Ship It Or Fix It

---
name: ship-it-or-fix-it
description: "Oracle-frozen Builder and independent-Judge convergence cycle. Load ONLY when the operator explicitly sets Governance Dial G2 for the task, or explicitly names this skill or an active work unit already running it. Never auto-activate on task class, such as security, auth, or payments. If a task seems to warrant G2 and the operator has not said so, ask first. Not for ordinary governed implementation, analysis, review-only, or documentation work."
---

# Ship It or Fix It

## Progressive activation and mutual exclusion

Use the smallest production-completion level that fits the task:

- **Level 0, ordinary work:** factual answers, analysis, diagnosis,
  review-only work, formatting, generated refreshes, and non-executable
  documentation use proportional verification only.
- **Level 1, governed completion:** material production code or configuration
  changes use the existing `governed-operator` Builder and independent final
  Reviewer path. Do not load or claim `ship-it-or-fix-it` at this level.
- **Level 2, Ship It or Fix It:** load this skill ONLY per the Governance
  Dial in `governed-operator`: a direct operator
  instruction setting G2 for the current or named work unit, a direct
  imperative naming this skill for the work unit, or a resumed work unit
  whose durable `governance_level` record is already G2. Task class alone,
  including security, privacy, authentication, authorization, payments,
  destructive operations, irreversible migration, cross-system authority, or
  production publication, NEVER auto-activates this level; those tasks
  default to Level 1 with its integrity floor. If this level seems warranted
  and the operator has not set it, ask once (one line: risk at the current
  level, cost of this level); an unanswered question changes nothing and
  creates no stop. Discussion, quotation, or questions about this skill
  activate nothing.

The operator may explicitly stop this skill at any time; lowering is a
prospective operator transition that preserves produced evidence. If risk
classification is uncertain, perform the smallest read-only check needed to
frame the dial question; do not load the full skill merely to classify the
task. This skill never grants commit, publication, installation, deployment,
account, or product-Done authority.

Exactly one completion workflow may be enabled for a task, and the frozen
Outcome Contract names it. If another self-review or repair-loop workflow
appears enabled beside this skill, stop before candidate work and return
`RECONVERGE`.

`SHIP` means the implementation is independently `ACCEPTED` against the frozen
Outcome Contract and acceptance oracle. It is not merely ready for another
review. It is also not operator verification, product Done, or authority for a
later irreversible action.

## Responsibilities

Use existing governed seats. These are work-unit responsibilities, not new
authority-bearing seats.

- **Contract Owner**: normally the Orchestrator. Defines the outcome, authority,
  public seam, applicable production properties, exclusions, predicates, and
  proposed acceptance oracle. Never judges the artifact it assembled and never
  supplies the only scope-completeness or sensitivity challenge.
- **Scope Enumerator and Sensitivity Verifier**: independent of the Contract
  Owner, Builder, evaluator author, and Oracle Certifier. It produces the
  production-surface enumeration from pinned mechanical commands and
  authoritative repository sources. It also verifies Certifier-authored
  mutations through the frozen mechanical sensitivity harness; it never authors
  the predicate or mutation it verifies.
- **Oracle Certifier**: normally the Pressure-Tester and independent of the
  Contract Owner, Builder, and Scope Enumerator. Before a candidate exists, it
  attacks scope and sensitivity, authors at least one adversarial mutation per
  predicate that the Contract Owner did not supply, verifies identities and
  dominance, and either rejects the subject or certifies the frozen oracle. It
  does not certify its own mutations. It also adjudicates route families during
  repair and may not serve as Cycle Judge or Ship Judge.
- **Builder**: changes only the authorized implementation subject. It may run
  tests and return evidence, but never edits the frozen oracle, never contributes
  a candidate-authored test to acceptance, and never issues `SHIP`.
- **Cycle Judge**: a Reviewer independent of the Builder, Contract Owner, Scope
  Enumerator, and Oracle Certifier. It runs the complete frozen oracle, inspects
  the candidate and every repair delta, and maintains the cause and progress
  ledger. It returns `FIX`, `RECONVERGE`, `BLOCKED`, or
  `COLD_CHECK_PENDING`.
- **Ship Judge**: a Reviewer independent of the Builder, Contract Owner, Scope
  Enumerator, and Oracle Certifier, in a fresh session that did not observe the
  repair history and is not the Cycle Judge for this candidate. It receives only
  the frozen contract, certified oracle, final candidate, and identity-bound
  receipts. It alone may return `SHIP`.

