The complete, verified surface of shipmoor claim-check in 0.8.0. This is the “I’m done” gate: the command you run after your agent finishes, to check the change against what the task asked for.
usage: shipmoor claim-check [-h] [--config CONFIG] [--floor-only]
[--acceptance ACCEPTANCE]
[--staged | --diff DIFF | --all]
[--from FROM_REF] [--to TO_REF]
[--intent-ticket PATH] [--intent-prompt TEXT]
[--agent AGENT] [--vsa-out VSA_OUT]
[--trace-out TRACE_OUT] [--json] [--no-color]
[--terse]
[target]
shipmoor claim-check is a peer subcommand of shipmoor scan. Full mode (with --agent) is gated behind the claim_check entitlement, checked before any config, git, or agent work. A locked run never imports the judge engine or spawns your agent. The deterministic floor path (--floor-only, or simply omitting --agent) needs no model and no secret.
Positional argument
| Argument | Default | Meaning |
|---|---|---|
target | . | Project directory or repo root to check. |
Selectors: what gets checked
By default shipmoor claim-check checks your working tree (tracked changes plus untracked files) as a diff. The selectors below change that. --staged, --diff, and --all are mutually exclusive. --from and --to form a committed range and are given together.
| Flag | What it checks |
|---|---|
| (none) | Working tree: tracked changes plus untracked files. |
--staged | Staged changes only (the index, like git diff --staged). |
--diff <spec> | A raw git diff spec you provide, for example main...HEAD. |
--all | The whole tree, not just the change surface. |
--from <ref> --to <ref> | A committed range. |
shipmoor claim-check . # working tree (default)
shipmoor claim-check . --staged # the staged index
shipmoor claim-check . --diff main...HEAD # a raw diff spec
shipmoor claim-check . --from origin/main --to HEAD # a committed range
shipmoor claim-check . --all # whole tree
Floor-only mode: --floor-only
| Flag | Meaning |
|---|---|
--floor-only | Run the deterministic floor and synthesizer, with no judge. The fully deterministic path: no model, no secret, reproducible. |
shipmoor claim-check . --floor-only
With no --agent, the run is already floor-only in practice: the judge only ever runs when an agent is configured. --floor-only makes that explicit and is the form to reach for in CI, where you want the run’s behavior to be self-evident from the command line.
Acceptance set: --acceptance
| Flag | Default | Meaning |
|---|---|---|
--acceptance <path> | .shipmoor/acceptance.yaml | Path to the acceptance set: the human-authored, editable list of obligations the change is checked against. |
shipmoor claim-check . --acceptance .shipmoor/acceptance.yaml
Use shipmoor claim-check init to scaffold a starter set. If no acceptance file is committed at that path, the gate can auto-derive a draft from the resolved intent instead; that draft is disclosed as unapproved and never counts as an approved pass. See Turning on the gate for the authoring modes and what “approved” means.
Intent sources
shipmoor claim-check resolves intent from two flags, in precedence order. These are distinct from the older three-flag surface on claim-check resolve (below).
| Flag | Meaning |
|---|---|
--intent-ticket <path> | Highest-precedence intent source. Freezes intent from a ticket file. |
--intent-prompt <text-or-path> | The task prompt (inline text or a path to it). Outranked by --intent-ticket; outranks the acceptance file’s own stated goal. |
shipmoor claim-check . --intent-ticket tickets/PROJ-482.md
shipmoor claim-check . --intent-prompt "Add a Stripe webhook handler for failed payments"
If neither is given, Shipmoor falls back to whatever goal the acceptance set itself states. See Providing intent for how precedence and confidence interact.
The judge: --agent
| Flag | Meaning |
|---|---|
--agent <preset-or-cmd> | The intent-fidelity judge. The bare preset claude drives that CLI for you (claude -p). Any other value is a bring-your-own-agent command: shlex-split and run as a subprocess, with a JSON request on its stdin and a JSON response on its stdout. Optional; with no agent configured, the judge simply abstains wherever it would have run. |
shipmoor claim-check . --agent claude
claude is the only bare token with a built-in headless-JSON invocation today. A bare codex or cursor fails fast with a clear error rather than guessing at an invocation, since their headless review commands aren’t yet an established judge invocation; point --agent at the raw command instead (for example --agent "claude -p", or your own script) and it runs unchanged, shlex-split, as a subprocess. See BYO-Judge for the request and response wire contract and how to adapt an agent that is not already a stdin-to-stdout filter.
The judge can only BLOCK or ABSTAIN, never pass an obligation on its own. Shipmoor’s default calibration samples a judgment three times (K=3) and needs 2-of-3 agreement to confirm a block; a block also has to survive actually re-running its cited test or command hermetically at the reviewed head before it counts. Below a mean confidence of 0.8 the judge abstains rather than blocks. A green verdict always rides the deterministic floor, never the judge alone. See BYO-Judge for the full mechanics.
