Ship It Or Fix It

Ship It or Fix It

Progressive activation and mutual exclusion

Use the smallest production-completion level that fits the task:

• Level 0, ordinary work: factual answers, analysis, diagnosis, review-only work, formatting, generated refreshes, and non-executable documentation use proportional verification only.
• Level 1, governed completion: material production code or configuration changes use the existing governed-operator Builder and independent final Reviewer path. Do not load or claim ship-it-or-fix-it at this level.
• Level 2, Ship It or Fix It: load this skill ONLY per the Governance Dial in governed-operator: a direct operator instruction setting G2 for the current or named work unit, a direct imperative naming this skill for the work unit, or a resumed work unit whose durable governance_level record is already G2. Task class alone, including security, privacy, authentication, authorization, payments, destructive operations, irreversible migration, cross-system authority, or production publication, NEVER auto-activates this level; those tasks default to Level 1 with its integrity floor. If this level seems warranted and the operator has not set it, ask once (one line: risk at the current level, cost of this level); an unanswered question changes nothing and creates no stop. Discussion, quotation, or questions about this skill activate nothing.

The operator may explicitly stop this skill at any time; lowering is a prospective operator transition that preserves produced evidence. If risk classification is uncertain, perform the smallest read-only check needed to frame the dial question; do not load the full skill merely to classify the task. This skill never grants commit, publication, installation, deployment, account, or product-Done authority.

Exactly one completion workflow may be enabled for a task, and the frozen Outcome Contract names it. If another self-review or repair-loop workflow appears enabled beside this skill, stop before candidate work and return RECONVERGE.

SHIP means the implementation is independently ACCEPTED against the frozen Outcome Contract and acceptance oracle. It is not merely ready for another review. It is also not operator verification, product Done, or authority for a later irreversible action.

Responsibilities

Use existing governed seats. These are work-unit responsibilities, not new authority-bearing seats.

• Contract Owner: normally the Orchestrator. Defines the outcome, authority, public seam, applicable production properties, exclusions, predicates, and proposed acceptance oracle. Never judges the artifact it assembled and never supplies the only scope-completeness or sensitivity challenge.
• Scope Enumerator and Sensitivity Verifier: independent of the Contract Owner, Builder, evaluator author, and Oracle Certifier. It produces the production-surface enumeration from pinned mechanical commands and authoritative repository sources. It also verifies Certifier-authored mutations through the frozen mechanical sensitivity harness; it never authors the predicate or mutation it verifies.
• Oracle Certifier: normally the Pressure-Tester and independent of the Contract Owner, Builder, and Scope Enumerator. Before a candidate exists, it attacks scope and sensitivity, authors at least one adversarial mutation per predicate that the Contract Owner did not supply, verifies identities and dominance, and either rejects the subject or certifies the frozen oracle. It does not certify its own mutations. It also adjudicates route families during repair and may not serve as Cycle Judge or Ship Judge.
• Builder: changes only the authorized implementation subject. It may run tests and return evidence, but never edits the frozen oracle, never contributes a candidate-authored test to acceptance, and never issues SHIP.
• Cycle Judge: a Reviewer independent of the Builder, Contract Owner, Scope Enumerator, and Oracle Certifier. It runs the complete frozen oracle, inspects the candidate and every repair delta, and maintains the cause and progress ledger. It returns FIX, RECONVERGE, BLOCKED, or COLD_CHECK_PENDING.
• Ship Judge: a Reviewer independent of the Builder, Contract Owner, Scope Enumerator, and Oracle Certifier, in a fresh session that did not observe the repair history and is not the Cycle Judge for this candidate. It receives only the frozen contract, certified oracle, final candidate, and identity-bound receipts. It alone may return SHIP.

One person or session may not occupy responsibilities that would certify its own assembled or previously certified artifact. A Pressure-Tester may later judge a revised subject that incorporates its findings because the revised subject is the Contract Owner's new artifact, not the Pressure-Tester return.

The cold Ship Judge remains required until the measurable sunset rule under Qualification is separately satisfied and accepted. If no eligible fresh Ship Judge is available, return BLOCKED with the exact eligibility gap and reopen condition; never substitute a repair-exposed Judge.

Distinct sessions may fill them only when the independence graph above permits; no session may cross a stated exclusion. The Outcome Contract records the minimum sufficient assignment and explains why this Level 2 control is proportionate to the change risk.

At ORACLE_FREEZE, apply the current test-verification guidance to public-seam, failure-path, and durable-evidence design. At CYCLE_JUDGE and SHIP_JUDGE, apply the judging-seat rules in governed-operator. Pin both dependency identities in the Outcome Contract; they grant no additional authority.

