Every feature, configuration surface, command, skill, tool and integration a v200b session carries — enumerated from the live estate, with each claim marked by how it was established.
v200b is a session realm, not a product. The CLI it runs is stock Claude Code, shipped as a compiled binary whose source cannot be read. Everything below is therefore established by behaviour, configuration and observed use — never by reading source. The evidence tag on each claim is the most important column in this document.
Six defects surfaced during enumeration. They are filed in the bug registry; none was repaired, because this was an inventory, not a repair.
permissions.requirePermission is not a Claude Code settings key. It returns 0 hits in the 2.1.229 binary, while defaultMode (46), bypassPermissions (166), additionalDirectories (20) and autoMemoryEnabled (5) all appear, and invented control keys return 0. It behaves exactly like a key that does not exist.
The 11 rules beneath it cover *credential*, *secret*, *token*, *password* and *.env* for Bash, Edit and Write. With deny empty, ask absent and defaultMode: bypassPermissions, no settings-tier gate covers credential-bearing paths. The Change Gate is a separate mechanism and is unaffected. The fix is one line — rename the key to ask — and it is a gated mutation.
The Snowflake copy's newest row is 2026-07-16. The local database is current to the minute (379.6 MB, newest row 22:37 today) and the N1 mirror synced at 18:30. Two of three layers are live; the only one that is not in the same building silently stopped. Its scheduled job is loaded, so a process-level check reports green.
main is 59 commits ahead of origin/main and growing. Nine of those commits carry no Gate-Token and every one was authored by the autocommit watcher, which commits without passing through the hook that attaches the token. The remote pre-receive gate refuses them, so nothing reaches cloud Gitea.
V200-CAPABILITY-REFERENCE.md states sm_* tools race direct to Snowflake containers. The deployed relay has SF_CONTAINER_BACKENDS = [] — that fleet was deleted on 2026-07-21 and every tool now proxies to the Cloudflare worker. It also records the wrong response envelope and a tool count of 237 against a live 266. Its regeneration job is loaded but the file has not changed since 2026-07-31.
The launcher omits --strict-mcp-config, so v200b-mcp.json's deliberate two-server scope is merged with rather than substituted for the six servers in settings. A session silently receives all six, including 45 Framer tools scoped to an Apeirin project and 6 tools with write access to Node 1.
REGISTRY.md claims 141; the filesystem holds 146. The five missing are asom, model-consensus, deep-research, save-continue and mgc-html-report — four of them core governance. A session consulting the registry would conclude the seven-model panel does not exist. Separately, eight skills sit on disk and never load.
Measured The gateway count came from a direct tools/list POST with nextCursor absent — a single complete page, not a truncated one. Built-ins were established from 746 transcript files and 707,879 lines of observed use, plus permission rules and live schemas. A built-in never called and not in context cannot be proven present, so 32 is a floor, not a ceiling.
| Server | Tools | Transport | Purpose |
|---|---|---|---|
v200alb | 266 | http, Tailscale-direct | The gateway. Every external service. |
framer-design | 45 | stdio | Framer canvas, CMS, assets — Apeirin project |
n1-fs | 6 | stdio | Node 1 filesystem, read and write |
open-websearch | 6 | stdio | Keyless multi-engine search |
local-hive | 4 | stdio | Local Hive Mind, sub-millisecond |
context7 | 2 | stdio | Version-accurate library docs |
| Family | n | What it reaches |
|---|---|---|
| m365 | 32 | Mail, calendar, rules, attachments, directory — service account, never the Architect's |
| asana | 22 | Full task/project/section/comment CRUD |
| cf · vercel | 15+15 | DNS, zones, Pages, SSL; projects, deployments, domains, env |
| dropbox | 14 | Service account only — the sole working write path |
| drive · tailscale | 12+12 | Google Drive read/write; tailnet devices, keys, ACL, routes |
| dc (DealCloud) | 9 | 102 entry types; create/update/delete are gated writes |
| azure · bambu · make · runpod | 8 each | ACA and CLI; 3D printer; scenarios; GPU pods |
| Snowflake | 7 | Five accounts — see below |
| elevenlabs · mac | 7 each | Voice; Mac Studio shell and files |
| Model endpoints | ~20 | gemini, openai, deepseek, grok, bedrock, azure_openai, copilot, nano_banana |
| Remaining 30 families | ~60 | vision, simli, recall, notebooklm, graphify, slide, gamma, apollo, deepgram, julius, document, markitdown, drawio, makerworld, zerobounce, percy, gfdata, godaddy, github, list_models |
Measured Three gateway tools are exposed but absent from a session's advertised set — azure_run_command, mac_run_command, mac_write_file. All three are arbitrary-execution or remote-write. The names are scattered through the listing rather than clipped from its end, so this is a filter, not truncation. The mechanism is inside the closed binary and was not determined.
