Stop-Ship Criterion¶
A release go/no-go protocol — instantiates Tradeoff Guardrail
A short list of no-go conditions that, if any is present at the ship gate, blocks release outright — no matter how ready everything else is.
A Stop-Ship Criterion is a predefined no-go condition checked at the moment of release: if it is present, shipping is blocked, full stop. Its defining move — what sets it apart from the standing floors in this family — is that it is a one-time gate event framed as a disqualifier, not a target. It doesn't say "the product must be at least this good"; it says "if this specific bad thing is true, do not ship, regardless of how good everything else is." A single tripped criterion vetoes the whole release. It exists because the moment of shipping concentrates every pressure to say yes — deadlines, sunk cost, a room full of people ready to celebrate — and that is exactly when a known catastrophic defect is most likely to be waved through.
Example¶
A pharmaceutical plant is at the end of a production run, one batch away from a quarter-end shipping target the whole site is measured on. Everything says go: the schedule, the forecast, the pressure to book the revenue. The stop-ship criteria are the short list that can override all of it — among them, any positive sterility or contamination result, a broken cold-chain excursion in transit records, a missing batch-release signature. These are not quality scores to average; each is a binary disqualifier. When the final sterility test flags a single contaminated sub-lot, the criterion doesn't weigh "one bad sub-lot against a whole quarter's target" — the presence of the no-go condition blocks the shipment, and the batch is quarantined pending investigation. The gate turns the hardest possible moment to say no into a rule that has already said it, and it records which criterion tripped and who held the shipment, so the hold can be audited and the target-versus-safety pressure can't quietly relitigate it next quarter.
How it works¶
- Enumerate no-go conditions, not quality goals. Each criterion is a specific, recognizable bad state (contamination present, a Sev-1 open, a legal blocker) whose mere presence disqualifies — deliberately narrow, so the gate is unambiguous and can't be argued into greyness.
- Check once, at the release boundary. Unlike a standing floor, it fires at a single gate — the ship/deploy/launch decision — where all the go-pressure converges.
- Make it a veto, not a vote. Any one criterion present blocks the whole release; the gate is conjunctive on absence of all no-gos, so a strong showing elsewhere can't buy past a single tripped condition.
- Vest stop authority widely and protect it. Whoever can see the no-go can invoke the stop, and that authority is shielded from the person whose deadline the stop threatens — the point is to make halting the socially default, un-punished move.
Tuning parameters¶
- Criteria strictness — how severe a condition must be to count as no-go. Stricter lists catch more disasters but block more releases and tempt people to reclassify a real no-go as "just a bug."
- Criteria breadth — how many conditions are on the list. A long list catches more but slows every release and invites checkbox fatigue; a short list is enforceable but may miss a category.
- Binary vs. severity-scored — a flat "present/absent" gate versus tiers that only the top tier blocks. Binary is unambiguous; tiering adds nuance but reopens the "is this really a stop?" argument at the worst moment.
- Override path — whether a stop can be released by an exception, by whom, and with what record. A no-override gate is strongest; a narrow, logged, high-level override handles genuine edge cases without becoming a routine escape hatch.
- Stop authority breadth — who may pull the cord. Wider authority catches more but risks nuisance stops; narrow authority is orderly but lets a lone deadline-owner suppress the call.
When it helps, and when it misleads¶
Its strength is placing an unconditional veto at the one decision where optimizing pressure is most concentrated and most dangerous — the go/no-go moment — and framing it so that stopping is the empowered, expected act. The strongest versions borrow the logic of the andon cord: anyone who sees the defect has both the authority and the obligation to halt the line, and pulling it is treated as doing your job, not causing trouble.[n1]
It misleads when the criteria are vague or negotiable at the gate — "significant issues" invites exactly the on-the-spot rationalization it was meant to prevent, and a gate that can be argued with under deadline pressure is not a gate. It also fails through override creep: a stop-ship that is routinely waived "to make the date" trains everyone that the criteria are theatre, so the next real no-go ships too. And a criterion no one checks before the gate is worthless — the gate only works if the evidence for each no-go is gathered before the go/no-go moment, not asserted in the room. The discipline is to keep the criteria specific and binary, guard the override so it stays rare and high, and treat every pulled stop as a success of the system rather than a failure of the schedule.
