Delegate

Delegate Skill

Orchestrate token-efficient workflows by delegating heavy tasks to Codex CLI (codex) and Antigravity CLI (agy), which run on separate subscription quotas at ~$0 marginal cost. An independent Claude Code delegate (via ask_claude.sh) runs under an isolated config dir (~/.claude-delegate) on OAuth subscription auth, providing a 3rd voter for majority-of-3 vote flows and an agentic worker mode symmetric with the Codex leg.

The core discipline: dispatch a self-contained prompt to an external CLI, write its output to a file, then read only the first few lines (a STATUS:/VERDICT: header) instead of pasting the whole result into context. On success this costs ~15–50 tokens instead of thousands.

Prerequisites

• Antigravity CLI installed and authenticated (agy on PATH; install: curl -fsSL https://antigravity.google/cli/install.sh | bash)
• Codex CLI installed and authenticated (codex on PATH; install: npm install -g @openai/codex)
• Claude Code CLI installed. Only needed for ask_claude.sh (3rd voter / agentic worker). The delegate runs under an ISOLATED config dir (~/.claude-delegate by default, override: CLAUDE_DELEGATE_CONFIG_DIR), independent of your main session's config (default ~/.claude). One-time setup — run in a regular terminal, NOT via ! inside a Claude Code session (the long-lived token must never enter argv, shell history, or a session transcript, which memory plugins may index):

``bash CLAUDE_CONFIG_DIR=~/.claude-delegate claude setup-token # browser flow, prints an sk-ant-oat… token umask 077 cat > ~/.claude-delegate/oauth_token # paste token, Enter, Ctrl-D ``

Rationale (verified 2026-07-07 on Claude Code 2.1.198): --bare cannot be used for OAuth delegation — bare-mode auth is strictly ANTHROPIC_API_KEY/apiKeyHelper ("OAuth and keychain are never read") — so the wrapper passes an explicit CLAUDE_CODE_OAUTH_TOKEN env token (honored without --bare; takes precedence over keychain credentials) and replicates --bare's hygiene mechanically: fresh config dir (no hooks/plugins/memory/user CLAUDE.md), throwaway mktemp cwd in voter mode, --tools "", --no-session-persistence. Authenticating ~/.claude-delegate against a second subscription (optional) isolates quota from your main session; with the same account, config/process/cwd isolation still holds but quota is shared. (Env-token auth also sidesteps a macOS caveat: CLAUDE_CONFIG_DIR does not namespace the macOS Keychain, so keychain-based logins may be shared across profiles.)

• All CLIs must support non-interactive/headless mode.

New here? See [docs/SETUP.md](../../docs/SETUP.md) for step-by-step install and authentication, and [docs/WORKFLOW.md](../../docs/WORKFLOW.md) for how this skill fits the orchestrate-and-verify workflow.

Locating the scripts

Every example below calls scripts through $DELEGATE. Set it once per shell so the examples work whether the skill was installed as a plugin or copied manually:

if [ -n "$CLAUDE_PLUGIN_ROOT" ]; then
  DELEGATE="$CLAUDE_PLUGIN_ROOT/skills/delegate"   # installed as a Claude Code plugin
else
  DELEGATE="$HOME/.claude/skills/delegate"          # installed by manual copy
fi

Verify before first use:

bash "$DELEGATE/scripts/preflight.sh"   # checks agy + codex (required) + claude (optional)
ls "$DELEGATE/prompts/"                 # compact_code.txt, compact_verify.txt, result_only.txt, ...

Antigravity sandbox note

agy binds a localhost TCP port for its in-process language server. Under Claude Code's default sandbox this is blocked with bind: operation not permitted. The ask_antigravity.sh wrapper detects this and synthesizes a clear STATUS: FAILED — Sandbox blocked agy TCP bind line. To actually run agy, callers must either:

1. Pass dangerouslyDisableSandbox: true on the Bash tool call, or
2. Run from a shell outside the Claude Code sandbox.

claude -p (via ask_claude.sh) does not need the sandbox disabled: auth is an explicit env token (no keychain), and full voter + agentic dispatches (including ~/.claude-delegate session writes and --resume) were verified working under the default sandbox on 2026-07-07.

