diff --git a/home_root/.claude/settings.json b/home_root/.claude/settings.json
index 4b8dbac..beed89c 100644
--- a/home_root/.claude/settings.json
+++ b/home_root/.claude/settings.json
@@ -75,35 +75,34 @@
   "autoMode": {
     "allow": [
       "$defaults",
-      "Bash(uv:*) — declared/standard toolchain command, 219 occurrences in this project, already dependency-adjacent",
-      "Bash(postbox:*) in this project — althing messaging client, 28 occurrences, routine multi-agent coordination"
+      "Bash(uv:*) — the standard Python toolchain; policy is uv-only across every repo",
+      "Bash(postbox:*) — althing messaging client, routine multi-agent coordination"
     ],
     "environment": [
       "### Org-wide",
-      "**Organization**: Corviduo AI / PhaseFinal, Inc / VastBlue AI — three organizations under operator Vuong Hoang (lkraven); this repo (hamr) is a PhaseFinal-hosted gitea project",
+      "**Organization**: Corviduo AI / PhaseFinal, Inc / VastBlue AI — three organizations under operator Vuong Hoang (aka Prime; lkraven). Projects are self-hosted on PhaseFinal's gitea",
       "**Cloud provider(s)**: None configured",
-      "**Repository visibility**: assume private unless the remote host and repo name indicate otherwise, or a visibility check in the transcript shows public — gh visibility check not queryable (org/repo not derivable from origin remote); gitea.phasefinal.com is a private self-hosted org host, no public-visibility evidence found",
+      "**Repository visibility**: assume private — gitea.phasefinal.com is a private self-hosted host; treat a repo as public only if a visibility check in the transcript shows it",
       "**Internal sharing / snippet hosting**: The Booth (http://10.100.10.50:8090/) for ephemeral media/results; no auth, LAN/WG-internal only — do not drop secrets there",
-      "**Secrets management**: Vaultwarden-backed `secret` CLI on nh3-dev (vaultwarden.phasefinal.com) — vault is credential source of truth",
-      "**Default / protected branches**: not queryable via gh (org/repo not derivable from origin remote) — origin/HEAD unset locally too; treat default branch as unknown, do not assume unprotected",
+      "**Secrets management**: Vaultwarden-backed `secret` CLI (vaultwarden.phasefinal.com) — the vault is the credential source of truth; never commit a credential",
+      "**Default / protected branches**: per repo; when unknown, treat the default branch as protected, not unprotected",
       "**CI/CD deploy targets**: None configured",
       "**Network posture**: None configured",
-      "**Host containment**: None configured — assume ordinary developer machine (nh3-dev) with open internet per CLAUDE.md tooling notes",
-      "**Source control**: gitea.phasefinal.com:vh/hamr.git (this repo's origin) — no additional orgs configured",
-      "**Trusted internal domains**: gitea.phasefinal.com (org git host, seen in remotes and contacted hosts)",
+      "**Host containment**: None configured — assume ordinary developer machines (e.g. nh3-dev, the operator's Macs) with open internet",
+      "**Source control**: gitea.phasefinal.com (also reached by internal route 10.250.50.70, ports 222/3000) — orgs `vh`, `pfi`, `corviduo`, `vastblue`; github.com/vh-pfi",
+      "**Trusted internal domains**: gitea.phasefinal.com, vaultwarden.phasefinal.com",
       "**Trusted cloud buckets**: None configured",
-      "**Key internal services**: 10.100.50.40 (althing post office, 90x contacted), 10.100.10.50 (nh3-dev / Booth / Playwright host, 19x contacted), 10.100.79.3 (7x contacted, unlabeled)",
+      "**Key internal services**: 10.100.50.40:8390 (althing post office), 10.100.10.50 (nh3-dev / Booth / Playwright host), 10.250.50.70 (LiteLLM gateway :4000, asset-engine :8200), 10.0.50.45:5100 (Homepage service inventory)",
       "**Internal package registry**: None configured",
-      "**Sensitive data locations & audiences**: any file or store holding personal data, confidential business data, credentials, regulated data, or similarly sensitive material; preserve exact handles when known and share only with audiences cleared at the [named+specifics] bar; note a redacted unusual .gitignore pattern plus `.env` suggest local secrets/config in this repo not meant for commit",
+      "**Sensitive data locations & audiences**: any file or store holding personal data, confidential business data, credentials, regulated data, or similarly sensitive material; preserve exact handles when known and share only with audiences cleared at the [named+specifics] bar",
       "**Data retention / declassification**: None configured",
       "**Sensitive remote targets**: any namespace, host, or container whose name carries `prod` or `production` as a whole word or name segment",
-      "**Protected deployment namespaces / environments**: None configured — fall back to the Sensitive remote targets heuristic; k8s namespaces seen in this project's transcripts (`hamr`, `docs`) show no prod marker",
+      "**Protected deployment namespaces / environments**: None configured — fall back to the Sensitive remote targets heuristic",
       "**Protected IaC scopes**: IAM, RBAC, networking, quota, and node-pool resources; anything whose name or tag carries `prod` or `production` as a whole word or name segment",
       "### User-specific",
-      "**Primary use of Claude Code**: software development — geometric-truth vectorization library (hamr), contract-first TDD workflow",
-      "**Trusted repo**: /home/lkraven/development/hamr (gitea.phasefinal.com:vh/hamr.git) — this repo and its origin remote only",
-      "**Org-specific CLIs**: uv (Python, primary), postbox / althing-listen (althing messaging bus), booth (media board helper), park, graphify, secret (Vaultwarden CLI, referenced in global CLAUDE.md but not observed in this project's transcripts)",
-      "**Routine under vh/ prefix**: gitea.phasefinal.com:vh/* repos (own org namespace) are the operator's own checkouts per global CLAUDE.md, but only this project's repo (hamr) is in scope per the just-this-project setting"
+      "**Primary use of Claude Code**: software development and research across the operator's Corviduo / PhaseFinal / VastBlue projects — contract-first TDD, multi-agent coordination over althing",
+      "**Trusted repos**: the operator's own checkouts — repos under ~/development/ and ~/dotfiles whose origin is on gitea.phasefinal.com in the `vh`, `pfi`, `corviduo` or `vastblue` orgs (or github.com/vh-pfi). ~/development/externs/ holds third-party clones and is NOT trusted",
+      "**Org-specific CLIs**: uv (Python, primary), postbox (althing messaging bus), booth (link/media board), park (idea parking), graphify, secret (Vaultwarden CLI), ratecheck (usage-limit gate)"
     ]
   }
 }