Methodology · how we ship

The Get Shipped method.

In plain words: how we get AI-built code to production. A zone, seven gates, a proof record. AI writes code at machine speed, and getting it live without a quiet leak, an unfinished tree, or an unchecked change is a discipline, not a hope.

What this page gives you

The zone the AI works inside, the seven gates before live, and the proof record we leave behind. Every check is a real measurement, never a verdict.

The controlled zone

An AI agent can touch anything it is given. So the first thing we do is decide what it may touch. Every engagement starts by drawing a boundary around the work: the files, routes and services in scope, and the things that are off-limits by default.

IN THE ZONE
  • The application code in scope for this piece of work
  • Additive schema changes, with a version bump alongside them
  • Content, copy and configuration the change needs
  • Its own repo-resident brief and handoff notes
OUT OF BOUNDS
  • Secrets and credentials, which never enter the code
  • Renaming or dropping a column another product shares
  • Deploying from a dirty tree that carries unrelated work
  • Anything the sign-off step has not cleared

The zone travels with the project, not the tool. A one-page brief (PROJECT-BRIEF.md) and a handoff (HANDOFF.md) live in the repo, so any model or session reads the same boundary first and never re-learns it from scratch.

The gates before live

Before anything reaches your users, the change runs through a fixed sequence of checks. Each one catches a specific failure that AI-written code ships often. A blocking check turns the whole run into a NO-GO. The gate is a real tool you can run yourself, open on the ship-safe page.

1Dirty-tree guardA production deploy ships the working tree, not a tidy commit. This blocks on any tracked, modified file, so no unrelated or half-finished work rides along by accident.explainer →2Secret scanReads every committed and staged file for leaked-secret patterns (OpenAI, Stripe, AWS, GitHub, private-key blocks and more). A match blocks the ship and prints a masked fingerprint, never the secret itself.explainer →3Tracked .env fileA committed .env is a leak by itself, whatever it contains, because git history keeps every value it ever held. This blocks on any tracked .env file; a local .env that is not gitignored warns, one git add away from a leak.explainer →4TypecheckRuns tsc --noEmit. Type errors block. A change that does not compile does not ship.explainer →5Production buildRuns the full npm run build. The build must complete for the change to pass. This is the check that must read Compiled successfully.explainer →6Schema-bump checkAdditive database changes are skipped on a live database whose version already matches, so a change that alters schema without bumping the version passes on a fresh database and silently no-ops in production. This flags exactly that.explainer →7Envelope mapsThree read-only maps of what the app actually exposes: every route and whether it authenticates its caller, every external and LLM integration and the key behind it, and every scheduled job and whether it is gated. A write route with no gate, a secret reachable from the browser bundle, or a publicly triggerable cron is surfaced here.explainer →

The safety checks own the NO-GO. The envelope maps warn, never block: a surprising map is information you should see, not a reason to stop on its own.

Run these seven gates in your own repo, no install:

your-repo · the same gates
npx getadvantage

you geta read-only GO or NO-GO for your repo before you deploy: dirty-tree guard, secret scan, tracked .env check, typecheck, plus three maps of what your app exposes. Add --build for the full production build.

Built is not deployed. Deployed is not verified.

Three words that sound alike and mean different things. The whole method rests on keeping them apart.

BuiltThe change compiles and the build completes on our machine. It exists. It has not touched your users.
DeployedThe build is live at a URL, and we have confirmed the deployment is the one we intended, not a stale or misrouted one. Live is not the same as working.
VerifiedA person has walked the real journey on the live build: clicked the buttons, changed the inputs, confirmed the output actually changed and makes sense. Only now is the change done.

The proof record

Every run ends on a record of what was checked and what the checks found. It is deliberately plain: each check with a pass, a warning or a fail, then one overall verdict.

Checks
  ✓ Dirty-tree guard — Working tree is clean.
  ✓ Secret scan — no leaked-secret patterns matched.
  ✓ Typecheck (tsc --noEmit) — compiled with no type errors.
  ✓ Production build (npm run build) — build completed.
  ✓ Schema-bump check — no DDL changes.

Verdict
  ✓ 5   ⚠ 0   ✗ 0
  GO — all checks clear. Safe to ship.
What it proves

That each named check ran and what it found at that moment: a clean tree, no matched secrets, a green build, a considered schema change.

What it does not prove

That the app is secure, certified or bug-free. A clean run means these specific checks found nothing, not that nothing is there. We never call an app secure.

Where a person decides

The gate produces a verdict. It does not press the button. A NO-GO stops the ship until the blocking issue is clear. A GO with warnings hands you the warnings to eyeball first. And even a clean GO ends with a person walking the live build before the work is called done. The machine measures. A human releases. Every engagement ends on a plain go or no-go, in writing.

One module · Get Found

The public reading behind Get Found

One of the checks we run is a reading of how legible a page is to AI engines. We fetch one page the way an AI crawler does and read 9 signals, weighted by how much they decide whether ChatGPT, Claude or Perplexity can read, cite and recommend the app. The weights sum to exactly 100. The hardest, rarest signals carry the most points, so a pretty page with none of them reads low, honestly.

The curve: scores up to 70 are taken as measured; above 70 we compress the top end, so high-80s and 90s are rare and earned, and only a page passing everything reads 100. Grades: A ≥ 90 · B ≥ 72 · C ≥ 55 · D ≥ 35 · F below. Live outputs: the leaderboard and the vibe-coding study, both rebuilt from real scans every day.

Want the AI built and shipped, with the proof included?

We scope it, gate it, ship it and prove it, and run this method for you along the way. Start with a call.

Book a call →