Ops Deploy

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

doppler secrets get AWS_ACCESS_KEY_ID --plain

Outbound: one draft → one approval → one send.

Audit 0.4.1 · source sha 90a91797a66f · 26 Oct 2026Report an issue or request a re-scan

• PublisherLifecycle-Innovations-Limited GitHub organizationOwner of the repository this skill is read from
• Source folderLifecycle-Innovations-Limited/claude-ops/claude-ops/skills/ops-deployThe exact folder we audited
• LicenceMITAs the repository states it
• Commit pinned for this verdict90a91797a66fA new audit runs when the source changes
• Repository statusNot archivedPushed today
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: OPS on-demand: This skill should be used when the user asks to "deploy status", "what is in...

---
name: ops-deploy
description: "OPS on-demand: This skill should be used when the user asks to \"deploy status\", \"what is in..."
argument-hint: '[project-alias|ecs|vercel|all]'
allowed-tools:
  - Bash
  - Read
  - Grep
  - Glob
  - Skill
  - Agent
  - TeamCreate
  - SendMessage
  - AskUserQuestion
  - TaskCreate
  - TaskUpdate
  - Monitor
  - WebFetch
  - mcp__claude_ai_Vercel__list_deployments
  - mcp__claude_ai_Vercel__list_projects
  - mcp__claude_ai_Vercel__get_deployment
  - mcp__claude_ai_Vercel__get_runtime_logs
  - mcp__claude_ai_Vercel__get_deployment_build_logs
effort: low
maxTurns: 20
disallowedTools:
  - Edit
  - Write
  - NotebookEdit
---

# OPS ► DEPLOY STATUS

Load `ops-rules` before acting. Public repo (no personal data). Outbound: one draft → one approval → one send. If `AskUserQuestion` / `Workflow` are missing, follow Rule 10 in `ops-rules` (Hermes: numbered options / two-turn Telegram card; `delegate_task`).

## Runtime Context

Before executing, load available context:

1. **Preferences**: Read `${CLAUDE_PLUGIN_DATA_DIR:-$HOME/.claude/plugins/data/ops-ops-marketplace}/preferences.json`
   - `timezone` — display all deploy timestamps in the correct timezone

2. **Daemon health**: Read `${CLAUDE_PLUGIN_DATA_DIR}/daemon-health.json`
   - Check `infra-monitor` status — if not running, note that ECS data may be stale

3. **Secrets**: AWS and Vercel credentials required.
   ### Secret Resolution
   - AWS: check `$AWS_PROFILE` / `$AWS_ACCESS_KEY_ID` → `doppler secrets get AWS_ACCESS_KEY_ID --plain` → vault query cmd from prefs
   - Vercel token: check `$VERCEL_TOKEN` → `doppler secrets get VERCEL_TOKEN --plain` → vault

## CLI/API Reference

### aws CLI

| Command                                                                     | Usage               | Output                                                                          |
| --------------------------------------------------------------------------- | ------------------- | ------------------------------------------------------------------------------- |
| `aws ecs list-clusters --output json`                                       | All ECS clusters    | `{clusterArns: [...]}`                                                          |
| `aws ecs list-services --cluster <name> --output json`                      | Services in cluster | `{serviceArns: [...]}`                                                          |
| `aws ecs describe-services --cluster <name> --services <arn> --output json` | Service health      | `{services: [{serviceName, status, runningCount, desiredCount, pendingCount}]}` |
| `aws logs tail /ecs/<service> --since 1h --format short`                    | ECS logs            | Log lines                                                                       |

### gh CLI (GitHub)

| Command                                                                                                   | Usage          | Output                         |
| --------------------------------------------------------------------------------------------------------- | -------------- | ------------------------------ |
| `gh run list --repo <owner/repo> --limit 5 --json status,conclusion,name,headBranch,createdAt,databaseId` | CI runs        | JSON array                     |
| `gh run view <id> --repo <repo> --log-failed`                                                             | Failed CI logs | Log output                     |
| `gh api repos/<repo>/actions/runs/<run-id> --jq .status,.conclusion`                                      | Poll one CI run | JSON fields (REST bucket)     |

`gh run watch` and `gh pr checks --watch` are banned — they poll every 2-5s with no
cap. `hooks/gh-watch-guard.sh` denies them. Poll the REST endpoint above on a `sleep
30` floor with a finite tick count instead.

---

## Agent Teams support

If `CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1` is set, use **Agent Teams** when checking deploy platforms in parallel. This enables:

- Agents share context and can coordinate mid-flight
- You can steer priorities in real-time
- Agents report progress as they complete

**Team setup** (only when flag is enabled):

```
TeamCreate("deploy-team")
Agent(team_name="deploy-team", name="ecs-checker", prompt="List all ECS clusters and describe service health, running/desired counts")
Agent(team_name="deploy-team", name="vercel-checker", prompt="List Vercel projects and recent deployments with status")
Agent(team_name="deploy-team", name="ci-checker", prompt="Check GitHub Actions runs across all registered repos for failures")
```

If the flag is NOT set, use standard fire-and-forget subagents.

## Phase 1 — Gather deploy data in parallel

### ECS services (all clusters)

```bash
${CLAUDE_PLUGIN_ROOT}/bin/ops-infra 2>/dev/null || \
aws ecs list-clusters --output json 2>/dev/null
```

### ECS service details

```bash
for cluster in $(aws ecs list-clusters --output json 2>/dev/null | jq -r '.clusterArns[]'); do
  cluster_name=$(basename "$cluster")
  aws ecs list-services --cluster "$cluster_name" --output json 2>/dev/null | \
    jq -r '.serviceArns[]' | while read svc; do
    aws ecs describe-services --cluster "$cluster_name" --services "$svc" \
      --output json 2>/dev/null | jq '.services[] | {name: .serviceName, desired: .desiredCount, running: .runningCount, pending: .pendingCount, image: (.taskDefinition // "unknown"), status: .status}'
  done
done
```

### Recent GitHub Actions runs (registry-driven)

```bash
REGISTRY="${CLAUDE_PLUGIN_ROOT}/scripts/registry.json"
[ -f "$REGISTRY" ] || REGISTRY="${CLAUDE_PLUGIN_ROOT}/scripts/registry.example.json"
for repo in $(jq -r '.projects[] | select(.gsd == true) | .repos[]' "$REGISTRY" 2>/dev/null); do
  echo "=== $repo ==="
  gh run list --repo "$repo" --limit 5 --json status,conclusion,name,headBranch,createdAt,databaseId 2>/dev/null
done
```

### Vercel deployments

Use `mcp__claude_ai_Vercel__list_projects` then `mcp__claude_ai_Vercel__list_deployments

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

git clone https://github.com/Lifecycle-Innovations-Limited/claude-ops
git -C claude-ops checkout 90a91797a66f

Works in

1. 2026-10-26
   !CAUTION B 89 / 100

   first audit · source 90a91797a66f

Questions about Ops Deploy

• github.com/Lifecycle-Innovations-Limited/claude-ops/tree/main/cl — the audited source at commit 90a91797a66f and every finding aboveObserved · 26 Oct 2026

Spotted something wrong? Report a correction · Methodology