Output contracts & schemas

Shipmoor keeps product output separate from account and allowance metadata. Authentication and allowance UI never contaminates machine-readable stdout, and usage metadata never enters evidence, report schemas, or self-digests.

shipmoor.scan.v1

shipmoor scan --json emits the stable Scan report. Key finding fields include id, rule_id, severity, path, start_line, message, recommendation, evidence, subtype, change_status, and fingerprint. See Output formats & exit codes.

The report contains local analysis results. It does not include account plan, allowance counters, usage idempotency keys, or raw authorization credentials.

Capability access

The v2 CLI capability output preserves enabled for existing readers and adds access, allowance, and allowance snapshots:

{
  "plan": "free",
  "capabilities": {
    "scan": { "enabled": true, "access": "unlimited" },
    "claim_check": {
      "enabled": true,
      "access": "metered",
      "allowance": "claim_check_invocations"
    },
    "code_review": {
      "enabled": true,
      "access": "metered",
      "allowance": "code_review_invocations"
    }
  },
  "allowances": {
    "claim_check_invocations": {
      "included": 5,
      "remaining_snapshot": 3,
      "renews_at": "2026-09-01T00:00:00Z"
    }
  }
}

enabled means the capability exists for the account. A metered Free command must still consume successfully before execution. Allowance snapshots are display-only; the online usage service is authoritative.

Consumer rules

• Check schema_version before parsing a versioned output.
• Tolerate unknown additive fields and capability keys.
• Use access and the command-specific allowance, not a plan-name comparison, for new access decisions.
• Never read or persist raw access, refresh, or machine-token credentials from output.
• Keep account and usage messaging on stderr when JSON or SARIF is written to stdout.

The canonical external plans are Free, Pro, Team, and Enterprise. Team and Enterprise capability surfaces remain coming soon/contact-only.

Privacy

Capability and usage payloads contain no source, diffs, prompts, findings, verdicts, evidence, paths, repository or branch names, test output, or acceptance criteria. See Security & privacy.