One person or session may not occupy responsibilities that would certify its
own assembled or previously certified artifact. A Pressure-Tester may later
judge a revised subject that incorporates its findings because the revised
subject is the Contract Owner's new artifact, not the Pressure-Tester return.

The cold Ship Judge remains required until the measurable sunset rule under
Qualification is separately satisfied and accepted. If no eligible fresh Ship
Judge is available, return `BLOCKED` with the exact eligibility gap and reopen
condition; never substitute a repair-exposed Judge.

Distinct sessions may fill them only when the independence graph above permits;
no session may cross a stated exclusion. The Outcome Contract records the
minimum sufficient assignment and explains why this Level 2 control
is proportionate to the change risk.

At ORACLE_FREEZE, apply the current `test-verification` guidance to public-seam,
failure-path, and durable-evidence design. At CYCLE_JUDGE and SHIP_JUDGE, apply
the judging-seat rules in `governed-operator`. Pin both dependency identities in
the Outcome Contract; they grant no additional authority.

## Freeze the oracle before the candidate exists

Before Builder execution, seal a digest-pinned Outcome Contract and acceptance
oracle. Record:

- baseline and candidate identity rules;
- authorized implementation paths, protected paths, and a complete path
  classifier, including explicit rules for authorized new implementation paths;
- frozen evaluator and fixture paths, exact test allowlists, commands, tool
  versions, configuration, environment receipt, and expected outputs;
- the frozen mechanical sensitivity harness, including its exact path, command,
  tool version, inputs, outputs, and digest;
- every applicable production property, stable predicate ID, exact predicate,
  decisive evidence, evidence locator, public seam, and Contract-Owner-proposed
  failure mutation;
- the frozen cause-class and route-family taxonomies used to normalize failures
  and repair routes;
- every excluded property and the reason it is inapplicable;
- the independent production-surface enumeration and its receipt;
- authority boundaries, recovery, and true stops; and
- any externally imposed attempt, time, usage, or budget ceiling already owned
  by a higher-authority contract.

The Oracle Certifier verifies the oracle before it judges any candidate:

1. **Behavior sensitivity.** For every predicate, the Oracle Certifier authors
   at least one representative adversarial mutation that the Contract Owner did
   not supply. The independent Scope Enumerator, acting as Sensitivity Verifier,
   runs a frozen deterministic harness. The receipt passes only when the
   unmutated baseline passes, the mutation is proven reachable through the
   declared public seam, the protected behavior changes, and the frozen predicate
   fails. Exact inputs and outputs are pinned. The mutation author has no
   discretionary certification step.
2. **Scope sensitivity.** Scope is generated independently of the predicate and
   evaluator search lists. The receipt pins command, tool version, inputs, and
   output. Code subjects use authoritative build and deploy manifests, package
   entrypoints, public exports, module graphs, and tracked production-source
   discovery as applicable. Documentation, configuration, and repositories with
   no usable module graph use tracked-file discovery plus governing registries,
   indexes, routers, public entrypoints, and reference and consumer searches. If
   these cannot enumerate the affected surface, the independent Scope Enumerator
   assembles the set and the limitation remains explicit.
3. **Set agreement.** The receipt records the independently enumerated set and
   the evaluated set. Missing governed members fail closed.
4. **Public reachability.** The real entrypoint or caller reaches the behavior;
   source presence and isolated fixtures alone are insufficient.
5. **Absence discipline.** Zero matches prove absence only when coverage and
   sensitivity are independently established.

Candidate-authored or candidate-modified tests are never part of the acceptance
oracle. They may be supplementary Builder evidence only. Frozen test selection
uses an exact pre-candidate allowlist. Every allowlisted test's dynamic
dependencies, discovered members, registries, globs, directory walks, generated
inputs, and predicate denominators are also frozen and compared for exact set
equality; both added and missing members fail closed. A command whose acceptance
result can change through Builder-controlled discovery is not a valid oracle. A
candidate test may enter a later oracle only through a newly sealed subject and
independent certification.