> ⚠️ Security — read before disabling the sandbox. dangerouslyDisableSandbox: true lets the delegation CLI reach the network and your credential store (it needs both to authenticate and call the model API). Only disable the sandbox for these specific delegation calls — never as a blanket setting — and never delegate a prompt built from untrusted input. Also note that delegating sends your prompt, and any file content you paste into it, to the external provider (OpenAI for Codex, Google for Antigravity). Do not delegate confidential, embargoed, or privacy-sensitive material. See docs/SETUP.md for the full security checklist.

---

Models & Reasoning Effort

CLI interfaces change quickly. Re-verify quarterly via codex --version / codex debug models, agy --version, and claude --version; update the defaults below if the resolved model identifier in recent session logs has moved.

| CLI | Default model (verified 2026-05-28) | Effort tiers | Effort knob | Override env var(s) | |---|---|---|---|---| | Codex | gpt-5.5 | low \| medium \| high \| xhigh (per codex debug models; minimal is not in the gpt-5.5 catalog) | -c model_reasoning_effort=xhigh (passed via -c config override on codex exec) | CODEX_MODEL, CODEX_EFFORT | | Antigravity | gemini-3.1-pro (logically — see note) | n/a | none exposed at CLI level (agy v1.0.0 has NO --model flag); model is configured via ~/.gemini/antigravity-cli/settings.json or the agy /model interactive command | ANTIGRAVITY_MODEL (informational only — recorded in metadata header; not passed to the binary) | | Claude Code (delegate: 3rd voter + agentic worker; verified 2026-07-07) | opus alias → latest Claude Opus (4.8 as of 2026-07) | low \| medium \| high \| xhigh \| max | --effort max if the installed CLI advertises the flag; otherwise omitted (feature-detected via claude --help) | CLAUDE_DELEGATE_MODEL, CLAUDE_DELEGATE_EFFORT, CLAUDE_DELEGATE_CONFIG_DIR |

Default invocation = best model, max effort

ask_codex.sh always pins effort to xhigh and uses gpt-5.5 as the model. No flag is needed to "go strongest" — that is the default. The pinning is intentional: the script unconditionally passes -c model_reasoning_effort="$EFFORT" (with EFFORT=${CODEX_EFFORT:-xhigh}), which overrides whatever ~/.codex/config.toml says. Per-call overrides via CODEX_EFFORT=… and CODEX_MODEL=… are still respected.

ask_antigravity.sh does not pass a --model flag (agy v1.0.0 doesn't have one). The model is whatever the user has set in ~/.gemini/antigravity-cli/settings.json. For math-heavy / proof-verification workloads, set the model to Gemini 3.1 Pro (High) via the interactive agy /model command. ANTIGRAVITY_MODEL is recorded in the wrapper's metadata header for provenance but is not passed to the binary.

ask_claude.sh defaults to model opus (resolves to the latest Claude Opus) with --effort max (feature-detected). Voter mode disables all tool use with --tools "" — verified present on 2.1.198 and fail-closed: the wrapper hard-errors rather than dispatch a vote if a future CLI drops the flag — plus --permission-mode dontAsk as a backstop (dontAsk alone would still allow read-only tools), --strict-mcp-config (MCP tools are NOT governed by --tools ""), --no-session-persistence, and --max-turns 1. It does not pass --bare (which would break OAuth auth — see Prerequisites); context-freedom comes from the fresh delegate config dir and a throwaway mktemp cwd. Wrapper knobs use the CLAUDE_DELEGATE_* namespace because an orchestrating Claude Code session ambiently exports CLAUDE_EFFORT (and other CLAUDE_CODE_* vars) into every Bash child — un-namespaced knobs would silently inherit the orchestrator's values. Because the voter has zero file access, it will confabulate plausible-looking content (even fake tool transcripts) if asked about local files — always paste the material to be judged directly into the prompt; never ask the voter to "read" anything.

Independence caveat (3rd voter)

The Claude 3rd voter shares the model family with the orchestrating Claude Code session. Vote independence is mechanically preserved (3 distinct dispatches), but statistically reduced vs. using a third model from a different provider. Use this for mechanical disagreement detection, not as a true triangulation against the orchestrator's biases.

