# Forge Ship

> Enforce a fail-closed release gate across project checks, findings, generated assets, packages, licenses, and installation.

- Skill: `is-bo/forge-ship-3` (Agent Skill)
- Install (CLI): `npx skillmds@latest add is-bo/forge-ship-3`
- Raw SKILL.md: https://api.skillmd.com/api/skills/is-bo/forge-ship-3/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: is-bo (https://skillmd.com/u/is-bo)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/is-bo/forge-ship-3

---


# forge-ship: Release readiness

Engine: Forge native

## Purpose

Enforce a fail-closed release gate across project checks, findings, generated assets, packages, licenses, and installation.



Resolve and read `../fullstack-forge/references/shared/module-contract.md` (applicability,
execution, mutation, verification, completion) and
`../fullstack-forge/references/shared/evidence-rules.md` (statuses, standards, tools, findings via
`../fullstack-forge/references/PROTOCOL.md`) relative to this module `SKILL.md` before reporting.

Never hide failed checks or claim that an operation ran when it did not.

## Automatic activation signals

Activate when a request or direct repository evidence involves release readiness, when
the user explicitly names `forge-ship`, or when discovery proves an applicable boundary.

- A candidate release or deployment

## When not to activate

- Exploratory work not represented as release-ready

## Automated support

Relevant discovery inputs are:

- project profile
- prior finding reports as historical diagnostics
- detected project commands
- package and license manifests

Deterministic support, bounded evidence only:

- `validate-skill`
- `check-platform-assets`
- `package-platforms`
- `smoke-install`

## Agent inspection procedure

1. Re-discover and re-inspect a stable current working-tree revision, keeping prior report outcomes as diagnostics only; assemble fresh inspector evidence, authorized command results, skill validation, platform synchronization, packaging, and license checks from registered root/revision/artifact-bound producers, not memory.
2. Fail the gate on any open CRITICAL finding, any required failing check, or any required high-risk check still `NOT_VERIFIED`; never downgrade a status to proceed.
3. Verify packaging integrity: archives build deterministically, contain no symlinks or excluded content, and match their checksums.
4. Run the installation smoke test from the packed artifact in a clean directory.
5. Emit the release decision with the complete evidence ledger: what ran, what did not, why, and the residual risk accepted by shipping.

Manual inspection requirements:

- Review residual risk, skipped checks, release notes, rollback, and human-only publication steps
- Confirm production authority before any deployment

Stack-specific guidance:

- Use the repository's authoritative CI commands and pinned runtime

## Evidence to collect

Standards used as criteria:

- SLSA 1.2
- NIST SSDF
- Agent Skills Specification

## Common production failures

- Re-discover and inspect the stable current revision, then run applicable format, lint, type, unit, integration, end-to-end, build, security, dependency, migration, authorization, upload, and validation checks
- Check canonical/generated synchronization, deterministic packaging, checksums, attribution, and clean installation
- Fail for open critical or required high findings, failed gates, unregistered or stale evidence, incomplete packages, or required high-risk NOT_VERIFIED checks

## Missing-control checks

Each item needs direct evidence or one reasoned status.

- Current format, lint, typecheck, unit, integration, end-to-end, and production build gates with registered root/revision/input-bound evidence
- Skill validation and platform asset synchronization
- Current security, dependency, migration, authorization, and upload-security checks re-derived independently of prior report outcomes
- Package, archive, license, attribution, and installation smoke validation
- Open critical findings block release
- Required open high-severity findings block release
- Failed required tests or build block release
- Invalid skills or out-of-sync generated copies block release
- Required high-risk NOT_VERIFIED checks block release
- Incomplete packaging or failed installation smoke tests block release
- Invalid license or attribution evidence blocks release
- Remote CI, release, and production state require separate direct verification

## Commands and tools

- Run `forge ship audit --json` or `fullstack-forge ship audit --json` when
  an explicit audit is requested and the CLI is installed. Normal feature work does not require it.

## Safe fixes

- No implicit fixes; invoke module fix modes separately with explicit scope
- Regenerate deterministic derived assets

## Approval-required changes

- Publishing, deploying, bypassing a gate, or accepting high residual risk

## Verification

- Repeat the complete gate after the final change
- Install release artifacts in a clean temporary project and invoke the skill

## Completion contract

Follow `fullstack-forge/references/shared/completion.md` and the limitations below.

## Known limitations

- A local gate cannot prove remote CI, registry, release, or deployment status