Code Factory

6 mandatory audit lanes. 136 coded rejection conditions. One human-owned release decision.

Your code passed. But did it pass the right tests?

An AI agent—or a human developer—can write the code, write the tests, and set the rules used to approve its own work. Everything can turn green while the result still misses the request, leaks another tenant's data, breaks during a retry, damages a migration, or slows down in production.

Code Factory is an engineering audit and orchestration system: the independent review layer between “the build passed” and “a person should approve this.”

It seals the original intent before work begins, observes what changed, challenges the implementation and its tests, and connects every decision to inspectable evidence. If evidence is missing, contradictory, stale, or based on a weakened rule, the result does not quietly become a pass.

One review path, six questions

Audit lane	The practical question it answers
Stateful workflows	Do business rules still hold after real sequences such as create, cancel, retry, and refund?
Authorization and tenant isolation	Can one customer, session, export, cache, or background job reach another customer's data?
Failure and recovery	What happens during duplicate requests, timeouts, partial writes, worker crashes, and retries?
API and consumer compatibility	Will this change silently break an older app, SDK, integration, or service?
Migration and data integrity	Can the system upgrade without losing, corrupting, or stranding data?
Performance and resources	Did latency, queries, memory, connections, or other resources regress against an approved baseline?

Those lanes contain 81 lane-specific and 55 cross-cutting coded rejection conditions. The source-bound inventory recomputes the total from the implementation; it is not a claim that every project executes 136 tests.

Built for the way you work

• Solo developers and vibe coders: get a second opinion before a plausible AI-generated change becomes your problem in production.
• Engineering teams: compare the request, code delta, independent checks, repair evidence, and remaining unknowns in one reviewable handoff.
• Enterprise teams: keep policy provenance, exceptions, approvals, tenant boundaries, and evidence traceable without giving the coding agent authority to redefine success.
• Connected agents: use the CLI, FactoryLine IDE surfaces, MCP, WebMCP, or A2A handoffs to follow the same bounded process and report the next action to a human.

Specialist modules join the same review when needed: Deep Defect Mesh consumes analyzer evidence, SaaS checks examine customer journeys, and AppForge organizes mobile build, design, privacy, signing, and store-submission evidence. AppForge does not replace the other audit lanes or promise store approval.

Choose your review path

pip install factoryline-code-factory
factory guide

factory guide is a read-only orientation: it shows the smallest suitable path without running tests or agents. When you are ready to produce evidence, follow the engineering review workflow. Its result shows what was checked, what failed, why it matters, what evidence supports the finding, and what must happen next. Code Factory does not promise perfect software. It makes the basis for approval visible and keeps the final decision human-owned.

For developers: how the review connects across modules

From a plausible change to an inspectable engineering decision

• Build what was actually requested. SpecLine clarifies requirements; sealed intent and Oracle Firewall checks flag scope drift and weakened gates.
• Review behavior beyond a green unit test. Six audit lanes coordinate stateful invariants, authorization and tenant isolation, failure/concurrency recovery, API compatibility, database migration, and performance/resource regressions. Each lane needs the appropriate runner and real evidence.
• Turn findings into repair work. Deep Defect Mesh checks supplied analyzer evidence; linked traces and repair comparisons keep consequences, stale results, and the next validation visible.
• Keep the handoff coherent. ForgeLine orchestration and FactoryLine receipts connect work across modules. Mission Control and Graph Ops show humans and connected agents the same scope, blockers, evidence, and next step.
• Activate specialist checks when needed. SaaS journey checks and AppForge mobile-release evidence fit into the same review path. AppForge is an optional module, not the whole product.

The payoff: a reviewer can see what was audited, what passed, what remains unknown, and what must happen next. A receipt supports that decision; it is not a guarantee of defect-free code, enterprise certification, or store approval. People retain authority over policy, exceptions, and release.

