Claim Check executes locally. By default, Shipmoor does not upload source, diffs, prompts, findings, verdicts, evidence, file paths, repository names, branch names, tests, or acceptance criteria.
Required Shipmoor service contacts
Every installation requires account and device authorization. On Free, each admitted Claim Check contacts the allowance service before engine, judge, runner, evidence, progress, or output work begins. That request carries only opaque account/device identity, command family, random invocation idempotency key, invocation source, and timestamp.
If the Free allowance service is unavailable, Claim Check does not execute. Pro may rely on a valid signed unlimited lease.
Local inputs and artifacts
Acceptance sets, intent tickets and prompts, diffs, findings, verdicts, VSA files, trace sidecars, tests, and repair output remain local by default. Usage metadata never enters evidence, output schemas, or self-digests.
Claim Check output may include repair guidance on Free as part of the admitted Claim Check invocation. Standalone advanced repair and history capabilities require Pro.
Bring your own judge
Shipmoor does not host a model. If you explicitly enable a bring-your-own-agent judge, that subprocess uses the provider and configuration you selected. Before the judge sees a signal, Shipmoor masks the obligation text, changed file paths, commit subject, and per-file added-line summary. The trace sidecar contains only masked signals and excludes raw per-sample model rationale. Review your selected provider’s data practices separately. Enabling it does not cause Shipmoor’s authentication or allowance service to receive source-shaped fields.
Local probe-backlog recording
Probe coverage recording is off by default. Opt in for the current shell with:
export SHIPMOOR_INTENT_DRIFT_TELEMETRY=1Records append only to the gitignored local file .shipmoor/intent-coverage.jsonl. Each record contains masked, normalized term frequencies, a locally salted intent fingerprint, coverage flags, confidence, matched probe ids, a coarse domain, and the probe-library version. It never contains raw intent text, word order, or model rationale. .shipmoor/intent-coverage.salt remains local beside the store. SHIPMOOR_OFFLINE=1 disables recording even when the opt-in variable is set.
shipmoor claim-check probes gaps, scaffold, and coverage read this local store. Gap clusters are reported only after the configured k-anonymity threshold is met; no backlog command uploads the store.
Counting without project context
A Free Claim Check consumes one Claim Check invocation. Internal Review and Test Evidence composition beneath that admitted parent command does not consume those separate counters. A rerun is a new invocation, regardless of verdict or later operational outcome.
See Security & privacy for credential storage and the complete service metadata allowlist.