Measured 147 directories, of which one (_archive) has no SKILL.md. Counts were taken with find | wc -l independently of the listings, then the listings diffed against them — no listing here is a truncated page. Group totals sum to 146 exactly.
| Group | n | Representative |
|---|---|---|
| Core, governance, operating model | 25 | devpolicy model-consensus fix-repair completion-gate asom |
| Infrastructure and cloud | 26 | tailscale azure-container-apps cloudflare-workers docker |
| Data, research, analysis | 23 | snowflake edgartools docling ediscovery mdna |
| Build, test, release | 17 | test-panel change-baseline rollback-runner realm-pipeline |
| Delivery and documents | 17 | mgcppt mgc-whitepaper persuasion pacereport |
| Integrations and external tools | 12 | dropbox m365-integration bambu telegram |
| Session management | 11 | objective deliverables end save-continue |
| Agent frameworks and evaluation | 8 | crewai langgraph ragas mem0 |
| Language and shell | 7 | node typescript python-patterns zsh |
The eight file-backed commands are /PPT, /asom, /bug, /que, /quekill, /quesend, /questat, /queview. Everything else typed with a slash — /objective, /end, /devpolicy, /autobuild — is a skill, not a command file. Three exist in both trees.
Documented The ~123 native commands were extracted from the binary's own command-to-category registry and corroborated by a second independent extraction returning a 99-name subset. Many carry feature-flag or hidden guards, so this is the set the binary defines, not the set a session can type.
Measured Precedence runs managed → CLI flags → local → project → user. All of v200b's configuration sits at the lowest tier (~/.claude/settings.json), so any project-level settings file in a working directory would silently outrank it. None exists today; nothing prevents one.
| Surface | State | Note |
|---|---|---|
settings.json keys | 11 of ~80 | env, permissions, model, hooks, statusLine, effortLevel, tui, theme, mcpServers, and two more |
| permissions | 17 allow, 0 deny, no ask | defaultMode: bypassPermissions; the 11 requirePermission rules are inert |
| Hook events used | 11 of 31 | 20 unused, including four that can block |
| Autocompact | 97% | Overridden from the ~75–80% default |
| Statusline fields consumed | 5 of ~40 | cost.* and rate_limits.* arrive every tick and are discarded |
| CLAUDE.md hierarchy | Empty at all 8 tiers | ~/CLAUDE.md is a dangling symlink into the dead Dropbox mount |
| Keybindings file | Absent | All bindings at default |
Measured Because the CLAUDE.md hierarchy is empty, the entire persistent instruction layer is the --append-system-prompt boot prompt plus auto-memory and the compass-inject hooks. There is no CLAUDE.md safety net beneath them. MEMORY.md is 20,219 bytes against a ~25 KB auto-memory ceiling — near the truncation boundary.
stty -ixon in zshrc. tmux intercepts it first, so prompt-stashing and Ctrl+R scope-cycling are unavailable inside any tmux-wrapped session.Ctrl+X Ctrl+B.| Tool | Account | Database | Role |
|---|---|---|---|
sm_sm_query_snowflake | IRA11585 | SOVEREIGN_MIND | ACCOUNTADMIN |
hurricane_* | JGA82554 | HURRICANE | ACCOUNTADMIN |
banner_* | KGB57253 | BANNER (D365 FSC) | BANNER_APP_ROLE |
resolute_* | MLA96789 | RESOLUTE_MIND | RESOLUTE_APP_ROLE |
v2abbi_* | SXA84406 | V2_ABBI_AI_WH | V2ABBI_APP_ROLE |
Measured All five probed live with CURRENT_ACCOUNT(). The same login, V200_ABBI_ADMIN, reaches all five including V2 production and Resolute — separation here is by account and role, not by identity. Two accounts still run ACCOUNTADMIN.
| Node | Tailscale | Runs | Models |
|---|---|---|---|
| N1 | 100.87.243.54 | LiteLLM Conductor :4000, Gitea mirror, model-router, Gatus | 7 |
| N2 | 100.83.16.54 | Ollama, Kimi via llama-server :8080 | 3 |
| N3 | 100.84.18.5 | Ollama | 2 |
| N4 | 100.106.20.5 | Ollama, hosts abbi-embed | 3 |
Measured The Conductor load-balances local aliases across all four nodes. It has no redundancy: all four were probed on :4000 and :4001 and only N1:4000 answers. It serves both OpenAI and Anthropic wire formats natively.
The constraint holds at the account, resource-group and tag level — never at the tenant level. Realms share one tailnet, Azure subscription, Cloudflare account, Vercel account, Gitea repo, Mac, and Snowflake login. No realm shares another's credential store or data plane. Two resource groups mix v2 and v200 apps.
This section exists because a reference document that hides its own gaps is worse than one that admits them.
tools/list proves registration, not reachability or credential validity.MP.000 AI Projects are ungated while deletes are gated is policy. A read-only session cannot falsify it without attempting a gated mutation.abbis-mac-studio-4; Tailscale reports abbi-m1-bigscreen at the same address. Which is canonical is unresolved./help in-session is authoritative; the extracted list is a floor.