clodex-ship

clodex-ship — one authorization, then two-phase steps that reconcile before they retry

Overview

This is the only stage in clodex that changes anything outside the repository, so it is the only one whose mistakes cannot be undone by editing a file. It owes the run three things, all of them fact in the event log:

Fact	Event	In the run manifest
exactly what the user authorized — actions and accepted debt	approval:granted	approvals[] with scope: "release-authorization"
every external step, before and after it happened	release:step:pending → release:step:done / :failed	release.steps[]
where the release ended up	release:updated	release.state, .tag, .deployed, .verified_live

This is the single binding debt gate in clodex

clodex-plan declared the evidence classes. clodex-verify produced what it could and recorded the rest as verification debt — deliberately without gating on it, because there is exactly one place in this system where a human accepts debt, and it is here, inside the release authorization (§5), in the same message as the exact commands the release will run.

So: non-empty debt is itemised in the authorization, class by class, with its reason and its risk, and it is accepted in words. Never inferred from silence, never rolled into "approve?", never assumed because the user already saw it at verify. They did not accept it at verify. Nobody has.

Where this stage ends

In the repository tree you write two files and no others: the profile's changelog.path and its version.source (§2). Working artifacts — a diff, a prompt, a log — go in the run directory, which is gitignored. You do not edit code, tests, or docs: those were clodex-build's under a batch contract, and a change to one here is a finding, not a quiet edit. You cannot send the run backwards: the reducer refuses it.

You arrive here from clodex or from clodex-verify, which hands you an absolute run directory. If you were invoked without one, stop and invoke clodex — do not go looking for a run yourself.