Why the plan comes before the build

Fast is not the same as invisible

A one-click deployment can still leave the owner guessing: Which runtime was selected? What data does the app expect? Which values are private? What happens if the build fails?

Shiplet puts a review step between detection and execution so speed does not erase control.

Fail closed when the answer matters

Shiplet does not claim universal arbitrary-code isolation. When the repository asks for a capability outside the supported contract, the safer product behavior is to show the boundary and stop. An explicit limit is more useful than a deployment that appears successful but cannot be operated safely.

A plan becomes operating context

The decisions made before deployment should remain useful after it. Release history, the repository revision, logs, configuration, and recovery belong to the same application story. That continuity is what lets an owner understand a change instead of reconstructing it across providers.