shipwright-security

Shipwright SDLC

Ship right, not just fast.

AI can build your software now. The hard part is keeping it true to what you already decided, on every change, not just the first.

Shipwright is the harness your AI follows. On every change it checks the work back against your baseline (requirements, architecture, past decisions) and won't let through a change that silently drops a requirement or reverses a call you already made. That is enforced in code, not left to the model to remember; the traceability and audit trail just fall out of it.

/shipwright-iterate "Add a dark mode toggle"

What comes with it: a failing test written first, the change, your specs and traceability updated to match, and a clean Conventional-Commit PR, security-scanned and gated on green checks. Nothing you'd already settled gets quietly undone.

Not a stack framework, not autonomous codegen, just the discipline layer that makes whatever generates your code something you can stand behind. Use it from the Claude Code VSCode Extension or CLI terminal, or for multi-project work through the Shipwright Command Center web UI. Built for daily iteration, not one-shot generation. It scales from a one-line change to a whole new app:

/shipwright-run "A SaaS time tracking app with Supabase and Next.js"

Beta: Shipwright is in active beta. It builds itself daily, but you're an early user, so expect the occasional rough edge. Report issues and feedback are very welcome.

Shipwright Command Center

Kanban board across every Shipwright project: Backlog, In Progress, In Review, Done. One place to see where everything stands.	Task detail: embedded terminal, Project File Viewer, Markdown Editor.

The Command Center is the browser surface for the same skills you run in the terminal or VS Code Extension. Instead of keeping 4 terminal windows or VS Code sessions open for 4 projects, you get one kanban board, one inbox for agent questions, and one place to launch a new pipeline or iterate. When you launch, the claude command runs in an embedded terminal on the task page, and the Command Center follows the session live. It lives in its own repo. See Start the Command Center.

Why Shipwright?

• Keeps your context true. On every change, Shipwright re-checks the diff against the requirements, architecture, and decisions, and blocks anything that drops a requirement or reverses a past call. Enforced mechanically, not left to the model to remember.
• Structure over vibes. IREB-aligned specs, TDD with acceptance criteria, mechanical hooks, not advisory prose.
• Flexible, not linear. Run the full pipeline with /shipwright-run, iterate daily with /shipwright-iterate, or invoke any single skill on its own.
• Compliance without the overhead. Traceability matrix, test evidence, change history, SBOM, and a dashboard, all generated automatically from an append-only event log. The audit paperwork that normally costs weeks of manual work ships as a byproduct of building the software.
• Mechanical quality gates. Hooks block dangerous actions deterministically (exit code 2), so quality doesn't depend on the agent remembering the rules.
• Proven on itself. Shipwright builds Shipwright: every commit on main runs through the same pipeline, scanner chain, and compliance gates it ships to you.

Who is it for?