Any path, fixture, configuration, or tool that contributes to a frozen
predicate is oracle-owned and protected. Any changed or new path that matches
no frozen classification is `UNCLASSIFIED`; judgment stops and returns
`RECONVERGE` before its output can contribute to acceptance.

## Production properties

Apply every property whose normal trigger fires. Repository security,
data-integrity, migration, registry-critical, privacy, or other hard gates are
additional required properties and cannot be weakened here.

1. **Behavioral completeness.** Required behavior passes at an observable
   public seam.
2. **Regression preservation.** Protected behavior remains intact.
3. **Failure behavior.** Invalid, unsupported, denied, and dependency-failure
   paths fail safely and observably without false success.
4. **Public integration.** The real entrypoint reaches the changed behavior.
5. **Change containment.** Only authorized implementation paths change; no
   unrelated churn or evaluator mutation is disguised as implementation.
6. **Maintainable shape.** Repository-owned deterministic checks for
   complexity, concentration, duplication, growth, and dependency shape pass
   their baseline-relative bounds. Absolute ceilings require existing
   repository authority.
7. **Evidence integrity.** Evidence is current, reproducible, candidate-bound,
   scope-complete, sensitive to failure, and independently interpretable.

## State machine

External verdicts are exactly `SHIP`, `FIX`, `RECONVERGE`, and `BLOCKED`.
`COLD_CHECK_PENDING` is an internal status, not an external verdict.

```text
OPEN
  -> ORACLE_FREEZE

ORACLE_FREEZE
  -> BUILD              only after certification and digest sealing
  -> RECONVERGE         when the contract, oracle, scope, sensitivity, role
                         independence, or identity cannot be certified
  -> BLOCKED            only when a true authority, safety, privacy, access,
                         essential-evidence, or irreversible-action stop
                         prevents certification

BUILD
  -> CYCLE_JUDGE        when the Builder returns the candidate and evidence
  -> RECONVERGE         when Builder work reveals an invalid contract or oracle
  -> BLOCKED            when a non-candidate environment, authority, safety,
                         privacy, access, essential-evidence, or irreversible
                         stop prevents further work

CYCLE_JUDGE
  -> MODEL_CHECKPOINT   before FIX when the third distinct objective-lineage
                         cause since the previous checkpoint is certified
  -> FIX                when the subject and oracle remain valid and a concrete
                         authorized implementation correction exists
  -> RECONVERGE         when outcome, scope, route, oracle, authority,
                         applicability, identity, or locked constraints are wrong
  -> BLOCKED            only at a true stop; candidate-caused failure is FIX or
                         RECONVERGE, never BLOCKED
  -> COLD_CHECK_PENDING when every frozen predicate passes

MODEL_CHECKPOINT
  -> FIX                on CONTINUE with a concrete next ledger delta
  -> RECONVERGE         when the subject or oracle model is invalid
  -> BLOCKED            only at a true stop or authority boundary

FIX
  -> BUILD
  -> CYCLE_JUDGE        with the same Cycle Judge and complete frozen oracle

COLD_CHECK_PENDING
  -> SHIP               only when an eligible fresh Ship Judge passes the
                         complete oracle
  -> FIX                when the Ship Judge finds an in-scope implementation defect
  -> RECONVERGE         when the Ship Judge finds a contract or oracle defect
  -> BLOCKED            when no eligible cold Judge or another true-stop
                         dependency is available
```

If the Ship Judge returns `FIX`, it becomes repair-exposed and may serve as the
Cycle Judge for that cause. A later terminal check requires another eligible
fresh-context Ship Judge. A candidate-caused environment or dependency failure
is `FIX`; a verified external environment failure that prevents decisive
evidence may be `BLOCKED` with an exact reopen condition.

An oracle defect discovered after BUILD preserves the candidate and receipts as
recoverable evidence but returns `RECONVERGE`, changes every oracle-dependent
green to `UNKNOWN`, and forbids acceptance under that subject. A new Contract
Owner may explicitly carry the implementation into a newly sealed subject; no
work is silently trusted or discarded.

