---
name: multi-workstation-remote-control
description: Operator hops workstations; drives ONE live jumphost session via Remote Control (claude.ai/code or mobile); batch tasks OK but cloud mutations stay gated
metadata: 
  node_type: memory
  type: user
  originSessionId: e5fa05aa-1418-4d5c-80ab-b4d6c72e8fe9
  modified: 2026-07-19T07:50:20.711Z
---

The operator works across multiple workstations and likes to keep a session productive
during the time between desks by having batch tasks run. The durable setup for this:

- Claude Code runs on the **jumphost** (vopenstack-jesse); workstations are just the
  control surface. `remoteControlAtStartup: true` is set in the jumphost's
  `~/.claude/settings.json`, so every session auto-registers with **Remote Control** --
  drive the SAME live session from claude.ai/code (web) or the mobile app, no re-attach.
- To pick up a **still-running** session from a new workstation: ATTACH (Remote Control,
  or SSH + `claude agents`), never `claude --resume` (that forks a SECOND session -- the
  fragmentation that spawned the runaway agent at the start of the 2026-07-15 session).
- **ONE session** against the live clone at a time. Between workstations: push before
  switching; never leave an auto-permission background agent running.
- Batch/unattended work is fine for read-only/safe tasks, but **live-cloud mutations must
  stay GATED** -- they queue for approval, which the operator grants from Remote Control on
  check-in. This is the line between "productive batch" and "runaway agent". See also the
  session-open hygiene (process/daemon scan before `claude`; `claude daemon stop --any`).
- **Walls vs gates (ruled 2026-07-19):** the operator cannot always run commands in a
  second terminal, so a classifier HARD-DENY is a wall that stalls work. When a tool call
  gets classifier-denied, do NOT work around it -- add a TARGETED `ask` rule for that
  surface to `.claude/settings.json` (the Edit itself prompts; self-service is by design)
  so it arrives as an approve prompt in Remote Control. Never a catch-all `Bash(*)` ask
  (kills frictionless reads; ask appears to preempt allow), never additions to `allow`
  for mutations. Posture history: repo changelogs 2026-07-18 (ask-preempts-classifier)
  and 2026-07-19 (session changelog, out-of-batch item).