Independence guarantees (Claude-from-Claude)

ask_claude.sh enforces independence on four axes:

1. Config: CLAUDE_CONFIG_DIR=~/.claude-delegate — own auth, settings, session store. No contention with the orchestrating session; optionally a separate subscription. Keep this dir free of CLAUDE.md/memory (the wrapper WARNs if one appears).
2. Process: ALL CLAUDECODE*/CLAUDE_CODE_* harness vars are unset in the child — an orchestrating session ambiently exports CLAUDE_CODE_SESSION_ID, CLAUDE_CODE_EFFORT_LEVEL, and more (measured 2026-07-07), which would otherwise alter the delegate's behavior. CLAUDE_DELEGATE_DEPTH blocks delegate-of-delegate recursion (depth ≥ 1 fails fast).
3. Auth: explicit env token, priority token file > inherited CLAUDE_CODE_OAUTH_TOKEN (stderr WARN — orchestrator's token, independence degraded) > ANTHROPIC_API_KEY opt-in only (CLAUDE_DELEGATE_ALLOW_API_KEY=1; an orchestrating session exports a metered API key ambiently, so an unguarded fallback would silently bill the API). Per the documented CLI auth precedence, ANTHROPIC_API_KEY outranks CLAUDE_CODE_OAUTH_TOKEN (and ANTHROPIC_AUTH_TOKEN outranks both), so the wrapper unsets ANTHROPIC_API_KEY whenever an OAuth token is selected and drops ANTHROPIC_AUTH_TOKEN unconditionally — subscription billing, never metered. An empty token file is a hard error, not a fallback.
4. Cwd: voter mode runs in a throwaway mktemp -d (no project CLAUDE.md pickup, no session-store collisions). Agentic mode requires an explicit CLAUDE_DELEGATE_WORKDIR (no $PWD fallback). Honest scope note: the workdir bounds file tools only — an allowed Bash tool is NOT jailed to it, and --add-dir widens Edit/Write scope; dangerouslyDisableSandbox: true on the dispatch removes the last containment layer. Treat agentic prompts as trusted code. The delegate token is readable by the delegatee by design (same user/host).

The statistical caveat above stands: config/process/auth/cwd independence is mechanical, not statistical.

Claude delegate environment variables

All knobs live in the CLAUDE_DELEGATE_* namespace (legacy CLAUDE_MODEL/CLAUDE_EFFORT/CLAUDE_TIMEOUT/CLAUDE_AGENTIC/… are ignored — an orchestrating session ambiently exports CLAUDE_EFFORT etc. into Bash children, which would silently hijack un-namespaced knobs):

| Var | Default | Meaning | |---|---|---| | CLAUDE_DELEGATE_CONFIG_DIR | ~/.claude-delegate | Child's CLAUDE_CONFIG_DIR | | CLAUDE_DELEGATE_MODEL | opus | Model alias/name | | CLAUDE_DELEGATE_EFFORT | max | Effort tier (feature-detected --effort) | | CLAUDE_DELEGATE_TIMEOUT | 570 | Internal timeout, seconds — deliberately under the Bash tool's 600s default cap so the wrapper's timeout classification fires before a harness kill (see Timeout Configuration) | | CLAUDE_DELEGATE_AGENTIC | 0 | 1 = agentic worker; else voter | | CLAUDE_DELEGATE_WORKDIR | — | Required in agentic mode (hard error if unset) | | CLAUDE_DELEGATE_ALLOWED_TOOLS | Read,Grep,Glob,Edit,Write,Bash | Agentic --allowedTools | | CLAUDE_DELEGATE_MAX_TURNS | 1 voter / 40 agentic | Turn cap; quota guardrail. Applied via a runtime parser probe — --max-turns exists on 2.1.198 but is hidden from --help. Wrapper WARNs if a future CLI drops the flag | | CLAUDE_DELEGATE_RESUME | unset | Session ID for --resume; agentic-only (hard error in voter mode) | | CLAUDE_DELEGATE_ADD_DIRS | unset | Colon-separated extra --add-dir paths (agentic) | | CLAUDE_DELEGATE_ALLOW_API_KEY | 0 | 1 permits metered ANTHROPIC_API_KEY fallback |