## Repair cycle

For every `FIX`:

1. The Cycle Judge returns one complete finding set inside its declared search
   boundary. Each finding names the stable predicate ID, canonical evidence
   locator, frozen failure class, mechanically derived cause ID, evidence,
   required correction outcome, and exact recheck. The Judge does not prescribe
   reversible implementation method.
2. Before another action runs, the Judge records the expected
   `KEEP` / `DROP` / `UNKNOWN` ledger delta. A step that cannot change the ledger
   does not run.
3. The Builder proposes a route and family ID. The Oracle Certifier, not the
   Cycle Judge, checks it against the frozen route-family taxonomy before
   execution. A renamed command, wrapper, or syntactic variation is the same
   family. An unclassifiable route returns to the Contract Owner before it runs.
4. The Builder repairs the implementation inside the frozen scope.
5. A mechanical diff classification labels every changed path
   `IMPLEMENTATION`, `ORACLE`, `FIXTURE`, or `UNCLASSIFIED` against the frozen
   map and rules.
6. Any `ORACLE`, frozen `FIXTURE`, or `UNCLASSIFIED` change returns
   `RECONVERGE`. Every property previously green under the superseded or
   untrusted oracle becomes `UNKNOWN`; no stale green carries forward.
7. Before judgment, the Cycle Judge re-hashes the contract, oracle, fixtures,
   frozen mechanical sensitivity harness, enumeration, classifier, and tools
   against their pins. A mismatch returns `RECONVERGE` before tests run.
8. The same Cycle Judge inspects the repair delta, reruns the complete frozen
   oracle, rechecks prior failures, and looks for repair-introduced defects.

Derive cause identity mechanically:

```text
CAUSE_ID = SHA256(
  PREDICATE_ID || CANONICAL_EVIDENCE_LOCATOR || FAILURE_CLASS
)
```

All three inputs are frozen semantic IDs before candidate work and are scoped to
the operator-approved objective lineage, not one oracle version. A failure that
does not match the taxonomy is `UNCLASSIFIED_CAUSE` and returns `RECONVERGE`;
changing oracle, subject, prose, session, or Judge cannot mint a new cause ID.

`PREDICATE_ID` and `CANONICAL_EVIDENCE_LOCATOR` are objective-lineage-stable
semantic IDs. The locator identifies the public seam and observation channel and
never uses a transient line number, timestamp, output ordering, temp path, or
repair-sensitive formatting. Every reconverged subject carries the complete
cause, route-family, checkpoint, and counter history. Its cause-lineage receipt
maps updated source clauses and oracle checks to the unchanged semantic IDs. A
genuinely changed production property requires an explicit new predicate and
new-cause justification independently checked by the Oracle Certifier. The
Certifier challenges the taxonomy for both false splits and false merges before
sealing it.

There is no numerical repair, artifact-version, token, or time ceiling created
by this skill. Externally owned ceilings remain binding and never reset when a
route or session changes.

At the third distinct certified objective-lineage cause since the previous
checkpoint, CYCLE_JUDGE enters `MODEL_CHECKPOINT` before another BUILD. The
Contract Owner and Oracle Certifier re-check outcome, scope, root-cause model,
oracle sensitivity, and authority. They record `CONTINUE`, `RECONVERGE`, or
`BLOCKED` with evidence. `CONTINUE` is not acceptance and requires a concrete
next ledger delta. The scheduling count restarts only after the receipt; it does
not erase causes, route-family history, reconvergence lineage, external counters,
or evidence. This is an automatic model-integrity checkpoint, not a repair cap
or an operator approval gate.

## Find a Way and cause-based termination

Invoke `reasoning-doctrine`'s `references/find-a-way.md` by its pinned
identity and apply the whole reference: guard, trigger, KEEP/DROP/UNKNOWN
salvage, cheapest discriminating experiment, route-family diversity, progress,
counter accounting, terminal, and authority limits.

