| name | shipyard-ship |
| description | Use when delivering or releasing a completed Shipyard phase under Codex — final verification, pre-ship security audit, documentation, and release. Trigger when the user says "ship it", "ship this phase", "release this", "we're done — finalize", or "run the shipyard ship workflow". This is the Codex inline-sequential form of the /shipyard:ship orchestration. |
Shipping a phase (Codex inline-sequential)
This is Shipyard's /shipyard:ship delivery flow, adapted for Codex. The flow is already
sequential (verify → audit → document → deliver), so it maps cleanly to a single context —
you adopt each role in turn rather than dispatching subagents.
Degradation note: the audit and documentation steps run as inline personas, not
fresh-context subagents. Be deliberately thorough on the audit step — shipping is the
final gate, so do not let earlier context make you assume the code is fine.
Run scripts/state-read.sh first if state isn't loaded.
Steps (run each in order; stop on a hard failure)
- Pre-ship verification. Use the
shipyard-verification skill to confirm success
criteria are met and the phase is actually complete.
- Run the test suite. All tests must pass. A failure here blocks the ship.
- Pre-ship security audit. Adopt the auditor mandate (OWASP Top 10, secrets, dependency
vulnerabilities). Shipping is the final security gate — this runs even if the build skipped
auditing. If a passing audit already exists and nothing changed since, verify it has no
unresolved critical findings instead of re-auditing. Any unresolved critical finding
blocks the ship.
- Documentation. Adopt the documenter mandate — generate/refresh API, architecture, and
user-facing docs in
docs/. If up-to-date docs already exist from the build, verify
completeness instead of regenerating.
- Capture lessons. Use the
lessons-learned skill to record what was learned this phase.
- Deliver. Finalize per the project's release convention (version bump, CHANGELOG, tag,
PR/merge). Never auto-merge without the user's go-ahead unless they've authorized it.
Done means
Verification passed, tests green, no unresolved critical audit findings, docs complete,
lessons captured, and the release artifact prepared. Report the status of each gate
explicitly — do not claim "shipped" if any gate was skipped.
