shipyard-ship

---
name: shipyard-ship
description: Use when delivering or releasing a completed Shipyard phase under Codex — final verification, pre-ship security audit, documentation, and release. Trigger when the user says "ship it", "ship this phase", "release this", "we're done — finalize", or "run the shipyard ship workflow". This is the Codex inline-sequential form of the /shipyard:ship orchestration.
---

# Shipping a phase (Codex inline-sequential)

This is Shipyard's `/shipyard:ship` delivery flow, adapted for Codex. The flow is already
sequential (verify → audit → document → deliver), so it maps cleanly to a single context —
you adopt each role in turn rather than dispatching subagents.

**Degradation note:** the audit and documentation steps run as inline personas, not
fresh-context subagents. Be deliberately thorough on the audit step — shipping is the
final gate, so do not let earlier context make you assume the code is fine.

Run `scripts/state-read.sh` first if state isn't loaded.

## Steps (run each in order; stop on a hard failure)

1. **Pre-ship verification.** Use the `shipyard-verification` skill to confirm success
   criteria are met and the phase is actually complete.
2. **Run the test suite.** All tests must pass. A failure here blocks the ship.
3. **Pre-ship security audit.** Adopt the auditor mandate (OWASP Top 10, secrets, dependency
   vulnerabilities). Shipping is the final security gate — this runs even if the build skipped
   auditing. If a passing audit already exists and nothing changed since, verify it has no
   unresolved critical findings instead of re-auditing. **Any unresolved critical finding
   blocks the ship.**
4. **Documentation.** Adopt the documenter mandate — generate/refresh API, architecture, and
   user-facing docs in `docs/`. If up-to-date docs already exist from the build, verify
   completeness instead of regenerating.
5. **Capture lessons.** Use the `lessons-learned` skill to record what was learned this phase.
6. **Deliver.** Finalize per the project's release convention (version bump, CHANGELOG, tag,
   PR/merge). Never auto-merge without the user's go-ahead unless they've authorized it.

## Done means

Verification passed, tests green, no unresolved critical audit findings, docs complete,
lessons captured, and the release artifact prepared. Report the status of each gate
explicitly — do not claim "shipped" if any gate was skipped.