A workflow that takes a task or open pull request through implementation, independent review, fixes, checks, and merge preparation. A pull request is a proposed code change awaiting review before it is merged into a project.

Move a change toward a merge-ready pull request, record independent verdicts, run bounded fix rounds, prepare required checks, and merge through controlled Git operations.

It separates implementation from review, uses fresh agents for fixes, preserves progress across restarts, and blocks unsafe Git actions such as force-pushing or rebasing.

ship — Skill for Claude Code by RobinNorberg/oh-my-copilot

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add RobinNorberg/oh-my-copilot --skill ship

Clone the repo

git clone --depth 1 https://github.com/RobinNorberg/oh-my-copilot

Made for: Claude Code.

Or install oh-my-copilot, the plugin that ships this one along with the rest of its 63 skills, 21 commands, 20 agents, 11 hooks, 1 MCP server.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/robinnorberg/oh-my-copilot/ship/github.svg)](https://agentmods.dev/skills/robinnorberg/oh-my-copilot/ship)

Your own site

<a href="https://agentmods.dev/skills/robinnorberg/oh-my-copilot/ship"><img src="https://agentmods.dev/badge/skills/robinnorberg/oh-my-copilot/ship/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/robinnorberg/oh-my-copilot/ship"><img src="https://agentmods.dev/badge/skills/robinnorberg/oh-my-copilot/ship.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 37 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 3,809 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00037	$0.03809
Opus 5.5	$0.00015	$0.01524
Sonnet 5.5	$0.00007	$0.00762
Haiku 4.5	$0.00004	$0.00381

Measured 4d ago against content hash c65cf50551b1, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

ship scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/ship/SKILL.md · 265 lines

How it starts

The opening of the file, as written. The whole thing — 265 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Ship

Carry one change from task (or existing PR) to a merge-ready PR. Agents do the judgment work; omc ship does everything mechanical and refuses the unsafe steps itself. The ship state lives in .omg/state/ship/<pr>.json, so a run survives restarts: omc ship status <pr> tells you where you are.

Hard rules (every lane, every brief)

Each rule exists because breaking it once cost a round-trip or a wiped tree.

Never self-approve. The lane that wrote a change never records its verdict; omc ship verdict refuses a reviewer equal to the implementer.
Reviewers get the diff and the task, never the author's summary or conclusion. An author's "all tests pass" anchors the reviewer.
Fixes go to a fresh agent, never back to the implementer or the reviewer. A fresh context does not defend its earlier choices.
No git worktree add / git worktree remove, no npm ci in a junctioned tree: removing a worktree empties the shared node_modules junction target.
No force push, no rebase, no amend. Update a branch with git merge origin/<base> and a plain push. omc ship only spawns an allowlist of the exact git/gh/node command shapes it builds, so force, rebase, pull, amend, reset, gh api, any npm command and a push to main / master / dev / the run's base are refused before anything spawns.
The inventory regeneration is the LAST commit. Any later commit re-stales inventory/inventory-graph.json; omc ship prepare orders this for you.
Merge only through omc ship merge. It checks the gates and the verdict; a human-typed gh pr merge skips both.
Lanes never edit .omg/state/ship/, never touch the ship block of .copilot/omg.jsonc, and never set OMG_SHIP_HUMAN. Those are the owner's controls: ship.allowAdminMerge is the only switch that runs the admin merge, and OMG_SHIP_HUMAN=1 is the only way to init --force over a blocked or merged run, to reset the implementer or fix-round count of a run that has verdicts, or to merge a PR that touches .copilot/omg.jsonc, .github/known-flaky-tests.json or .github/workflows/.

Read the full file on GitHub · 265 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

4d ago First seen · 265 lines · 37 tokens per session scan A c65cf50551b1

Subscribe to this mod's changes

ship is a skill published in the GitHub repository RobinNorberg/oh-my-copilot (5 stars, last pushed 2d ago), licensed MIT. It adds 37 tokens to every session and 3,809 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-12.

Code review Commits Git and workflow agentic-coding ai-agents automation copilot copilot-cli copilot-enabled

work-unit-commits

Plan commits as reviewable work units. Trigger: implementation, commit splitting, chained PRs, or keeping tests and docs with code.

Gentleman-Programming/gentle-ai · 33 tokens

validate-changes

Evaluate staged changes using LLM-as-a-Judge before committing.

FlorianBruniaux/claude-code-ultimate-guide · 16 tokens

signing-preflight

Before the first commit of a session, check that commit signing will work — the key is loaded and unlocked — and ask the operator to unlock it once, up front, instead of discovering it after a hundred unsigned commits. Never disables signing silently, never re-signs history without asking. Use at the start of…

avelikiy/great_cto · 105 tokens

ase-repo-review

Perform a holistic, human-reviewer-style critique of the currently staged Git changes (or, with --unstaged, of the unstaged and untracked changes, with --branch, of a branch against its base, or, with --commit, of a single commit) and emit an approve/reject verdict with prioritized, severity-tagged, line-cited…

rse/ase · 111 tokens

spec-finish

Post-implementation completion workflow for Spec-backed Plans. Use after spec-implement completes to validate, review, create stacked commits, and open a PR via code-pull-request. Triggers only with an active Spec-backed Plan after spec-implement completes, including when the user says "finish", "done", or "complete"…

martinffx/atelier · 73 tokens

gh-pr

Create GitHub pull requests with smart title and description from branch commits.

mir-am/skills-agents-ai-coding · 16 tokens