Shipwright

Shipwright - the assisted delivery agent for life after code

Code generation is solved. What happens next - review, testing, security scanning, compliance, packaging, release, monitoring - is still a pile of manual chores. Shipwright automates that post-code half of the DevSecOps lifecycle, at the Assisted level of autonomy: the agent analyses everything and proposes actions, and a human approves every change before it happens.

One command runs nine real checks mapped to GitLab's nine lifecycle stages: roadmap planning, static code review, the test suite, a SHA-256 package manifest, a committed-secrets scan, drafted release notes with a proposed version bump, environment-configuration documentation checks, a live health probe of the service, and license/CI compliance. It ends in a delivery readiness report with a READY or NOT READY verdict, and - the Assisted part - release mutations are applied only after explicit per-action approval.

The same engine runs three ways: as a CLI, inside GitLab CI (this repository's pipeline has one job per lifecycle stage, all running the shipped engine), and as an MCP server exposing the checks as tools (security_scan, code_review, compliance_check, release_readiness) that a GitLab Duo agent or flow can call on a merge request and summarise for a human approver.

Built with zero dependencies on Node's standard library, MIT licensed, with a unit-tested stage engine and a demo service included so the full loop - code written, then everything after code - runs end to end.

Pipeline history: 36 pipeline runs are visible in the GitLab project, triggered on every commit. GitLab gates job creation for this account behind an identity verification step that requires a payment-card check, which is not available to me in Pakistan, so jobs currently show 0 created. The exact CI commands were run locally in CI mode: all nine stages pass, and the 7 unit tests pass - the run is shown in the demo video and the test report is in the repo.