Freeze the oracle before the candidate exists

Before Builder execution, seal a digest-pinned Outcome Contract and acceptance oracle. Record:

• baseline and candidate identity rules;
• authorized implementation paths, protected paths, and a complete path classifier, including explicit rules for authorized new implementation paths;
• frozen evaluator and fixture paths, exact test allowlists, commands, tool versions, configuration, environment receipt, and expected outputs;
• the frozen mechanical sensitivity harness, including its exact path, command, tool version, inputs, outputs, and digest;
• every applicable production property, stable predicate ID, exact predicate, decisive evidence, evidence locator, public seam, and Contract-Owner-proposed failure mutation;
• the frozen cause-class and route-family taxonomies used to normalize failures and repair routes;
• every excluded property and the reason it is inapplicable;
• the independent production-surface enumeration and its receipt;
• authority boundaries, recovery, and true stops; and
• any externally imposed attempt, time, usage, or budget ceiling already owned by a higher-authority contract.

The Oracle Certifier verifies the oracle before it judges any candidate:

1. Behavior sensitivity. For every predicate, the Oracle Certifier authors at least one representative adversarial mutation that the Contract Owner did not supply. The independent Scope Enumerator, acting as Sensitivity Verifier, runs a frozen deterministic harness. The receipt passes only when the unmutated baseline passes, the mutation is proven reachable through the declared public seam, the protected behavior changes, and the frozen predicate fails. Exact inputs and outputs are pinned. The mutation author has no discretionary certification step.
2. Scope sensitivity. Scope is generated independently of the predicate and evaluator search lists. The receipt pins command, tool version, inputs, and output. Code subjects use authoritative build and deploy manifests, package entrypoints, public exports, module graphs, and tracked production-source discovery as applicable. Documentation, configuration, and repositories with no usable module graph use tracked-file discovery plus governing registries, indexes, routers, public entrypoints, and reference and consumer searches. If these cannot enumerate the affected surface, the independent Scope Enumerator assembles the set and the limitation remains explicit.
3. Set agreement. The receipt records the independently enumerated set and the evaluated set. Missing governed members fail closed.
4. Public reachability. The real entrypoint or caller reaches the behavior; source presence and isolated fixtures alone are insufficient.
5. Absence discipline. Zero matches prove absence only when coverage and sensitivity are independently established.

Candidate-authored or candidate-modified tests are never part of the acceptance oracle. They may be supplementary Builder evidence only. Frozen test selection uses an exact pre-candidate allowlist. Every allowlisted test's dynamic dependencies, discovered members, registries, globs, directory walks, generated inputs, and predicate denominators are also frozen and compared for exact set equality; both added and missing members fail closed. A command whose acceptance result can change through Builder-controlled discovery is not a valid oracle. A candidate test may enter a later oracle only through a newly sealed subject and independent certification.

Any path, fixture, configuration, or tool that contributes to a frozen predicate is oracle-owned and protected. Any changed or new path that matches no frozen classification is UNCLASSIFIED; judgment stops and returns RECONVERGE before its output can contribute to acceptance.

Production properties

Apply every property whose normal trigger fires. Repository security, data-integrity, migration, registry-critical, privacy, or other hard gates are additional required properties and cannot be weakened here.

1. Behavioral completeness. Required behavior passes at an observable public seam.
2. Regression preservation. Protected behavior remains intact.
3. Failure behavior. Invalid, unsupported, denied, and dependency-failure paths fail safely and observably without false success.
4. Public integration. The real entrypoint reaches the changed behavior.
5. Change containment. Only authorized implementation paths change; no unrelated churn or evaluator mutation is disguised as implementation.
6. Maintainable shape. Repository-owned deterministic checks for complexity, concentration, duplication, growth, and dependency shape pass their baseline-relative bounds. Absolute ceilings require existing repository authority.
7. Evidence integrity. Evidence is current, reproducible, candidate-bound, scope-complete, sensitive to failure, and independently interpretable.

State machine

External verdicts are exactly SHIP, FIX, RECONVERGE, and BLOCKED. COLD_CHECK_PENDING is an internal status, not an external verdict.

OPEN
  -> ORACLE_FREEZE

ORACLE_FREEZE
  -> BUILD              only after certification and digest sealing
  -> RECONVERGE         when the contract, oracle, scope, sensitivity, role
                         independence, or identity cannot be certified
  -> BLOCKED            only when a true authority, safety, privacy, access,
                         essential-evidence, or irreversible-action stop
                         prevents certification

BUILD
  -> CYCLE_JUDGE        when the Builder returns the candidate and evidence
  -> RECONVERGE         when Builder work reveals an invalid contract or oracle
  -> BLOCKED            when a non-candidate environment, authority, safety,
                         privacy, access, essential-evidence, or irreversible
                         stop prevents further work

