: ✅
+- DKIM selector2: ✅
+- MS Verification: ✅
+- Enterprise Registration: ✅
+- Enterprise Enrollment: ✅
+
+### Work Performed
+
+#### 2025-12-19
+- **Problem:** Email DNS records incomplete for Microsoft 365
+- **Solution:** Added DMARC and both DKIM selectors via WHM API
+- **Verification:** Both selectors verified by M365
+- **Result:** DKIM signing enabled in M365 Admin Center
+
+### Important Dates
+- **2025-12-19:** Complete M365 email DNS configuration
+
+---
+
+## Scileppi Law Firm
+
+### Status
+**Active** - Major data migration December 2025
+
+### Network Infrastructure
+- **Subnet:** 172.16.1.0/24
+- **Gateway:** 172.16.0.1 (pfSense via Tailscale)
+
+### Storage Infrastructure
+
+#### DS214se (Source NAS - Old)
+- **IP:** 172.16.1.54
+- **SSH:** admin / Th1nk3r^99
+- **Storage:** 1.8TB total, 1.6TB used
+- **Data Location:** /volume1/homes/
+- **User Folders:**
+  - admin: 1.6TB (legal case files)
+  - Andrew Ross: 8.6GB
+  - Chris Scileppi: 570MB
+  - Samantha Nunez: 11MB
+  - Tracy Bender Payroll: 7.6MB
+
+#### RS2212+ (Destination NAS - New)
+- **IP:** 172.16.1.59 (changed from .57 during migration)
+- **Hostname:** SL-SERVER
+- **SSH:** sysadmin / Gptf*77ttb123!@#-sl-server
+- **Storage:** 25TB available
+- **SSH Key:** Public key added for DS214se pull access
+
+#### Unraid (Secondary Migration Source)
+- **IP:** 172.16.1.21
+- **SSH:** root / Th1nk3r^99
+- **Data:** /mnt/user/Scileppi (5.2TB)
+  - Active: 1.4TB
+  - Archived: 451GB
+  - Billing: 17MB
+  - Closed: 3.0TB
+
+### Data Migration
+
+#### Migration Timeline
+- **Started:** 2025-12-23
+- **Sources:** DS214se (1.6TB) + Unraid (5.2TB)
+- **Destination:** RS2212+ /volume1/homes/
+- **Total Expected:** ~6.8TB
+- **Method:** Parallel rsync jobs (pull from RS2212+)
+- **Status (2025-12-26):** 6.4TB transferred (~94% complete)
+
+#### Migration Commands
+```bash
+# DS214se to RS2212+ (via SSH key)
+rsync -avz --progress -e 'ssh -i ~/.ssh/id_ed25519' \
+  admin@172.16.1.54:/volume1/homes/ /volume1/homes/
+
+# Unraid to RS2212+ (via SSH key)
+rsync -avz --progress -e 'ssh -i ~/.ssh/id_ed25519' \
+  root@172.16.1.21:/mnt/user/Scileppi/ /volume1/homes/
+```
+
+#### Transfer Statistics
+- **Average Speed:** ~5.4 MB/s (19.4 GB/hour)
+- **Duration:** ~55 hours for 6.4TB (as of 2025-12-26)
+- **Progress Tracking:** `df -h /volume1` and `du -sh /volume1/homes/`
+
+### VLAN Configuration Attempt
+
+#### Issue (2025-12-23)
+- User attempted to add Unraid at 192.168.242.5 on VLAN 5
+- VLAN misconfiguration on pfSense caused network outage
+- All devices (pfSense, RS2212+, DS214se) became unreachable
+- **Resolution:** User fixed network, removed VLAN 5, reset Unraid to 172.16.1.21
+
+### Work Performed
+
+#### 2025-12-23 (Migration Start)
+- **Setup:** Enabled User Home Service on DS214se
+- **Setup:** Enabled rsync service on DS214se
+- **SSH Keys:** Generated on RS2212+, added to DS214se authorized_keys
+- **Permissions:** Fixed home directory permissions (chmod 700)
+- **Migration:** Started parallel rsync from DS214se and Unraid
+- **Speed Issue:** Initially 1.5 MB/s, improved to 5.4 MB/s after switch port move
+- **Network Issue:** VLAN 5 misconfiguration caused temporary outage
+
+#### 2025-12-23 (Network Recovery)
+- **Tailscale:** Re-authenticated after invalid key error
+- **pfSense SSH:** Added SSH key for management
+- **VLAN 5:** Diagnosed misconfiguration (wrong parent interface igb0 instead of igb2, wrong netmask /32 instead of /24)
+- **Migration:** Automatically resumed after network restored
+
+#### 2025-12-25
+- **Migration Check:** 3.0TB used / 25TB total (12%), ~44% complete
+- **Folders:** Active, Archived, Billing, Closed from Unraid + user homes from DS214se
+
+#### 2025-12-26
+- **Migration Progress:** 6.4TB transferred (~94% complete)
+- **Estimated Completion:** ~0.4TB remaining
+
+### Pending Tasks
+- Monitor migration completion (~0.4TB remaining)
+- Verify all data integrity after migration
+- Decommission DS214se after verification
+- Backup RS2212+ configuration
+
+### Important Dates
+- **2025-12-23:** Migration started (both sources)
+- **2025-12-23:** Network outage (VLAN 5 misconfiguration)
+- **2025-12-26:** ~94% complete (6.4TB of 6.8TB)
+
+---
+
+## Sonoran Green LLC
+
+### Status
+**Active** - Related entity to BG Builders LLC (same M365 tenant)
+
+### Company Information
+- **Domain:** sonorangreenllc.com
+- **Primary Entity:** BG Builders LLC
+
+### Microsoft 365
+- **Tenant:** Shared with BG Builders LLC (ededa4fb-f6eb-4398-851d-5eb3e11fab27)
+- **onmicrosoft.com:** sonorangreenllc.onmicrosoft.com
+
+### DNS Configuration
+
+#### Current Status
+- **Nameservers:** Still on GoDaddy (not migrated to Cloudflare)
+- **A Record:** 172.16.10.200 (private IP - problematic)
+- **Email Records:** Properly configured for M365
+
+#### Needed Records (Not Yet Applied)
+- DMARC: `v=DMARC1; p=reject; rua=mailto:sysadmin@bgbuildersllc.com`
+- DKIM selector1: CNAME to selector1-sonorangreenllc-com._domainkey.sonorangreenllc.onmicrosoft.com
+- DKIM selector2: CNAME to selector2-sonorangreenllc-com._domainkey.sonorangreenllc.onmicrosoft.com
+
+### Work Performed
+
+#### 2025-12-19
+- **Investigation:** Shared tenant with BG Builders identified
+- **Assessment:** DMARC and DKIM records missing
+- **Status:** DNS records prepared but not yet applied
+
+### Pending Tasks
+- Migrate domain to Cloudflare DNS
+- Fix A record (pointing to private IP)
+- Apply DMARC and DKIM records
+- Enable DKIM signing in M365 Defender
+
+---
+
+## Valley Wide Plastering (VWP)
+
+### Status
+**Active** - RADIUS/VPN setup completed December 2025
+
+### Network Infrastructure
+
+#### UDM (UniFi Dream Machine)
+- **IP:** 172.16.9.1
+- **SSH:** root / Gptf*77ttb123!@#-vwp
+- **Note:** SSH password auth may not be enabled, use web UI
+
+#### VWP-DC1 (Domain Controller)
+- **IP:** 172.16.9.2
+- **Hostname:** VWP-DC1.VWP.US
+- **Domain:** VWP.US (NetBIOS: VWP)
+- **SSH:** sysadmin / r3tr0gradE99#
+- **Role:** Primary DC, NPS/RADIUS server
+
+#### Network Details
+- **Subnet:** 172.16.9.0/24
+- **Gateway:** 172.16.9.1 (UDM)
+
+### NPS RADIUS Configuration
+
+#### RADIUS Server (VWP-DC1)
+- **Server:** 172.16.9.2
+- **Ports:** 1812 (auth), 1813 (accounting)
+- **Shared Secret:** Gptf*77ttb123!@#-radius
+- **AuthAttributeRequired:** Disabled (required for UniFi OpenVPN)
+
+#### RADIUS Clients
+| Name | Address | Auth Attribute |
+|------|---------|----------------|
+| UDM | 172.16.9.1 | No |
+| VWP-Subnet | 172.16.9.0/24 | No |
+
+#### Network Policy: "VPN-Access"
+- **Conditions:** All times (24/7)
+- **Allow:** All authenticated users
+- **Auth Methods:** All (1-11: PAP, CHAP, MS-CHAP, MS-CHAPv2, EAP)
+- **User Dial-in:** All users in VWP_Users OU set to msNPAllowDialin=True
+
+#### AD Structure
+- **Users OU:** OU=VWP_Users,DC=VWP,DC=US
+- **Users with VPN Access (27 total):** Darv, marreola, farias, smontigo, truiz, Tcapio, bgraffin, cguerrero, tsmith, tfetters, owner, cougar, Receptionist, Isacc, Traci, Payroll, Estimating, ARBilling, orders2, guru, sdooley, jguerrero, kshoemaker, rose, rguerrero, jrguerrero, Acctpay
+
+### Work Performed
+
+#### 2025-12-22 (RADIUS/VPN Setup)
+- **Objective:** Configure RADIUS authentication for VPN (similar to Dataforth)
+- **Installation:** Installed NPS role on VWP-DC1
+- **Configuration:** Created RADIUS clients for UDM and VWP subnet
+- **Network Policy:** Created "VPN-Access" policy allowing all authenticated users
+
+#### 2025-12-22 (Troubleshooting & Resolution)
+- **Issue 1:** Message-Authenticator invalid (Event 18)
+  - **Fix:** Set AuthAttributeRequired=No on RADIUS clients
+- **Issue 2:** Dial-in permission denied (Reason Code 65)
+  - **Fix:** Set all VWP_Users to msNPAllowDialin=True
+- **Issue 3:** Auth method not enabled (Reason Code 66)
+  - **Fix:** Added all auth types to policy, removed default deny policies
+- **Issue 4:** Default policy catching requests
+  - **Fix:** Deleted "Connections to other access servers" policy
+
+#### Testing Results
+- **Success:** VPN authentication working with AD credentials
+- **Test User:** INTRANET\sysadmin (or cguerrero)
+- **NPS Event:** 6272 (Access granted)
+
+### Important Dates
+- **2025-12-22:** Complete RADIUS/VPN configuration and testing
+
+---
+
+## Infrastructure Summary
+
+### Core Infrastructure (AZ Computer Guru)
+
+#### Physical Servers
+| Server | IP | CPU | RAM | OS | Role |
+|--------|-----|-----|-----|-----|------|
+| Jupiter | 172.16.3.20 | Dual Xeon E5-2695 v3 (56 cores) | 128GB | Unraid | Primary container host |
+| Saturn | 172.16.3.21 | - | - | Unraid | Secondary storage, being migrated |
+| Build Server | 172.16.3.30 | - | - | Ubuntu 22.04 | GuruRMM, PostgreSQL |
+| pfSense | 172.16.0.1 | Intel N100 | - | FreeBSD/pfSense 2.8.1 | Firewall, VPN gateway |
+
+#### Network Equipment
+- **Firewall:** pfSense (Intel N100, 4x igc NICs)
+  - WAN: 98.181.90.163/31 (Fiber)
+  - LAN: 172.16.0.1/22
+  - Tailscale: 100.119.153.74
+- **Tailscale:** Mesh VPN for remote access to 172.16.0.0/22
+
+#### Services & Ports
+| Service | External URL | Internal | Port |
+|---------|-------------|----------|------|
+| Gitea | git.azcomputerguru.com | 172.16.3.20 | 3000, SSH 2222 |
+| GuruRMM | rmm-api.azcomputerguru.com | 172.16.3.30 | 3001 |
+| NPM | - | 172.16.3.20 | 7818 (admin) |
+| Seafile | sync.azcomputerguru.com | 172.16.3.21 | - |
+| WebSvr | websvr.acghosting.com | - | - |
+| IX | ix.azcomputerguru.com | 172.16.3.10 | - |
+
+### Client Infrastructure Summary
+
+| Client | Primary Device | IP | Type | Admin Credentials |
+|--------|---------------|-----|------|-------------------|
+| Dataforth | UDM, AD1, AD2 | 192.168.0.254, .27, .6 | UniFi, AD | root / Paper123!@#-unifi |
+| VWP | UDM, VWP-DC1 | 172.16.9.1, 172.16.9.2 | UniFi, AD | root / Gptf*77ttb123!@#-vwp |
+| Khalsa | UCG, KMS-QB | 192.168.0.1, 172.16.50.168 | UniFi, Workstation | root / Paper123!@#-camden |
+| Scileppi | RS2212+, DS214se, Unraid | 172.16.1.59, .54, .21 | NAS, NAS, Unraid | sysadmin / Gptf*77ttb123!@#-sl-server |
+| Glaztech | AD Domain | - | Active Directory | - |
+| BG Builders | M365 Tenant | - | Cloud | sysadmin@bgbuildersllc.com |
+| Grabb & Durando | IX cPanel | 172.16.3.10 | WHM/cPanel | grabblaw account |
+
+### SSH Key Distribution
+
+#### Windows Machine (ACG-M-L5090)
+- **Public Key:** ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIABnQjolTxDtfqOwdDjamK1oyFPiQnaNT/tAgsIHH1Zo
+- **Authorized On:** pfSense
+
+#### WSL/Linux Machines
+- **guru@wsl:** Added to Jupiter, Saturn, Build Server
+- **claude-code@localadmin:** Added to pfSense, Khalsa UCG
+
+#### Build Server
+- **For Gitea:** ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKSqf2/phEXUK8vd5GhMIDTEGSk0LvYk92sRdNiRrjKi
+
+---
+
+## Common Services & Credentials
+
+### Microsoft Graph API
+Used for M365 automation across multiple clients:
+- **Scopes:** Calendars, Contacts, Mail, Users, Groups, etc.
