The rungs between a merged commit and a thing somebody has
delivery/1 — the rungs between a merged commit and a thing somebody actually has. Published, distributed and linked are measured by fetching, never declared.
Most organisations have a backlog and a changelog: what somebody wants, and what somebody merged. Between them is the gap everything falls into after the merge — shipped, published, distributed, linked — where finished work goes unread because nothing checks whether it actually arrived. This is the ladder across that gap, and the four rungs after the merge are settled by fetching rather than typed into a status field.
`delivery/1` is a seven-rung ladder from a filed intention to a thing another host points at — filed, committed, built, shipped, published, distributed, linked — with a line drawn across the middle. Everything left of the line somebody declares; everything right of it something checks.
The four measured rungs are settled by fetching, never by a status field. `shipped` is git saying the ref is reachable from the default branch; `published` is a fetch of the URL returning a body; `distributed` is the URL appearing in a machine surface the property publishes; `linked` is the URL appearing in a document served by a different host. `advance(item, { to: "published" })` throws and tells you to run `observe`.
A board is only worth reading if a green tick cannot be typed in, so moving the cheap action out of reach and the expensive one into automation is the whole design. For a repository with no package.json, a dependency-free `vendor-delivery.mjs` runs the same rules, and CI asserts the two agree.
Installing it puts this command on your path — read from the package’s own manifest, so this list cannot drift from what you actually get.
deliveryThe board cannot be faked because its four measured rungs are re-derived by fetching, not stored: observe fetches each URL, checks the machine surfaces a property publishes, and moves the ladder from what it finds. The dependency-free vendor-delivery.mjs is byte-checked against the package, so a repository with no toolchain runs the identical rules. Verify it yourself by running `npx delivery observe` and watching a rung refuse to advance until the evidence exists.
Apache-2.0, read from the package’s own manifest. Embed it in anything, including closed software — that is what makes a spec adoptable and a verifier worth running. FlashyOS’s server side is AGPL-3.0-only instead, and a test in the monorepo asserts the direction between them: AGPL code may consume this, this may never consume AGPL code.