Output flags
| Flag | Meaning |
|---|---|
--vsa-out <path> | Write the VSA attestation to this path (default .shipmoor/claim-check.vsa.json). |
--trace-out <path> | Write the per-probe trace to this path (machine-readable, for debugging and reproducibility). |
--json | Write the shipmoor.scan.v1 JSON contract with the claim check under change_results[]. |
--no-color | Disable terminal color in the human output. |
--terse | Collapse the result to a single-line status, for busy CI logs. |
Without --terse, the default output is the full verdict card: the resolved intent, the per-item detail for every acceptance criterion, and the badge. There is no separate flag to expand detail; full detail is simply what you get unless you ask for --terse.
shipmoor claim-check . --vsa-out .shipmoor/claim-check.vsa.json --json --output claim-check.json
Config
| Flag | Meaning |
|---|---|
--config <path> | Path to the project config file (otherwise discovered from target). |
Defaults come from .shipmoor.yaml. The precedence is flags, then config, then built-in defaults:
review:
agent: "claude" # shared with Code Review; the judge reuses this same key
claim_check:
acceptance: ".shipmoor/acceptance.yaml"
authoring_mode: "author" # author | auto | hybrid
policy_path: ".shipmoor/floor_policy.yaml"
| Key | Default | Notes |
|---|---|---|
review.agent | (unset) | The judge’s agent command. There is no separate claim_check.agent key: this is the same key Code Review uses, so one setting configures both. claude is the only bare preset with a built-in headless-JSON invocation; any other coding-agent CLI needs its full invocation as a raw command (see BYO-Judge). Optional; omit to run the floor alone. |
claim_check.acceptance | .shipmoor/acceptance.yaml | Path to the acceptance set. |
claim_check.authoring_mode | "author" | author (hand-authored, zero model), auto (LLM extraction only), or hybrid (auto draft plus a human-confirm step). See Turning on the gate. |
claim_check.policy_path | .shipmoor/floor_policy.yaml (ships a default) | Path to the floor policy file. Toggles a narrow set of optional cross-cutting requirements; it cannot loosen the core floor. See Turning on the gate. |
Subcommands
shipmoor claim-check init
Scaffold a starter acceptance set:
shipmoor claim-check init [--force] [target]
| Flag | Meaning |
|---|---|
--force | Overwrite an existing acceptance file at the target path. |
Writes .shipmoor/acceptance.yaml. Edit the file to fill in the obligations for your change, in plain language. The deterministic probes are pinned to specific acceptance criteria from this set.
shipmoor claim-check resolve
An intent-only preview utility: resolve the intent without a diff (no probes, no VSA). It has its own, older three-flag surface, separate from the main gate’s --intent-ticket / --intent-prompt:
shipmoor claim-check resolve [target] [--intent TEXT] [--prompt TEXT] [--session PATH] [--json]
| Flag | Meaning |
|---|---|
--intent <text> | One-line goal. |
--prompt <text> | The agent prompt that produced the change. |
--session <path> | Agent session transcript; the first user turn becomes the intent. |
--json | Machine output: goal_text, confidence, sources. |
resolve also reads .shipmoor/intent.txt from the target directory if present. Use it to sanity-check what Shipmoor would resolve as intent before wiring a full claim check:
shipmoor claim-check resolve --intent "…" --json
shipmoor claim-check resolve --session run.jsonl
shipmoor claim-check probes
Inspect the probe library. Three subcommands, unchanged:
shipmoor claim-check probes gaps # show known coverage gaps
shipmoor claim-check probes scaffold # scaffold a starter probe definition
shipmoor claim-check probes coverage # show probe coverage by language / file type
Exit codes
shipmoor claim-check returns one of four verdicts, and the exit code follows unconditionally from it. There is no flag or config key that changes this mapping.
| Code | Verdict / cause | When |
|---|---|---|
0 | READY | The deterministic floor is green, no judge block is confirmed, and nothing required is left underspecified. |
0 | READY_WITH_GAPS | The floor is green and nothing is blocked, but something non-required is still open or unresolved. |
1 | BLOCKED | Any deterministic-floor red, always; or the floor is green but a judge block is confirmed. |
1 | INCONCLUSIVE | The floor is green, nothing is blocked, but a required item is abstained or undecided, routing to a human. |
2 | usage error | Not entitled (claim_check locked in full mode), bad flags, a git or ref or config error, or an --agent command that cannot be launched. |
3 | engine crash | An operational failure: the agent ran but the engine errored, or a transport or timeout failure the engine could not recover from. |
So:
- Verdict
READYorREADY_WITH_GAPS? Exit0. - Verdict
BLOCKEDorINCONCLUSIVE? Exit1, unconditionally. There is no policy flag that softens this. claim_checklocked in full mode? Exit2(with theshipmoor.paid_feature_error.v1contract under--json).- Engine crash or an operational failure the engine could not recover from? Exit
3.
This mapping is unconditional: it is not a default that a config key can override. See Turning on the gate for what it means to run this in CI, and for the one real, narrower tuning lever that does exist (the floor policy file).
Next
- What is Claim Check: the three layers and the four verdicts.
- Turning on the gate: the exit-code mapping in CI, and the floor policy file.
- BYO-Judge: the judge’s sampling, confidence threshold, and pointer-must-resolve rule.
- Reading the verdict: the four verdicts, exit codes, and the VSA.
- Providing intent:
--intent-ticket,--intent-prompt, and how precedence works. - Attestation artifacts: the VSA, the trace sidecar, and tamper evidence and replay.
- Test Evidence: attesting that tests actually ran, as a producer this gate can consume.