+- **Implementations:**
+  - Dataforth: Claude-Code-M365 app (full tenant access)
+  - Generic: Microsoft Graph API app for mail automation
+
+### PSA/RMM Systems
+- **Syncro:** 5,064 customers
+- **Autotask:** 5,499 companies
+- **CIPP:** Multi-tenant management portal
+- **GuruRMM:** Custom RMM platform (in development)
+
+### WHM/cPanel Hosting
+- **WebSvr:** websvr.acghosting.com
+- **IX:** 172.16.3.10 (72.194.62.5)
+- **API Token (WebSvr):** 8ZPYVM6R0RGOHII7EFF533MX6EQ17M7O
+
+---
+
+## Data Migrations
+
+### Active Migrations (December 2025)
+
+#### Scileppi Law Firm (RS2212+)
+- **Status:** 94% complete as of 2025-12-26
+- **Sources:** DS214se (1.6TB) + Unraid (5.2TB)
+- **Destination:** RS2212+ (25TB)
+- **Total:** 6.8TB
+- **Transferred:** 6.4TB
+- **Method:** Parallel rsync
+
+#### Saturn → Jupiter (SeaFile)
+- **Status:** Completed 2025-12-25
+- **Source:** Saturn /mnt/user/SeaFile/
+- **Destination:** Jupiter /mnt/user0/SeaFile/ (bypasses cache)
+- **Data:** SeaFile application data, databases, backups
+- **Method:** rsync over SSH
+
+---
+
+## Security Incidents & Responses
+
+### BG Builders Email Spoofing (2025-12-19)
+- **Type:** External email spoofing (not account compromise)
+- **Target:** shelly@bgbuildersllc.com
+- **Response:** Added DMARC with p=reject, configured DKIM
+- **Status:** Resolved, future spoofing attempts will be rejected
+
+### Dataforth Mailbox Issues (2025-12-22)
+- **Type:** Duplicate data causing sync issues
+- **Affected:** jlehman@dataforth.com
+- **Response:** Graph API cleanup (removed 476 contacts, 175 calendar series)
+- **Status:** Resolved, user needs Outlook profile reset
+
+---
+
+## Technology Stack
+
+### Platforms & Operating Systems
+- **Unraid:** Jupiter, Saturn, Scileppi Unraid
+- **pfSense:** Firewall/VPN gateway
+- **Ubuntu 22.04:** Build Server
+- **Windows Server:** Various DCs (AD1, VWP-DC1)
+- **Synology DSM:** DS214se, RS2212+
+
+### Services & Applications
+- **Containerization:** Docker on Unraid (Gitea, NPM, GuruRMM, Seafile)
+- **Web Servers:** Nginx (NPM), Apache (WHM/cPanel)
+- **Databases:** PostgreSQL 16, MySQL 8, MariaDB
+- **Directory Services:** Active Directory (Dataforth, VWP, Glaztech)
+- **VPN:** OpenVPN (UniFi UDM, UCG), Tailscale (mesh VPN)
+- **Monitoring:** GuruRMM (custom platform)
+- **Version Control:** Gitea
+- **PSA/RMM:** Syncro, Autotask, CIPP
+
+### Development Tools
+- **Languages:** Rust (GuruRMM), Python (Autocoder 2.0, scripts), PowerShell, Bash
+- **Build Systems:** Cargo (Rust), npm (Node.js)
+- **CI/CD:** Webhook-triggered builds on Build Server
+
+---
+
+## Notes
+
+### Status Key
+- **Active:** Current client with ongoing support
+- **Pending:** Work scheduled or in progress
+- **Completed:** One-time project or resolved issue
+
+### Credential Security
+All credentials in this document are extracted from session logs for operational reference. In production:
+- Credentials are stored in `shared-data/credentials.md`
+- Session logs are preserved for context recovery
+- SSH keys are distributed and managed per machine
+- API tokens are rotated periodically
+
+### Future Additions
+This catalog will be updated as additional session logs are processed and new client work is performed. Target: Process remaining 15 session log files to add:
+- Additional client details
+- More work history
+- Network diagrams
+- Additional credentials and access methods
+
+---
+
+**END OF CATALOG - Version 1.0 (Partial)**
+**Next Update:** After processing remaining 15 session log files

CATALOG_PROJECTS.md

@@ -0,0 +1,666 @@
+# Claude Projects Catalog
+
+**Generated:** 2026-01-26
+**Source:** C:\Users\MikeSwanson\claude-projects\
+**Purpose:** Comprehensive catalog of all project documentation for ClaudeTools context import
+
+---
+
+## Overview
+
+This catalog documents all projects found in the claude-projects directory, extracting key information for import into the ClaudeTools tracking system.
+
+**Total Projects Cataloged:** 11 major projects
+**Infrastructure Servers:** 8 servers documented
+**Active Development Projects:** 4 projects
+
+---
+
+## Projects by Category
+
+### Active Development Projects
+
+#### 1. GuruRMM
+- **Path:** C:\Users\MikeSwanson\claude-projects\gururmm\
+- **Status:** Active Development (Phase 1 MVP)
+- **Purpose:** Custom RMM (Remote Monitoring and Management) system
+- **Technologies:** Rust (server + agent), React + TypeScript (dashboard), Docker
+- **Repository:** https://git.azcomputerguru.com/azcomputerguru/gururmm
+- **Key Components:**
+  - Agent: Rust-based monitoring agent (Windows/Linux/macOS)
+  - Server: Rust + Axum WebSocket server
+  - Dashboard: React + Vite web interface
+  - Tray: System tray application (planned)
+- **Infrastructure:**
+  - Server: 172.16.3.20 (Jupiter/Unraid) - Container deployment
+  - Build Server: 172.16.3.30 (Ubuntu 22.04) - Cross-platform builds
+  - External URL: https://rmm-api.azcomputerguru.com
+  - Internal: 172.16.3.20:3001
+- **Features:**
+  - Real-time metrics (CPU, RAM, disk, network)
+  - WebSocket-based agent communication
+  - JWT authentication
+  - Cross-platform support
+  - Future: Remote commands, patch management, alerting
+- **Key Files:**
+  - `docs/FEATURE_ROADMAP.md` - Complete feature roadmap with priorities
+  - `tray/PLAN.md` - System tray implementation plan
+  - `session-logs/2025-12-15-build-server-setup.md` - Build server setup
+  - `session-logs/2025-12-20-v040-build.md` - Version 0.40 build
+- **Related Credentials:** Database, API auth, JWT secrets (in credentials.md)
+
+#### 2. MSP Toolkit (Rust)
+- **Path:** C:\Users\MikeSwanson\claude-projects\msp-toolkit-rust\
+- **Status:** Active Development (Phase 2)
+- **Purpose:** Integrated CLI for MSP operations connecting multiple platforms
+- **Technologies:** Rust, async/tokio
+- **Repository:** (Gitea - azcomputerguru)
+- **Integrated Platforms:**
+  - DattoRMM - Remote monitoring
+  - Autotask PSA - Ticketing and time tracking
+  - IT Glue - Documentation
+  - Kaseya 365 - M365 management
+  - Datto EDR - Endpoint security
+- **Key Features:**
+  - Unified CLI for all MSP platforms
+  - Automatic documentation to IT Glue
+  - Automatic time tracking to Autotask
+  - AES-256-GCM encrypted credential storage
+  - Workflow automation
+- **Architecture:**
+  ```
+  User Command → Execute Action → [Success] → Workflow:
+    ├─→ Document to IT Glue
+    ├─→ Add note to Autotask ticket
+    └─→ Log time to Autotask
+  ```
+- **Key Files:**
+  - `CLAUDE.md` - Complete development guide
+  - `README.md` - User documentation
+  - `ARCHITECTURE.md` - System architecture and API details
+- **Configuration:** ~/.config/msp-toolkit/config.toml
+- **Dependencies:** reqwest, tokio, clap, ring (encryption), governor (rate limiting)
+
+#### 3. GuruConnect
+- **Path:** C:\Users\MikeSwanson\claude-projects\guru-connect\
+- **Status:** Planning/Early Development
+- **Purpose:** Remote desktop solution (ScreenConnect alternative) for GuruRMM
+- **Technologies:** Rust (agent + server), React (dashboard), WebSocket, Protobuf
+- **Architecture:**
+  ```
+  Dashboard (React) ↔ WSS ↔ GuruConnect Server (Rust) ↔ WSS ↔ Agent (Rust)
+  ```
+- **Key Components:**
+  - Agent: Windows remote desktop agent (DXGI capture, input injection)
+  - Server: Relay server (Rust + Axum)
+  - Dashboard: Web viewer (React, integrate with GuruRMM)
+  - Protocol: Protocol Buffers
+- **Encoding Strategy:**
+  - LAN (<20ms RTT): Raw BGRA + Zstd + dirty rects
+  - WAN + GPU: H264 hardware encoding
+  - WAN - GPU: VP9 software encoding
+- **Key Files:**
+  - `CLAUDE.md` - Project overview and build instructions
+- **Security:** TLS, JWT auth for dashboard, API key auth for agents, audit logging
+- **Related Projects:** RustDesk reference at ~/claude-projects/reference/rustdesk/
+
+#### 4. Website2025 (Arizona Computer Guru)
+- **Path:** C:\Users\MikeSwanson\claude-projects\Website2025\
+- **Status:** Active Development
+- **Purpose:** Company website rebuild for Arizona Computer Guru MSP
+- **Technologies:** HTML, CSS, JavaScript (clean static site)
+- **Server:** ix.azcomputerguru.com (cPanel/Apache)
+- **Sites:**
+  - Production: https://www.azcomputerguru.com (WordPress - old)
+  - Dev (original): https://dev.computerguru.me/acg2025/ (WordPress)
+  - Working copy: https://dev.computerguru.me/acg2025-wp-test/ (WordPress test)
+  - Static site: https://dev.computerguru.me/acg2025-static/ (Active development)
+- **File Paths on Server:**
+  - Dev site: /home/computergurume/public_html/dev/acg2025/
+  - Working copy: /home/computergurume/public_html/dev/acg2025-wp-test/
+  - Static site: /home/computergurume/public_html/dev/acg2025-static/
+  - Production: /home/azcomputerguru/public_html/
+- **Business Info:**
+  - Company: Arizona Computer Guru - "Any system, any problem, solved"
+  - Phone: 520.304.8300
+  - Service Area: Statewide (Tucson, Phoenix, Prescott, Flagstaff)
+  - Services: Managed IT, network/server, cybersecurity, remote support, websites
+- **Design Features:**
+  - CSS Variables for theming
+  - Mega menu dropdown with blur overlay
+  - Responsive breakpoints (1024px, 768px)
+  - Service cards grid layout
+  - Fixed header with scroll-triggered shrink
+- **Key Files:**
+  - `CLAUDE.md` - Development notes and SSH access
+  - `static-site/` - Clean static rebuild
+- **SSH Access:** ssh root@ix.azcomputerguru.com OR ssh claude-temp@ix.azcomputerguru.com
+- **Credentials:** See credentials.md (claude-temp password: Gptf*77ttb)
+
+---
+
+### Production/Operational Projects
+
+#### 5. Dataforth DOS Test Machines
+- **Path:** C:\Users\MikeSwanson\claude-projects\dataforth-dos\
+- **Status:** Production (90% complete, operational)
+- **Purpose:** SMB1 proxy system for ~30 legacy DOS test machines at Dataforth
+- **Client:** Dataforth Corporation (industrial test equipment manufacturer)
+- **Technologies:** Netgear ReadyNAS (SMB1), Windows Server (AD2), DOS 6.22, QuickBASIC
+- **Problem Solved:** Crypto attack disabled SMB1 on production servers; deployed NAS as SMB1 proxy
+- **Infrastructure:**
+  | System | IP | Purpose | Credentials |
+  |--------|-----|---------|-------------|
+  | D2TESTNAS | 192.168.0.9 | NAS/SMB1 proxy | admin / Paper123!@#-nas |
+  | AD2 | 192.168.0.6 | Production server | INTRANET\sysadmin / Paper123!@# |
+  | UDM | 192.168.0.254 | Gateway | See credentials.md |
+- **Key Features:**
+  - Bidirectional sync every 15 minutes (NAS ↔ AD2)
+  - PULL: Test results from DOS machines → AD2 → Database
+  - PUSH: Software updates from AD2 → NAS → DOS machines
+  - Remote task deployment (TODO.BAT)
+  - Centralized software management (UPDATE.BAT)
+- **Sync System:**
+  - Script: C:\Shares\test\scripts\Sync-FromNAS.ps1
+  - Log: C:\Shares\test\scripts\sync-from-nas.log
+  - Status: C:\Shares\test\_SYNC_STATUS.txt
+  - Scheduled: Windows Task Scheduler (every 15 min)
+- **DOS Machine Management:**
+  - Software deployment: Place files in TS-XX\ProdSW\ on NAS
+  - One-time commands: Create TODO.BAT in TS-XX\ root (auto-deletes after run)
+  - Central management: T:\UPDATE TS-XX ALL (from DOS)
+- **Key Files:**
+  - `PROJECT_INDEX.md` - Quick reference guide
+  - `README.md` - Complete project overview
+  - `CREDENTIALS.md` - All passwords and SSH keys
+  - `NETWORK_TOPOLOGY.md` - Network diagram and data flow
+  - `REMAINING_TASKS.md` - Pending work and blockers
+  - `SYNC_SCRIPT.md` - Sync system documentation
+  - `DOS_BATCH_FILES.md` - UPDATE.BAT and TODO.BAT details
+- **Repository:** https://git.azcomputerguru.com/azcomputerguru/claude-projects (dataforth-dos folder)
+- **Machines Working:** TS-27, TS-8L, TS-8R (tested operational)
+- **Machines Pending:** ~27 DOS machines need network config updates
+- **Blocking Issue:** Datasheets share needs creation on AD2 (waiting for Engineering)
+- **Test Database:** http://192.168.0.6:3000
+- **SSH to NAS:** ssh root@192.168.0.9 (ed25519 key auth)
+- **Engineer Access:** \\192.168.0.9\test (SFTP port 22, engineer / Engineer1!)