Install the CLI, then follow the engineering review workflow for a full review:

pip install factoryline-code-factory

Want a small demonstration first? factory first-proof --root . challenges whether a test can actually reject its declared failure in a disposable sandbox. It writes a receipt and a privacy-safe Proof Card; it does not assess or change your project. First Proof is one entry point—not the scope of the full audit.

LLM-friendly product context: Canonical Product Card states the supported capabilities, boundaries, audiences, integration terms, and exact vocabulary that documentation assistants and agent tools may safely reuse. It is intentionally claim-bounded: local evidence is not a release, provider approval, remote execution, or a guarantee of correctness.

Pick the path that matches your work

Beyond hollow tests: Deep Defect Mesh evaluates signed analyzer-report contracts, flags missing negative controls, traces findings into Graph Ops, and compares repair outcomes. It coordinates supplied evidence; it does not execute the analyzers or guarantee that a clean report means safe code.

Choose your review path below. The current factory guide command still lists the existing onboarding paths, including the solo First Proof demo; it is not the full engineering-review workflow linked above.

• Individual developer or vibe coder: What did my change miss? Use the engineering review workflow to inspect intent, behavior, and evidence. Try factory first-proof --root . for a contained demonstration first.
• Engineering team: Did the agent build what we asked for? Start with factory oracle status --root .. Bind the original intent, observe the exact file delta, challenge the tests independently, and keep approval human-owned.
• Enterprise evaluator: Can we govern agent work without trusting the agent's story? Start with factory graph ops --root . --json. Inspect the source-to-decision chain, blockers, unknowns, and authority boundaries in a controlled pilot.

Choose the relevant audit scope. Specialized SaaS, mobile, multi-repository, and enterprise controls remain available in the advanced workflow guide only when their trigger applies. AppForge is an optional mobile-delivery capability; it surfaces avoidable gaps but cannot guarantee store approval.

For a release-bound service change, use the six-lane runtime assurance workflow. It coordinates stateful invariants, tenant isolation, fault recovery, consumer compatibility, database migration, and equivalent-load performance/resource checks under one signed plan. Every failed lane returns the consequence, evidence digest, exact replay, and next repair. A six-lane pass means ready for human review—not approved for release.

Senior engineering controls in 0.46.3

When a team needs stronger evidence than a self-reported green build, use the senior-engineering integration:

• verify an independently collected, candidate-bound execution attestation;
• measure a reviewed buggy/fixed defect corpus with case-level recall and precision; and
• route a dependency DAG through RUN, REUSE, SKIP, or BLOCK, then compare the incremental plan with a full baseline;
• reproduce a failure in a fresh, contract-bound process workspace, compare the original failure with a repair and negative controls, explain every reuse decision across policy/dependency/toolchain/environment fingerprints, and hand a reviewer a runnable, evidence-linked failure briefing.

These adapters are provider-neutral and review-only. Replay and repair execute only when the operator supplies --execute; they use a fresh temporary process workspace with a secret-free environment, not a kernel/container sandbox. They never publish a package or approve a release. Missing independent evidence remains an evidence gap.

Do not take the word verified on faith. The Capability Evidence Map separates the locally verified core, controlled-pilot workflows, reference enterprise controls, and candidate-bound mobile preflight—and links each claim to the tests you can inspect and run yourself. For one agent-neutral human review path, use factory proof-review to seal intent, audit trajectory evidence, route the change, learn confirmed regressions, inspect the team inbox, and export a tamper-evident Proof Card. To create a contained starter later, run factory mvp "Build an approval tracker" --root .. That starter is never called production-ready until the relevant proof exists.

AppForge: make the review queue the last surprise, not the first

You have a build, a launch date, and a review queue that can take days to come back around. The costly failure is often not a crash—it is discovering after submission that the selected build has no exercised restore path, an iPad dead end, unrepresentative screenshots, an accessibility gap, or reviewer access that does not match the app.

AppForge turns that uncertainty into a local, candidate-bound worklist. Start with the user’s design direction, keep a story-led storyboard, then bind real iPhone/iPad media, App Review checks, quality evidence, SaaS journey evidence, and a final Markdown/PDF dossier to the same build. In JetBrains, AppForge Mission Control makes the missing lane visible before a human decides to enter the queue.

