Claim Check treats intent text as as sensitive as source code: a goal like “Add the refund path for the Apollo billing migration” carries ticket titles, codenames, and roadmap signal. This page spells out what stays on your machine, which is everything that matters, and what the one local, opt-in telemetry feature records.
What never leaves your machine
- Your source and diffs. The deterministic floor and the judge both run entirely locally. No files, no diffs, and no repo paths are uploaded to Shipmoor.
- Your intent text. The resolved goal text is used locally and never transmitted.
- Model rationales. When the BYO-Judge runs, its free-text rationale is shown to you in the report and never recorded by any Shipmoor telemetry; it’s treated as the highest-risk leak surface in the whole design.
- Session transcripts. Session ingestion (
shipmoor claim-check resolve --session) is explicitly opt-in, no auto-discovery of a transcript you didn’t name, and the transcript is masked the moment it’s read.
Masking is the first step, everywhere
Every text input runs through the same secret scanner before anything else uses it:
- The intent text shown in a report is already masked; a pasted
sk_live_…key or an AWS credential never survives into the terminal, the JSON output, the VSA, or a judge prompt. - The change signal handed to the judge is masked by the same extractor first; secrets never reach the prompt.
- A session’s plan is carried as masked, term-level context only, never the raw transcript.
The only model in the loop is yours
Shipmoor hosts no model and calls no model on your behalf. The one path where an LLM ever sees anything about your change is the one you opt into yourself: the --agent command (or review.agent in .shipmoor.yaml) you configure for the intent fidelity judge. That command runs as a subprocess on your own machine, under whatever provider relationship you already have, a local model, a CLI wrapping a hosted one, or anything else you point it at.
Shipmoor itself doesn’t open a separate network path for this data. Your source code, your diffs, and your resolved intent text reach exactly one place beyond your own disk: whatever command you named in --agent. Nothing about the change is transmitted anywhere else, and the judge never runs at all unless you’ve configured that command yourself.
The floor never calls a model at all
--floor-only runs the deterministic floor alone: no model, no secret, and fully reproducible. Two runs over the same frozen acceptance set and the same fixed evidence set produce the same, byte-identical verdict, replayable later, offline, from what it wrote to disk. That reproducibility, not a claim about what’s happening under the hood, is what --floor-only buys you, and it’s why a CI gate can lean on it. See Turning on the gate and Plans & tiers for which mode each tier unlocks.
Probe-coverage telemetry (local, opt-in, off by default)
Shipmoor’s probe library grows by knowing which task shapes the deterministic floor repeatedly can’t match on its own, the recurring cases where the judge has to step in. To surface that backlog, you can opt in to a local, redaction-safe record of each intent-resolved run. It’s designed so the record is useless to an adversary:
| Recorded (redaction-safe) | Deliberately NOT recorded |
|---|---|
| A salted intent fingerprint (SHA-256) | Raw intent text, in any form |
| Term frequencies over masked, normalized terms | Word order, or the sentence |
Intent confidence (high / medium / low) | The model rationale, ever |
| Which probes matched, or none | Intent sources or ticket references |
| Whether the judge ran, and its shape | The diff, file paths, precise timestamps |
The protections, briefly: terms are extracted only after secret masking; the fingerprint is salted with a locally stored, never-recorded salt, so there’s no rainbow table over common term sets; short, low-entropy intents deliberately collide so they’re grouped rather than individually identified; and a recurring gap only ever surfaces once at least 3 distinct intent shapes cluster together.
Off by default. Enable it per shell:
export SHIPMOOR_INTENT_DRIFT_TELEMETRY=1Records append to a local JSONL under your repo’s gitignored .shipmoor/ directory. Nothing is transmitted: there’s no server and no network call in this feature. Read the backlog it builds with:
shipmoor claim-check probes gaps # recurring unmatched-intent clusters
shipmoor claim-check probes coverage # judge-invocation rate, per library versionSee Providing intent for where the ticket, prompt, and session sources that feed this actually come from.
Next
- BYO-Judge: the one opt-in path where a model sees a masked view of your change.
- Turning on the gate: why floor-only is the form a CI gate can lean on.
- Providing intent: tickets, prompts, and sessions as intent sources.