Rollout model
Trust is the bottleneck, not the tooling.
Most teams stall on AI adoption for the same reason: nobody wants to be the person who let an agent break production. So it stays a side experiment for a few enthusiasts and nothing changes for everyone else.
Shipwright is built to be dialled up, not switched on. You choose how much the agent does on its own, and you change your mind in under a minute.
The three stages
Plan and build.
The agent reads your task queue, picks the next ready task, builds it with tests, and opens a PR. Your engineers review and merge, exactly as they would for a new hire. The agent cannot merge anything.
Crons: dev-task on.review, patch,deploy off.
Add review and patch.
The agent reviews open PRs and fixes failing CI. Review and patch are separate toggles, so you can take one without the other. Your engineers still control every merge.
Crons: dev-task, review,patch on. deploy off.
Close the loop.
The agent merges approved PRs and watches post-merge CI. Plan, build, review, patch, deploy, without manual intervention.
Crons: all on.
Only turn on Stage 3 once the safeguards are in place: CI gates, required reviewers, and a working deploy pre-check. The docs say the same thing, and we mean it.
The dial, in detail
Each of these is a real per-agent policy setting, edited in the admin UI. No restart, no redeploy, picked up on the next config sync.
| You want | Setting |
|---|---|
| Read every review before it reaches GitHub | autoPostReviews off - findings stage locally until you approve them |
| An agent can never block a human PR | Built into review.md's rules — REQUEST_CHANGES is never used |
| Agent PRs always need a human reviewer | allowSelfReview off, the default |
| Less review noise | minConfidence, maxFindings |
What does not change between stages
Three things are true at Stage 1 and still true at Stage 3:
- Tests come first, always. Every task writes its failing test before the implementation and CI must be green to merge. That is not a setting you can relax.
- It runs on your infrastructure. Your cloud, your data boundary, your existing controls.
- You keep the record. Every task and PR carries an append-only trail of what changed, which actor changed it, and when, in your own database.
Two ways in
- Hands-off: dev-task and patch on, review off. The agent builds and fixes CI; your team does all the reviewing.
- Bring your own PR: skip the queue entirely. Open a PR yourself and let review, patch, and deploy take it from there.
Every stage is a toggle, and every toggle goes both ways. If a stage is not working for your team, turn it off and nothing is stranded.
Try it
Install the plugin into Claude Code and run a task end to end. Free, MIT, runs on your own infra.
/plugin install shipwright@app-vitals/shipwrightRolling this out to a team? We can talk through which stage to start at.How the stages work