For iOS and Android delivery, factory revenue appforge-mobile-evidence normalizes supplied, hash-bound Xcode/XCTest, Android Gradle/ADB, Fastlane, device-cloud, and production-monitoring exports into one local receipt. It requires visual, privacy-to-listing, release-chain, design-system, production-signal, and Android-parity evidence to be explicit; it does not run those tools, access a store, submit a build, or guarantee approval.

That can prevent avoidable rework and repeat review cycles; it does not submit to Apple, access credentials, replace TestFlight, provide legal advice, or guarantee approval. Start with the AppForge Evidence Kit, then use the credential-free EAS handoff preflight before a separately authorized build or submission.

Support posture

The open-source core is free. Community support runs through public GitHub issues and has no guaranteed response time. For teams that need an operating commitment, the repository includes a transparent proposed Support SLA with P1/P2/P3 response targets, availability, recovery, exclusions, and an activation checklist.

Those targets are planning terms, not a current contract: the SLA remains proposed and non-effective until Code Factory has a named support owner, monitored escalation, production telemetry, dependency and recovery evidence, legal/security terms, and a signed enterprise order. This keeps the GitHub page useful to evaluators without implying that a free repository already carries a managed-service guarantee.

See actual Factory Studio and the current FactoryLine visual set or open the live Hugging Face Space.

Advanced workflows

• Start a real project. Turn one outcome into a contained web, mobile, API, CLI, worker, MCP, or agent-UI starting state.
• Review what AI produced. Turn requirements, diffs, proofs, and blockers into receipts, Graph Ops, and one fact-derived next action.
• Refresh the evidence that matters. Watch a local Assembly while it runs, refresh the next-proof brief, and see privacy-bounded observed Git contribution context without pretending it is a verified directory or billing roster.
• Keep "done" honest. Challenge declared validators for hollow tests; a green-looking scaffold is never called production-ready by default.
• Stop vague work before it starts. Use Intake Grill to record framework, exact intent, observable acceptance evidence, and the external-effects boundary before a Product Mission begins.
• Make a behavior survive its declared failure cases. Use the supervised Gauntlet to turn human-written E2E sabotage cases into an offline-verifiable Survival Card. A hollow negative check stays visible; a card is never a production-readiness certificate.
• Let autonomy be earned, not assumed. Use factory license to derive an expiry-bound local tier from independently verified governed runs. A severe hollow-test, hollow-validator, or scope-escape result demotes the declared agent automatically; it never authenticates identity or grants execution.
• Compare agents with receipts, not vibes. Use factory combine to rank completed, sealed, independently verified runs on the same task. It never starts an agent or turns a local scoreboard into a vendor-quality claim.
• Make every agent session feed the evidence loop. Use factory wrap around Claude Code, Codex, DeepSeek, or another local CLI. It verifies a sealed admission before launch, observes the exact file delta, runs declared independent validators, and records the result for Agent License and Combine. It stores hashes and bounded facts—not prompts or raw output—and observes the process without pretending to sandbox it.
• Verify an explicit agent workflow without adopting its runtime. Use factory atomic import to bind a secret-free exported stage DAG, scoped handoffs, checkpoint facts, and immutable source preconditions to a current Oracle Contract. Graph Ops, MCP, and WebMCP show the receipt read-only; Code Factory never starts Atomic, resumes a checkpoint, or treats a declared workflow as release authority.
• Keep decisions from becoming tribal knowledge. Use factory judgment to track a human-promoted design decision with exact paths, a named owner, review date, and hash-bound proof obligations. A Change Safety Case routes one explicit diff to its owner; it never infers intent, promotes a decision, runs a test, or approves a release.
• Prove the whole journey—and audit the repairing agent. Use factory journey to compare declared and observed product journeys, preserve a hash-bound failure capsule, prove state flow and cleanup, and challenge a proposed healing with a negative mutation. Choose human-controlled or bounded supervised-auto mode; every autonomous attempt receives a separate FactoryLine audit and neither mode can self-approve.