+- **Project Time:** ~11 hours implementation
+- **Implementation Date:** 2025-12-14
+
+#### 6. MSP Toolkit (PowerShell)
+- **Path:** C:\Users\MikeSwanson\claude-projects\msp-toolkit\
+- **Status:** Production (web-hosted scripts)
+- **Purpose:** PowerShell scripts for MSP technicians, web-accessible for remote execution
+- **Technologies:** PowerShell, web hosting (www.azcomputerguru.com/tools/)
+- **Access Methods:**
+  - Interactive menu: `iex (irm azcomputerguru.com/tools/msp-toolkit.ps1)`
+  - Direct execution: `iex (irm azcomputerguru.com/tools/Get-SystemInfo.ps1)`
+  - Parameterized: `iex (irm azcomputerguru.com/tools/msp-toolkit.ps1) -Script systeminfo`
+- **Available Scripts:**
+  - Get-SystemInfo.ps1 - System information report
+  - Invoke-HealthCheck.ps1 - Health diagnostics
+  - Create-LocalAdmin.ps1 - Create local admin account
+  - Set-StaticIP.ps1 - Configure static IP
+  - Join-Domain.ps1 - Join Active Directory
+  - Install-RMMAgent.ps1 - Install RMM agent
+- **Configuration Files (JSON):**
+  - applications.json
+  - presets.json
+  - scripts.json
+  - themes.json
+  - tweaks.json
+- **Deployment:** deploy.bat script uploads to web server
+- **Server:** ix.azcomputerguru.com (SSH: claude@ix.azcomputerguru.com)
+- **Key Files:**
+  - `README.md` - Usage and deployment guide
+  - `msp-toolkit.ps1` - Main launcher
+  - `scripts/` - Individual PowerShell scripts
+  - `config/` - Configuration files
+
+#### 7. Cloudflare WHM DNS Manager
+- **Path:** C:\Users\MikeSwanson\claude-projects\cloudflare-whm\
+- **Status:** Production
+- **Purpose:** CLI tool and WHM plugin for managing Cloudflare DNS from cPanel/WHM servers
+- **Technologies:** Bash (CLI), Perl (WHM plugin), Cloudflare API
+- **Components:**
+  - CLI Tool: `cf-dns` bash script
+  - WHM Plugin: Web-based interface
+- **Features:**
+  - List zones and DNS records
+  - Add/delete DNS records
+  - One-click M365 email setup (MX, SPF, DKIM, DMARC, Autodiscover)
+  - Import new zones to Cloudflare
+  - Email DNS verification
+- **CLI Commands:**
+  - `cf-dns list-zones` - Show all zones
+  - `cf-dns list example.com` - Show records
+  - `cf-dns add example.com A www 192.168.1.1` - Add record
+  - `cf-dns add-m365 clientdomain.com tenantname` - Add M365 records
+  - `cf-dns verify-email clientdomain.com` - Check email DNS
+  - `cf-dns import newclient.com` - Import zone
+- **Installation:**
+  - CLI: Copy to /usr/local/bin/, create ~/.cf-dns.conf
+  - WHM: Run install.sh from whm-plugin/ directory
+- **Configuration:** ~/.cf-dns.conf (CF_API_TOKEN)
+- **WHM Access:** Plugins → Cloudflare DNS Manager
+- **Key Files:**
+  - `docs/README.md` - Complete documentation
+  - `cli/cf-dns` - CLI script
+  - `whm-plugin/cgi/addon_cloudflareDNS.cgi` - WHM interface
+  - `whm-plugin/lib/CloudflareDNS.pm` - Perl module
+
+#### 8. Seafile Microsoft Graph Email Integration
+- **Path:** C:\Users\MikeSwanson\claude-projects\seafile-graph-email\
+- **Status:** Partial Implementation (troubleshooting)
+- **Purpose:** Custom Django email backend for Seafile using Microsoft Graph API
+- **Server:** 172.16.3.21 (Saturn/Unraid) - Container: seafile
+- **URL:** https://sync.azcomputerguru.com
+- **Seafile Version:** Pro 12.0.19
+- **Current Status:**
+  - Direct Django email sending works (tested)
+  - Password reset from web UI fails (seafevents background process issue)
+- **Problem:** Seafevents background email sender not loading custom backend properly
+- **Architecture:**
+  - Synchronous (Django send_mail): Uses EMAIL_BACKEND setting - WORKING
+  - Asynchronous (seafevents worker): Not loading custom path - BROKEN
+- **Files on Server:**
+  - Custom backend: /shared/custom/graph_email_backend.py
+  - Config: /opt/seafile/conf/seahub_settings.py
+  - Seafevents: /opt/seafile/conf/seafevents.conf
+- **Azure App Registration:**
+  - Tenant: ce61461e-81a0-4c84-bb4a-7b354a9a356d
+  - App ID: 15b0fafb-ab51-4cc9-adc7-f6334c805c22
+  - Sender: noreply@azcomputerguru.com
+  - Permission: Mail.Send (Application)
+- **Key Files:**
+  - `README.md` - Status, problem description, testing commands
+- **SSH Access:** root@172.16.3.21
+
+---
+
+### Reference/Support Projects
+
+#### 9. WHM DNS Cleanup
+- **Path:** C:\Users\MikeSwanson\claude-projects\whm-dns-cleanup\
+- **Status:** Completed (one-time project)
+- **Purpose:** WHM DNS cleanup and recovery project
+- **Key Files:**
+  - `WHM-DNS-Cleanup-Report-2025-12-09.md` - Cleanup report
+  - `WHM-Recovery-Data-2025-12-09.md` - Recovery data
+
+#### 10. Autocode Remix
+- **Path:** C:\Users\MikeSwanson\claude-projects\Autocode-remix\
+- **Status:** Reference/Development
+- **Purpose:** Fork/remix of Autocoder project
+- **Contains Multiple Versions:**
+  - Autocode-fork/ - Original fork
+  - autocoder-master/ - Master branch
+  - Autocoder-2.0/ - Version 2.0
+  - Autocoder-2.0 - Copy/ - Backup copy
+- **Key Files:**
+  - `CLAUDE.md` files in each version
+  - `ARCHITECTURE.md` - System architecture
+  - `.github/workflows/ci.yml` - CI/CD configuration
+
+#### 11. Claude Settings
+- **Path:** C:\Users\MikeSwanson\claude-projects\claude-settings\
+- **Status:** Configuration
+- **Purpose:** Claude Code settings and configuration
+- **Key Files:**
+  - `settings.json` - Claude Code settings
+
+---
+
+## Infrastructure Overview
+
+### Servers Documented
+
+| Server | IP | OS | Purpose | Location |
+|--------|-----|-----|---------|----------|
+| **Jupiter** | 172.16.3.20 | Unraid | Primary server (Gitea, NPM, GuruRMM) | LAN |
+| **Saturn** | 172.16.3.21 | Unraid | Secondary (Seafile) | LAN |
+| **pfSense** | 172.16.0.1 | pfSense | Firewall, Tailscale gateway | LAN |
+| **Build Server** | 172.16.3.30 | Ubuntu 22.04 | GuruRMM cross-platform builds | LAN |
+| **WebSvr** | websvr.acghosting.com | cPanel | WHM/cPanel hosting | External |
+| **IX** | ix.azcomputerguru.com | cPanel | WHM/cPanel hosting | External (VPN) |
+| **AD2** | 192.168.0.6 | Windows Server | Dataforth production server | Dataforth LAN |
+| **D2TESTNAS** | 192.168.0.9 | NetGear ReadyNAS | Dataforth SMB1 proxy | Dataforth LAN |
+
+### Services
+
+| Service | External URL | Internal | Purpose |
+|---------|--------------|----------|---------|
+| **Gitea** | https://git.azcomputerguru.com | 172.16.3.20:3000 | Git hosting |
+| **NPM Admin** | - | 172.16.3.20:7818 | Nginx Proxy Manager |
+| **GuruRMM API** | https://rmm-api.azcomputerguru.com | 172.16.3.20:3001 | RMM server |
+| **Seafile** | https://sync.azcomputerguru.com | 172.16.3.21 | File sync |
+| **Dataforth Test DB** | http://192.168.0.6:3000 | 192.168.0.6:3000 | Test results |
+
+---
+
+## Session Logs Overview
+
+### Main Session Logs
+- **Path:** C:\Users\MikeSwanson\claude-projects\session-logs\
+- **Contains:** 20+ session logs (2025-12-12 through 2025-12-20)
+- **Key Sessions:**
+  - 2025-12-14-dataforth-dos-machines.md - Dataforth implementation
+  - 2025-12-15-gururmm-agent-services.md - GuruRMM agent work
+  - 2025-12-15-grabbanddurando-*.md - Client work (multiple sessions)
+  - 2025-12-16 to 2025-12-20 - Various development sessions
+
+### GuruRMM Session Logs
+- **Path:** C:\Users\MikeSwanson\claude-projects\gururmm\session-logs\
+- **Contains:**
+  - 2025-12-15-build-server-setup.md - Build server configuration
+  - 2025-12-20-v040-build.md - Version 0.40 build notes
+
+---
+
+## Shared Data
+
+### Credentials File
+- **Path:** C:\Users\MikeSwanson\claude-projects\shared-data\credentials.md
+- **Purpose:** Centralized credential storage (UNREDACTED)
+- **Sections:**
+  - Infrastructure - SSH Access (GuruRMM, Jupiter, AD2, D2TESTNAS)
+  - Services - Web Applications (Gitea, ClaudeTools API)
+  - Projects - ClaudeTools (Database, API auth, encryption keys)
+  - Projects - Dataforth DOS (Update workflow, key files, folder structure)
+
+### Commands
+- **Path:** C:\Users\MikeSwanson\claude-projects\.claude\commands\
+- **Contains:**
+  - context.md - Context search command
+  - s.md - Short save command
+  - save.md - Save session log command
+  - sync.md - Sync command
+
+---
+
+## Technologies Used Across Projects
+
+### Languages
+- Rust (GuruRMM, GuruConnect, MSP Toolkit Rust)
+- PowerShell (MSP Toolkit, various scripts)
+- JavaScript/TypeScript (React dashboards)
+- Python (Seafile backend)
+- Perl (WHM plugins)
+- Bash (CLI tools, automation)
+- HTML/CSS (Website)
+- DOS Batch (Dataforth)
+
+### Frameworks & Libraries
+- React + Vite + TypeScript (dashboards)
+- Axum (Rust web framework)
+- Tokio (Rust async runtime)
+- Django (Seafile integration)
+- Protocol Buffers (GuruConnect)
+
+### Infrastructure
+- Docker + Docker Compose
+- Unraid (Jupiter, Saturn)
+- Ubuntu Server (build server)
+- Windows Server (Dataforth AD2)
+- cPanel/WHM (hosting)
+- Netgear ReadyNAS (Dataforth NAS)
+
+### Databases
+- PostgreSQL (GuruRMM, planned)
+- MariaDB (ClaudeTools API)
+- Redis (planned for caching)
+
+### APIs & Integration
+- Microsoft Graph API (Seafile email)
+- Cloudflare API (DNS management)
+- DattoRMM API (planned)
+- Autotask API (planned)
+- IT Glue API (planned)
+- Kaseya 365 API (planned)
+
+---
+
+## Repository Information
+
+### Gitea Repositories
+- **Gitea URL:** https://git.azcomputerguru.com
+- **Main User:** azcomputerguru
+- **Repositories:**
+  - azcomputerguru/gururmm - GuruRMM project
+  - azcomputerguru/claude-projects - All projects
+  - azcomputerguru/ai-3d-printing - 3D printing projects
+- **Authentication:**
+  - Username: mike@azcomputerguru.com
+  - Password: Window123!@#-git
+- **SSH:** git.azcomputerguru.com:2222
+
+---
+
+## Client Work Documented
+
+### Dataforth Corporation
+- **Project:** DOS Test Machines SMB1 Proxy
+- **Status:** Production
+- **Network:** 192.168.0.0/24
+- **Key Systems:** AD2 (192.168.0.6), D2TESTNAS (192.168.0.9)
+- **VPN:** OpenVPN configuration available
+
+### Grabb & Durando (BGBuilders)
+- **Multiple sessions documented:** 2025-12-15
+- **Work:** Data migration, Calendar fixes, User reports, MariaDB fixes
+- **DNS:** bgbuilders-dns-records.txt, bgbuildersllc-godaddy-zonefile.txt
+
+### RalphsTransfer
+- **Security audit:** ralphstransfer-security-audit-2025-12-12.md
+
+### Lehman
+- **Cleanup work:** cleanup-lehman.ps1, scan-lehman.ps1
+- **Duplicate contacts/events:** lehman-dup-contacts.csv, lehman-dup-events.csv
+
+---
+
+## Key Decisions & Context
+
+### GuruRMM Design Decisions
+1. **WebSocket-based communication** for real-time agent updates
+2. **Rust** for performance, safety, and cross-platform support
+3. **React + Vite** for modern, fast dashboard
+4. **JWT authentication** for API security
+5. **Docker deployment** for easy infrastructure management
+6. **True integration philosophy** - avoid Datto anti-pattern (separate products with APIs)
+
+### MSP Toolkit Design Decisions
+1. **Workflow automation** - auto-document and auto-track time
+2. **AES-256-GCM encryption** for credential storage
+3. **Modular platform integrations** - enable/disable per platform
+4. **Async operations** for performance
+5. **Configuration-driven** setup
+
+### Dataforth DOS Solution
+1. **Netgear ReadyNAS** as SMB1 proxy (modern servers can't use SMB1)
+2. **Bidirectional sync** for data flow (test results up, software down)
+3. **TODO.BAT pattern** for one-time remote commands
+4. **UPDATE.BAT** for centralized software management
+5. **WINS server** critical for NetBIOS name resolution
+
+### Website2025 Design Decisions
+1. **Static site** instead of WordPress (cleaner, faster, no bloat)
+2. **CSS Variables** for consistent theming
+3. **Mega menu** for service organization
+4. **Responsive design** with clear breakpoints
+5. **Fixed header** with scroll-triggered effects
+
+---
+
+## Pending Work & Priorities
+
+### GuruRMM
+- [ ] Complete Phase 1 MVP (basic monitoring operational)
+- [ ] Build updated agent with extended metrics
+- [ ] Cross-platform builds (Linux/Windows/macOS)
+- [ ] Agent updates via server (built-in handler, not shell script)
+- [ ] System tray implementation (Windows/macOS)
+- [ ] Remote commands execution
+
+### MSP Toolkit Rust
+- [ ] Complete Phase 2 core integrations
+- [ ] DattoRMM client implementation
+- [ ] Autotask client implementation
+- [ ] IT Glue client implementation
+- [ ] Workflow system implementation
+
+### Dataforth DOS
+- [ ] Datasheets share creation on AD2 (BLOCKED - waiting for Engineering)
+- [ ] Update network config on remaining ~27 DOS machines
+- [ ] DattoRMM monitoring integration
+- [ ] Future: VLAN isolation, modernization planning
+
+### Website2025
+- [ ] Complete static site pages (services, about, contact)
+- [ ] Mobile optimization
+- [ ] Content migration from old WordPress site
+- [ ] Testing and launch
+
+### Seafile Email
+- [ ] Fix seafevents background email sender (move backend to Seafile Python path)
+- [ ] OR disable background sender, rely on synchronous email
+- [ ] Test password reset functionality
+
+---
+
+## Important Notes for Context Recovery
+
+### Credentials Location
+**Primary:** C:\Users\MikeSwanson\claude-projects\shared-data\credentials.md
+**Project-Specific:** Each project folder may have CREDENTIALS.md
+
+### Session Logs
+**Main:** C:\Users\MikeSwanson\claude-projects\session-logs\
+**Project-Specific:** {project}/session-logs/
+
+### When User References Previous Work
+1. **Use /context command** - Searches session logs and credentials.md
+2. **Never ask user** for information already in logs/credentials
+3. **Apply found information** - Connect to servers, continue work
+4. **Report findings** - Summarize relevant credentials and previous work
+
+### SSH Access Patterns
+- **Jupiter/Saturn:** SSH key authentication (Tailscale or direct LAN)
+- **Build Server:** SSH with password
+- **Dataforth NAS:** SSH root@192.168.0.9 (ed25519 key or password)
+- **WHM Servers:** SSH claude@ix.azcomputerguru.com (password)
+
+---
+
+## Quick Command Reference
+
+### GuruRMM
+```bash
+# Start dashboard dev server
+cd gururmm/dashboard && npm run dev
+
+# Build agent
+cd gururmm/agent && cargo build --release
+
+# Deploy to server
+ssh root@172.16.3.20
+cd /mnt/user/appdata/gururmm/
+```
+
+### Dataforth DOS
+```bash
+# SSH to NAS
+ssh root@192.168.0.9
+
+# Check sync status
+cat /var/log/ad2-sync.log
+
+# Manual sync
+/root/sync-to-ad2.sh
+```
+
+### MSP Toolkit
+```bash
+# Run from web
+iex (irm azcomputerguru.com/tools/msp-toolkit.ps1)
+
+# Build Rust version
+cd msp-toolkit-rust && cargo build --release
+```
+
+### Cloudflare DNS
+```bash
+# List zones
+cf-dns list-zones
+
+# Add M365 records
+cf-dns add-m365 clientdomain.com tenantname
+```
+
+---
+
+## File Organization
+
+### Project Documentation Standard
+Most projects follow this structure:
+- **CLAUDE.md** - Development guide for Claude Code
+- **README.md** - User documentation
+- **CREDENTIALS.md** - Project-specific credentials (if applicable)
+- **session-logs/** - Session notes and work logs
+- **docs/** - Additional documentation
+
+### Configuration Files
+- **.env** - Environment variables (gitignored)
+- **config.toml** / **settings.json** - Application config
+- **docker-compose.yml** - Container orchestration
+
+---
+
+## Data Import Recommendations
+
+### Priority 1 (Import First)
+1. **GuruRMM** - Active development, multiple infrastructure dependencies
+2. **Dataforth DOS** - Production system, detailed infrastructure
+3. **MSP Toolkit Rust** - Active development, API integrations
+4. **Website2025** - Active client work
+
+### Priority 2 (Import Next)
+5. **GuruConnect** - Related to GuruRMM
+6. **Cloudflare WHM** - Production tool
+7. **MSP Toolkit PowerShell** - Production scripts
+8. **Seafile Email** - Operational troubleshooting
+
+### Priority 3 (Reference)
+9. **WHM DNS Cleanup** - Completed project
+10. **Autocode Remix** - Reference material
+11. **Claude Settings** - Configuration
+
+### Credentials to Import
+- All server SSH access (8 servers)
+- All service credentials (Gitea, APIs, databases)
+- Client-specific credentials (Dataforth VPN, etc.)
+
+### Infrastructure to Import
+- Server inventory (8 servers with roles, IPs, OS)
+- Service endpoints (internal and external URLs)
+- Network topology (especially Dataforth network)
+
+---
+
+## Conclusion
+
+This catalog represents the complete project landscape from the claude-projects directory. It documents:
+- **11 major projects** (4 active development, 4 production, 3 reference)
+- **8 infrastructure servers** with complete details
+- **5+ service endpoints** (Gitea, GuruRMM, Seafile, etc.)
+- **Multiple client projects** (Dataforth, BGBuilders, RalphsTransfer, Lehman)
+- **20+ session logs** documenting detailed work
+
+All information is ready for import into the ClaudeTools tracking system for comprehensive context management.
