Use when delivering or releasing a completed Shipyard phase under Codex — final verification, pre-ship security audit, documentation, and release. Trigger when the user says "ship it", "ship this phase", "release this", "we're done — finalize", or "run the shipyard ship workflow". This is the Codex inline-sequential form of the /shipyard:ship orchestration.
Installs into .claude/skills of the current project.
Are you the author of Shipyard Ship?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/lgbarn-shipyard-ship)
---
name: shipyard-ship
description: Use when delivering or releasing a completed Shipyard phase under Codex — final verification, pre-ship security audit, documentation, and release. Trigger when the user says "ship it", "ship this phase", "release this", "we're done — finalize", or "run the shipyard ship workflow". This is the Codex inline-sequential form of the /shipyard:ship orchestration.
---
# Shipping a phase (Codex inline-sequential)
This is Shipyard's `/shipyard:ship` delivery flow, adapted for Codex. The flow is already
sequential (verify → audit → document → deliver), so it maps cleanly to a single context —
you adopt each role in turn rather than dispatching subagents.
**Degradation note:** the audit and documentation steps run as inline personas, not
fresh-context subagents. Be deliberately thorough on the audit step — shipping is the
final gate, so do not let earlier context make you assume the code is fine.
Run `scripts/state-read.sh` first if state isn't loaded.
## Steps (run each in order; stop on a hard failure)
1. **Pre-ship verification.** Use the `shipyard-verification` skill to confirm success
criteria are met and the phase is actually complete.
2. **Run the test suite.** All tests must pass. A failure here blocks the ship.
3. **Pre-ship security audit.** Adopt the auditor mandate (OWASP Top 10, secrets, dependency
vulnerabilities). Shipping is the final security gate — this runs even if the build skipped
auditing. If a passing audit already exists and nothing changed since, verify it has no
unresolved critical findings instead of re-auditing. **Any unresolved critical finding
blocks the ship.**
4. **Documentation.** Adopt the documenter mandate — generate/refresh API, architecture, and
user-facing docs in `docs/`. If up-to-date docs already exist from the build, verify
completeness instead of regenerating.
5. **Capture lessons.** Use the `lessons-learned` skill to record what was learned this phase.
6. **Deliver.** Finalize per the project's release convention (version bump, CHANGELOG, tag,
PR/merge). Never auto-merge without the user's go-ahead unless they've authorized it.
## Done means
Verification passed, tests green, no unresolved critical audit findings, docs complete,
lessons captured, and the release artifact prepared. Report the status of each gate
explicitly — do not claim "shipped" if any gate was skipped.