What the latest upgrade resolves

Common AI-assisted delivery pain	FactoryLine response	What stays under human control
A test is green but could never catch the behavior it claims to cover	Reality Check and Gauntlet bind declared positive and negative cases, then keep hollow or blocked checks visible in a Survival Card	Which behaviors and commands to admit; whether evidence is sufficient
A vague PRD becomes the wrong scaffold or framework	Intake Grill records a named, byte-bound intent, framework decision, observable acceptance evidence, and external-effects posture before a mission begins	The answers, architecture choice, and decision to start work
An agent retries the same failed approach and burns review time	Proof-Delta requires a changed candidate plus fresh, hash-bound evidence for a retry; no-gain attempts halt	Any repair, retry admission, and final apply
Teams gradually trust an agent because it has been successful recently	Earned Autonomy derives an expiring local tier from governed evidence and demotes severe hollow-test or scope-escape results	Identity, permissions, execution, approval, and release authority
A hard-won design decision is forgotten, then a later diff silently breaks its assumptions	Engineering Judgment Capsules bind one named owner, explicit path scope, review date, and declared proof obligations; an optional human-declared Change Profile makes novel boundaries and required Senior Attention explicit before review	Proposal, independent promotion, decision reconsideration, proof execution, acceptance, merge, and release
A reviewer has suggestions but no shared evidence picture	Graph Ops, local receipts, and read-only MCP facts show current scope, proof debt, and the next fact-derived action	Merge, release, deployment, and provider access
A selector repair makes the test green but changes the user journey—or an autonomous agent silently edits outside scope	Journey Reality, Stateful Workflow Proof, and Proof-Gated Healing require preserved semantic identity and coverage, cleanup proof, an adversarial negative result, exact workspace deltas, and an independent Agent Work Audit	Agent/provider choice, repair admission, final approval, merge, and release
Agent work happens outside the evidence ledger, while writing real E2E manifests takes too long	Evidence Supply Line wraps any admitted local agent CLI; gauntlet draft proposes inert, structure-derived promise drafts and explicitly withholds commands it cannot derive	Agent identity, sandboxing, draft promotion, validator choice, Gauntlet admission, and release
A large/remote workspace feels opaque or sluggish	Workspace Advisor measures bounded local project shape and path-only WSL/remote signals without changing indexes, heap, caches, inspections, or remote settings	Every IDE performance change and environment setting

These are local evidence and supervision tools, not guarantees of performance, security, productivity, production readiness, or an automatic repair service.

FactoryLine by role

Who is using it	Start here	Highest-value uses	The result they can inspect
Individual developer / vibe coder	factory first-proof	See whether a passing test can actually reject a known failure before trusting it	A local receipt and privacy-safe Proof Card from a disposable demonstration; your project remains unchanged
Junior developer	factory prd grill, factory plan verify, factory change review	Clarify acceptance evidence before coding; keep an AI-assisted diff inside the approved plan; surface missing tests and Proof Debt before review	Source-bound questions, exact changed paths, severity-ordered findings, and a review handoff
Senior / staff engineer	`factory senior replay	repair	reuse
Engineering team	factory wrap, then GitHub Proof Review	Record the exact agent-created file delta, run declared independent validators, and hand reviewers a commit-bound evidence packet without retaining prompts	Local receipts, exact changed paths, explicit blockers, and a neutral PR Check beside AI review
Platform / assurance pilot	Policy gates and evidence packets	Evaluate named approval boundaries, expiring exceptions, tenant isolation, budgets, and release evidence inside existing SDLC controls	Independently verifiable packets and read-only views; identity, credentials, merge, release, and deployment remain enterprise-owned. No SLA, certification, references, or procurement-readiness claim
Enterprise support evaluator	Support and operating requirements	Review the proposed response, availability, recovery, exclusions, and activation evidence before procurement	Support SLA policy; terms remain proposed until a signed order and all activation gates are evidenced

Expected operational outcomes

FactoryLine is designed to reduce avoidable review loops, evidence hunting, and the frustration of discovering late that an AI-generated test never exercised the claimed behavior. The expected outcome is a shorter path to a defensible human decision—not a promise that every project becomes faster or cheaper.

