The coding agent that
proves its work.
Ship works a task in a sandbox on your servers, then runs the evidence itself: tests, a deployed preview, a browser flow, and a window of production telemetry after the merge. The pull request carries the results. The agent's word is never the evidence.
- intake#412
- sandboxwarm
- work1 file
- build9f3c21
- tests47 passed
- previewsmoke 3s
- flow9 steps
- mergemerged
- observeclean
Every coding agent returns a pull request. Ship returns one that was built, deployed, exercised, merged with earned authority, and watched in production - on your own hardware, with a cost you saw before it started.
The model is not the product.
Frontier models move quality more than any harness does, so Ship does not compete on being the smartest loop. It competes on everything around it.It is a control plane.
Intake policy, spend governance, sandboxing, evidence, audit, and merge authority - the parts a team needs before an agent touches a real repo.Self-hosted first.
For the teams that cannot send source to someone else's cloud. The native loop needs nothing but a shell, so air-gapped is a configuration.Seven rungs. Authority is earned from the ones that ran.
Each repository declares which rungs apply. Ship runs them after the agent stops and records every outcome verbatim. A rung that did not run is listed with its reason, never omitted - and a skipped required rung holds the merge.
Change class
Docs and comments only. No rung is needed to earn auto-merge; the diff is published as is.Every declared rung must pass. Auto-merge is per repo and off until you turn it on.Large or sensitive diffs park on a person whatever the rungs say. The rungs still run; they inform the review.
The preview and observe rungs use the teploy CLI and Observe. Without them Ship still runs baseline, build, and tests; with them it closes a loop no standalone agent can.
baselinenot neededrequiredheld for review
The suite before the agent touched anything, so a red test is attributed to the change and not to the repo.
buildnot neededrequiredheld for review
The branch builds into a real image with the teploy CLI. Not a claim that it compiles; an artifact with a digest.
testsnot neededrequiredheld for review
The repository's own test command, run by Ship after the agent stops. The result is recorded verbatim.
previewnot neededrequiredheld for review
The branch image deployed to a preview URL and smoke-tested. Deploy and smoke are one rung; a preview that serves nothing is a failure.
visualnot neededrequiredheld for review
A screenshot diff of the preview against the baseline, when the project declares one.
flownot neededrequiredheld for review
An agent-written browser flow driven against the preview, exercising what the change was for.
observenot neededrequiredheld for review
A post-merge window of error rate and latency read from Observe. A regression rolls back and reopens the work.
Governance for autonomous work
The controls an operator needs before letting an agent near production repos. Built in, not bolted on.
01
Intake policy per source
Each source resolves to ignore, propose, or auto. Unknown means propose; a typo never widens authority.
02
Spend that cannot fail open
A daily cap enforced at enqueue and a hard per-run ceiling. Unrecognised hosted models are priced at the highest known rate.
03
Admission control
Task text is screened for prompt injection before a run exists. A stranger's note becomes a proposal, never a run.
04
Secrets scoped and redacted
Runs receive only the credentials they need, by name. Values never reach the log. Key material in a diff is refused.
05
Sandbox, default-deny egress
One container per run, no outbound network unless the project allows a host. Timeouts enforced inside the container.
06
Blast-radius caps
A diff that touches too many files is refused at the publish gate. Oversized changes raise drafts, not surprises.
07
Roles and SSO
Admin, editor, and viewer on the dashboard. Approving and steering are grants. OIDC sign-in is built in.
08
A complete run record
Runs are event-sourced: every step, decision, cost, and rung is recorded and replayable. The audit trail is the execution log.
Parks on a decision. Resumes days later. Nothing re-runs.
Runs are workflows over an event log. A run parks on a plan review, an approval, a merge boundary, or a question the agent chose to ask - and while parked it holds zero processes. Answer from the dashboard, the CLI, the API, or an approvals queue; replay skips every completed step.
- steeradd instructions to a run in flight instead of killing it
- askthe agent can stop and ask; an empty answer tells it to decide
- retrya failed rung re-runs the agent against the failure, bounded
- recoverstuck-run detection is on by default; a loop is stopped, not discovered
Ship holds no model and is not married to its own loop
Point it at any endpoint that speaks the Anthropic or OpenAI wire format - directly, through your own gateway, or at a local runtime. Then choose what edits the tree. Whichever harness runs, intake, approvals, the publish gate, the evidence rungs, spend, and audit stay Ship's.
Route through the gateway. Provider keys stay in teploy-gateway; Ship never sees them.
Local models cost zero. ollama, vllm, llama.cpp are priced at nothing; flat-rate plans are counted, not priced.
Measured, not claimed. Benchmark results are published with the model named and the interval, in MODELS.md.
Ship's own CodeAct loop
The agent acts by writing bash or Python and reading real output, one block per turn. It needs nothing in the sandbox image but a shell, which makes it the air-gapped option and the measured baseline every adapter is compared against.
Claude Code, headless
Runs claude -p inside the sandbox with forwarded credentials. Its event stream is read live into the Now card as it arrives. Its result is a working tree and a claim, which Ship records and then verifies like any other.
OpenCode, headless
The same seam: one recorded preflight for the binary and its version, one recorded run. A missing binary is a recorded error, not a silent fallback. The harness is chosen per project or per run.
$4.08
of a $4.00 ceiling. The run halted.
That is the whole feature. Every run has a cap you set before it starts, a cost that is visible while it runs, and a ledger entry when it stops. The daily cap is checked at enqueue, so a busy morning cannot spend the afternoon.
Work arrives from where it already lives
One dashboard, one worker, one store
The stack idles around 200 MB. A second box joins with teploy-ship join, which verifies the controller, store, sandbox pool, forge, and model route and starts nothing unless all of them answered. What one worker carries is measured under load, not projected.
Where Ship stands
Not the smartest agent, and not trying to be. These are the rows that decide whether you can run it at all, what it costs, and what a merge means.
| Ship | Devin | Vorflux | OpenHands | |
|---|---|---|---|---|
| Runs on your servers, air-gap capable | Yes | Cloud | Cloud | Yes |
| Durable runs that park and resume | Yes, event-sourced | No | Keeps a VM warm | No |
| Bring your own model, no markup | Any Anthropic- or OpenAI-wire endpoint | No | BYOK | Yes |
| Per-run cost visible, hard cap | Enforced at enqueue | Opaque credits | Tokens plus compute | Partial |
| Deploys the preview itself | Yes, via the teploy CLI | No | No | No |
| Post-merge telemetry watch with rollback | Yes, via Observe | No | No | No |
| Merge authority earned from evidence | Per repo, off by default | PR only | Threshold auto-merge | PR only |
| The agent can ask and wait | Parks the run | Side chat | No | No |
Sub-agent fleets and browser task capture are deliberately absent. Ship does not have them and is not building them.
Issues in. Proof out.
One install brings up the dashboard, the worker, and the store. The quickstart gets you to a pull request that carries its own test result in about ten minutes.