Skip to content
Back to skills

Ship

ASecurity

Use after audit returns Verdict PASS. Atomic git commit + tag + ledger update. Single-writer; cannot fan-out.

  • 5 stars
  • 0 votes
  • 0 copies
  • 2 views
  • Added September 3, 2026
ai-agentsgogit

Works with

  • cli

Security analysis

A100/100

Scanned September 3, 2026

npx -y skills add mickeyyaya/evolve-loop --skill ship --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Ship?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Ship
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/mickeyyaya-ship/badge)](https://www.skillsdirectory.com/skills/mickeyyaya-ship)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: ship
description: Use after audit returns Verdict PASS. Atomic git commit + tag + ledger update. Single-writer; cannot fan-out.
---

# ship

> Sprint 3 composable skill. Wraps the Ship phase. The atomic commit at the end of every successful cycle.

## When to invoke

- After `audit` returns Verdict PASS (or WARN with explicit override)
- Cycle is in `audit` phase, transitioning to `ship`

## When NOT to invoke

- Audit verdict is FAIL or ABORT
- The current tree-state SHA differs from what the auditor saw (cycle-binding violation)
- Ship class is unclear (use `--class cycle`, `--class manual`, or `--class release` explicitly)

## Workflow

| Step | Action | Exit criteria |
|---|---|---|
| 1 | Verify audit verdict = PASS via `gate_audit_to_ship` | Gate passes |
| 2 | Run `legacy/scripts/utility/release.sh <version>` for consistency check | Markers consistent |
| 3 | Run `legacy/scripts/lifecycle/ship.sh "<commit message>"` | Atomic commit + tag created |
| 4 | Verify ledger entry added | `kind: "ship"` with cycle binding |

## Single-writer invariant

Ship is ATOMIC by design — even if other phases fan out, Ship cannot. There is one git commit per cycle. Concurrent ship attempts on the same cycle are blocked by `phase-gate-precondition.sh` (only one `active_agent: orchestrator` at ship phase).

## Cycle-binding (v8.13.0+)

`legacy/scripts/lifecycle/ship.sh` refuses to ship if the current tree-state SHA differs from the SHA captured at audit time (in the auditor's ledger entry). Prevents "audit cycle 50, ship cycle 51" exploits. This guarantee is preserved through Sprint 3's tri-layer refactor.

<!-- GENERATED:phase-facts BEGIN — do not edit; run `evolve skills generate`. Sources: docs/architecture/phase-registry.json · go/internal/phasecontract · .evolve/profiles/orchestrator.json -->
## Phase facts

| Fact | Value |
|---|---|
| Phase | `ship` (control archetype, mandatory) |
| Persona | `agents/evolve-orchestrator.md` |
| Profile | `.evolve/profiles/orchestrator.json` — CLI `codex-tmux`, tier `balanced`, single-writer |
| Inputs | `audit-report.md` |
<!-- GENERATED:phase-facts END -->

## Composition

Invoked by:
- `/evo:ship` (user-driven)
- `loop` macro after `/evo:audit`

## Reference

- `legacy/scripts/lifecycle/ship.sh` (atomic commit + tag)
- `legacy/scripts/release-pipeline.sh` (full release lifecycle for `publish` operations)
- `docs/release-protocol.md` (vocabulary: push / tag / release / propagate / publish / ship)
- CLAUDE.md "Release & Publish Workflow"

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.