How it implements the components¶
review_trigger— the ship/deploy gate is the trigger point where the no-go conditions are checked and any present one forces attention.violation_response— defines the consequence as an outright block on release (quarantine, hold, no-launch) rather than a note to fix later.constraint_envelope— encodes each no-go as a hard forbidden region: a present disqualifier means the candidate has crossed outside the acceptable envelope, so "unacceptable to ship" is unambiguous at the gate.
It does not set a positive minimum bar the candidate must clear (minimum_threshold) — that is a Quality Gate, which passes what meets the bar rather than blocking what trips a disqualifier. It also does not name and protect a standing value over time (protected_invariant, margin_buffer) — that is Safety Floor or Minimum Service Guarantee — nor keep the running log of granted exceptions and their owners (decision_rationale, monitoring_and_audit), which is an Exception Register.
Related¶
- Instantiates: Tradeoff Guardrail — the stop-ship criterion is the pattern at the release boundary: a disqualifying condition that vetoes shipping no matter what the schedule wants.
- Consumes: the no-go conditions are often the release-time enforcement of floors declared elsewhere — e.g. a Safety Floor breach or an unmet Nonfunctional Requirement can each be listed as a stop-ship condition.
- Sibling mechanisms: Safety Floor · Nonfunctional Requirement · Minimum Service Guarantee · Rights Constraint · Quality Gate · Budget Floor · Compliance Threshold Check · Exception Register · Ethical Guardrail Review
Editorial Notes¶
Form Classification¶
Form family: Rule, Policy & Commitment
Rationale: Stop Ship Criterion operates by imposes standing no-go conditions whose presence disqualifies shipment. That concrete deployed or enacted form is Rule, Policy & Commitment under the frozen taxonomy.
Nearest alternative: Decision, Gate & Allocation — Although Decision, Gate & Allocation can support this mechanism, the frozen evidence makes its operative form the act that imposes standing no-go conditions whose presence disqualifies shipment; the alternative is therefore secondary rather than defining.
Review outcome: Adjudicated after independent review; high confidence.
Origin Attribution¶
Primary origin: Engineering & Design
Origin pattern: Convergent development
Present-day reach: Universal
Rationale: Hard no-go conditions at release are quality and safety assurance.
Related originating lineages:
- Computer Science & Software Engineering — Release gates block defective builds.
- Logistics & Supply Chain Management — Logistics, inventory, and supply-chain operations supplies a parallel or contributing lineage for the mechanism's defining operation: a short list of no-go conditions that, if any is present at the ship gate, blocks release outright — no matter how ready everything else is.
- Organizational & Management Science — Criteria override schedule pressure.
- Systems Thinking & Cybernetics — Systems thinking, feedback control, and cybernetics supplies a parallel or contributing lineage for the mechanism's defining operation: a short list of no-go conditions that, if any is present at the ship gate, blocks release outright — no matter how ready everything else is.
Review resolution: The blind reviewers agree that engineering_design is the primary origin and differ only on alternate origin disagreement. I preserve every independently explained alternate from both records rather than imposing a numeric cap. I retain convergent because the combined evidence shows independent disciplinary development. The broader reach of universal records portability separately from historical provenance; encyclopedia_synthesis=true preserves the affirmative synthesis judgment where either reviewer identified one.
Encyclopedia synthesis: The exact catalogued form synthesizes established practice rather than reproducing a single standard historical label.
Review outcome: Reconciled after independent review; medium confidence.
Notes¶
A Stop-Ship Criterion is a veto, not a verdict of readiness. It can only ever say "not this, not now" — the absence of any no-go condition means not disqualified, which is not the same as good. Pairing it with a Quality Gate (which blocks advancement until positive quality evidence is present) covers both directions: the gate confirms the product cleared the bar, the stop-ship confirms no disqualifier snuck in. Relying on the stop-ship alone risks shipping something that is merely not-catastrophic.
[n1] The andon cord of the Toyota Production System — a line any worker can pull to halt production the instant a defect appears, under the principle of jidoka (build in quality by stopping at the first sign of trouble). It is the canonical example of a stop authority that is widely vested and culturally protected, so that halting is treated as responsible rather than disruptive. ↩