superforge-ship

Superforge Ship — the release gate

superforge-verify answers "does it work?" with runtime evidence. This skill answers a different question that has stopped more launches:

"Are we allowed to release this, and will we be able to tell what happened after we do?"

A product can pass every test and still be unshippable — because it collects data it never disclosed, because the store will reject it for a reason nobody checked, because there is no way to turn it off if it goes wrong, or because it ships with no instrumentation and the first month produces feelings instead of facts.

---

0. The gate rule

Never report "ready to ship" as prose. End every run with one code:

Verdict	Meaning
SHIP	Every blocker below is cleared, or explicitly does not apply, with the reason recorded
BLOCK	At least one blocker is unresolved. Name it, name what clears it, stop
RISK-ACCEPTED	A known gap is being shipped deliberately. Requires: what the gap is, what it could cost, who decided, and when it gets fixed. Undated risk acceptance is just BLOCK with better manners

A gate that always returns SHIP is decoration. If nothing has ever come back BLOCK, the checks are not being run.

---

1. Legal — what the product's own behaviour has triggered

The single fact that makes this checkable rather than infinite:

Jurisdiction follows your users, not your address. A developer in New York, in Tokyo, or anywhere else faces the same obligations, determined by where the people using the product are and what data is touched.

That is why this gate is universal, and why "I'm not in Europe" is never the answer to a GDPR question — one EU user is enough.

Work in this order, always: what data does it touch → who does that reach → what does that oblige → what must be visible before launch.

The trigger tables — data categories, regional triggers, sensitive-category escalation, children, subscription disclosure, and the explicit list of situations where a lawyer stops being optional — are in references/legal-triggers.md.