mapit → shipit — a five-stage delivery pipeline
The class of problem
A standard you have to remember isn't a gate.
Solo and small-team delivery has no guardrails: a standard that should hold on every release — no secrets, scoped changes, a real license, signed artifacts — rides on the maker remembering to check it, and erodes under time and turnover. The class is release safety that depends on attention rather than on a gate.
What it is
A five-stage promotion pipeline, implemented as Claude Code skills, plus the continuity and decision artifacts around it. Each stage is a command; each promotes a project one step along a fixed lifecycle: T0 (scratch, no git) → T1 (private repo) → T2 (public repo). Tier is lifecycle state, not a directory layout — a stage moves a project from one state to the next, and adds only the artifacts the next tier requires.
Where it generalizes
This is the SDLC / release-governance layer — the gates between a developer's commit and a signed public artifact. The same shape recurs anywhere code has to ship under review. Eight repos have shipped through it to public:
Three tiers, forward-only
Nothing skips a tier, and nothing is demoted.
A project enters at T0 and is promoted one tier at a time. Retirement is a separate move — archive the repo — not a step backward. Because the path is fixed, the same gates run in the same order on every project.
| Tier | State | What it carries |
|---|---|---|
| T0 | Scratch container — no .git | Scope notes, task lists, decision records, and working files; nothing under version control yet |
| T1 | Private GitHub repo | What a real project needs: a license, a pre-commit config, a task runner, and CI |
| T2 | Public GitHub repo | What a public release requires: contribution and security docs, code ownership, branch protection, and signed releases |
Five commands
Each stage is a single command.
The first two operate on the scratch container; the last three on the repo. Each promotes a project one step and adds only what the next tier requires.
/mapit — map the universe
Universe-scoping cartography: a wide-net triage catalog of every component, vendor, and technology in an area, scored against fixed constraints — available hardware, standing license posture, active domains. The output is a dated map, and the stage is triage only: it deliberately does not pick a winner, so the option surface is captured before it narrows. Runs before a project candidate exists.
/pointit — commit to a candidate
Promotes one candidate off a map into a T0 dev-scoping container: the container bones — scope/, tasks/, adr/, work/ — plus a structured scope stub. It explicitly does not run git init; a T0 container has no .git by design, which keeps scoping cheap and reversible.
/sendit — make it a repo
Promotes T0 → T1. Creates the private repo, symlinks the workspace container back to it, and layers the T1 scaffolding from templates — a license (dual Apache-2.0 / MIT by default), a pre-commit config, a task runner, and CI — then pushes the repo private. The point at which a scoped concept becomes a version-controlled project.
/vetit — the ship-prep gate
Read-only and artifact-agnostic — it can vet a repo, a bundle, or a single file, and it never edits, remediates, or publishes. Two passes: an automated sanitization sweep (a denylist grep, a full-history secret scan, and a private-key/credential regex) and a six-judge adversarial review panel with a synthesis pass. The result is a dated, re-runnable report with two buckets — BLOCK-publish and ADVISE.
/shipit — flip it public
Promotes T1 → T2. Layers the tier-2 artifacts — contribution guide, security policy, code ownership — flips the GitHub repo from private to public, moves it into the public part of the substrate, re-points the workspace symlink, and applies the hardening: branch protection, secret scanning, and signed releases. Releases are signed with cosign keyless via Actions OIDC; an SBOM (syft) and SLSA provenance ride along at the public tier rather than being separate opt-in decisions.
Preconditions, enforced
A project cannot arrive at a stage in the wrong state.
Each stage has a precondition the previous stage establishes. Three gates do the enforcing — and the ship gate is the hard one.
The map gate
/mapit stays in triage and does not converge into a build decision; the candidate /pointit consumes is chosen deliberately, after the option surface is mapped.
The T0 gate
The absence of .git — scoping happens with no version-control commitment, and /sendit is the act that introduces it.
The ship gate
/shipit aborts without a clear /vetit report. The BLOCK bucket must be empty before the visibility flip, and the report is re-run after each fix. The denylist the sanitization pass greps against is a single source of truth, read by both the automated gate and the adversarial panel — so the two checks agree on what counts as a leak.
What a full run produces
A project that runs the full chain arrives at a public repo carrying all of the below. The path is identical every time, and the gates are the same instruments on each run.
The supporting artifacts
The stages move a project forward. Three standing artifacts keep it coherent.
Sessions end, decisions age, and commits happen in a hurry. Three artifacts hold the work together across sessions and over time.
Session continuity
/handoff writes an end-of-session package: a raw active-context dump, a reasoning dump, and an entrypoint prompt for the next session. /intake consumes the oldest pending package first-in-first-out and archives it after reading. A session can resume cold from the package rather than from memory.
Decision register
Standing decisions are recorded centrally and reviewed on a cadence — 15 / 30 / 60 / 180-day buckets — with an append-only ledger of revisions and retirements. A review pass re-opens settled decisions on schedule and walks each through hold / revise / retire / re-snooze: the inverse of the fork-review pass that closes open questions.
Guardrail hooks
The pre-commit framework (config in .pre-commit-config.yaml, installed at first scaffold) runs format, lint, and secret-scanning hooks before a commit lands. The denylist the ship gate reads is the same source these hooks check against — so a credential is caught at commit time, not only at the ship gate.