For this workflow, the standing trigger keys on the objective-lineage-stable
cause ID: when that same cause survives one meaningful correction, Find a Way
fires. The Oracle Certifier adjudicates route-family difference. When two
certified families die on the same cause, do not open a third and do not reset
through reconvergence. Return the cause exactly as the pinned reference requires:
either a true stop or an authority proposal. The workflow mapping is `BLOCKED`;
an authority proposal carries `CONTEXT IMPACT: AUTHORITY_STOP` and the exact
operator decision needed to open a different authorized work unit.

Persistence never expands authority, scope, spend, access, or irreversibility.

## Judge returns

Every Judge return begins with candidate, baseline, contract, oracle,
enumeration, classifier, tool, environment, role-eligibility, and ledger
identities plus the declared search boundary.

For each property:

```text
PROPERTY:
PREDICATE ID:
PREDICATE:
ORACLE IDENTITY:
INDEPENDENT SCOPE ENUMERATION:
OBSERVED EVIDENCE:
CERTIFIER-AUTHORED SENSITIVITY RECEIPT:
VERDICT EFFECT:
```

For `FIX`, also return:

```text
CAUSE ID:
CAUSE-ID INPUTS:
EXACT GAP:
WHY IT MATTERS:
REQUIRED CORRECTION OUTCOME:
EXPECTED LEDGER DELTA:
ROUTE FAMILY CLAIM / CERTIFIER DISPOSITION:
EXACT RECHECK:
```

For `RECONVERGE`, name the invalid contract or oracle assumption, invalidate
dependent greens, preserve recoverable candidate evidence, close the current
subject, and state the minimum new subject and its review gate.

For `BLOCKED`, name the true stop, evidence, preserved assets, lawful
alternatives, and exact reopen condition. A candidate-caused failure is not
`BLOCKED`.

For `SHIP`, record complete final-state evidence and state explicitly:

```text
SHIP = INDEPENDENT IMPLEMENTATION ACCEPTANCE
PRODUCT DONE: NOT CLAIMED
COMMIT / PUBLICATION / INSTALLATION / DEPLOYMENT AUTHORITY: NOT GRANTED
OWNER VERIFICATION: STILL SEPARATE
```

## Qualification design and cold-control sunset

The 32-case, 96-judgment qualification is not complete. Its design is not a
per-task gate.

The qualification corpus contains at least 32 interleaved whole cases:

- 8 clean candidates whose expected terminal verdict is `SHIP`;
- 14 defect candidates, two independently assembled injections for each
  production property P1-P7; and
- 10 process attacks covering frozen-oracle mutation, candidate-test and dynamic
  discovery infiltration, incomplete self-declared scope, evidence tampering,
  unconditional verdict behavior, progressive multi-repair, zero-delta churn,
  two-family same-cause exhaustion, cause-lineage reset, and role or cold-Judge
  unavailability.

Run each sealed case in exactly three fresh Judge contexts: 96 primary judgments,
with no discretionary reruns. A whole case passes by majority only when both its
terminal verdict and required state transitions match the hidden expectation.
Qualification requires all 32 whole-case majorities correct and at least 92 of
96 primary judgments individually exact, the smallest whole-judgment count that
meets a predeclared 95% individual-accuracy floor.

Any primary judgment that returns `SHIP` for a known defect, changed oracle,
tampered channel, or missing governed member triggers exactly two predeclared
fresh-context confirmation judgments on that same sealed case. If either
confirmation also false-ships, qualification fails. Both confirmations count in
the published measurement; there are no further retries.

Measure Cycle-Judge versus Ship-Judge detection on every terminal pair. The cold
Ship Judge cannot be retired during initial qualification. A later sunset
subject requires at least 149 independently scored paired terminal judgments:
at least 99 defect candidates and 50 clean candidates. Warm judgments must match
all sealed expectations. Among the 99 or more defect pairs, zero defects may be
detected only by the cold Judge; that criterion is exactly the one-sided 95%
Clopper-Pearson upper bound of at most 3% for a zero-event cold-only detection
rate with defect candidates as the denominator. Clean-case false-positive rates
must not worsen without the cold control. The analysis and retirement amendment
require independent acceptance. Any missed threshold keeps the cold control in
force.