ShipGateShipGateNothing WholeStack builds reaches production without a SHIP from ShipGate. Checking software WholeStack did not build is not available yet.
Works with the editor you already use
A build that compiles is not a change that is proven. Platform teams add ShipGate for three gaps CI doesn’t cover.
Tests answer whether code compiles. They do not answer if a protected route lost its auth guard, or if a caught error returns a false success.
A scanner returning green on unreadable code is worse than no scanner. ShipGate returns UNVERIFIED when it cannot prove safety — never false green.
A verdict is true only for the artifact that earned it. Once the tree moves, an old SHIP is flagged stale — bound to its hash, not your branch.
WholeStack puts nothing into production without a SHIP. Each build boots in isolation, runs its journey, and ShipGate reads the evidence before release. Checking software WholeStack did not build is not available yet.
Reason: Unauthorized tenant access detected. Mutation: tenantId replaced with foreign tenant Expected: 403 Observed: 200 Production deployment BLOCKED.
The repo scan is a sample. Production Admission is the product: no SHIP, no production.
ShipGate exists for the moment someone asks “what did we actually check before this merged?” The answer is a named gate, a finding, and a hash — not a screenshot of a green tick.
Every verdict carries the tree digest of the revision that earned it — not the branch tip.
Manifest verification checks content hash plus a local Ed25519 service signature. Authenticity, not a public CA.
The PR answer is a named gate, a finding, and a hash — never a screenshot of green.
17 static gates · severity-counted findings · advisory until a signed ShipGate run.
A gate is only worth having if it tells you when it cannot answer. ShipGate publishes its own limits in the same places it publishes verdicts.
Manifest verification checks the content hash and a local Ed25519 service signature. That is authenticity — not a public CA, and not a third-party attestation.
The free scan has no approved spec, no runtime evidence, and no signed certificate. It never issues SHIP and never returns a green branch-protection check.
Continuous CI answers 401 without an account and 402 without the entitlement, and refuses activation when the GitHub App lacks Checks: write.
The check WholeStack posts back on the commit — the same 17 gates as the free scan, run on that commit alone.
Free advisory scan → continuous check → Production Admission in the deploy path.
Open the labelled demo scan. All 17 static gates report individually. Advisory only — never a SHIP verdict. Hosted free-scan quotas are not a sold product.
The report names the failing gate, the finding, and the revision it was earned on. A spec-free static scan is advisory by design — it never issues SHIP and never returns a green check.
ShipGate issues SHIP / NO_SHIP on apps WholeStack builds. Foreign-repo merge CI and a $50/mo ShipGate CI add-on are not shipping products. Commercial exits follow §9: Build $99 once, live app $79/mo.
Persisted runs live behind the ShipGate dashboard — part of continuous CI, and of every paid plan. The free scan reports; CI remembers.
Every persisted run with its decision, tree digest, file count, and source commit.
Completed runs counted into a ship rate — exactly what ShipGate persisted, never a recomputed verdict.
When the project's tree moves past a run, that verdict is marked stale instead of shown as current.
There is no ShipGate CI add-on. §9 prices: Build $99 once, live app $79/mo. The PR check is not built yet.
Labelled demo + live MCP. No card. No hosted free-scan quota product.
An agreed app scope, two scoped revisions, release checks, and source export. Larger projects are quoted before work starts.
§9 live app — hosting after SHIP, no source purchase required.
Already on WholeStack? You get verification on apps WholeStack builds. Paid exits stay the §9 SKUs — nothing called ShipGate CI is bundled.
Gates, verdicts, GitHub permissions, and what we refuse to claim.