Outcome	What should improve	Evidence FactoryLine can retain
Less time lost before coding	Ambiguous intent, missing acceptance evidence, and external-effect boundaries surface during intake instead of after implementation	Intake questions, approved scope, plan hashes, and explicit blockers
Faster review orientation	Reviewers receive the exact diff, proof state, top risk, and one supported next action instead of reconstructing context across chat logs	Proof Cards, Change Review, Plan-to-Proof findings, GitHub Checks, and handoff packets
Less frustrating rework	Hollow validators, duplicate effects, resume drift, and out-of-plan changes are challenged closer to their source	Negative-test results, first-divergence facts, rejected candidates, and Proof Debt
Lower evidence-handling cost	Reusable receipts and read-only dashboards reduce repeated screenshots, manual summaries, and status meetings	Receipt reuse decisions, governed-run records, assurance dossiers, and local Graph Ops views
Measurable savings when a baseline exists	Teams can compare observed duration or cost with a declared baseline; otherwise savings stay unavailable	Bounded savings records that label source, baseline, observation window, and confidence

FactoryLine never converts an unmeasured estimate into a savings claim. Use the Savings Tracker to report observed time or cost only when the repository has a valid baseline and evidence window.

For planning, a transparent starting band is 25–120 minutes of avoidable review and rework per AI-assisted PR: roughly 10–30 minutes of reviewer context reconstruction plus 15–90 minutes of one preventable clarification, validator, or scope-rework loop. At 50 AI-assisted PRs per month, that models about 21–100 hours; at a team-supplied loaded cost of $75–$150/hour, the illustrative range is about $1,560–$15,000 per month. These are adjustable scenario inputs, not observed FactoryLine results. See the outcomes and savings model before using the range.

Works with your existing AI development stack

FactoryLine is the proof and control layer around generation, orchestration, and review tools. The status column distinguishes implemented adapters from clean workflow fits; it does not imply a vendor partnership.

Product or stack	What it does well	Where FactoryLine adds value	Current connection status
Blitzy	Large codebase understanding, reviewed action plans, autonomous generation, validation, and PR creation	Seal the approved plan, compare it with the exact resulting diff, challenge declared tests, and attach a neutral proof walkthrough before human merge	Workflow fit. Use repository artifacts and PR Checks; no bundled Blitzy API adapter or claimed partnership
CodeRabbit	AI review comments and remediation suggestions across the pull request	Supply deterministic FactoryLine Check results, proof gaps, and Proof Debt beside the AI review without treating suggestions as evidence	Documented interoperability. GitHub Checks are the boundary; no CodeRabbit credential or API is required
Mastra	TypeScript agents, tools, memory, workflows, and MCP clients/servers	Expose read-only local proof context through MCP, then verify the resulting repository diff and declared tests independently	Protocol-level fit. Mastra supports MCP; a dedicated FactoryLine-Mastra adapter is not bundled or claimed tested
LangGraph	Durable, stateful agent orchestration with checkpoints and human-in-the-loop control	Compare sealed reference and resumed transition lineages, detect duplicate effects or unsafe parallel writes, and keep receipts authoritative over checkpoints	Native optional support. LangGraph Assurance Bridge, optional adapter, GitHub Action, and cross-agent plugin are included
Codex, Claude Code, and Deep Agents	Interactive or autonomous repository implementation	Admit scoped work, wrap the local CLI process, hash the file delta, run independent validators, and feed Agent License / Combine	Included paths. Local wrapper, read-only MCP, LangGraph plugin, and optional Claude session trace
Cursor and OpenCode	IDE- or terminal-based AI coding with MCP clients	Read bounded FactoryLine receipt, verifier, PRD, memory-brief, and Graph Ops facts without granting write or release authority	Documented local MCP setup. Stdio-only and read-only
DeepSeek Harness	Model session and tool lifecycle	Add FactoryLine’s local proof facts while keeping the harness responsible for the agent lifecycle	Opt-in adapter. Developer-preview upstream boundary is explicit

See the complete compatibility and handoff guide for the recommended flow and the exact authority boundary for each stack.

