OPS ► FIRES

Load ops-rules before acting. Public repo (no personal data). Outbound: one draft → one approval → one send. If AskUserQuestion / Workflow are missing, follow Rule 10 in ops-rules (Hermes: numbered options / two-turn Telegram card; delegate_task).

Runtime Context

Before executing, load available context:

1. Daemon health: Read ${CLAUDE_PLUGIN_DATA_DIR:-$HOME/.claude/plugins/data/ops-ops-marketplace}/daemon-health.json

   • Check infra-monitor service status, if not running, pre-gathered infra data may be stale
   • If action_needed is not null → surface it immediately as a potential fire

2. Secrets: AWS credentials are required for ECS/CloudWatch queries.

   Secret Resolution

   • First: check $AWS_ACCESS_KEY_ID / $AWS_PROFILE env vars
   • Then: doppler secrets get AWS_ACCESS_KEY_ID --plain (if doppler configured in prefs)
   • Then: use password_manager_config.query_cmd from preferences
   • Sentry token: $SENTRY_AUTH_TOKEN → $SENTRY_TOKEN → Doppler claude-ops/prd/SENTRY_AUTH_TOKEN. Resolved by bin/ops-sentry; no action needed here.
   • Sentry org and region: preferences.json .partner_registry.sentry.{org,region_url}. Sentry is region-sharded, issues are served by the org's own region host (e.g. https://us.sentry.io), not sentry.io, and querying the wrong region returns an empty list rather than an error. Omit org and the script discovers the first org the token can see.

3. Preferences: Read ${CLAUDE_PLUGIN_DATA_DIR}/preferences.json for secrets_manager config to know which vault to query.

CLI/API Reference

aws CLI