+
+---
+
+**Generated by:** Claude Sonnet 4.5
+**Date:** 2026-01-26
+**Source Directory:** C:\Users\MikeSwanson\claude-projects\
+**Total Files Scanned:** 100+ markdown files, multiple CLAUDE.md, README.md, and project documentation files

CATALOG_SHARED_DATA.md

@@ -0,0 +1,914 @@
+# Shared Data Credential Catalog
+**Source:** C:\Users\MikeSwanson\claude-projects\shared-data\
+**Extracted:** 2026-01-26
+**Purpose:** Complete credential inventory from shared-data directory
+
+---
+
+## File Inventory
+
+### Main Credential File
+- **File:** credentials.md (22,136 bytes)
+- **Last Updated:** 2025-12-16
+- **Purpose:** Centralized credentials for Claude Code context recovery across all machines
+
+### Supporting Files
+- **.encryption-key** (156 bytes) - ClaudeTools database encryption key
+- **context-recall-config.env** (535 bytes) - API and context recall settings
+- **ssh-config** (1,419 bytes) - SSH host configurations
+- **multi-tenant-security-app.md** (8,682 bytes) - Multi-tenant Entra app guide
+- **permissions/** - File/registry permission exclusion lists (3 files)
+
+---
+
+## Infrastructure - SSH Access
+
+### Jupiter (Unraid Primary)
+- **Service:** Primary container host
+- **Host:** 172.16.3.20
+- **SSH User:** root
+- **SSH Port:** 22
+- **SSH Password:** Th1nk3r^99##
+- **WebUI Password:** Th1nk3r^99##
+- **Role:** Primary container host (Gitea, NPM, GuruRMM, media)
+- **iDRAC IP:** 172.16.1.73 (DHCP)
+- **iDRAC User:** root
+- **iDRAC Password:** Window123!@#-idrac
+- **iDRAC SSH:** Enabled (port 22)
+- **IPMI Key:** All zeros
+- **Access Methods:** SSH, WebUI, iDRAC
+
+### Saturn (Unraid Secondary)
+- **Service:** Unraid Secondary Server
+- **Host:** 172.16.3.21
+- **SSH User:** root
+- **SSH Port:** 22
+- **SSH Password:** r3tr0gradE99
+- **Role:** Migration source, being consolidated to Jupiter
+- **Access Methods:** SSH
+
+### pfSense (Firewall)
+- **Service:** Network Firewall/Gateway
+- **Host:** 172.16.0.1
+- **SSH User:** admin
+- **SSH Port:** 2248
+- **SSH Password:** r3tr0gradE99!!
+- **Role:** Firewall, Tailscale gateway
+- **Tailscale IP:** 100.79.69.82 (pfsense-1)
+- **Access Methods:** SSH, Web, Tailscale
+
+### OwnCloud VM (on Jupiter)
+- **Service:** OwnCloud file sync server
+- **Host:** 172.16.3.22
+- **Hostname:** cloud.acghosting.com
+- **SSH User:** root
+- **SSH Port:** 22
+- **SSH Password:** Paper123!@#-unifi!
+- **OS:** Rocky Linux 9.6
+- **Services:** Apache, MariaDB, PHP-FPM, Redis, Datto RMM agents
+- **Storage:** SMB mount from Jupiter (/mnt/user/OwnCloud)
+- **Notes:** Jupiter has SSH key auth configured
+- **Access Methods:** SSH, HTTPS
+
+### GuruRMM Build Server
+- **Service:** GuruRMM/GuruConnect dedicated server
+- **Host:** 172.16.3.30
+- **Hostname:** gururmm
+- **SSH User:** guru
+- **SSH Port:** 22
+- **SSH Password:** Gptf*77ttb123!@#-rmm
+- **Sudo Password:** Gptf*77ttb123!@#-rmm (special chars cause issues with sudo -S)
+- **OS:** Ubuntu 22.04
+- **Services:** nginx, PostgreSQL, gururmm-server, gururmm-agent, guruconnect-server
+- **SSH Key Auth:** Working from Windows/WSL (ssh guru@172.16.3.30)
+- **Service Restart Method:** Services run as guru user, pkill works without sudo
+- **Deploy Pattern:**
+  1. Build: `cargo build --release --target x86_64-unknown-linux-gnu -p <package>`
+  2. Rename old: `mv target/release/binary target/release/binary.old`
+  3. Copy new: `cp target/x86_64.../release/binary target/release/binary`
+  4. Kill old: `pkill -f binary.old` (systemd auto-restarts)
+- **GuruConnect Static Files:** /home/guru/guru-connect/server/static/
+- **GuruConnect Binary:** /home/guru/guru-connect/target/release/guruconnect-server
+- **Access Methods:** SSH (key auth)
+
+---
+
+## Services - Web Applications
+
+### Gitea (Git Server)
+- **Service:** Self-hosted Git server
+- **External URL:** https://git.azcomputerguru.com/
+- **Internal URL:** http://172.16.3.20:3000
+- **SSH URL:** ssh://git@172.16.3.20:2222
+- **Web User:** mike@azcomputerguru.com
+- **Web Password:** Window123!@#-git
+- **API Token:** 9b1da4b79a38ef782268341d25a4b6880572063f
+- **SSH User:** git
+- **SSH Port:** 2222
+- **Access Methods:** HTTPS, SSH, API
+
+### NPM (Nginx Proxy Manager)
+- **Service:** Reverse proxy manager
+- **Admin URL:** http://172.16.3.20:7818
+- **HTTP Port:** 1880
+- **HTTPS Port:** 18443
+- **User:** mike@azcomputerguru.com
+- **Password:** Paper123!@#-unifi
+- **Access Methods:** HTTP (internal)
+
+### Cloudflare
+- **Service:** DNS and CDN
+- **API Token (Full DNS):** DRRGkHS33pxAUjQfRDzDeVPtt6wwUU6FwtXqOzNj
+- **API Token (Legacy/Limited):** U1UTbBOWA4a69eWEBiqIbYh0etCGzrpTU4XaKp7w
+- **Permissions:** Zone:Read, Zone:Edit, DNS:Read, DNS:Edit
+- **Used for:** DNS management, WHM plugin, cf-dns CLI
+- **Domain:** azcomputerguru.com
+- **Notes:** New full-access token added 2025-12-19
+- **Access Methods:** API
+
+---
+
+## Projects - GuruRMM
+
+### Dashboard/API Login
+- **Service:** GuruRMM dashboard login
+- **Email:** admin@azcomputerguru.com
+- **Password:** GuruRMM2025
+- **Role:** admin
+- **Access Methods:** Web
+
+### Database (PostgreSQL)
+- **Service:** GuruRMM database
+- **Host:** gururmm-db container (172.16.3.20)
+- **Port:** 5432 (default)
+- **Database:** gururmm
+- **User:** gururmm
+- **Password:** 43617ebf7eb242e814ca9988cc4df5ad
+- **Access Methods:** PostgreSQL protocol
+
+### API Server
+- **External URL:** https://rmm-api.azcomputerguru.com
+- **Internal URL:** http://172.16.3.20:3001
+- **JWT Secret:** ZNzGxghru2XUdBVlaf2G2L1YUBVcl5xH0lr/Gpf/QmE=
+- **Access Methods:** HTTPS, HTTP (internal)
+
+### Microsoft Entra ID (SSO)
+- **Service:** GuruRMM SSO via Entra
+- **App Name:** GuruRMM Dashboard
+- **App ID (Client ID):** 18a15f5d-7ab8-46f4-8566-d7b5436b84b6
+- **Object ID:** 34c80aa8-385a-4bea-af85-f8bf67decc8f
+- **Client Secret:** gOz8Q~J.oz7KnUIEpzmHOyJ6GEzYNecGRl-Pbc9w
+- **Secret Expires:** 2026-12-21
+- **Sign-in Audience:** Multi-tenant (any Azure AD org)
+- **Redirect URIs:** https://rmm.azcomputerguru.com/auth/callback, http://localhost:5173/auth/callback
+- **API Permissions:** openid, email, profile
+- **Created:** 2025-12-21
+- **Access Methods:** OAuth 2.0
+
+### CI/CD (Build Automation)
+- **Webhook URL:** http://172.16.3.30/webhook/build
+- **Webhook Secret:** gururmm-build-secret
+- **Build Script:** /opt/gururmm/build-agents.sh
+- **Build Log:** /var/log/gururmm-build.log
+- **Gitea Webhook ID:** 1
+- **Trigger:** Push to main branch
+- **Builds:** Linux (x86_64) and Windows (x86_64) agents
+- **Deploy Path:** /var/www/gururmm/downloads/
+- **Access Methods:** Webhook
+
+### Build Server SSH Key (for Gitea)
+- **Key Name:** gururmm-build-server
+- **Key Type:** ssh-ed25519
+- **Public Key:** AAAAC3NzaC1lZDI1NTE5AAAAIKSqf2/phEXUK8vd5GhMIDTEGSk0LvYk92sRdNiRrjKi guru@gururmm-build
+- **Added to:** Gitea (azcomputerguru account)
+- **Access Methods:** SSH key authentication
+
+### Clients & Sites
+
+#### Glaztech Industries (GLAZ)
+- **Client ID:** d857708c-5713-4ee5-a314-679f86d2f9f9
+- **Site:** SLC - Salt Lake City
+- **Site ID:** 290bd2ea-4af5-49c6-8863-c6d58c5a55de
+- **Site Code:** DARK-GROVE-7839
+- **API Key:** grmm_Qw64eawPBjnMdwN5UmDGWoPlqwvjM7lI
+- **Created:** 2025-12-18
+- **Access Methods:** API
+
+---
+
+## Projects - GuruConnect
+
+### Database (PostgreSQL on build server)
+- **Service:** GuruConnect database
+- **Host:** localhost (172.16.3.30)
+- **Port:** 5432
+- **Database:** guruconnect
+- **User:** guruconnect
+- **Password:** gc_a7f82d1e4b9c3f60
+- **DATABASE_URL:** postgres://guruconnect:gc_a7f82d1e4b9c3f60@localhost:5432/guruconnect
+- **Created:** 2025-12-28
+- **Access Methods:** PostgreSQL protocol
+
+---
+
+## Projects - ClaudeTools
+
+### Database (MariaDB on Jupiter)
+- **Service:** ClaudeTools MSP tracking database
+- **Host:** 172.16.3.20
+- **Port:** 3306
+- **Database:** claudetools
+- **User:** claudetools
+- **Password:** CT_e8fcd5a3952030a79ed6debae6c954ed
+- **Notes:** Created 2026-01-15, MSP tracking database with 36 tables
+- **Access Methods:** MySQL/MariaDB protocol
+
+### Encryption Key
+- **File Location:** C:\Users\MikeSwanson\claude-projects\shared-data\.encryption-key
+- **Key:** 319134ddb79fa44a6751b383cb0a7940da0de0818bd6bbb1a9c20a6a87d2d30c
+- **Generated:** 2026-01-15
+- **Usage:** AES-256-GCM encryption for credentials in database
+- **Warning:** DO NOT COMMIT TO GIT
+
+### JWT Secret
+- **Secret:** NdwgH6jsGR1WfPdUwR3u9i1NwNx3QthhLHBsRCfFxcg=
+- **Usage:** JWT token signing for API authentication
+- **Access Methods:** N/A (internal use)
+
+### API Server
+- **External URL:** https://claudetools-api.azcomputerguru.com
+- **Internal URL:** http://172.16.3.20:8000
+- **Status:** Pending deployment
+- **Docker Container:** claudetools-api
+- **Access Methods:** HTTPS (pending), HTTP (internal)
+
+### Context Recall Configuration
+- **Claude API URL:** http://172.16.3.30:8001
+- **API Base URL:** http://172.16.3.30:8001
+- **JWT Token:** (empty - get from API via setup script)
+- **Context Recall Enabled:** true
+- **Min Relevance Score:** 5.0
+- **Max Contexts:** 10
+- **Auto Save Context:** true
+- **Default Relevance Score:** 7.0
+- **Debug Context Recall:** false
+
+---
+
+## Client Sites - WHM/cPanel
+
+### IX Server (ix.azcomputerguru.com)
+- **Service:** cPanel/WHM hosting server
+- **SSH Host:** ix.azcomputerguru.com
+- **Internal IP:** 172.16.3.10 (VPN required)
+- **SSH User:** root
+- **SSH Password:** Gptf*77ttb!@#!@#
+- **SSH Key:** guru@wsl key added to authorized_keys
+- **Role:** cPanel/WHM server hosting client sites
+- **Access Methods:** SSH, cPanel/WHM web
+
+### WebSvr (websvr.acghosting.com)
+- **Service:** Legacy cPanel/WHM server
+- **Host:** websvr.acghosting.com
+- **SSH User:** root
+- **SSH Password:** r3tr0gradE99#
+- **API Token:** 8ZPYVM6R0RGOHII7EFF533MX6EQ17M7O
+- **Access Level:** Full access
+- **Role:** Legacy cPanel/WHM server (migration source to IX)
+- **Access Methods:** SSH, cPanel/WHM web, API
+
+### data.grabbanddurando.com
+- **Service:** Client website (Grabb & Durando Law)
+- **Server:** IX (ix.azcomputerguru.com)
+- **cPanel Account:** grabblaw
+- **Site Path:** /home/grabblaw/public_html/data_grabbanddurando
+- **Site Admin User:** admin
+- **Site Admin Password:** GND-Paper123!@#-datasite
+- **Database:** grabblaw_gdapp_data
+- **DB User:** grabblaw_gddata
+- **DB Password:** GrabbData2025
+- **Config File:** /home/grabblaw/public_html/data_grabbanddurando/connection.php
+- **Backups:** /home/grabblaw/public_html/data_grabbanddurando/backups_mariadb_fix/
+- **Access Methods:** Web (admin), MySQL, SSH (via IX root)
+
+### GoDaddy VPS (Legacy)
+- **Service:** Legacy hosting server
+- **IP:** 208.109.235.224
+- **Hostname:** 224.235.109.208.host.secureserver.net
+- **Auth:** SSH key
+- **Database:** grabblaw_gdapp
+- **Note:** Old server, data migrated to IX
+- **Access Methods:** SSH (key)
+
+---
+
+## Seafile (on Jupiter - Migrated 2025-12-27)
+
+### Container
+- **Service:** Seafile file sync server
+- **Host:** Jupiter (172.16.3.20)
+- **URL:** https://sync.azcomputerguru.com
+- **Internal Port:** 8082
+- **Proxied via:** NPM
+- **Containers:** seafile, seafile-mysql, seafile-memcached, seafile-elasticsearch
+- **Docker Compose:** /mnt/user0/SeaFile/DockerCompose/docker-compose.yml
+- **Data Path:** /mnt/user0/SeaFile/seafile-data/
+- **Access Methods:** HTTPS
+
+### Seafile Admin
+- **Service:** Seafile admin interface
+- **Email:** mike@azcomputerguru.com
+- **Password:** r3tr0gradE99#
+- **Access Methods:** Web
+
+### Database (MariaDB)
+- **Service:** Seafile database
+- **Container:** seafile-mysql
+- **Image:** mariadb:10.6
+- **Root Password:** db_dev
+- **Seafile User:** seafile
+- **Seafile Password:** 64f2db5e-6831-48ed-a243-d4066fe428f9
+- **Databases:** ccnet_db (users), seafile_db (data), seahub_db (web)
+- **Access Methods:** MySQL protocol (container)
+
+### Elasticsearch
+- **Service:** Seafile search indexing
+- **Container:** seafile-elasticsearch
+- **Image:** elasticsearch:7.17.26
+- **Notes:** Upgraded from 7.16.2 for kernel 6.12 compatibility
+- **Access Methods:** HTTP (container)
+
+### Microsoft Graph API (Email)
+- **Service:** Seafile email notifications via Graph
+- **Tenant ID:** ce61461e-81a0-4c84-bb4a-7b354a9a356d
+- **Client ID:** 15b0fafb-ab51-4cc9-adc7-f6334c805c22
+- **Client Secret:** rRN8Q~FPfSL8O24iZthi_LVJTjGOCZG.DnxGHaSk
+- **Sender Email:** noreply@azcomputerguru.com
+- **Usage:** Seafile email notifications via Graph API
+- **Access Methods:** Graph API
+
+### Migration Notes
+- **Migrated from:** Saturn (172.16.3.21) on 2025-12-27