For teams: use the Teams and Enterprise Operations Manual to run the same proof-first loop with named reviewers, approved AI-change scope, and explicit Proof Debt—without giving Code Factory merge, release, or provider authority. The commercial packaging guide keeps the free core separate from proposed Team and Enterprise services that are not purchasable yet. For a human-selected, customer-managed reference pilot, the local Team Pilot readiness gate hash-binds the operating evidence for owner review; it does not accept a customer or activate a paid service.

Design is part of the review. For UI-scoped work, add the optional Prestige Design Review: a purpose-led design brief plus review artifacts for hierarchy, responsive behavior, affordances, consistency, and declared design tokens. It makes design quality visible; it does not claim a conversion result, WCAG certification, or production readiness.

Reuse a proven decision without reusing stale context. Factory Continuity keeps a local, purpose-bound record of the evidence behind prior work. Graph Ops can replay only redacted, current, independently promoted metadata; it does not store private source, prompts, embeddings, or transcripts, and it cannot execute a repair.

Revenue-ready iOS scaffolds

factory revenue build turns one reviewed products.yaml into StoreKit 2, a transparent SwiftUI paywall, an Apple-JWS-verifying entitlement-server scaffold, privacy/review artifacts, and a local evidence page. Then replay, testflight-sync, failure-matrix, and policy-watch expose where observed purchase behavior, beta feedback, negative paths, or policy sources diverge—without turning unknowns green. Evidence Memory carries human-approved, receipt-backed lessons into the next exact-app journey while expiring stale knowledge and quarantining contradictions. IDEs and coding agents can inspect the same local facts through MCP; compatible browser agents can inspect bounded Graph Ops status through progressive WebMCP. App Store writes, pricing, experiments, offers, publication, and credentials stay human-controlled. See RevenueForge and the MCP/WebMCP handoff.

Install

# No account, model key, or cloud connection is required for this local run.
pip install factoryline-code-factory
factory first-proof --root .
factory mvp "Build an approval tracker" --root .
factory studio --root .\my-mvp

If Code Factory helps you find a proof gap or makes an AI-assisted change easier to review, star Code Factory so other developers can find it. This optional link only opens the repository.