When to override the defaults

• Cheaper / faster verifications: CODEX_EFFORT=high bash ask_codex.sh ... (drops one tier).
• Probing alternative models: CODEX_MODEL=gpt-5.4 bash ask_codex.sh ....
• Switch Antigravity model: edit ~/.gemini/antigravity-cli/settings.json (model field is a display string like "Gemini 3.1 Pro (High)"); the wrapper does not change this.
• Switch Claude model: CLAUDE_DELEGATE_MODEL=sonnet bash ask_claude.sh ... (faster/cheaper alternative for the 3rd voter; not recommended for high-stakes votes).

How to refresh this section

codex --version
codex debug models | jq '.[] | {id: .id, reasoning_efforts: .reasoning_efforts}'
agy --version
cat ~/.gemini/antigravity-cli/settings.json | jq '.model'   # current Antigravity model
claude --version
ls -t ~/.codex/sessions/$(date +%Y)/$(date +%m)/ | head -1   # latest Codex session — open and check resolved model

Note: codex exec --help does not list model_reasoning_effort — the value is consumed via -c config overrides and config.toml, not as a dedicated flag. On codex exec, the approval policy flag -a/--ask-for-approval is not accepted (it lives on root codex). Approval behaviour on exec comes from ~/.codex/config.toml (approval_policy="never" is the operational default) or via -c approval_policy=never override.

---

Delegation Rules

Delegate to Antigravity (scripts/ask_antigravity.sh) when:

• Literature review, scooping check, citation verification
• Proof or derivation verification (second opinion)
• Summarizing or critiquing long documents or papers
• Any task that is mostly reading + reasoning, not code execution
• Tasks benefiting from large context window (1M+ tokens)
• Deep research queries (use daemon for multi-step; CLI for single-pass)

Delegate to Codex (scripts/ask_codex.sh) when:

• Code implementation — writing new functions/scripts from spec (compact_implement.txt)
• Debugging or refactoring R/Python/Julia code (compact_code.txt)
• Running and iterating on Monte Carlo simulations (compact_code.txt)
• Building or fixing estimation routines (compact_code.txt)
• Data wrangling — CSV/JSON/Parquet manipulation (result_only.txt)
• Shell scripts and automation (result_only.txt)
• Code review (assist — Claude Code owns final verdict) (compact_review.txt)
• Test generation (compact_code.txt)
• Mechanical LaTeX — booktabs tables, pgfplots, TikZ (result_only.txt)
• Regex, SQL, awk construction (result_only.txt)

Delegate to Claude agentic worker (CLAUDE_DELEGATE_AGENTIC=1 ask_claude.sh) when:

• The task needs Claude-quality reasoning AND file access, but not the orchestrator's context (e.g., self-contained LaTeX refactors, test suites, formalization in a scratch repo)
• Parallel Claude workers are wanted on a second subscription's quota
• Codex is quota-exhausted and the task is code-heavy

# Isolated workdir is REQUIRED (use a git worktree for parallel dispatches)
git -C ~/proj worktree add /tmp/wt-fix HEAD
CLAUDE_DELEGATE_AGENTIC=1 CLAUDE_DELEGATE_WORKDIR=/tmp/wt-fix \
  bash "$DELEGATE/scripts/ask_claude.sh" @task.md result.md
head -3 result.md    # metadata + STATUS; session= in the header enables follow-ups

Multi-turn follow-up (must use the same workdir; session lookup is cwd-scoped):

SID=$(sed -n 's/.*session=\([^ ]*\).*/\1/p; 1q' result.md)
CLAUDE_DELEGATE_AGENTIC=1 CLAUDE_DELEGATE_WORKDIR=/tmp/wt-fix CLAUDE_DELEGATE_RESUME=$SID \
  bash "$DELEGATE/scripts/ask_claude.sh" "Now add unit tests" re

…

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [hkasahar](https://github.com/hkasahar)
- **Source:** [hkasahar/claude-code-skills](https://github.com/hkasahar/claude-code-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.