CYCLE_JUDGE
  -> MODEL_CHECKPOINT   before FIX when the third distinct objective-lineage
                         cause since the previous checkpoint is certified
  -> FIX                when the subject and oracle remain valid and a concrete
                         authorized implementation correction exists
  -> RECONVERGE         when outcome, scope, route, oracle, authority,
                         applicability, identity, or locked constraints are wrong
  -> BLOCKED            only at a true stop; candidate-caused failure is FIX or
                         RECONVERGE, never BLOCKED
  -> COLD_CHECK_PENDING when every frozen predicate passes

MODEL_CHECKPOINT
  -> FIX                on CONTINUE with a concrete next ledger delta
  -> RECONVERGE         when the subject or oracle model is invalid
  -> BLOCKED            only at a true stop or authority boundary

FIX
  -> BUILD
  -> CYCLE_JUDGE        with the same Cycle Judge and complete frozen oracle

COLD_CHECK_PENDING
  -> SHIP               only when an eligible fresh Ship Judge passes the
                         complete oracle
  -> FIX                when the Ship Judge finds an in-scope implementation defect
  -> RECONVERGE         when the Ship Judge finds a contract or oracle defect
  -> BLOCKED            when no eligible cold Judge or another true-stop
                         dependency is available

If the Ship Judge returns FIX, it becomes repair-exposed and may serve as the Cycle Judge for that cause. A later terminal check requires another eligible fresh-context Ship Judge. A candidate-caused environment or dependency failure is FIX; a verified external environment failure that prevents decisive evidence may be BLOCKED with an exact reopen condition.

An oracle defect discovered after BUILD preserves the candidate and receipts as recoverable evidence but returns RECONVERGE, changes every oracle-dependent green to UNKNOWN, and forbids acceptance under that subject. A new Contract Owner may explicitly carry the implementation into a newly sealed subject; no work is silently trusted or discarded.

Repair cycle

For every FIX:

1. The Cycle Judge returns one complete finding set inside its declared search boundary. Each finding names the stable predicate ID, canonical evidence locator, frozen failure class, mechanically derived cause ID, evidence, required correction outcome, and exact recheck. The Judge does not prescribe reversible implementation method.
2. Before another action runs, the Judge records the expected KEEP / DROP / UNKNOWN ledger delta. A step that cannot change the ledger does not run.
3. The Builder proposes a route and family ID. The Oracle Certifier, not the Cycle Judge, checks it against the frozen route-family taxonomy before execution. A renamed command, wrapper, or syntactic variation is the same family. An unclassifiable route returns to the Contract Owner before it runs.
4. The Builder repairs the implementation inside the frozen scope.
5. A mechanical diff classification labels every changed path IMPLEMENTATION, ORACLE, FIXTURE, or UNCLASSIFIED against the frozen map and rules.
6. Any ORACLE, frozen FIXTURE, or UNCLASSIFIED change returns RECONVERGE. Every property previously green under the superseded or untrusted oracle becomes UNKNOWN; no stale green carries forward.
7. Before judgment, the Cycle Judge re-hashes the contract, oracle, fixtures, frozen mechanical sensitivity harness, enumeration, classifier, and tools against their pins. A mismatch returns RECONVERGE before tests run.
8. The same Cycle Judge inspects the repair delta, reruns the complete frozen oracle, rechecks prior failures, and looks for repair-introduced defects.

Derive cause identity mechanically:

CAUSE_ID = SHA256(
  PREDICATE_ID || CANONICAL_EVIDENCE_LOCATOR || FAILURE_CLASS
)

All three inputs are frozen semantic IDs before candidate work and are scoped to the operator-approved objective lineage, not one oracle version. A failure that does not match the taxonomy is UNCLASSIFIED_CAUSE and returns RECONVERGE; changing oracle, subject, prose, session, or Judge cannot mint a new cause ID.

PREDICATE_ID and CANONICAL_EVIDENCE_LOCATOR are objective-lineage-stable semantic IDs. The locator identifies the public seam and observation channel and never uses a transient line number, timestamp, output ordering, temp path, or repair-sensitive formatting. Every reconverged subject carries the complete cause, route-family, checkpoint, and counter history. Its cause-lineage receipt maps updated source clauses and oracle checks to the unchanged semantic IDs. A genuinely changed production property requires an explicit new predicate and new-cause justification independently checked by the Oracle Certifier. The Certifier challenges the taxonomy for both false splits and false merges before sealing it.

There is no numerical repair, artifact-version, token, or time ceiling created by this skill. Externally owned ceilings remain binding and never reset when a route or session changes.