Choose the job in front of you

If you need to…	Use	You get
Build a first slice	factory mvp	A contained, app-shaped local starting state
Pin down intent before work begins	factory intake grill	A source-bound framework, intent, acceptance-evidence, and safety decision worksheet
Clarify a fuzzy PRD	factory prd grill	Source-bound questions instead of invented requirements
Review an AI-assisted diff	factory change review	A local risk, proof-gap, and next-action packet
Turn a diff into the next safe proof	factory memory brief	Refreshable actions, redacted continuity facts, and observed local Git contribution context
Keep an agent diff inside approved scope	factory plan verify	Exact plan alignment and explicit Proof Debt—not another AI opinion
Prove an E2E check can say no	factory e2e verify	A native positive/negative command-pair receipt that catches hollow E2E checks
Ask whether a behavior survives declared sabotages	factory gauntlet	A named, one-run admission, optional redacted verified-context binding, and offline-verifiable Survival Card—never generated commands or automatic repair
Keep agent autonomy evidence-bound	factory license	A local, expiring tier derived from governed evidence, automatic severe-failure demotion, and no silent authority grant
Compare completed agent evidence fairly	factory combine	A sealed-task, offline-verifiable scoreboard—never an agent launcher or vendor leaderboard
Capture an agent run without copying its prompt	factory wrap	A pre-admitted, hash-bound delta and independent-validator receipt that feeds Agent License
Draft the first Gauntlet promises	factory gauntlet draft	Inert structure-derived candidates, with unsupported HTTP commands explicitly withheld
Prepare a bounded Team pilot	factory team-pilot readiness	Hash-bound, customer-managed readiness evidence for owner review—not a checkout or service activation
Operate a team evidence workspace	factory ops	Tenant-bound identities, immutable evidence, explicit runner posture, fresh required checks, outcome telemetry, and seven-gate SLA readiness—without merge, deploy, billing, SSO, or contract authority
Prove SaaS access matches the promise	factory saas verify	Provider-neutral OAuth/OIDC identity, tenant authorization, checkout, webhook, entitlement, access, and revocation evidence—with unknowns blocked
Add evidence to a GitHub PR	factory github proof-review	One neutral Check and stable proof walkthrough, tied to the head commit
Prove a LangGraph resume path	factory langgraph replay-verify	Hash-only parity, duplicate-effect and parallel-write safeguards, plus a shareable incident capsule
Detect policy drift before a human merge	factory github assurance-dossier	Deterministic supplied-policy comparison, named expiring exceptions, and a merge-evidence packet
Inspect delivery state	factory studio	Graph Ops, receipts, and the next supported action
Debug why two graph runs diverged	factory graph forensics	Hash-sealed state lineage, concurrency findings, and a read-only recovery preview
Choose among competing repairs	factory proofsearch	Hash-bound candidate rejection, mutation-tested evidence, a deterministic winner, and locked apply authority
Decide what evidence to collect next	Evidence Frontier	A deterministic next-test hypothesis that separates repair candidates, with execution locked
Admit a repair retry only with new evidence	Proof-Delta Loop	A changed candidate and fresh hash-bound evidence, or a deliberate no-gain halt
Reconsider verified prior work safely	Factory Continuity	Purpose-bound, expiring Decision Replay metadata with independent promotion and no private content
Prove one user-visible behavior	Factory Reality Check	Deep intent assertions, a deliberate failure case, and an optional named one-time re-run authorization
Verify supplied work	Verifier Plane	Independent, hash-bound evidence checks

For the short product map, read the overview. For a two-minute first run, follow Start Here. For full command and contract reference, browse the documentation directory.

Use Code Factory with CodeRabbit or another AI reviewer

They solve different parts of the review problem. CodeRabbit can supply AI findings and suggestions; Code Factory makes declared local proof gaps, coverage, and the next review action explicit. Enable the opt-in GitHub Proof Review workflow to put one neutral, commit-bound FactoryLine Check and walkthrough beside existing CodeRabbit comments. It uses no CodeRabbit account, API, credential, or output as proof.

For agent-created pull requests, add a small human-approved factory.agent_plan.v1 envelope. Plan-to-Proof compares that plan with the exact diff and exposes Proof Debt: unresolved scope, declared-test, human-routing, and existing proof obligations that must be settled before a team makes its own merge decision.

That makes Code Factory a standalone proof layer for teams that do not use an AI reviewer, and a complementary evidence layer for teams that do. For agent-created pull requests, Code Factory does not replace human review, auto-approve a pull request, or merge code.

Use Code Factory with LangGraph

LangGraph teams can keep their own graph and checkpoint runtime, then use the LangGraph Assurance Bridge to compare recorded reference and resumed transitions. The free local adapter produces hash-only parity evidence and a reviewable incident capsule when a run diverges; it does not import LangGraph, invoke a graph, or claim production resilience. The optional GitHub Action puts the same Proof Card in a pull-request job summary.

For Codex, Claude Code, and Deep Agents, install the Code Factory LangGraph plugin to add the proof workflow and read-only local MCP facts to the coding-agent surface.

Use Code Factory with DeepSeek Harness

The optional DeepSeek Harness adapter starts the same local read-only MCP proof surface through Harness's official generic MCP client. It lets a Harness agent inspect Graph Ops, current proof gaps, and Earned Autonomy / Combine facts without sending source to a hosted endpoint or gaining permission to execute, repair, approve, release, deploy, sign, or use credentials.

