Ops Deploy Fix

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

Audit 0.4.1 · source sha 90a91797a66f · 27 Oct 2026Report an issue or request a re-scan

• PublisherLifecycle-Innovations-Limited GitHub organizationOwner of the repository this skill is read from
• Source folderLifecycle-Innovations-Limited/claude-ops/claude-ops/skills/ops-deploy-fixThe exact folder we audited
• LicenceMITAs the repository states it
• Commit pinned for this verdict90a91797a66fA new audit runs when the source changes
• Repository statusNot archivedLast push 1 day ago
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: OPS on-demand: This skill should be used when the user asks to "deploy auto-fix", "failed deploy", or...

---
name: ops-deploy-fix
description: "OPS on-demand: This skill should be used when the user asks to \"deploy auto-fix\", \"failed deploy\", or..."
argument-hint: '[status|tail|configure|test]'
allowed-tools:
  - Bash
  - Read
  - AskUserQuestion
  - Skill
---

# /ops:deploy-fix — Auto-fix subsystem control surface

Load `ops-rules` before acting. Public repo (no personal data). Outbound: one draft → one approval → one send. If `AskUserQuestion` / `Workflow` are missing, follow Rule 10 in `ops-rules` (Hermes: numbered options / two-turn Telegram card; `delegate_task`).

This skill is the operator console for the post-merge + build-failure auto-fix loop installed by `/ops:setup` Step 6.5a. The underlying daemons, hooks, and prompts live in `${CLAUDE_PLUGIN_ROOT}/scripts/`, `${CLAUDE_PLUGIN_ROOT}/hooks/`, and `${CLAUDE_PLUGIN_ROOT}/prompts/`. State lives in `~/.claude/state/ops-deploy-fix/`. Logs live in `~/.claude/logs/ops-deploy-fix/`.

**Plugin rules apply (see `claude-ops/CLAUDE.md`).** In particular:

- Rule 0 — never echo personal data (slugs are fine, but redact tokens, webhooks, emails)
- Rule 1 — max 4 options per `AskUserQuestion`
- Rule 4 — background by default during `configure`
- Rule 5 — destructive ops (clearing locks, wiping state) require explicit per-action confirmation
- Rule 6 — this skill never sends outbound comms; if a future flow needs to, use the universal send gate

## Arguments

The first positional argument selects the subcommand. If absent, present:

```
/ops:deploy-fix — what do you want to do?
  [status]
  [tail]
  [configure]
  [test]
```

Subcommands:

| Subcommand  | Purpose                                                              |
| ----------- | -------------------------------------------------------------------- |
| `status`    | Dashboard of recent monitor runs, fixer dispatches, locks, budget    |
| `tail`      | Follow the latest fixer log live                                     |
| `configure` | Re-run the wizard from `/ops:setup` Step 6.5a                        |
| `test`      | Send a synthetic failure through the pipeline (dry-run, no real fix) |

---

## Subcommand: `status`

Print a compact dashboard. Read all data via Bash; favor parallel reads.

```
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 OPS ► DEPLOY-FIX STATUS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 Master switch:    <on|off>          (deploy_fix_enabled)
 Auto-dispatch:    <on|off>          (auto_dispatch_fixer)
 Danger flag:      <on|off>          (allow_dangerous)
 Budget cap:       <N>/hour/repo     (max_fixes_per_hour)
 Notify channel:   <macos|ntfy|discord|none>
 Fix model:        <haiku|sonnet|opus>

 Last 5 monitor runs:
   2026-04-26T08:14Z  owner/repo-a:dev   merge-watch         deploy-success
   2026-04-26T08:11Z  owner/repo-b:main  build-watch         transient → rerun
   ...

 Last 5 fixer dispatches:
   2026-04-26T08:09Z  owner/repo-b:main  build-fix.md   in-flight   pid 41123
   2026-04-26T07:42Z  owner/repo-a:dev   deploy-fix.md  done        log:fix-...log

 Active locks:
   owner/repo-b:main:build  pid=41123 (alive)

 Hourly budget remaining (this hour, <YYYYMMDD-HH>):
   owner/repo-a   2 / 3
   owner/repo-b   1 / 3
──────────────────────────────────────────────────────
```

