Read-only inventory of the Claude Code operator kit — what exists, how it fits together, and what it would take to fire it from here.
| Layer | Count | Source of truth | Freshness |
|---|---|---|---|
| Slash commands 10 trees | 88 | DEVOPS/.claude/commands/ | static · git |
| Skills 272 SKILL.md on disk | 44 | account + repo | live · flaps |
| MCP tools 14 servers | ~290 | running processes | live · flaps |
| Agent packs | 16 | apps/agents/packs/ | static · git |
| Subagent types | 6 | harness | static |
| Plugins 2 unique | 4 | .claude-plugin/ | static · git |
| A2A agents | 3 | a2a_agent_registry | live · DB |
| Tree | Leaves | Covers |
|---|---|---|
| /plan | 16 | ULTRAPLAN pipeline, red-team, decision records |
| /legal | 14 | Intake, motions, litigation QC, court research, SIBYL prediction |
| /mode | 9 | Execution posture — careful, autopilot, speedrun, explore, swarm |
| /research | 9 | Deep research, docs, papers, video, consumer testing |
| /ship | 9 | Commit, review, security, TDD, root-cause, build, release |
| /ops | 8 | Azure blob, Supabase, Cloudflare, Vercel, storage, zip |
| /doc | 5 | Word, PowerPoint, Excel, PDF, co-authored specs |
| /comms | 4 | Email extraction, drafting, e-signature, voice |
| /money | 4 | Spending, cash flow, forecast, tax |
| /find | — | Master index across every tree |
Type /legal to browse a tree's menu, or /legal:motion to jump straight to a leaf. Both work.
| Agent | Port | Backend | Status |
|---|---|---|---|
| Claude Code | 9103 | claude -p "<prompt>" | working |
| Codex | 9101 | codex exec -s read-only | no credits |
| Hermes | 9102 | hermes -z "<prompt>" | no credits |
Spec-compliant A2A (Agent2Agent) servers — JSON-RPC 2.0 over HTTP with a /.well-known/agent-card.json discovery endpoint each. Bearer auth via A2A_BRIDGE_TOKEN; all three bind to 127.0.0.1.
Codex and Hermes are fully wired and round-trip tested — they return billing errors from OpenAI/xAI, not code errors. They answer the moment credits land, no restart.
In one working session, all ~290 MCP tools disconnected and reconnected four times, and the server names changed shape. A hardcoded list goes stale within a day — and stale in the way hardest to catch, because it still looks authoritative. Same failure shape PR #22 found in /corpus.
Available fix, not yet wired: public.a2a_agent_registry already holds live agent cards and status in Supabase. Reading that table beats hardcoding for the A2A row.
It is a markdown file containing a prompt. No parameters, no return value, no code. Typing /legal:motion pastes text into the conversation — that is the command running. Everything after is the model reading that text and deciding what to do.
/legal:motion actually does.claude/commands/legal/motion.md off disk.$ARGUMENTS with whatever you typed after the command.Which is why a command is best understood as a macro for typing. Its whole power is that it expands to well-chosen words at the moment you need them.
An agent can ship in a plugin — but that is one delivery route of three. Same file format in every column; only the scope differs.
| plugin | project | user | |
|---|---|---|---|
| commands | <plugin>/commands/ | .claude/commands/ | ~/.claude/commands/ |
| skills | <plugin>/skills/ | .claude/skills/ | ~/.claude/skills/ |
| agents | <plugin>/agents/ | .claude/agents/ | ~/.claude/agents/ |
The 88 commands are project-level — no plugin involved. ULTRAPLAN's 12 are plugin-level. Identical format, different suitcase.
/ parser, no command loader. The only edge that can cross today is reading the repository as data.Five rungs. Each is independently shippable, and each is a real increase in capability — not a rewrite of the one below.
Static inventory. Zero infrastructure, zero credentials, zero attack surface. Tells you what exists and how it fits.
Ceiling: you still switch to a terminal to do anything.
Each command gets a copy button that puts /legal:motion <args> — or the full expanded prompt body — on the clipboard. Paste into any Claude Code session.
No API, no keys, no network. It is the honest 80% of dispatch value for none of the risk, and it works from a phone.
The bridge already wraps claude -p "<prompt>" as a spec-compliant A2A server on 127.0.0.1:9103. A slash command is a prompt. So dispatch is a JSON-RPC POST:
POST http://127.0.0.1:9103/
Authorization: Bearer $A2A_BRIDGE_TOKEN
Content-Type: application/json
{ "jsonrpc":"2.0", "id":"1", "method":"message/send",
"params": { "message": {
"role":"user",
"parts":[{ "kind":"text", "text":"<body of legal/motion.md>" }]
}}}The constraint: 127.0.0.1 means the browser and the bridge must be on the same machine. Works when the board runs locally (npm run dev). A deployed Vercel function cannot reach your laptop's loopback — that is not a config problem, it is what loopback means.
Full Claude Code power: real filesystem, real MCP servers, real tools.
A Next.js route posts the command body straight to the Anthropic API. The key and an /api route already exist in this repo. Works from anywhere, including a phone on cellular.
The trade: you get the model, not the harness. No filesystem, no MCP servers, no Bash. A command like /ship:commit is meaningless here; /plan:decide works fine. Roughly half the catalog is API-portable and half is not — worth labelling per command before building this.
Tunnel the bridge so the deployed board reaches it, and route per command — Claude for drafting, Codex for code, Hermes for a second opinion. Agent cards make the fleet self-describing, so new agents appear without a board deploy.
Prerequisite: Codex and Hermes need account credits. Both are wired and round-trip tested; they return billing errors, not code errors.
Armory stops hardcoding and reads public.a2a_agent_registry for live agent status — which fixes the staleness problem in the Catalog tab rather than papering over it. public.a2a_call_log gets written from cli_executor.py, so every dispatch is auditable. Multi-step runs become ULTRAPLAN DAGs with gates, not single shots.
Both tables already exist. The registry is populated; the call log is empty.
Unauthenticated A2A endpoints are a documented attack surface — agent-card spoofing, task hijacking, replay. Bearer-token auth over an unencrypted tunnel is not sufficient. Before exposing any of ports 9101–9103 beyond loopback via ngrok, cloudflared, or a Supabase Edge relay, you want TLS termination and probably signed agent cards (A2A v1.0's native mechanism) at minimum.
Worth stating plainly: an exposed dispatch endpoint runs claude -p on your machine with your filesystem and your credentials. That is a remote code execution primitive with your name on it. L2 and L3 avoid this entirely — L2 never leaves the host, L3 never touches the host.
Recommended order: L1 → L3 → L2 → L5, with L4 gated on both the credits and the TLS work. L1 is an afternoon and removes most of the daily friction. L3 unlocks phone use. L2 is the powerful one but only helps at the desk — which is exactly where a terminal already is.