Use it where you work

Code Factory keeps the same local, receipt-bound workflow across the command line, VS Code, and the JetBrains plugin. It also provides local stdio Cursor or OpenCode MCP without handing an AI client permission to publish, deploy, approve, sign, or access credentials.

The same local proof surface is discoverable in the Official MCP Registry as io.github.zrk222/code-factory; registry setup starts the public PyPI package over local stdio and never creates a hosted service or write authority.

FactoryLine's core local proof workflow remains free. The planned JetBrains Freemium transition starts January 1, 2027, subject to Marketplace and activation gates. Early adopters may retain Founding Proof Pro at $5.95 USD/month or $60 USD/year; standard Proof Pro is planned at $9/month or $90/year, and AppForge Builder at $24/month or $240/year. Team Assurance is a separate $20-per-active-contributor annual-commit hypothesis. None is active today; no checkout, entitlement, or license enforcement exists. See the Marketplace control-room guide for the exact feature boundary and approval gates.

The matching GitHub Assurance Seat is also planned for January 1, 2027 at the same future price. It is for maintained, customer-managed proof operations (commit-bound review, Proof Debt, policy drift, governed exceptions, and evidence packets)—not source access or opaque AI-token resale. The source license and free core are unchanged. See the GitHub per-seat plan.

For Open VSX, the extension and local proof core remain free. All capabilities shipped before the transition are free through December 14, 2026. From December 15, 2026, Founding Proof Pro may remain $5.95/month or $60/year for early adopters; standard Proof Pro is planned at $9/month or $90/year, AppForge Builder at $24/month or $240/year, and Team Assurance at $20 per active contributor/month annually or $24 monthly, subject to explicit activation gates. See the Open VSX service plan.

Release owners can use the read-only release candidate preflight to bind source, commit, platform artifacts, and active metadata before any upload. The Codex metadata integrity audit keeps archival claims out of active proof, and Windows process binding closes the bind-before-run process-tree race.

The proof boundary

Code Factory creates and inspects local artifacts. It does not silently call a model, discover credentials, publish, deploy, sign, approve, message, or grant a connector. The Gauntlet executes only caller-declared E2E pairs after a named, expiry-bound, one-run admission; all other Gauntlet paths are read-only. Its deterministic proof receipts bind supplied byte bindings, declared identities, and evidence; an external runner must separately prove runtime isolation and network policy. Token, cost, and productivity claims remain unknown until a bound measurement exists.

flowchart LR
  intent["Plain-language outcome"] --> mvp["Local MVP"]
  mvp --> evidence["Receipts and declared checks"]
  evidence --> review["Graph Ops / review packet"]
  review --> decision["One evidence-backed next action"]

Loading

Use Intake Grill to pin down intent before a mission, PRD Grill before code exists, the deterministic contradiction gate when requirements collide, Proof Review when a diff arrives, and the Verifier Plane when a worker claims it is finished. Use the supervised Gauntlet when a specific behavior needs to survive explicitly reviewed failure cases. The local MCP contract and generated Mermaid output map make the same proof context reusable by a client you choose.

Go deeper when you need it

• Read why I built Code Factory for the founder story behind catching passing tests that fail in real use.
• Start with PRD Grill, Proof Review, or Verifier Plane when the job calls for it.
• Browse Graph Ops, Gauntlet, Proof-Delta Loop, Graph Portfolio and Run Admission, Evidence Frontier, Factory Reality Check, proof reuse, and LangGraph Assurance, and savings boundaries for advanced evidence workflows.
• Use IDE Health and Index Continuity when a JetBrains IDE slows down and you need locally observed signals before deciding what to review.
• For UI work, read Prestige Design Review for the optional design-quality lane and its explicit review boundaries.
• Read The approval signal decays when AI-written code becomes routine for the design and limits of the habituation gate.
• See the 0.46.3 core release notes, the grilling ladder, CHANGELOG.md, release channels, and publication guide for versioned release detail.

License

MIT OR Apache-2.0.