Launch lifecycle plugin for Claude Code

Ship your
webapp wisely.

Fifteen skills that make Claude's answers production-ready — from architecture decisions to deploy-day security — plus a four-agent auditor that reads your codebase in parallel and tells you exactly what's missing.

Install Source v0.6.6 · MIT
shipwise-state.json live
stackNext.js · Postgres · Vercel
phasebuild
levelintermediate
scanned28 items · 9 done
readiness0%
▲ top gap — error tracking · ~10 min
01 — The lifecycle

Design. Build. Ship. Grow.

Shipwise knows which phase you're in and loads only what that phase needs. You never pick a skill — the work you're doing picks it.

Phase 1

Design

Validate the idea, scope the MVP, form the entity, plan for accessibility before a line of UI exists.

3 skills · 15 docs
Phase 2

Build

Architecture decisions, fullstack patterns, CI/CD, test strategy, and security hardening as you write.

5 skills · 24 docs
Phase 3

Ship

Observability, SEO, billing, legal compliance, and a launch-day sequence from T-2h to T+4h.

5 skills · 25 docs
Phase 4

Grow

Event taxonomy, funnels, retention cohorts, revenue analytics, lifecycle email, cost control.

1 skill · 12 docs
0
Skills

Fourteen domain skills plus an orchestrator that routes between them.

0
Audit agents

Four parallel auditors, a delta scanner, a fallback, and a gap analyser.

0
Reference docs

Every one carries at least one copy-paste template. Change the marked values and ship.

0
Lifecycle hooks

Session context, edit whispers, deploy gate, progress tracking. Zero friction.

0/25
Scenarios passed

Across three developer archetypes and three test fixtures. All open source.

02 — How it works

Four ways it
reaches you.

01

Scaffold/shipwise

Nine questions, then a codebase scan and a project profile card with your readiness score, top gaps, and time estimates. The scan starts in the background after question four, so it's done before you are.

Once, at start
02

Checkpoint gateshooks

Fire on session start, file edits, and deploys. Auth code draws security tips, billing code draws webhook reminders, secrets draw a gitignore warning — deduplicated across restarts, once per topic. The deploy gate stops you shipping with P0 gaps open.

Fully automatic
03

Contextual skills15 domains

You don't invoke these. Claude loads them when the task matches — auth code pulls security patterns, payment code pulls billing practice. Off-topic prompts load nothing at all.

Claude decides
04

On-demand audit/launch-audit

Four agents scan your codebase in parallel and merge into one readiness state. quick mode reads only what changed since the last run. /launch-checklist drills into one domain.

When you choose
03 — The auditor

It doesn't run
one big scan.

/launch-audit fans out to four specialised agents that read different domains at the same time, then merges their findings into a single readiness state. All four run on Haiku with a turn cap — which is the only reason a fan-out this wide is cheap enough to run often.

/launch-audit auditor-security headers · auth · validation · deps · tests auditor-infrastructure CI/CD · Docker · env · secrets · health auditor-ux-accessibility a11y · states · contrast · labels · landmarks auditor-compliance-quality legal · SEO · billing · code quality merged state readiness % · P0 gaps
/launch-audit

Full parallel scan

All four auditors at once across every domain. If one fails or times out, that domain falls back to the monolithic auditor — a partial failure never yields a partial audit.

~30–45s~$0.12
/launch-audit quick

Incremental delta

A delta auditor reads git diff and scans only changed files, returning just the items that improved or regressed. Past fifty changed files it upgrades itself to a full scan.

~10–15s~$0.03
/shipwise

Background scan

During first-run setup the audit starts in the background after question four, finishing while you're still answering the interview. You never wait on it.

Overlapped
auditor-security
Security headers, auth, input validation, dependencies, test coverage.
auditor-infrastructure
CI/CD, Docker, environment config, secrets, error tracking, health endpoints. Also returns the detected stack.
auditor-ux-accessibility
Accessibility, empty and loading states, contrast, form labels, landmarks.
auditor-compliance-quality
Legal pages, SEO, billing integration, code quality, launch readiness.
auditor-delta
Incremental scan of git-changed files only — the engine behind quick mode.
launch-readiness-auditor
Monolithic full-checklist scan. The per-domain fallback when a parallel auditor fails.
gap-analyzer
Turns audit results into a prioritised plan with time estimates and sequencing.
04 — The library

Fifteen skills,
seventy-eight docs.

Every reference doc carries at least one copy-paste template. Counts below are reference documents per skill, excluding the skill definition itself.

Phase 1

Design

3 skills · 15 docs
validate-idea
JTBD framework, Lean Canvas, user interview scripts, competitive analysis, TAM/SAM/SOM sizing, landing page tests, go/no-go frameworks.
4 docs
product-design
MVP scoping with RICE, user stories, wireframe pipeline, 50-item WCAG 2.2 AA checklist, 14-dimension design audit, form UX, onboarding, micro-interactions.
8 docs
business-legal-foundation
Entity formation decision tree, co-founder agreements, IP assignment, trademark, banking, accounting, insurance.
3 docs
Phase 2

Build

5 skills · 24 docs
tech-architecture
SaaS boilerplate comparison across five starters, framework matrix, database selection, auth decision tree, hosting comparison, monorepo guidance.
6 docs
fullstack-development
Component architecture, state management, API design, multi-tenancy with Postgres RLS, migrations, caching, error handling, dashboard UX patterns.
9 docs
platform-infrastructure
CI/CD templates for three stacks, Docker, Terraform, environment management, secrets rotation, DNS/SSL/CDN, preview environments.
3 docs
quality-assurance
Testing pyramid, Playwright setup with example tests, k6 load scripts for smoke, spike and soak, cross-browser checklist.
2 docs
security-compliance
OWASP Top 10, a 519-line auth hardening checklist, CORS config, security headers for Next.js, Express and Nginx, dependency and secret scanning. Detects managed auth and skips what doesn't apply.
4 docs
Phase 3