+- **Saturn Status:** Seafile stopped, data intact for rollback (keep 1 week)
+
+---
+
+## NPM Proxy Hosts Reference
+
+| ID | Domain | Backend | SSL Cert | Access Methods |
+|----|--------|---------|----------|----------------|
+| 1 | emby.azcomputerguru.com | 172.16.2.99:8096 | npm-1 | HTTPS |
+| 2 | git.azcomputerguru.com | 172.16.3.20:3000 | npm-2 | HTTPS |
+| 4 | plexrequest.azcomputerguru.com | 172.16.3.31:5055 | npm-4 | HTTPS |
+| 5 | rmm-api.azcomputerguru.com | 172.16.3.20:3001 | npm-6 | HTTPS |
+| - | unifi.azcomputerguru.com | 172.16.3.28:8443 | npm-5 | HTTPS |
+| 8 | sync.azcomputerguru.com | 172.16.3.20:8082 | npm-8 | HTTPS |
+
+---
+
+## Tailscale Network
+
+| Tailscale IP | Hostname | Owner | OS | Notes |
+|--------------|----------|-------|-----|-------|
+| 100.79.69.82 | pfsense-1 | mike@ | freebsd | Gateway |
+| 100.125.36.6 | acg-m-l5090 | mike@ | windows | Workstation |
+| 100.92.230.111 | acg-tech-01l | mike@ | windows | Tech laptop |
+| 100.96.135.117 | acg-tech-02l | mike@ | windows | Tech laptop |
+| 100.113.45.7 | acg-tech03l | howard@ | windows | Tech laptop |
+| 100.77.166.22 | desktop-hjfjtep | mike@ | windows | Desktop |
+| 100.101.145.100 | guru-legion9 | mike@ | windows | Laptop |
+| 100.119.194.51 | guru-surface8 | howard@ | windows | Surface |
+| 100.66.103.110 | magus-desktop | rob@ | windows | Desktop |
+| 100.66.167.120 | magus-pc | rob@ | windows | Workstation |
+
+---
+
+## SSH Public Keys
+
+### guru@wsl (Windows/WSL)
+- **User:** guru
+- **Sudo Password:** Window123!@#-wsl
+- **Key Type:** ssh-ed25519
+- **Public Key:** AAAAC3NzaC1lZDI1NTE5AAAAIAWY+SdqMHJP5JOe3qpWENQZhXJA4tzI2d7ZVNAwA/1u guru@wsl
+- **Usage:** WSL SSH authentication
+- **Authorized on:** GuruRMM build server, IX server
+
+### azcomputerguru@local (Mac)
+- **User:** azcomputerguru
+- **Key Type:** ssh-ed25519
+- **Public Key:** AAAAC3NzaC1lZDI1NTE5AAAAIDrGbr4EwvQ4P3ZtyZW3ZKkuDQOMbqyAQUul2+JE4K4S azcomputerguru@local
+- **Usage:** Mac SSH authentication
+- **Authorized on:** GuruRMM build server, IX server
+
+---
+
+## MSP Tools
+
+### Syncro (PSA/RMM) - AZ Computer Guru
+- **Service:** PSA/RMM platform
+- **API Key:** T259810e5c9917386b-52c2aeea7cdb5ff41c6685a73cebbeb3
+- **Subdomain:** computerguru
+- **API Base URL:** https://computerguru.syncromsp.com/api/v1
+- **API Docs:** https://api-docs.syncromsp.com/
+- **Account:** AZ Computer Guru MSP
+- **Added:** 2025-12-18
+- **Access Methods:** API
+
+### Autotask (PSA) - AZ Computer Guru
+- **Service:** PSA platform
+- **API Username:** dguyqap2nucge6r@azcomputerguru.com
+- **API Password:** z*6G4fT#oM~8@9Hxy$2Y7K$ma
+- **API Integration Code:** HYTYYZ6LA5HB5XK7IGNA7OAHQLH
+- **Integration Name:** ClaudeAPI
+- **API Zone:** webservices5.autotask.net
+- **API Docs:** https://autotask.net/help/developerhelp/Content/APIs/REST/REST_API_Home.htm
+- **Account:** AZ Computer Guru MSP
+- **Added:** 2025-12-18
+- **Notes:** New API user "Claude API"
+- **Access Methods:** REST API
+
+### CIPP (CyberDrain Improved Partner Portal)
+- **Service:** M365 management portal
+- **URL:** https://cippcanvb.azurewebsites.net
+- **Tenant ID:** ce61461e-81a0-4c84-bb4a-7b354a9a356d
+- **API Client Name:** ClaudeCipp2 (working)
+- **App ID (Client ID):** 420cb849-542d-4374-9cb2-3d8ae0e1835b
+- **Client Secret:** MOn8Q~otmxJPLvmL~_aCVTV8Va4t4~SrYrukGbJT
+- **Scope:** api://420cb849-542d-4374-9cb2-3d8ae0e1835b/.default
+- **CIPP-SAM App ID:** 91b9102d-bafd-43f8-b17a-f99479149b07
+- **IP Range:** 0.0.0.0/0 (all IPs allowed)
+- **Auth Method:** OAuth 2.0 Client Credentials
+- **Updated:** 2025-12-23
+- **Notes:** Working API client
+- **Access Methods:** REST API (OAuth 2.0)
+
+#### CIPP API Usage (Bash)
+```bash
+# Get token
+ACCESS_TOKEN=$(curl -s -X POST "https://login.microsoftonline.com/ce61461e-81a0-4c84-bb4a-7b354a9a356d/oauth2/v2.0/token" \
+  -d "client_id=420cb849-542d-4374-9cb2-3d8ae0e1835b" \
+  -d "client_secret=MOn8Q~otmxJPLvmL~_aCVTV8Va4t4~SrYrukGbJT" \
+  -d "scope=api://420cb849-542d-4374-9cb2-3d8ae0e1835b/.default" \
+  -d "grant_type=client_credentials" | python3 -c "import sys, json; print(json.load(sys.stdin).get('access_token', ''))")
+
+# Query endpoints (use tenant domain or tenant ID as TenantFilter)
+curl -s "https://cippcanvb.azurewebsites.net/api/ListLicenses?TenantFilter=sonorangreenllc.com" \
+  -H "Authorization: Bearer ${ACCESS_TOKEN}"
+```
+
+#### Old CIPP API Client (DO NOT USE)
+- **App ID:** d545a836-7118-44f6-8852-d9dd64fb7bb9
+- **Status:** Authenticated but all endpoints returned 403
+
+### Claude-MSP-Access (Multi-Tenant Graph API)
+- **Service:** Direct Graph API access for M365 investigations
+- **Tenant ID:** ce61461e-81a0-4c84-bb4a-7b354a9a356d
+- **App ID (Client ID):** fabb3421-8b34-484b-bc17-e46de9703418
+- **Client Secret:** ~QJ8Q~NyQSs4OcGqHZyPrA2CVnq9KBfKiimntbMO
+- **Secret Expires:** 2026-12 (24 months)
+- **Sign-in Audience:** Multi-tenant (any Entra ID org)
+- **Purpose:** Direct Graph API access for M365 investigations and remediation
+- **Admin Consent URL:** https://login.microsoftonline.com/common/adminconsent?client_id=fabb3421-8b34-484b-bc17-e46de9703418&redirect_uri=https://login.microsoftonline.com/common/oauth2/nativeclient
+- **Permissions:** User.ReadWrite.All, Directory.ReadWrite.All, Mail.ReadWrite, MailboxSettings.ReadWrite, AuditLog.Read.All, Application.ReadWrite.All, DelegatedPermissionGrant.ReadWrite.All, Group.ReadWrite.All, SecurityEvents.ReadWrite.All, AppRoleAssignment.ReadWrite.All, UserAuthenticationMethod.ReadWrite.All
+- **Created:** 2025-12-29
+- **Access Methods:** Graph API (OAuth 2.0)
+
+#### Usage (Python)
+```python
+import requests
+
+tenant_id = "CUSTOMER_TENANT_ID"  # or use 'common' after consent
+client_id = "fabb3421-8b34-484b-bc17-e46de9703418"
+client_secret = "~QJ8Q~NyQSs4OcGqHZyPrA2CVnq9KBfKiimntbMO"
+
+# Get token
+token_resp = requests.post(
+    f"https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/token",
+    data={
+        "client_id": client_id,
+        "client_secret": client_secret,
+        "scope": "https://graph.microsoft.com/.default",
+        "grant_type": "client_credentials"
+    }
+)
+access_token = token_resp.json()["access_token"]
+
+# Query Graph API
+headers = {"Authorization": f"Bearer {access_token}"}
+users = requests.get("https://graph.microsoft.com/v1.0/users", headers=headers)
+```
+
+---
+
+## Client - MVAN Inc
+
+### Microsoft 365 Tenant 1
+- **Service:** M365 tenant
+- **Tenant:** mvan.onmicrosoft.com
+- **Admin User:** sysadmin@mvaninc.com
+- **Password:** r3tr0gradE99#
+- **Notes:** Global admin, project to merge/trust with T2
+- **Access Methods:** Web (M365 portal)
+
+---
+
+## Client - BG Builders LLC
+
+### Microsoft 365 Tenant
+- **Service:** M365 tenant
+- **Tenant:** bgbuildersllc.com
+- **CIPP Name:** sonorangreenllc.com
+- **Tenant ID:** ededa4fb-f6eb-4398-851d-5eb3e11fab27
+- **Admin User:** sysadmin@bgbuildersllc.com
+- **Password:** Window123!@#-bgb
+- **Added:** 2025-12-19
+- **Access Methods:** Web (M365 portal)
+
+### Security Investigation (2025-12-22) - RESOLVED
+- **Compromised User:** Shelly@bgbuildersllc.com (Shelly Dooley)
+- **Symptoms:** Suspicious sent items reported by user
+- **Findings:**
+  - Gmail OAuth app with EAS.AccessAsUser.All (REMOVED)
+  - "P2P Server" app registration backdoor (DELETED by admin)
+  - No malicious mailbox rules or forwarding
+  - Sign-in logs unavailable (no Entra P1 license)
+- **Remediation:**
+  - Password reset: `5ecwyHv6&dP7` (must change on login)
+  - All sessions revoked
+  - Gmail OAuth consent removed
+  - P2P Server backdoor deleted
+- **Status:** RESOLVED
+
+---
+
+## Client - Dataforth
+
+### Network
+- **Subnet:** 192.168.0.0/24
+- **Domain:** INTRANET (intranet.dataforth.com)
+
+### UDM (Unifi Dream Machine)
+- **Service:** Gateway/firewall
+- **IP:** 192.168.0.254
+- **SSH User:** root
+- **SSH Password:** Paper123!@#-unifi
+- **Web User:** azcomputerguru
+- **Web Password:** Paper123!@#-unifi
+- **2FA:** Push notification enabled
+- **Role:** Gateway/firewall, OpenVPN server
+- **Access Methods:** SSH, Web (2FA)
+
+### AD1 (Domain Controller)
+- **Service:** Primary domain controller
+- **IP:** 192.168.0.27
+- **Hostname:** AD1.intranet.dataforth.com
+- **User:** INTRANET\sysadmin
+- **Password:** Paper123!@#
+- **Role:** Primary DC, NPS/RADIUS server
+- **NPS Ports:** 1812/1813 (auth/accounting)
+- **Access Methods:** RDP, WinRM
+
+### AD2 (Domain Controller)
+- **Service:** Secondary domain controller
+- **IP:** 192.168.0.6
+- **Hostname:** AD2.intranet.dataforth.com
+- **User:** INTRANET\sysadmin
+- **Password:** Paper123!@#
+- **Role:** Secondary DC, file server
+- **Access Methods:** RDP, WinRM
+
+### NPS RADIUS Configuration
+- **Client Name:** unifi
+- **Client IP:** 192.168.0.254
+- **Shared Secret:** Gptf*77ttb!@#!@#
+- **Policy:** "Unifi" - allows Domain Users
+- **Access Methods:** RADIUS protocol
+
+### D2TESTNAS (SMB1 Proxy)
+- **Service:** DOS machine SMB1 proxy
+- **IP:** 192.168.0.9
+- **Web/SSH User:** admin
+- **Web/SSH Password:** Paper123!@#-nas
+- **Role:** DOS machine SMB1 proxy
+- **Added:** 2025-12-14
+- **Access Methods:** Web, SSH
+
+### Dataforth - Entra App Registration (Claude-Code-M365)
+- **Service:** Silent Graph API access to Dataforth tenant
+- **Tenant ID:** 7dfa3ce8-c496-4b51-ab8d-bd3dcd78b584
+- **App ID (Client ID):** 7a8c0b2e-57fb-4d79-9b5a-4b88d21b1f29
+- **Client Secret:** tXo8Q~ZNG9zoBpbK9HwJTkzx.YEigZ9AynoSrca3
+- **Permissions:** Calendars.ReadWrite, Contacts.ReadWrite, User.ReadWrite.All, Mail.ReadWrite, Directory.ReadWrite.All, Group.ReadWrite.All
+- **Created:** 2025-12-22
+- **Access Methods:** Graph API
+
+---
+
+## Client - CW Concrete LLC
+
+### Microsoft 365 Tenant
+- **Service:** M365 tenant
+- **Tenant:** cwconcretellc.com
+- **CIPP Name:** cwconcretellc.com
+- **Tenant ID:** dfee2224-93cd-4291-9b09-6c6ce9bb8711
+- **Default Domain:** NETORGFT11452752.onmicrosoft.com
+- **Notes:** De-federated from GoDaddy 2025-12, domain needs re-verification
+- **Access Methods:** Web (M365 portal)
+
+### Security Investigation (2025-12-22) - RESOLVED
+- **Findings:**
+  - Graph Command Line Tools OAuth consent with high privileges (REMOVED)
+  - "test" backdoor app registration with multi-tenant access (DELETED)
+  - Apple Internet Accounts OAuth (left - likely iOS device)
+  - No malicious mailbox rules or forwarding
+- **Remediation:**
+  - All sessions revoked for all 4 users
+  - Backdoor apps removed
+- **Status:** RESOLVED
+
+---
+
+## Client - Valley Wide Plastering
+
+### Network
+- **Subnet:** 172.16.9.0/24
+
+### UDM (UniFi Dream Machine)
+- **Service:** Gateway/firewall
+- **IP:** 172.16.9.1
+- **SSH User:** root
+- **SSH Password:** Gptf*77ttb123!@#-vwp
+- **Role:** Gateway/firewall, VPN server, RADIUS client
+- **Access Methods:** SSH, Web
+
+### VWP-DC1 (Domain Controller)
+- **Service:** Primary domain controller
+- **IP:** 172.16.9.2
+- **Hostname:** VWP-DC1
+- **User:** sysadmin
+- **Password:** r3tr0gradE99#
+- **Role:** Primary DC, NPS/RADIUS server
+- **Added:** 2025-12-22
+- **Access Methods:** RDP, WinRM
+
+### NPS RADIUS Configuration
+- **RADIUS Server:** 172.16.9.2
+- **RADIUS Ports:** 1812 (auth), 1813 (accounting)
+- **Clients:** UDM (172.16.9.1), VWP-Subnet (172.16.9.0/24)
+- **Shared Secret:** Gptf*77ttb123!@#-radius
+- **Policy:** "VPN-Access" - allows all authenticated users (24/7)
+- **Auth Methods:** All (PAP, CHAP, MS-CHAP, MS-CHAPv2, EAP)
+- **User Dial-in:** All VWP_Users set to Allow
+- **AuthAttributeRequired:** Disabled on clients
+- **Tested:** 2025-12-22, user cguerrero authenticated successfully
+- **Access Methods:** RADIUS protocol
+
+---
+
+## Client - Khalsa
+
+### Network
+- **Subnet:** 172.16.50.0/24
+
+### UCG (UniFi Cloud Gateway)
+- **Service:** Gateway/firewall
+- **IP:** 172.16.50.1
+- **SSH User:** azcomputerguru
+- **SSH Password:** Paper123!@#-camden (reset 2025-12-22)
+- **Notes:** Gateway/firewall, VPN server, SSH key added but not working
+- **Access Methods:** SSH, Web
+
+### Switch
+- **User:** 8WfY8
+- **Password:** tI3evTNBZMlnngtBc
+- **Access Methods:** Web
+
+### Accountant Machine
+- **IP:** 172.16.50.168
+- **User:** accountant
+- **Password:** Paper123!@#-accountant
+- **Added:** 2025-12-22
+- **Notes:** VPN routing issue
+- **Access Methods:** RDP
+
+---
+
+## Client - Scileppi Law Firm
+
+### DS214se (Source NAS - Migration Source)
+- **Service:** Legacy NAS (source)
+- **IP:** 172.16.1.54
+- **SSH User:** admin
+- **Password:** Th1nk3r^99
+- **Storage:** 1.8TB (1.6TB used)
+- **Data:** User home folders (admin, Andrew Ross, Chris Scileppi, Samantha Nunez, etc.)
