ShipCAUTION

A framework for building agentic apps

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: ship
description: >-
  Commit and push the current snapshot, creating a branch in a detached,
  task-owned worktree when needed; open a ready PR and merge when clean. Use
  when the user asks to ship, publish, or hand off local changes.
  Matching beta and docs paths publish automatically after merge; other
  production promotion is manual.
user-invocable: true
scope: dev
metadata:
  internal: true
---

# Ship

Use /ship only when the user asks to ship, publish, or hand off the current
work. It means: publish the requested current-branch snapshot, open a ready
PR, and monitor it through merge unless the user explicitly asks to leave the
PR open. A merged shipment also leaves the worktree ready for the next task.

## Contract

- Ship all nonignored changes belonging to the requested work on the current
  branch. The checkpoint helper excludes learnings.md, bridge/**, and data/**.
- A ship request authorizes publishing a new PR. Pushing to someone else's PR
  needs explicit current authorization for that exact PR; links and inherited
  ship authority don't count. It permits a normal fast-forward push, not a
  merge. Merge with separate current authorization; otherwise use
  `ship_mode=ready-only` and leave the PR open. Before every push, resolve the
  active GitHub login with `gh api user --jq .login`, include `author` in the
  live PR query, and compare `author.login` with that login. Verify the head
  repository, branch, head OID, and base; recheck the head.
- PR feedback comments follow live PR ownership. Compare `author.login` with
  `gh api user --jq .login`. On a PR authored by the active user, concise
  replies in existing review threads and a concise top-level recap when feedback
  appears only in a review body are routine dispositions and need no extra
  authorization. This covers only comments needed to fix, decline, or otherwise
  disposition review feedback; do not add proactive or unrelated comments,
  tags, assignments, or mentions without an explicit request. On another
  person's PR, do not post any comment, including an inline reply or review-body
  recap, unless the current request explicitly authorizes commenting on that
  exact PR. Review, monitor, fix, push, or merge authorization alone does not
  authorize comments.
- Preserve unrelated or incomplete concurrent work. Never reset, clean, stash,
  overwrite, rebase, or force-push it.
- `/ship` starts in `ship_mode=merge-authorized` for a new PR or a PR authored
  by the current user. For an existing PR authored by someone else, an exact
  current-request authorization to push is push-only: use
  `ship_mode=ready-only` and leave the PR open. Use `merge-authorized` for
  that PR only when the same request separately authorizes merging that exact
  PR. A general ship request or earlier merge authorization does not change
  this. Otherwise, merge once the gates below pass unless the user explicitly
  says to leave the PR open. If they opt out, switch to `ship_mode=ready-only`;
  keep fixing CI and review feedback until the PR is ready, then leave it open
  and do not rotate the branch.
- Before the guarded merge, persist its exact verified PR head OID as
  `ship_merge_head_oid` in the active goal or task transcript. Continue in the
  foreground through post-merge disposition. Carry the immutable value through
  verification; never replace it with a live PR head read after merge, because
  the source branch may advance or be deleted.
- `/ship` uses the current suitable branch when attached. In a dedicated
  task-owned worktree, creating or switching to a needed task branch is already
  authorized; Steve's explicit request to ship or open a PR from a detached
  worktree is standing authorization, so do not ask again. Before branch
  movement, classify all staged, unstaged, and untracked paths; a switch carries
  the whole index and worktree, so proceed only when every dirty path belongs to
  this task. Otherwise preserve the checkout and report exact paths without
  asking again. Base new shipments on fresh `origin/main`; existing PR updates
  use the fetched live PR head as `new-branch` describes. Never move or rewrite
  a branch used by another worktree or a platform-assigned branch. After
  `origin/main` ancestry is verified, rotate to a fresh task branch in the
  task-owned worktree without asking when `/ship` safety checks pass. If
  unpublished commits or dirty publishable paths remain, retain the source
  branch and report them. In a shared checkout, keep its branch unchanged. If
  it cannot safely serve as the PR source, `/ship` authorizes a managed
  task-owned worktree and branch without asking. Follow `new-branch` for the
  base: fresh `origin/main` for a new PR, the fetched live PR head for an
  existing PR update. Carry only this task's changes. If they cannot be
  isolated safely, preserve all state and report exact paths or commits without
  asking for branch or worktree permission.
- In Codex, inspect the task goal with `get_goal` at the start. If none exists,
  create one with `create_goal` whose objective, under normal `/ship`
  authorization, says to continue until every explicitly scoped PR reaches its
  authorized endpoint, each merge is verified in `origin/main`, and the
  task-owned worktree is rotated to a fresh branch when the safety checks
  pass. Retain the source branch and report any unpushed commits or dirty
  publishable paths. In a shared checkout, keep the source
  branch; if it cannot safely source the PR, follow `new-branch` to isolate
  this shipment with the correct base without asking. Preserve
  platform-assigned branches while checking and fixing CI/review feedback and
  using the guarded squash-admin merge. If the user explicitly opts out of
  merging, make the goal match that endpoint. Reuse an existing goal only when
  it covers this shipment; never replace an unrelated goal. For
  `ship_mode=ready-only`, set the endpoint to an open PR with green required
  checks, addresse

CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.

What the source does

Filesystem

none-observed

Network

none-observed

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (5)

.agents/skills/an

.agents/skills/content-product-development

.agents/skills/design-exploration

.agents/skills/turn-into-app

.agents/skills/visual-edit

Gates applied: no_behavioural_pass.

[![ModelsAtlas audit: Ship](https://modelsatlas.com/skills/builderio/ship/badge.svg)](https://modelsatlas.com/skills/builderio/ship/)

Not your listing, or something out of date? Claim or update your listing.