Keep scrolling — the panel follows the change.
Describe the change in prose. shipd investigates your codebase first, asks only what it genuinely can't infer, and compiles your intent into three reviewable artifacts — then stops. No code yet. A wrong assumption costs one markdown edit, not a rework.
A deterministic, LLM-free gate checks the spec against your actual codebase. Pass promotes it to ready. Fail parks it with the gaps written into the plan — the system stops rather than build on a guess.
An orchestrator on the strongest model designs; execution agents one tier down claim tasks atomically in a dedicated worktree. The spec — not the chat transcript — is the single source of context every agent works from.
An independent validator takes every WHEN/THEN scenario in the spec and tries to refute it against the real, running code. Refuted goes back to the executors; confirmed moves on. Done means verified, not "seems done".
CI plus an AST-aware semantic review that must be explicitly dispositioned. Then the PR auto-merges — one change, one branch, one PR — and the deltas join the verified capability library, so the next plan starts better-informed.
The change archives immutably and appears on the delivery board with everything else this pipeline has shipped — 175 changes and counting, in shipd's own repo. What got built and what was asked for are the same document.
The expensive failure isn't bad code — it's an agent confidently building the wrong thing. shipd guides the agent while the change is still markdown: plan mode investigates your codebase, surfaces the open questions, and lets you validate the idea in minutes. Only when the context gate confirms nothing is missing does an agent get sent in.
Prose, a brief, even a screen recording — shipd compiles whatever you give it into the same three reviewable artifacts: a plan, testable requirement deltas, and a task list, checked into your repo. Answers you've given before are already there; they're never asked twice.
A deterministic gate checks the spec against your actual codebase before a line of code is written. Gaps park the plan with findings attached — you enrich it, it re-enters. The system stops rather than guess.
An independent validator tries to refute every scenario in the spec against the running code, then CI and a semantic review — explicitly dispositioned, on record — gate the merge. What ships is what the spec says, verified.