+- **Access Methods:** SSH, Web
+
+### Unraid (Source - Migration)
+- **Service:** Legacy Unraid (source)
+- **IP:** 172.16.1.21
+- **SSH User:** root
+- **Password:** Th1nk3r^99
+- **Role:** Data source for migration to RS2212+
+- **Access Methods:** SSH, Web
+
+### RS2212+ (Destination NAS)
+- **Service:** Primary NAS (destination)
+- **IP:** 172.16.1.59
+- **Hostname:** SL-SERVER
+- **SSH User:** sysadmin
+- **Password:** Gptf*77ttb123!@#-sl-server
+- **SSH Key:** claude-code@localadmin added to authorized_keys
+- **Storage:** 25TB total, 6.9TB used (28%)
+- **Data Share:** /volume1/Data (7.9TB - Active, Closed, Archived, Billing, MOTIONS BANK)
+- **Notes:** Migration and consolidation complete 2025-12-29
+- **Access Methods:** SSH (key + password), Web, SMB
+
+### RS2212+ User Accounts (Created 2025-12-29)
+| Username | Full Name | Password | Notes |
+|----------|-----------|----------|-------|
+| chris | Chris Scileppi | Scileppi2025! | Owner |
+| andrew | Andrew Ross | Scileppi2025! | Staff |
+| sylvia | Sylvia | Scileppi2025! | Staff |
+| rose | Rose | Scileppi2025! | Staff |
+| (TBD) | 5th user | - | Name pending |
+
+### Migration/Consolidation Status - COMPLETE
+- **Completed:** 2025-12-29
+- **Final Structure:**
+  - Active: 2.5TB (merged Unraid + DS214se Open Cases)
+  - Closed: 4.9TB (merged Unraid + DS214se Closed Cases)
+  - Archived: 451GB
+  - MOTIONS BANK: 21MB
+  - Billing: 17MB
+- **Recycle Bin:** Emptied (recovered 413GB)
+- **Permissions:** Group "users" with 775 on /volume1/Data
+
+---
+
+## SSH Config File
+
+**File:** ssh-config
+**Generated from:** credentials.md
+**Last updated:** 2025-12-16
+
+### Key Status
+- **gururmm, ix:** Mac + WSL keys authorized
+- **jupiter, saturn:** WSL key only (need to add Mac key)
+- **pfsense, owncloud:** May need key setup
+
+### Host Aliases
+- **jupiter:** 172.16.3.20:22 (root)
+- **saturn:** 172.16.3.21:22 (root)
+- **pfsense:** 172.16.0.1:2248 (admin)
+- **owncloud / cloud:** 172.16.3.22:22 (root)
+- **gururmm / rmm:** 172.16.3.30:22 (root)
+- **ix / whm:** ix.azcomputerguru.com:22 (root)
+- **gitea / git.azcomputerguru.com:** 172.16.3.20:2222 (git)
+
+### Default Settings
+- **AddKeysToAgent:** yes
+- **IdentitiesOnly:** yes
+- **IdentityFile:** ~/.ssh/id_ed25519
+
+---
+
+## Multi-Tenant Security App Documentation
+
+**File:** multi-tenant-security-app.md
+**Purpose:** Reusable Entra app for quick security investigations across client tenants
+
+### Purpose
+Guide for creating a multi-tenant Entra ID app for MSP security investigations. This app provides:
+- Quick consent mechanism for client tenants
+- PowerShell investigation commands
+- BEC detection scripts
+- Mailbox forwarding rule checks
+- OAuth consent monitoring
+
+### Recommended Permissions
+| API | Permission | Purpose |
+|-----|------------|---------|
+| Microsoft Graph | AuditLog.Read.All | Sign-in logs, risky sign-ins |
+| Microsoft Graph | Directory.Read.All | User enumeration, directory info |
+| Microsoft Graph | Mail.Read | Read mailboxes for phishing/BEC |
+| Microsoft Graph | MailboxSettings.Read | Detect forwarding rules |
+| Microsoft Graph | User.Read.All | User profiles |
+| Microsoft Graph | SecurityEvents.Read.All | Security alerts |
+| Microsoft Graph | Policy.Read.All | Conditional access policies |
+| Microsoft Graph | RoleManagement.Read.All | Check admin role assignments |
+| Microsoft Graph | Application.Read.All | Detect suspicious app consents |
+
+### Admin Consent URL Pattern
+```
+https://login.microsoftonline.com/{CLIENT-TENANT-ID}/adminconsent?client_id={YOUR-APP-ID}
+```
+
+---
+
+## Permission Exclusion Files
+
+### file_permissions_excludes.txt
+**Purpose:** Exclude list for file permission repairs using ManageACL
+**Filters:**
+- `$Recycle.Bin`
+- `System Volume Information`
+- `RECYCLER`
+- `documents and settings`
+- `Users`
+- `pagefile.sys`
+- `hiberfil.sys`
+- `swapfile.sys`
+- `WindowsApps`
+
+### file_permissions_profiles_excludes.txt
+**Purpose:** Exclude list for profiles folder in Windows (currently empty)
+**Note:** Main file permission repairs target all folders except profiles, then profiles repair runs separately with different permissions
+
+### reg_permissions_excludes.txt
+**Purpose:** Exclude list for registry permission repairs using SetACL
+**Filters:**
+- `bcd00000000`
+- `system\controlset001`
+- `system\controlset002`
+- `classes\appx`
+- `wow6432node\classes`
+- `classes\wow6432node\appid`
+- `classes\wow6432node\protocols`
+- `classes\wow6432node\typelib`
+- `components\canonicaldata\catalogs`
+- `components\canonicaldata\deployments`
+- `components\deriveddata\components`
+- `components\deriveddata\versionedindex`
+- `microsoft\windows nt\currentversion\perflib\009`
+- `microsoft\windows nt\currentversion\perflib\currentlanguage`
+- `tweakingtemp`
+
+---
+
+## Quick Reference Commands (from credentials.md)
+
+### NPM API Auth
+```bash
+curl -s -X POST http://172.16.3.20:7818/api/tokens \
+  -H "Content-Type: application/json" \
+  -d '{"identity":"mike@azcomputerguru.com","secret":"Paper123!@#-unifi"}'
+```
+
+### Gitea API
+```bash
+curl -H "Authorization: token 9b1da4b79a38ef782268341d25a4b6880572063f" \
+  https://git.azcomputerguru.com/api/v1/repos/search
+```
+
+### GuruRMM Health Check
+```bash
+curl http://172.16.3.20:3001/health
+```
+
+---
+
+## Summary Statistics
+
+### Credential Counts
+- **SSH Servers:** 17 (infrastructure + client sites)
+- **Web Applications:** 7 (Gitea, NPM, Cloudflare, CIPP, etc.)
+- **Databases:** 5 (PostgreSQL x2, MariaDB x2, MySQL x1)
+- **API Keys/Tokens:** 12 (Gitea, Cloudflare, WHM, Syncro, Autotask, CIPP, GuruRMM, etc.)
+- **Microsoft Entra Apps:** 5 (GuruRMM SSO, Seafile Graph, Claude-MSP-Access, Dataforth Claude-Code, CIPP)
+- **SSH Keys:** 3 (guru@wsl, azcomputerguru@local, gururmm-build-server)
+- **Client Tenants:** 5 (MVAN, BG Builders, Dataforth, CW Concrete, Valley Wide Plastering, Khalsa)
+- **Client Networks:** 4 (Dataforth, Valley Wide, Khalsa, Scileppi)
+- **Tailscale Nodes:** 10
+- **NPM Proxy Hosts:** 6
+
+### Infrastructure Components
+- **Unraid Servers:** 2 (Jupiter primary, Saturn secondary)
+- **Domain Controllers:** 3 (Dataforth AD1/AD2, VWP-DC1)
+- **NAS Devices:** 4 (Scileppi RS2212+, DS214se, Unraid, D2TESTNAS)
+- **Network Gateways:** 4 (pfSense, Dataforth UDM, VWP UDM, Khalsa UCG)
+- **Build Servers:** 1 (GuruRMM/GuruConnect)
+- **Container Hosts:** 1 (Jupiter)
+- **VMs:** 1 (OwnCloud)
+
+### Service Categories
+- **Self-Hosted:** Gitea, NPM, GuruRMM, GuruConnect, ClaudeTools, Seafile
+- **MSP Tools:** Syncro, Autotask, CIPP
+- **Cloud Services:** Cloudflare, Microsoft 365/Entra ID, Tailscale
+- **Client Hosting:** WHM/cPanel (IX, WebSvr)
+
+---
+
+## Notes
+
+- **All passwords are UNREDACTED** for context recovery purposes
+- **File locations are preserved** for easy reference
+- **Access methods documented** for each service
+- **Last updated dates included** where available in source
+- **Security incidents documented** with resolution status
+- **Migration statuses preserved** for historical reference
+- **SSH keys include full public key text** for verification
+- **API tokens include full values** for immediate use
+- **Database connection strings** can be reconstructed from provided credentials
+
+**WARNING:** This file contains sensitive credentials and should be protected accordingly. Do not commit to version control or share externally.

CLIENT_DIRECTORY.md

@@ -0,0 +1,836 @@
+# Client Directory
+
+**Generated:** 2026-01-26
+**Purpose:** Comprehensive directory of all MSP clients with infrastructure, work history, and credentials
+**Source:** CATALOG_CLIENTS.md, CATALOG_SESSION_LOGS.md
+
+---
+
+## Table of Contents
+
+1. [AZ Computer Guru (Internal)](#az-computer-guru-internal)
+2. [BG Builders LLC](#bg-builders-llc)
+3. [CW Concrete LLC](#cw-concrete-llc)
+4. [Dataforth Corporation](#dataforth-corporation)
+5. [Glaztech Industries](#glaztech-industries)
+6. [Grabb & Durando](#grabb--durando)
+7. [Khalsa](#khalsa)
+8. [MVAN Inc](#mvan-inc)
+9. [RRS Law Firm](#rrs-law-firm)
+10. [Scileppi Law Firm](#scileppi-law-firm)
+11. [Sonoran Green LLC](#sonoran-green-llc)
+12. [Valley Wide Plastering](#valley-wide-plastering)
+
+---
+
+## AZ Computer Guru (Internal)
+
+### Company Information
+- **Type:** Internal Operations
+- **Status:** Active
+- **Domain:** azcomputerguru.com
+- **Service Area:** Statewide (Arizona - Tucson, Phoenix, Prescott, Flagstaff)
+- **Phone:** 520.304.8300
+
+### Infrastructure
+
+#### Physical Servers
+| Server | IP | OS | Role | Access |
+|--------|-----|-----|------|--------|
+| Jupiter | 172.16.3.20 | Unraid | Primary container host | root / Th1nk3r^99## |
+| Saturn | 172.16.3.21 | Unraid | Secondary storage | root / r3tr0gradE99 |
+| Build Server (gururmm) | 172.16.3.30 | Ubuntu 22.04 | GuruRMM, PostgreSQL | guru / Gptf*77ttb123!@#-rmm |
+| pfSense | 172.16.0.1 | FreeBSD/pfSense 2.8.1 | Firewall, VPN | admin / r3tr0gradE99!! |
+| WebSvr | websvr.acghosting.com | cPanel | WHM/cPanel hosting | root / r3tr0gradE99# |
+| IX | 172.16.3.10 | cPanel | WHM/cPanel hosting | root / Gptf*77ttb!@#!@# |
+
+#### Network Configuration
+- **LAN Subnet:** 172.16.0.0/22
+- **Tailscale Network:** 100.x.x.x/32 (mesh VPN)
+  - pfSense: 100.119.153.74 (hostname: pfsense-2)
+  - ACG-M-L5090: 100.125.36.6
+- **WAN (Fiber):** 98.181.90.163/31
+- **Public IPs:** 72.194.62.2-10, 70.175.28.51-57
+
+#### Services
+| Service | External URL | Internal | Purpose |
+|---------|--------------|----------|---------|
+| Gitea | git.azcomputerguru.com | 172.16.3.20:3000 | Git server |
+| GuruRMM | rmm-api.azcomputerguru.com | 172.16.3.30:3001 | RMM platform |
+| NPM | - | 172.16.3.20:7818 | Nginx Proxy Manager |
+| Seafile | sync.azcomputerguru.com | 172.16.3.21 | File sync |
+
+### Work History
+
+#### 2025-12-12
+- Tailscale fix on pfSense after upgrade
+- WebSvr security: Blocked 10 IPs via Imunify360
+- Disk cleanup: Freed 58GB (86% to 80%)
+- DNS fix: Added A record for data.grabbanddurando.com
+
+#### 2025-12-14
+- SSL certificate: Added rmm-api.azcomputerguru.com to NPM
+- Session logging improvements
+- Rust installation on WSL
+- SSH key generation and distribution
+
+#### 2025-12-16 (Multiple Sessions)
+- GuruRMM dashboard deployed to build server
+- Auto-update system implemented for agent
+- Binary replacement bug fix (rename-then-copy pattern)
+- MailProtector deployed on WebSvr and IX
+
+#### 2025-12-21
+- Temperature metrics added to agent v0.5.1
+- CI/CD pipeline created with webhook handler
+- Policy system designed (Client → Site → Agent)
+- Authorization system implemented (Phases 1-2)
+
+#### 2025-12-25
+- pfSense hardware migration to Intel N100
+- Tailscale firewall rules made permanent
+- SeaFile and Scileppi data migration monitoring
+
+### Credentials
+**See:** credentials.md sections:
+- Infrastructure - SSH Access (Jupiter, Saturn, pfSense, Build Server, WebSvr, IX)
+- Services - Web Applications (Gitea, NPM, Cloudflare)
+- Projects - GuruRMM (Database, API, SSO, CI/CD)
+- MSP Tools (Syncro, Autotask, CIPP)
+
+### Status
+- **Active:** Production infrastructure operational
+- **Development:** GuruRMM Phase 1 MVP in progress
+- **Pending Tasks:**
+  - GuruRMM agent architecture support (ARM, different OS versions)
+  - Repository optimization (ensure all remotes point to Gitea)
+  - Clean up old Tailscale entries
+  - Windows SSH keys for Jupiter and RS2212+ direct access
+  - NPM proxy for rmm.azcomputerguru.com SSO dashboard
+
+---
+
+## BG Builders LLC
+
+### Company Information
+- **Type:** Client - Construction
+- **Status:** Active
+- **Domain:** bgbuildersllc.com
+- **Related Entity:** Sonoran Green LLC (same M365 tenant)
+
+### Infrastructure
+
+#### Microsoft 365
+- **Tenant ID:** ededa4fb-f6eb-4398-851d-5eb3e11fab27
+- **onmicrosoft.com:** sonorangreenllc.onmicrosoft.com
+- **Admin User:** sysadmin@bgbuildersllc.com
+- **Password:** Window123!@#-bgb
+- **Licenses:**
+  - 8x Microsoft 365 Business Standard
+  - 4x Exchange Online Plan 1
+  - 1x Microsoft 365 Basic
+- **Security Gap:** No advanced security features (no conditional access, Intune, or Defender)
+- **Recommendation:** Upgrade to Business Premium
+
+#### DNS Configuration (Cloudflare)
+- **Zone ID:** 156b997e3f7113ddbd9145f04aadb2df
+- **Nameservers:** amir.ns.cloudflare.com, mckinley.ns.cloudflare.com
+- **A Records:** 3.33.130.190, 15.197.148.33 (proxied) - GoDaddy Website Builder
+
+#### Email Security Records (Configured 2025-12-19)
+- **SPF:** `v=spf1 include:spf.protection.outlook.com -all`
+- **DMARC:** `v=DMARC1; p=reject; rua=mailto:sysadmin@bgbuildersllc.com`
+- **DKIM selector1:** CNAME to selector1-bgbuildersllc-com._domainkey.sonorangreenllc.onmicrosoft.com
+- **DKIM selector2:** CNAME to selector2-bgbuildersllc-com._domainkey.sonorangreenllc.onmicrosoft.com
+- **MX:** bgbuildersllc-com.mail.protection.outlook.com
+
+### Work History
+
+#### 2025-12-19 (Email Security Incident)
+- **Incident:** Phishing email spoofing shelly@bgbuildersllc.com
+- **Subject:** "Sonorangreenllc.com New Notice: All Employee Stipend..."