**Data sources:**

```bash
PREFS=~/.claude/plugins/data/ops-ops-marketplace/preferences.json
STATE=~/.claude/state/ops-deploy-fix
LOGS=~/.claude/logs/ops-deploy-fix

# Config snapshot (all keys read with defaults from plugin.json userConfig)
jq -r '{
  deploy_fix_enabled, auto_dispatch_fixer, allow_dangerous,
  max_fixes_per_hour, notify_channel, fix_model
}' "$PREFS" 2>/dev/null

# Monitor runs — last 5 across all repos
ls -t "$LOGS"/monitor-*.log 2>/dev/null | head -5 | while read f; do
  printf '%s  %s\n' "$(stat -f '%Sm' -t '%FT%RZ' "$f" 2>/dev/null || stat --format='%y' "$f" 2>/dev/null | awk '{print $1"T"$2"Z"}')" "$(basename "$f")"
done

# Fixer dispatches — last 5
ls -t "$LOGS"/fix-*.log 2>/dev/null | head -5 | while read f; do
  pid_file="$STATE/lock-$(basename "$f" | sed 's/^fix-//; s/-[0-9]*\.log$//')"
  status="done"
  [ -f "$pid_file" ] && kill -0 "$(cat "$pid_file")" 2>/dev/null && status="in-flight"
  printf '%s  %s  %s\n' "$(stat -f '%Sm' -t '%FT%RZ' "$f" 2>/dev/null || stat --format='%y' "$f" 2>/dev/null | awk '{print $1"T"$2"Z"}')" "$status" "$(basename "$f")"
done

# Active locks
for f in "$STATE"/lock-*; do
  [ -f "$f" ] || continue
  pid=$(cat "$f")
  if kill -0 "$pid" 2>/dev/null; then
    echo "$(basename "$f" | sed 's/^lock-//')  pid=$pid (alive)"
  fi
done

# Hourly budget — read all budget files for current hour
hour=$(date +%Y%m%d-%H)
cap=$(jq -r '.max_fixes_per_hour // 3' "$PREFS")
for f in "$STATE"/budget-*-"$hour"; do
  [ -f "$f" ] || continue
  slug=$(basename "$f" | sed "s/^budget-//; s/-$hour\$//")
  used=$(cat "$f")
  echo "$slug  $((cap - used)) / $cap"
done
```

After the dashboard, if any lock is older than the configured `watcher_timeout_seconds`, surface a `⚠️ Stale lock:` line and offer:

```
Stale lock detected for <repo>. Action?
  [Inspect log]
  [Clear lock (Rule 5 — destructive)]
  [Leave it]
  [Skip]
```

Only on `Clear lock` should you delete the file (per-action confirmation per Rule 5).

---

## Subcommand: `tail`

Tail the most-recent fixer log. Resolve via `ls -t`:

```bash
LATEST=$(ls -t ~/.claude/logs/ops-deploy-fix/fix-*.log 2>/dev/null | head -1)
if [ -z "$LATEST" ]; then
  echo "No fixer logs yet. Trigger one with /ops:deploy-fix test or wait for a real failure."
  exit 0
fi
echo "▸ Tailing $LATEST (Ctrl-C to stop)"
tail -f "$LATEST"
```

Run via Bash with `run_in_background: true` and a long timeout so the user can read the stream as it grows. Print the resolved log path and the spawned shell PID up-front so the user knows what's running.

If a second positional arg `--lines N` is passed, do `tail -n N -f`. If `--no-follow`, drop `-f`.

---

## Subcommand: `configure`

Re-run the wizard from `/ops:setup` Step

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

git clone https://github.com/Lifecycle-Innovations-Limited/claude-ops
git -C claude-ops checkout 90a91797a66f

Works in

1. 2026-10-27
   ✓SAFE B 89 / 100

   first audit · source 90a91797a66f

Questions about Ops Deploy Fix

• github.com/Lifecycle-Innovations-Limited/claude-ops/tree/main/cl — the audited source at commit 90a91797a66f and every finding aboveObserved · 27 Oct 2026

Spotted something wrong? Report a correction · Methodology