Ship

5 skills · 25 docs
observability-reliability
Sentry config templates, health endpoints for Next.js and Express, structured logging, alerting architecture, backup and DR with RTO/RPO, incident playbook, status page.
5 docs
seo-performance
A 507-line technical SEO checklist, structured data, Lighthouse targets, Core Web Vitals, Web Vitals RUM, bundle optimisation, landing and pricing page UX guides.
5 docs
billing-payments
Stripe vs Paddle vs Lemon Squeezy matrix, subscription architecture, webhook HMAC, dunning strategy, tax compliance, free trial design.
4 docs
legal-compliance-final
Privacy policy requirements, TOS framework, cookie consent, GDPR/CCPA checklist, data retention, SOC 2 readiness, OSS license audit.
5 docs
launch-execution
Staging regression, pre-ship verification with 25+ binary checks per page, rollback template, war room setup, a T-2h to T+4h timeline, support channel setup.
6 docs
Phase 4

Grow

1 skill · 12 docs
growth-ops
Event taxonomy, funnel instrumentation, five-funnel friction scoring, A/B testing, retention cohorts, privacy-first analytics, revenue analytics from Stripe, lifecycle email, referral design, cost optimisation.
12 docs
Orchestrator

Routing

1 skill · 2 docs
launch-assess
Detects your project phase, assesses readiness, and routes to the right domain skill. The one skill that decides which of the other fourteen you get.
2 docs
05 — Evidence

Same prompt.
Same model. Better code.

Vanilla Claude18/40
Claude + Shipwise37/40

One prompt — "set up user auth with email/password, include proper security practices" — run against the same fixture project with and without the plugin. A 106% improvement, covering all eleven security dimensions the checklist tracks.

  • Argon2id hashing
  • 3-tier rate limiting
  • CSRF double-submit
  • Hardened session config
  • HIBP k-anonymity
  • MFA / TOTP
  • Security headers
  • Zod input validation
  • Structured errors
  • Account lockout
  • bcrypt fallback guidance
25 scenarios · 25 passed
01Fresh scaffold — beginnerInterview, beginner mode, guided remediation, scoped itemsPASS
02Fresh scaffold — seniorAll components detected; static metadata and linters caughtPASS
03Tech stack — beginnerSingle clear recommendation per domain, no matrix dumpPASS
04Tech stack — seniortRPC vs GraphQL resolved in two steps with handoffPASS
05REST API patternsrequestId, Zod, rate limiting, RBAC, cursor paginationPASS
06Accessible data tableEmpty state with CTA, aria-sort, aria-checked, keyboard navPASS
07Off-topic silenceZero false triggers on four off-topic prompts, all 15 skillsPASS
08Skill boundary routingCorrect skill fires; no co-trigger on "plan selection"PASS
09Cross-skill flowArchitecture → fullstack; schema from prompt 2 used in prompt 3PASS
10/launch-audit full scan9/9 components detected, 20 gaps, scoped readiness %PASS
11/launch-checklist securityOWASP walkthrough, auth hardening, invalid domain handledPASS
12Before/After auth18/40 → 37/40, 11/11 security dimensionsPASS
F1Multi-step signup formStep shell, async per-step validation, sessionStorage persistencePASS
F2Inline validation timingPer-field timing tree, strength meter, cross-field refine()PASS
F3Autosave settings pageuseAutosave hook, unsaved state, auto-retry, mixed modePASS
O1First-time user experienceEmpty-state-as-onboarding plus a defined activation metricPASS
O2Onboarding checklistDB persistence, progress ring, auto-dismiss, skip optionPASS
O3Dormant user re-engagementDay 7/14/30 sequence plus WelcomeBack componentPASS
D1SaaS dashboard layoutBento grid, KPI cards, date range, responsive, zero-dataPASS
D2Empty dashboard stateFirst-time vs returning distinction with onboarding CTAPASS
P1Pricing page design3-tier layout, toggle, comparison matrix, social proof, FAQPASS
P2Free-to-paid conversionUsage limits, feature gating, contextual nudgesPASS
M1Button loading statesFull idle → loading → success/error → idle state machinePASS
M2Toast notificationsFour types, stacking, positioning, aria-live regionsPASS
M3Skeleton vs spinnerDecision tree on duration and layout predictabilityPASS

Full results, prompts and findings are open source.

06 — Calibration

It adapts to you,
not the other way.

BeginnerIntermediateSenior
ChecklistFull explanationsStandard termsTerse, code-first
WhispersJargon explainedOne-line remindersSuppressed if obvious
Deploy gateGuided remediationTime estimatesGap list only
AuditOne recommendationOptions + tradeoffsDecision matrix

Set during scaffold, changed any time with /shipwise set-level.

  • < 100

    Focus on shipping. Skip SOC 2, skip multi-region — they aren't your problem yet.

  • 100 – 1K

    Add error tracking, basic monitoring, and a privacy policy.

  • 1K – 10K

    Rate limiting, load testing, incident response, backup and disaster recovery.

  • 10K+

    Full observability, SOC 2 readiness, multi-region, cost optimisation.

Expected user scale reweights every priority in your checklist.

07 — Quick start

Three commands.

Step 01 — Install

From the Claude Code plugin marketplace.

Step 02 — Initialise

Nine questions and a codebase scan. Once per project.

Step 03 — Ship

Hooks are already live and skills auto-trigger. Audit before each milestone.

Ready to ship wisely?

25/25 test scenarios · 11/11 security dimensions · zero friction

MIT · Built for Claude Code · Skills portable via convert.sh