+- **Investigation:** Account NOT compromised - external spoofing attack
+- **Root Cause:** Missing DMARC and DKIM records
+- **Response:**
+  - Verified no mailbox forwarding, inbox rules, or send-as permissions
+  - Added DMARC record with `p=reject` policy
+  - Configured DKIM selectors (selector1 and selector2)
+  - Email correctly routed to Junk folder by M365
+
+#### 2025-12-19 (Cloudflare Migration)
+- Migrated bgbuildersllc.com from GoDaddy to Cloudflare DNS
+- Recovered original A records from GoDaddy nameservers
+- Created 14 DNS records including M365 email records
+- Preserved GoDaddy zone file for reference
+
+#### 2025-12-22 (Security Investigation - Resolved)
+- **Compromised User:** Shelly@bgbuildersllc.com (Shelly Dooley)
+- **Findings:**
+  - Gmail OAuth app with EAS.AccessAsUser.All (REMOVED)
+  - "P2P Server" app registration backdoor (DELETED by admin)
+  - No malicious mailbox rules or forwarding
+  - Sign-in logs unavailable (no Entra P1 license)
+- **Remediation:**
+  - Password reset: `5ecwyHv6&dP7` (must change on login)
+  - All sessions revoked
+  - Gmail OAuth consent removed
+  - P2P Server backdoor deleted
+- **Status:** RESOLVED
+
+### Credentials
+- **M365 Tenant ID:** ededa4fb-f6eb-4398-851d-5eb3e11fab27
+- **Admin User:** sysadmin@bgbuildersllc.com
+- **Password:** Window123!@#-bgb
+- **Cloudflare Zone ID:** 156b997e3f7113ddbd9145f04aadb2df
+
+### Status
+- **Active:** Email security hardening complete
+- **Pending Tasks:**
+  - Create cPanel account for bgbuildersllc.com on IX server
+  - Update Cloudflare A records to IX server IP (72.194.62.5) after account creation
+  - Enable DKIM signing in M365 Defender
+  - Consider migrating sonorangreenllc.com to Cloudflare
+
+### Important Dates
+- **2025-12-19:** Email security hardening completed
+- **2025-12-22:** Security incident resolved
+- **2025-04-15:** Last password change for user accounts
+
+---
+
+## CW Concrete LLC
+
+### Company Information
+- **Type:** Client - Construction
+- **Status:** Active
+- **Domain:** cwconcretellc.com
+
+### Infrastructure
+
+#### Microsoft 365
+- **Tenant ID:** dfee2224-93cd-4291-9b09-6c6ce9bb8711
+- **Default Domain:** NETORGFT11452752.onmicrosoft.com
+- **Licenses:**
+  - 2x Microsoft 365 Business Standard
+  - 2x Exchange Online Essentials
+- **Security Gap:** No advanced security features
+- **Recommendation:** Upgrade to Business Premium for Intune, conditional access, Defender
+- **Notes:** De-federated from GoDaddy 2025-12, domain needs re-verification
+
+### Work History
+
+#### 2025-12-22 (Security Investigation - Resolved)
+- **Findings:**
+  - Graph Command Line Tools OAuth consent with high privileges (REMOVED)
+  - "test" backdoor app registration with multi-tenant access (DELETED)
+  - Apple Internet Accounts OAuth (left - likely iOS device)
+  - No malicious mailbox rules or forwarding
+- **Remediation:**
+  - All sessions revoked for all 4 users
+  - Backdoor apps removed
+- **Status:** RESOLVED
+
+#### 2025-12-23
+- License analysis via CIPP API
+- Security assessment completed
+- Recommendation provided for Business Premium upgrade
+
+### Credentials
+- **M365 Tenant ID:** dfee2224-93cd-4291-9b09-6c6ce9bb8711
+- **CIPP Name:** cwconcretellc.com
+
+### Status
+- **Active:** Security assessment complete
+- **Pending Tasks:**
+  - Business Premium upgrade recommendation
+  - Domain re-verification in M365
+
+---
+
+## Dataforth Corporation
+
+### Company Information
+- **Type:** Client - Industrial Equipment Manufacturing
+- **Status:** Active
+- **Domain:** dataforth.com, intranet.dataforth.com
+- **Business:** Industrial test equipment manufacturer
+
+### Infrastructure
+
+#### Network
+- **LAN Subnet:** 192.168.0.0/24
+- **Domain:** INTRANET (intranet.dataforth.com)
+- **VPN Subnet:** 192.168.6.0/24
+- **VPN Endpoint:** 67.206.163.122:1194/TCP
+
+#### Servers
+| Server | IP | Role | Credentials |
+|--------|-----|------|-------------|
+| UDM | 192.168.0.254 | Gateway/OpenVPN | root / Paper123!@#-unifi |
+| AD1 | 192.168.0.27 | Primary DC, NPS/RADIUS | INTRANET\sysadmin / Paper123!@# |
+| AD2 | 192.168.0.6 | Secondary DC, file server | INTRANET\sysadmin / Paper123!@# |
+| D2TESTNAS | 192.168.0.9 | DOS machine SMB1 proxy | admin / Paper123!@#-nas |
+
+#### Active Directory
+- **Domain:** INTRANET
+- **DNS:** intranet.dataforth.com
+- **Admin:** INTRANET\sysadmin / Paper123!@#
+
+#### RADIUS/NPS Configuration (AD1)
+- **Server:** 192.168.0.27
+- **Ports:** 1812/UDP (auth), 1813/UDP (accounting)
+- **Shared Secret:** Gptf*77ttb!@#!@#
+- **RADIUS Client:** unifi (192.168.0.254)
+- **Network Policy:** "Unifi" - allows Domain Users 24/7
+- **Auth Methods:** All (PAP, CHAP, MS-CHAP, MS-CHAPv2, EAP)
+- **AuthAttributeRequired:** False (required for UniFi OpenVPN)
+
+#### Microsoft 365
+- **Tenant ID:** 7dfa3ce8-c496-4b51-ab8d-bd3dcd78b584
+- **Admin:** sysadmin@dataforth.com / Paper123!@# (synced with AD)
+
+#### Entra App Registration (Claude-Code-M365)
+- **Purpose:** Silent Graph API access for automation
+- **App ID:** 7a8c0b2e-57fb-4d79-9b5a-4b88d21b1f29
+- **Client Secret:** tXo8Q~ZNG9zoBpbK9HwJTkzx.YEigZ9AynoSrca3
+- **Created:** 2025-12-22
+- **Expires:** 2027-12-22
+- **Permissions:** Calendars.ReadWrite, Contacts.ReadWrite, User.ReadWrite.All, Mail.ReadWrite, Directory.ReadWrite.All, Group.ReadWrite.All, Sites.ReadWrite.All, Files.ReadWrite.All
+
+### Work History
+
+#### 2025-12-14 (DOS Test Machines Implementation)
+- **Problem:** Crypto attack disabled SMB1 on production servers
+- **Solution:** Deployed NetGear ReadyNAS as SMB1 proxy
+- **Architecture:**
+  - DOS machines → NAS (SMB1) → AD2 (SMB2/3)
+  - Bidirectional sync every 15 minutes
+  - PULL: Test results → Database
+  - PUSH: Software updates → DOS machines
+- **Features:**
+  - Remote task deployment (TODO.BAT)
+  - Centralized software management (UPDATE.BAT)
+- **Machines Working:** TS-27, TS-8L, TS-8R
+- **Machines Pending:** ~27 DOS machines need network config updates
+- **Project Time:** ~11 hours implementation
+
+#### 2025-12-20 (RADIUS/OpenVPN Setup)
+- **Problem:** VPN connections failing with RADIUS authentication
+- **Root Cause:** NPS required Message-Authenticator attribute, but UDM's pam_radius_auth doesn't send it
+- **Solution:**
+  - Set NPS RADIUS client AuthAttributeRequired to False
+  - Created comprehensive OpenVPN client profiles (.ovpn)
+  - Configured split tunnel (no redirect-gateway)
+  - Added proper DNS configuration
+- **Testing:** Successfully authenticated INTRANET\sysadmin via VPN
+
+#### 2025-12-22 (John Lehman Mailbox Cleanup)
+- **User:** jlehman@dataforth.com
+- **Problem:** Duplicate calendar events and contacts causing Outlook sync issues
+- **Investigation:** Created Entra app for persistent Graph API access
+- **Results:**
+  - Deleted 175 duplicate recurring calendar series (kept newest)
+  - Deleted 476 duplicate contacts
+  - Deleted 1 blank contact
+  - 11 series couldn't be deleted (John is attendee, not organizer)
+- **Cleanup Stats:**
+  - Contacts: 937 → 460 (477 removed)
+  - Recurring series: 279 → 104 (175 removed)
+- **Post-Cleanup Issues:**
+  - Calendar categories lost (colors) - awaiting John's preferences
+  - Focused Inbox ML model reset - created 12 "Other" overrides
+- **Follow-up:** Block New Outlook toggle via registry (HideNewOutlookToggle)
+
+### Credentials
+**See:** credentials.md sections:
+- Client - Dataforth (UDM, AD1, AD2, D2TESTNAS, NPS RADIUS, Entra app)
+- Projects - Dataforth DOS (Complete workflow documentation)
+
+### Status
+- **Active:** Ongoing support including RADIUS/VPN, AD, M365 management
+- **DOS System:** 90% complete, operational
+- **Pending Tasks:**
+  - John Lehman needs to reset Outlook profile for fresh sync
+  - Apply "Block New Outlook" registry fix on John's laptop
+  - Re-apply calendar categories based on John's preferences
+  - Datasheets share creation on AD2 (BLOCKED - waiting for Engineering)
+  - Update network config on remaining ~27 DOS machines
+
+### Important Dates
+- **2025-12-14:** DOS test machine system implemented
+- **2025-12-20:** RADIUS/VPN authentication configured
+- **2025-12-22:** Major mailbox cleanup for John Lehman
+
+---
+
+## Glaztech Industries
+
+### Company Information
+- **Type:** Client
+- **Status:** Active
+- **Domain:** glaztech.com
+- **Subdomain (standalone):** slc.glaztech.com
+
+### Infrastructure
+
+#### Active Directory Migration Plan
+- **Current:** slc.glaztech.com standalone domain (~12 users/computers)
+- **Recommendation:** Manual migration to glaztech.com using OUs for site segmentation
+- **Reason:** Small environment, manual migration more reliable than ADMT
+
+#### Firewall GPO Scripts (Created 2025-12-18)
+- **Purpose:** Ransomware protection via firewall segmentation
+- **Files:**
+  - Configure-WorkstationFirewall.ps1 - Blocks workstation-to-workstation traffic
+  - Configure-ServerFirewall.ps1 - Restricts workstation access to servers
+  - Configure-DCFirewall.ps1 - Secures Domain Controller access
+  - Deploy-FirewallGPOs.ps1 - Creates and links GPOs
+
+### Work History
+
+#### 2025-12-18
+- AD migration planning: Recommended manual migration approach
+- Firewall GPO scripts created for ransomware protection
+- GuruRMM testing: Attempted legacy agent deployment on 2008 R2
+
+#### 2025-12-21
+- **GuruRMM Site Code:** DARK-GROVE-7839 configured
+- **Compatibility Issue:** Agent fails silently on Server 2008 R2 (missing VC++ Runtime or incompatible APIs)
+- **Likely Culprits:** sysinfo, local-ip-address crates using newer Windows APIs
+
+### Credentials
+- **GuruRMM:**
+  - Client ID: d857708c-5713-4ee5-a314-679f86d2f9f9
+  - Site: SLC - Salt Lake City
+  - Site ID: 290bd2ea-4af5-49c6-8863-c6d58c5a55de
+  - Site Code: DARK-GROVE-7839
+  - API Key: grmm_Qw64eawPBjnMdwN5UmDGWoPlqwvjM7lI
+
+### Status
+- **Active:** AD planning, firewall hardening, GuruRMM deployment
+- **Pending Tasks:**
+  - Plan slc.glaztech.com to glaztech.com AD migration
+  - Deploy firewall GPO scripts after testing
+  - Resolve GuruRMM agent 2008 R2 compatibility issues
+
+---
+
+## Grabb & Durando
+
+### Company Information
+- **Type:** Client - Law Firm
+- **Status:** Active
+- **Domain:** grabbanddurando.com
+- **Related:** grabblaw.com
+
+### Infrastructure
+
+#### IX Server (WHM/cPanel)
+- **Internal IP:** 172.16.3.10
+- **Public IP:** 72.194.62.5
+- **cPanel Account:** grabblaw
+- **Database:** grabblaw_gdapp_data
+- **Database User:** grabblaw_gddata
+- **Password:** GrabbData2025
+
+#### data.grabbanddurando.com
+- **Record Type:** A
+- **Value:** 72.194.62.5
+- **TTL:** 600 seconds
+- **SSL:** Let's Encrypt via AutoSSL
+- **Site Admin:** admin / GND-Paper123!@#-datasite
+
+### Work History
+
+#### 2025-12-12 (DNS & SSL Fix)
+- **Problem:** data.grabbanddurando.com not resolving
+- **Solution:** Added A record via WHM API
+- **SSL Issue:** Wrong certificate being served (serveralias conflict)
+- **Resolution:**
+  - Removed conflicting serveralias from data.grabbanddurando.grabblaw.com vhost
+  - Added as proper subdomain to grabblaw cPanel account
+  - Ran AutoSSL to get Let's Encrypt cert
+  - Rebuilt Apache config and restarted
+
+#### 2025-12-12 (Database Sync from GoDaddy VPS)
+- **Problem:** DNS was pointing to old GoDaddy VPS, users updated data there Dec 10-11
+- **Old Server:** 208.109.235.224
+- **Missing Records Found:**
+  - activity table: 4 records (18539 → 18543)
+  - gd_calendar_events: 1 record (14762 → 14763)
+  - gd_assign_users: 2 records (24299 → 24301)
+- **Solution:** Synced all missing records using mysqldump with --replace option
+- **Verification:** All tables now match between servers
+
+#### 2025-12-16 (Calendar Event Creation Fix)
+- **Problem:** Calendar event creation failing due to MySQL strict mode
+- **Root Cause:** Empty strings for auto-increment columns
+- **Solution:** Replaced empty strings with NULL for MySQL strict mode compliance
+
+### Credentials
+**See:** credentials.md section:
+- Client Sites - WHM/cPanel (IX Server, data.grabbanddurando.com)
+
+### Status
+- **Active:** Database and calendar maintenance complete
+- **Important Dates:**
+  - 2025-12-10 to 2025-12-11: Data divergence period (users on old GoDaddy VPS)
+  - 2025-12-12: Data sync and DNS fix completed
+  - 2025-12-16: Calendar fix applied
+
+---
+
+## Khalsa
+
+### Company Information
+- **Type:** Client
+- **Status:** Active
+
+### Infrastructure
+
+#### Network
+- **Primary LAN:** 192.168.0.0/24
+- **Alternate Subnet:** 172.16.50.0/24
+- **VPN:** 192.168.1.0/24
+- **External IP:** 98.175.181.20
+- **OpenVPN Port:** 1194/TCP
+
+#### UCG (UniFi Cloud Gateway)
+- **Management IP:** 192.168.0.1
+- **Alternate IP:** 172.16.50.1 (br2 interface)
+- **SSH:** root / Paper123!@#-camden
+- **SSH Key:** ~/.ssh/khalsa_ucg (guru@wsl-khalsa)
+
+#### Switch
+- **User:** 8WfY8
+- **Password:** tI3evTNBZMlnngtBc
+
+#### Accountant Machine (KMS-QB)
+- **IP:** 172.16.50.168 (dual-homed on both subnets)
+- **Hostname:** KMS-QB
+- **User:** accountant / Paper123!@#-accountant
+- **Local Admin:** localadmin / r3tr0gradE99!