At the third distinct certified objective-lineage cause since the previous checkpoint, CYCLE_JUDGE enters MODEL_CHECKPOINT before another BUILD. The Contract Owner and Oracle Certifier re-check outcome, scope, root-cause model, oracle sensitivity, and authority. They record CONTINUE, RECONVERGE, or BLOCKED with evidence. CONTINUE is not acceptance and requires a concrete next ledger delta. The scheduling count restarts only after the receipt; it does not erase causes, route-family history, reconvergence lineage, external counters, or evidence. This is an automatic model-integrity checkpoint, not a repair cap or an operator approval gate.

Find a Way and cause-based termination

Invoke reasoning-doctrine's references/find-a-way.md by its pinned identity and apply the whole reference: guard, trigger, KEEP/DROP/UNKNOWN salvage, cheapest discriminating experiment, route-family diversity, progress, counter accounting, terminal, and authority limits.

For this workflow, the standing trigger keys on the objective-lineage-stable cause ID: when that same cause survives one meaningful correction, Find a Way fires. The Oracle Certifier adjudicates route-family difference. When two certified families die on the same cause, do not open a third and do not reset through reconvergence. Return the cause exactly as the pinned reference requires: either a true stop or an authority proposal. The workflow mapping is BLOCKED; an authority proposal carries CONTEXT IMPACT: AUTHORITY_STOP and the exact operator decision needed to open a different authorized work unit.

Persistence never expands authority, scope, spend, access, or irreversibility.

Judge returns

Every Judge return begins with candidate, baseline, contract, oracle, enumeration, classifier, tool, environment, role-eligibility, and ledger identities plus the declared search boundary.

For each property:

PROPERTY:
PREDICATE ID:
PREDICATE:
ORACLE IDENTITY:
INDEPENDENT SCOPE ENUMERATION:
OBSERVED EVIDENCE:
CERTIFIER-AUTHORED SENSITIVITY RECEIPT:
VERDICT EFFECT:

For FIX, also return:

CAUSE ID:
CAUSE-ID INPUTS:
EXACT GAP:
WHY IT MATTERS:
REQUIRED CORRECTION OUTCOME:
EXPECTED LEDGER DELTA:
ROUTE FAMILY CLAIM / CERTIFIER DISPOSITION:
EXACT RECHECK:

For RECONVERGE, name the invalid contract or oracle assumption, invalidate dependent greens, preserve recoverable candidate evidence, close the current subject, and state the minimum new subject and its review gate.

For BLOCKED, name the true stop, evidence, preserved assets, lawful alternatives, and exact reopen condition. A candidate-caused failure is not BLOCKED.

For SHIP, record complete final-state evidence and state explicitly:

SHIP = INDEPENDENT IMPLEMENTATION ACCEPTANCE
PRODUCT DONE: NOT CLAIMED
COMMIT / PUBLICATION / INSTALLATION / DEPLOYMENT AUTHORITY: NOT GRANTED
OWNER VERIFICATION: STILL SEPARATE

Qualification design and cold-control sunset

The 32-case, 96-judgment qualification is not complete. Its design is not a per-task gate.

The qualification corpus contains at least 32 interleaved whole cases:

• 8 clean candidates whose expected terminal verdict is SHIP;
• 14 defect candidates, two independently assembled injections for each production property P1-P7; and
• 10 process attacks covering frozen-oracle mutation, candidate-test and dynamic discovery infiltration, incomplete self-declared scope, evidence tampering, unconditional verdict behavior, progressive multi-repair, zero-delta churn, two-family same-cause exhaustion, cause-lineage reset, and role or cold-Judge unavailability.

Run each sealed case in exactly three fresh Judge contexts: 96 primary judgments, with no discretionary reruns. A whole case passes by majority only when both its terminal verdict and required state transitions match the hidden expectation. Qualification requires all 32 whole-case majorities correct and at least 92 of 96 primary judgments individually exact, the smallest whole-judgment count that meets a predeclared 95% individual-accuracy floor.

Any primary judgment that returns SHIP for a known defect, changed oracle, tampered channel, or missing governed member triggers exactly two predeclared fresh-context confirmation judgments on that same sealed case. If either confirmation also false-ships, qualification fails. Both confirmations count in the published measurement; there are no further retries.

Measure Cycle-Judge versus Ship-Judge detection on every terminal pair. The cold Ship Judge cannot be retired during initial qualification. A later sunset subject requires at least 149 independently scored paired terminal judgments: at least 99 defect candidates and 50 clean candidates. Warm judgments must match all sealed expectations. Among the 99 or more defect pairs, zero defects may be detected only by the cold Judge; that criterion is exactly the one-sided 95% Clopper-Pearson upper bound of at most 3% for a zero-event cold-only detection rate with defect candidates as the denominator. Clean-case false-positive rates must not worsen without the cold control. The analysis and retirement amendment require independent acceptance. Any missed threshold keeps the cold control in force.