Deploys you can read.
One typed workflow file per repo. It builds your images, plans and applies your infrastructure, waits for a human, and deploys. It's checked before anything runs, and it runs the same on your laptop as in CI.
Public beta · early access
# deploy the api: image → infra → prod
name: api
on: push main
steps:
build: oci.image
from: ./Dockerfile
push: ghcr.io/acme/api:{git.sha}
sign: true
plan: tofu.plan
dir: ./infra/prod
review: approval
show: plan.changes
from: @platform
apply: tofu.apply
plan: plan.file # the exact plan you approved
deploy: k8s.rollout
image: build.digest # oci.Digest, never a tag
to: apply.out.cluster
wait: healthy, 5m01 / Push and pray
Hundreds of lines of YAML nobody fully understands. Terraform and Docker held together with shell scripts. Every repo drifting a little. And the only way to test any of it is to push and wait.
02 / Typed and validated
Every step has typed inputs and outputs. Wire an image tag where a digest belongs, misspell a step, or reference a plan that doesn't exist, and keepshipping check tells you in under a second. Your editor does too.
Fine print: the checker catches wiring and type mistakes. It can't tell you that your tests are wrong or that the registry is down.
03 / Local = CI
keepshipping run on your laptop uses the same engine, the same file and the same steps as the CI runner. If it works here, it works there.
Same digest. Same plan. Same order. The only difference is who pressed y.
Fine print: the engine and steps are identical. Hardware, network and secrets still differ. Steps that can only run in CI are marked, and check tells you before you start.
04 / Built in, not bolted on
oci.image · oci.artifact
Use your Dockerfile. Push to any OCI registry. Signing is one line. The step returns a digest, so every later step deploys exactly what was built, never whatever latest points at today. Charts, SBOMs and other OCI artifacts work the same way.
tofu.plan · terraform.apply
Terraform and OpenTofu both work. The plan is saved, shown to a reviewer in plain terms, and apply runs that exact file. If the world changed since the plan, apply stops and asks again.
Fine print: a clean plan shows what will change, not whether you should change it. That part is still your call.
05 / Reusable blocks
Package steps as a typed, versioned block. Each repo pins a version and upgrades on its own schedule. No copy-pasted YAML, no quiet drift.
# acme/blocks · web-service@v3
block: web-service
inputs:
image: oci.Digest
domain: string
replicas: int = 2
# in any repo
deploy: acme/web-service@v3
image: build.digest
domain: api.acme.dev06 / Escape hatch
Database migrations, odd APIs, that one legacy thing. Drop into a script with typed inputs and outputs, and it runs locally and in CI like every other step.
// ship/migrate.ts
export default step({
inputs: { db: secret() },
async run({ db, log }) {
const n = await migrate(db)
log(`applied ${n} migrations`)
return { applied: n }
},
})07 / Safe for AI agents
Coding agents can write, check and run your workflow. They can't guess their way into prod: a file that doesn't type-check never runs, and anything risky waits for a person.
policy:
agents:
can: check, build, plan, deploy staging
ask: @platform
before: apply, deploy prod, destroy
never: read secrets
# humans follow the same file, minus the leash
A decide step sends the plan to Jev, a typed decision model from TypeSafe AI. It returns one of the answers you defined plus a confidence score, so the checker validates it like any other step. Low-risk, high-confidence changes go through on their own. Everything else waits for a reviewer, with the reason attached.
risk: decide
model: typesafe/jev
ask: "How risky is this plan?"
input: plan.changes
returns: low | medium | high
review: approval
auto: risk is low ≥ 0.95
and plan.destroys == 0
else: ask @platform, show risk.reasonFine print: Jev answers in milliseconds and only returns the answers you defined, but it can still be wrong. A confidence score is a number, not a promise. You set the threshold, destroys always go to a human, and every decision is logged with its score.
08 / Cloudflare console · in private use
Zones, DNS, Workers, Pages, D1, R2, custom domains, email routing and security settings, managed from a console that never clicks in Cloudflare for you. Every change becomes Terraform in a pull request: planned, shown, approved by a person, then applied and deployed by a ship.ks run. AWS comes next, starting with SES for email.
| Site | Runs on | Last deploy | Baseline | Drift |
|---|---|---|---|---|
| livingbrain.wiki | Worker · static assets | main · 4c36c60 | 100% | none |
| colonizer.dev | Pages | main · 04c6d8c | 100% | none |
| sealb.in | Pages | main · 93a0033 | 100% | 1 DNS record |
| factory0.ventures | Pages + Functions | main · 803d3b1 | 100% | none |
| api.owlpost.to | Worker · D1 · R2 + AWS SES | main · — | 92% | none |
main, with rollback.09 / Honest comparison
Including the rows where it wins.
| YAML-based CI | Shell scripts, glued | Keep Shipping | |
|---|---|---|---|
| Mistakes found | When the job reaches that line | When the script reaches that line | Before anything runs |
| Test locally | Mostly no. Push and wait. | Yes, if your laptop matches the runner | Yes. Same engine as CI. |
| Containers and IaC | Community plugins of varying age | Whatever you wrote in 2021 | Built in: OCI, Terraform, OpenTofu |
| Review plan before apply | Possible, with artifacts and manual jobs | Someone reads the terminal | One approval step |
| Sharing across repos | Templates, or copy-paste | Copy-paste | Typed, versioned blocks |
| AI agents | Push commits and read logs until green | Can run anything the shell allows | Checked first, scoped by policy, human approval for risky steps |
| Maturity | Huge ecosystem, years of production use | Runs anywhere bash does | New. That's why it's early access. |
Plan. Apply. Ship. Repeat.
Early access opens in small batches. One email when your invite is ready, nothing else. Privacy.
Public beta · early access