+- **RDP:** Enabled (accountant added to Remote Desktop Users)
+- **WinRM:** Enabled
+
+### Work History
+
+#### 2025-12-22 (VPN RDP Access Fix)
+- **Problem:** VPN clients couldn't RDP to 172.16.50.168
+- **Root Causes:**
+  1. RDP not enabled (TermService not listening)
+  2. Windows Firewall blocking RDP from VPN subnet (192.168.1.0/24)
+  3. Required services not running (UmRdpService, SessionEnv)
+- **Solution:**
+  1. Added SSH key to UCG for remote management
+  2. Verified OpenVPN pushing correct routes
+  3. Enabled WinRM on target machine
+  4. Added firewall rule for RDP from VPN subnet
+  5. Started required services (UmRdpService, SessionEnv)
+  6. Rebooted machine to fully enable RDP listener
+  7. Added 'accountant' user to Remote Desktop Users group
+- **Testing:** RDP access confirmed working from VPN
+
+### Credentials
+**See:** credentials.md section:
+- Client - Khalsa (UCG, Switch, Accountant Machine)
+
+### Status
+- **Active:** VPN and RDP troubleshooting complete
+- **Important Dates:**
+  - 2025-12-22: VPN RDP access fully configured and tested
+
+---
+
+## MVAN Inc
+
+### Company Information
+- **Type:** Client
+- **Status:** Active
+
+### Infrastructure
+
+#### Microsoft 365 Tenant 1
+- **Tenant:** mvan.onmicrosoft.com
+- **Admin User:** sysadmin@mvaninc.com
+- **Password:** r3tr0gradE99#
+- **Notes:** Global admin, project to merge/trust with T2
+
+### Status
+- **Active:** M365 tenant management
+- **Project:** Tenant merge/trust with T2 (status unknown)
+
+---
+
+## RRS Law Firm
+
+### Company Information
+- **Type:** Client - Law Firm
+- **Status:** Active
+- **Domain:** rrs-law.com
+
+### Infrastructure
+
+#### Hosting
+- **Server:** IX (172.16.3.10)
+- **Public IP:** 72.194.62.5
+
+#### Microsoft 365 Email DNS (Added 2025-12-19)
+| Record | Type | Value |
+|--------|------|-------|
+| _dmarc.rrs-law.com | TXT | `v=DMARC1; p=quarantine; rua=mailto:admin@rrs-law.com` |
+| selector1._domainkey | CNAME | selector1-rrslaw-com0i._domainkey.rrslaw.d-v1.dkim.mail.microsoft |
+| selector2._domainkey | CNAME | selector2-rrslaw-com0i._domainkey.rrslaw.d-v1.dkim.mail.microsoft |
+
+### Work History
+
+#### 2025-12-19
+- **Problem:** Email DNS records incomplete for Microsoft 365
+- **Solution:** Added DMARC and both DKIM selectors via WHM API
+- **Verification:** Both selectors verified by M365
+- **Result:** DKIM signing enabled in M365 Admin Center
+
+#### Final Email DNS Status
+- MX → M365: Yes
+- SPF (includes M365): Yes
+- DMARC: Yes
+- Autodiscover: Yes
+- DKIM selector1: Yes
+- DKIM selector2: Yes
+- MS Verification: Yes
+- Enterprise Registration: Yes
+- Enterprise Enrollment: Yes
+
+### Status
+- **Active:** Email DNS configuration complete
+- **Important Dates:**
+  - 2025-12-19: Complete M365 email DNS configuration
+
+---
+
+## Scileppi Law Firm
+
+### Company Information
+- **Type:** Client - Law Firm
+- **Status:** Active
+
+### Infrastructure
+
+#### Network
+- **Subnet:** 172.16.1.0/24
+- **Gateway:** 172.16.0.1 (pfSense via Tailscale)
+
+#### Storage Systems
+| System | IP | Role | Credentials | Status |
+|--------|-----|------|-------------|--------|
+| DS214se | 172.16.1.54 | Source NAS (old) | admin / Th1nk3r^99 | Migration source |
+| Unraid | 172.16.1.21 | Source server | root / Th1nk3r^99 | Migration source |
+| RS2212+ | 172.16.1.59 | Destination NAS (new) | sysadmin / Gptf*77ttb123!@#-sl-server | Production |
+
+#### RS2212+ (SL-SERVER)
+- **Storage:** 25TB total, 6.9TB used (28%)
+- **Data Share:** /volume1/Data (7.9TB)
+- **Hostname:** SL-SERVER
+- **SSH Key:** claude-code@localadmin added
+
+#### User Accounts (Created 2025-12-29)
+| Username | Full Name | Password | Notes |
+|----------|-----------|----------|-------|
+| chris | Chris Scileppi | Scileppi2025! | Owner |
+| andrew | Andrew Ross | Scileppi2025! | Staff |
+| sylvia | Sylvia | Scileppi2025! | Staff |
+| rose | Rose | Scileppi2025! | Staff |
+
+### Work History
+
+#### 2025-12-23 (Migration Start)
+- **Setup:** Enabled User Home Service on DS214se
+- **Setup:** Enabled rsync service on DS214se
+- **SSH Keys:** Generated on RS2212+, added to DS214se authorized_keys
+- **Permissions:** Fixed home directory permissions (chmod 700)
+- **Migration:** Started parallel rsync from DS214se and Unraid
+- **Speed Issue:** Initially 1.5 MB/s, improved to 5.4 MB/s after switch port move
+- **Network Issue:** VLAN 5 misconfiguration caused temporary outage
+
+#### 2025-12-23 (Network Recovery)
+- **Tailscale:** Re-authenticated after invalid key error
+- **pfSense SSH:** Added SSH key for management
+- **VLAN 5:** Diagnosed misconfiguration (wrong parent interface igb0 instead of igb2, wrong netmask /32 instead of /24)
+- **Migration:** Automatically resumed after network restored
+
+#### 2025-12-26
+- **Migration Progress:** 6.4TB transferred (~94% complete)
+- **Estimated Completion:** ~0.4TB remaining
+
+#### 2025-12-29 (Migration Complete & Consolidation)
+- **Status:** Migration and consolidation COMPLETE
+- **Final Structure:**
+  - Active: 2.5TB (merged Unraid + DS214se Open Cases)
+  - Closed: 4.9TB (merged Unraid + DS214se Closed Cases)
+  - Archived: 451GB
+  - MOTIONS BANK: 21MB
+  - Billing: 17MB
+- **Recycle Bin:** Emptied (recovered 413GB)
+- **Permissions:** Group "users" with 775 on /volume1/Data
+- **User Accounts:** Created 4 user accounts (chris, andrew, sylvia, rose)
+
+### Credentials
+**See:** credentials.md section:
+- Client - Scileppi Law Firm (DS214se, Unraid, RS2212+, User accounts)
+
+### Status
+- **Active:** Migration and consolidation complete
+- **Pending Tasks:**
+  - Monitor user access and permissions
+  - Verify data integrity
+  - Decommission DS214se after final verification
+  - Backup RS2212+ configuration
+
+### Important Dates
+- **2025-12-23:** Migration started (both sources)
+- **2025-12-23:** Network outage (VLAN 5 misconfiguration)
+- **2025-12-26:** ~94% complete (6.4TB of 6.8TB)
+- **2025-12-29:** Migration and consolidation COMPLETE
+
+---
+
+## Sonoran Green LLC
+
+### Company Information
+- **Type:** Client - Construction
+- **Status:** Active
+- **Domain:** sonorangreenllc.com
+- **Primary Entity:** BG Builders LLC
+
+### Infrastructure
+
+#### Microsoft 365
+- **Tenant:** Shared with BG Builders LLC (ededa4fb-f6eb-4398-851d-5eb3e11fab27)
+- **onmicrosoft.com:** sonorangreenllc.onmicrosoft.com
+
+#### DNS Configuration
+- **Current Status:**
+  - Nameservers: Still on GoDaddy (not migrated to Cloudflare)
+  - A Record: 172.16.10.200 (private IP - problematic)
+  - Email Records: Properly configured for M365
+
+#### Needed Records (Not Yet Applied)
+- DMARC: `v=DMARC1; p=reject; rua=mailto:sysadmin@bgbuildersllc.com`
+- DKIM selector1: CNAME to selector1-sonorangreenllc-com._domainkey.sonorangreenllc.onmicrosoft.com
+- DKIM selector2: CNAME to selector2-sonorangreenllc-com._domainkey.sonorangreenllc.onmicrosoft.com
+
+### Work History
+
+#### 2025-12-19
+- **Investigation:** Shared tenant with BG Builders identified
+- **Assessment:** DMARC and DKIM records missing
+- **Status:** DNS records prepared but not yet applied
+
+### Status
+- **Active:** Related entity to BG Builders LLC
+- **Pending Tasks:**
+  - Migrate domain to Cloudflare DNS
+  - Fix A record (pointing to private IP)
+  - Apply DMARC and DKIM records
+  - Enable DKIM signing in M365 Defender
+
+---
+
+## Valley Wide Plastering
+
+### Company Information
+- **Type:** Client - Construction
+- **Status:** Active
+- **Domain:** VWP.US
+
+### Infrastructure
+
+#### Network
+- **Subnet:** 172.16.9.0/24
+
+#### Servers
+| Server | IP | Role | Credentials |
+|--------|-----|------|-------------|
+| UDM | 172.16.9.1 | Gateway/firewall | root / Gptf*77ttb123!@#-vwp |
+| VWP-DC1 | 172.16.9.2 | Primary DC, NPS/RADIUS | sysadmin / r3tr0gradE99# |
+
+#### Active Directory
+- **Domain:** VWP.US (NetBIOS: VWP)
+- **Hostname:** VWP-DC1.VWP.US
+- **Users OU:** OU=VWP_Users,DC=VWP,DC=US
+
+#### NPS RADIUS Configuration (VWP-DC1)
+- **Server:** 172.16.9.2
+- **Ports:** 1812 (auth), 1813 (accounting)
+- **Shared Secret:** Gptf*77ttb123!@#-radius
+- **AuthAttributeRequired:** Disabled (required for UniFi OpenVPN)
+- **RADIUS Clients:**
+  - UDM (172.16.9.1)
+  - VWP-Subnet (172.16.9.0/24)
+- **Network Policy:** "VPN-Access" - allows all authenticated users (24/7)
+- **Auth Methods:** All (PAP, CHAP, MS-CHAP, MS-CHAPv2, EAP)
+- **User Dial-in:** All VWP_Users set to msNPAllowDialin=True
+
+#### VPN Users with Access (27 total)
+Darv, marreola, farias, smontigo, truiz, Tcapio, bgraffin, cguerrero, tsmith, tfetters, owner, cougar, Receptionist, Isacc, Traci, Payroll, Estimating, ARBilling, orders2, guru, sdooley, jguerrero, kshoemaker, rose, rguerrero, jrguerrero, Acctpay
+
+### Work History
+
+#### 2025-12-22 (RADIUS/VPN Setup)
+- **Objective:** Configure RADIUS authentication for VPN (similar to Dataforth)
+- **Installation:** Installed NPS role on VWP-DC1
+- **Configuration:** Created RADIUS clients for UDM and VWP subnet
+- **Network Policy:** Created "VPN-Access" policy allowing all authenticated users
+
+#### 2025-12-22 (Troubleshooting & Resolution)
+- **Issue 1:** Message-Authenticator invalid (Event 18)
+  - Fix: Set AuthAttributeRequired=No on RADIUS clients
+- **Issue 2:** Dial-in permission denied (Reason Code 65)
+  - Fix: Set all VWP_Users to msNPAllowDialin=True
+- **Issue 3:** Auth method not enabled (Reason Code 66)
+  - Fix: Added all auth types to policy, removed default deny policies
+- **Issue 4:** Default policy catching requests
+  - Fix: Deleted "Connections to other access servers" policy
+
+#### Testing Results
+- **Success:** VPN authentication working with AD credentials
+- **Test User:** cguerrero (or INTRANET\sysadmin)
+- **NPS Event:** 6272 (Access granted)
+
+### Credentials
+**See:** credentials.md section:
+- Client - Valley Wide Plastering (UDM, VWP-DC1, NPS RADIUS configuration)
+
+### Status
+- **Active:** RADIUS/VPN setup complete
+- **Important Dates:**
+  - 2025-12-22: Complete RADIUS/VPN configuration and testing
+
+---
+
+## Summary Statistics
+
+### Client Counts
+- **Total Clients:** 12 (including internal)
+- **Active Clients:** 12
+- **M365 Tenants:** 6 (BG Builders, CW Concrete, Dataforth, MVAN, RRS, Scileppi)
+- **Active Directory Domains:** 3 (Dataforth, Valley Wide, Glaztech)
+
+### Infrastructure Overview
+- **Domain Controllers:** 3 (Dataforth AD1/AD2, VWP-DC1)
+- **NAS Devices:** 4 (Scileppi RS2212+, DS214se, Unraid, Dataforth D2TESTNAS)
+- **Network Gateways:** 4 (Dataforth UDM, VWP UDM, Khalsa UCG, pfSense)
+- **RADIUS Servers:** 2 (Dataforth AD1, VWP-DC1)
+- **VPN Endpoints:** 3 (Dataforth, VWP, Khalsa)
+
+### Work Categories
+- **Security Incidents:** 3 (BG Builders - resolved, CW Concrete - resolved, Dataforth - mailbox cleanup)
+- **Email DNS Projects:** 2 (BG Builders, RRS)
+- **Network Infrastructure:** 3 (Dataforth DOS, VWP RADIUS, Khalsa VPN)
+- **Data Migrations:** 1 (Scileppi - complete)
+
+---
+
+**Last Updated:** 2026-01-26
+**Source Files:** CATALOG_CLIENTS.md, CATALOG_SESSION_LOGS.md
+**Status:** Complete import from claude-projects catalogs