Behavior Discovery
Find important behavior already encoded across the repository instead of waiting for someone to document it manually.
- Authorization guarantees
- Validation behavior
- Business rules
- Error-handling contracts
- Existing safeguards
Repository memory.Evidence before merge.
ShipCheck turns the behavior hidden across code, tests, and history into governed contracts. Every future change is verified against what your software is already supposed to do.
A decision layer for software change.
Each capability shares the same durable model of behavior, so discovery, verification, governance, and learning strengthen one another.
Behavior Guards
Turn important repository behavior into a persistent expectation connected to code, tests, impact, and history.
- Protect critical behavior
- Attach supporting evidence
- Track origin
- Detect future violations
- Evolve intentionally
Behavior Contracts V2
Govern every protected behavior with explicit claims, ownership, approval, risk, enforcement, and proof requirements.
- Versioned invariants
- Criticality and enforcement
- Owners and approvals
- Required evidence
- Immutable audit history
Verification Agent
Plan falsifiable checks, investigate with bounded read-only tools, and distinguish proof from uncertainty.
- Impact-based guard selection
- Verification scenarios
- File and reference lookup
- Test and history discovery
- Explicit inconclusive results
Behavioral Diff
Describe what the software now does differently instead of reducing a pull request to changed lines and comments.
- Preserved behavior
- Intentional changes
- Violations
- New behavior
- Restored behavior
Behavior History
Track how an important expectation evolves over months of commits and pull requests.
- Introduced
- Preserved
- Changed intentionally
- Violated
- Restored
Historical Origin
Trace related implementation and test history to find where a protected behavior first became true.
- Source commit
- Strongest implementation file
- Cross-file evidence
- Confidence score
- Origin explanation
Differential Verification
Run the same protected scenario against base and head to prove whether the pull request introduced a regression.
- Base-versus-head execution
- Confirmed regressions
- Pre-existing failures
- Behavior improvements
- Paired runtime evidence
Merge Governance
Turn risk-aware verdicts into GitHub checks with configurable blocking rules and audited, time-bounded exceptions.
- GitHub check runs
- Review-required gates
- Permission thresholds
- Temporary exceptions
- Governance audit history
Team Workspaces
Share repositories, contracts, policies, verification reports, and decisions with role-based access across an engineering team.
- Owner, admin, member, viewer
- Shared repositories
- Contract ownership
- Policy templates
- Two-person approvals
Cross-repository Verification
Map provider contracts to APIs, SDKs, events, and data consumers, then include downstream impact in every ship verdict.
- API consumers
- SDK dependencies
- Event consumers
- Data contracts
- Downstream risk findings
The risks that hide between changed lines.
ShipCheck combines repository context, deterministic checks, runtime evidence, and historical behavior to find regressions that ordinary diff review misses.
Security
Detect security guarantees that disappeared or became weaker because of a change.
- Authorization regressions
- Removed access checks
- Secrets and credentials
- Unsafe APIs
- Injection risks
Reliability
Find changes that quietly make previously working behavior less reliable.
- Removed normalization
- Broken error handling
- Null assumptions
- State cleanup failures
- Failure-path regressions
Contracts
Catch changes that violate assumptions shared between APIs, callers, helpers, and other systems.
- Broken API contracts
- Incomplete refactors
- Caller mismatches
- Duplicated behavior
- Changed assumptions
Accessibility
Identify user-facing changes that remove accessibility behavior that previously worked.
- Missing accessible names
- Keyboard regressions
- Semantic regressions
- Broken labels
- Interaction changes
Testing
Find important behavior changes that no longer have evidence proving what should continue to work.
- Changed behavior without tests
- Missing edge-case coverage
- Untested failure paths
- Missing authorization tests
- Regression-test opportunities
From repository fact to governed verdict.
The workflow remains inspectable from discovery through enforcement, with the evidence and policy behind every decision.
Discover behavior
ShipCheck identifies important safeguards, contracts, tests, assumptions, and product behavior already encoded in the repository.
Create a Behavior Contract
Promote important expectations into versioned contracts with explicit invariants, scenarios, risk, ownership, and evidence requirements.
Target affected behavior
The Behavior Impact Graph selects contracts connected to the code and workflows changed by the pull request.
Verify with governed evidence
The Verification Agent plans falsifiable checks, investigates under a strict read-only budget, and applies the contract's evidence policy.
Compare base and head
Eligible runtime guards execute the same scenario on both commits to separate new regressions from failures that already existed.
Issue a risk-aware verdict
Findings and contract risk produce Ready, Ready with uncertainty, Review before shipping, or Do not ship.
Enforce the merge policy
ShipCheck publishes a GitHub check and applies repository policy for passing, review-required, blocked, or temporarily waived changes.
Update repository memory
Every scan retains its contract version, evidence, uncertainty, and decision while intentional contract changes create a new immutable version.
Precise where it needs to be.
Tune analysis and enforcement per repository while keeping ownership, approvals, and policy visible to the team.
AI analysis
Enable or disable repository-aware AI analysis independently for each repository.
Category controls
Control Security, Reliability, Contracts, Accessibility, and Testing findings independently.
Ignored paths
Exclude generated files, snapshots, documentation, vendored code, or repository-specific paths.
Ignored rules
Disable deterministic rules that do not make sense for a specific repository.
Contract governance
Set lifecycle, criticality, enforcement, owners, approvals, evidence freshness, and required proof per protected behavior.
Merge governance
Configure GitHub check enforcement, review-required blocking, exception permissions, expiry, and regulated-contract policy.
Workspace governance
Use roles, shared policy templates, contract owners, second-admin approval, and audit history across a team.
Make every change prove what it preserves.
Connect a repository, discover the behavior it already depends on, and turn that knowledge into a durable merge decision.