The evidence
Every claim with its file, its test and its run.
One row per guarantee the landing page makes. Written 21 October 2026.
The columns: Enforced by names the code that holds the guarantee. Tested by names the test that exercises it. Proven by names a real run and where its record lives. Until a run exists, the column says not yet.
Paths are relative to ai-software-factory-code unless they start with infra: (ai-software-factory-infra). The tests run in CI: main and nightly run go test -race ./..., pull requests run the affected packages without the race detector (.forgejo/, pr.yml, nightly.yml).
The run records named below: the build plan's stage table, the status paragraph of architecture.md, the demo handover with its scene bank, and roadmap.md, which names the ledger artifacts. The ledger itself is local and not published.
- The kanban fills itself, the chat drives it
- Say it, it ships
- It plans before it builds
- Nothing merges unproven
- An issue lands, the fix ships
- Live software feeds back
- It does not stall
- No model call runs without its cost covered
- You hold the roadmap and the money
- The sandbox is the guardrail
- Three layers: the factory, your process, your prompts
- The numbers
1. The kanban fills itself, the chat drives it
The chat replaces card writing, and the same chat reaches a running agent.
| Guarantee | Enforced by | Tested by | Proven by |
|---|---|---|---|
| One chat tool per console action, 73 today | internal/, internal/ (ChatTools) | internal/, internal/ | Scenes 01 and 03 of the bank: one sentence files a card |
| Every write is a proposal; the reversible ones carry a 30 minute undo | internal/, internal/ (ConfirmFor) | internal/ | Scenes 03 and 24: the proposal and Do it |
| The chat drives the board's menus | internal/ (board_view), internal/ | internal/ | Scene 23 |
| A human or the project agent messages a running session, and the gates judge the result | cmd/ (message endpoint), internal/ | cmd/, internal/ | Scene 11: a line typed into a running card, the next turn quotes it |
2. Say it, it ships
A card becomes a sandbox, a pull request, a merge and a live deploy, with no human in between.
| Guarantee | Enforced by | Tested by | Proven by |
|---|---|---|---|
| One durable workflow per task, surviving restarts; a heal pass re-reads Forgejo every minute | internal/ (HealPass), internal/ | internal/, internal/ | Stage 8: a planted regression went from alert to a fix in production in 31 minutes, no human |
| A card is done only when a green run covers its merge | internal/, internal/ | internal/, internal/ | Every stage-exit merge, stage table |
3. It plans before it builds
A big request is measured and split, and the criteria name their proofs before any code exists.
| Guarantee | Enforced by | Tested by | Proven by |
|---|---|---|---|
| A big request splits into a plan of dependent cards | internal/ | internal/, internal/ | Stage 11: a spec card became ten planned cards and a deployed link shortener |
| Criteria carry an id, a kind and a named test, and the gate runs the named tests on the assembled feature | internal/ | internal/ | Stage 11's integration card passed the criteria gate (ledger task-105-report.md, named in roadmap.md) |
| The builders never see the hold-out tests: written by a separate session, stored outside every workspace | internal/ | internal/ | not yet |
| A card started on an older spec cannot merge | internal/ (ErrStalePlan) | internal/ | not yet |
4. Nothing merges unproven
The gate chain stands before every merge. It has run on every stage exit, and two of its findings rules have not fired in a recorded run.
| Guarantee | Enforced by | Tested by | Proven by |
|---|---|---|---|
| Nine gate stages, with a floor of four no process file may lower | internal/ (validateStages), infra:factory/ | internal/ (its testdata holds the shipped files) | Every stage-exit merge passed the chain |
| Policy fails forbidden paths, and migrations wait for a human | internal/, internal/ | internal/ (TestClassify), internal/ | Every merge of every stage run passed the policy gate |
| Checks run in untrusted gVisor pods with no push credential | internal/, .forgejo/ | internal/, the pr.yml job-env-audit asserts the job token cannot push | Every pull request of the factory's own code |
| Deleted or weakened tests are a finding returned to the agent | internal/ | internal/ | not yet |
| A review with no verdict is a finding on the human's card | internal/, internal/ | internal/ | not yet |
5. An issue lands, the fix ships
An issue with a reproduction becomes a card, and the gate proves the fault and the fix.
| Guarantee | Enforced by | Tested by | Proven by |
|---|---|---|---|
| A Forgejo issue becomes a card within a minute, and a heal pass catches a lost webhook | internal/, internal/ (HealPass) | internal/, internal/ | Scene 33: the lab filed an issue on the scene's repository for real, card 126 |
| The reproduction gate runs the repro at the base commit and at the head | internal/, cmd/ | internal/, cmd/ | Scene 33: base_exit 1, exit 0, merged |
| An outsider's issue is screened for injection before any session runs | internal/ (ScreenSuspect), internal/ | internal/, internal/ | not yet |
6. Live software feeds back
Alerts and routines file cards on their own.
| Guarantee | Enforced by | Tested by | Proven by |
|---|---|---|---|
| A SigNoz alert files a bug card, judged real or noise | internal/, internal/, k8s/ | internal/, internal/ | Stage 8: the regression's alert filed the card that fixed it |
| Routines run by cron, by every n merges or by event | internal/, internal/ | internal/, internal/ | not yet (template-pass is scheduled hourly in infra:factory/) |
7. It does not stall
Detectors and the supervisor answer in code before a human is asked.
| Guarantee | Enforced by | Tested by | Proven by |
|---|---|---|---|
| Eleven detectors watch every session | internal/ | internal/ | Scene 08: the flip-flop detector tripped |
| The supervisor answers in code first, then by the check-in model in the session's pod, twelve calls a card at most | internal/, internal/ | internal/, internal/ | Scene 08: redirect, then the next session on the stronger model |
| The ladder: a stronger model after three returns from one stage, a human after the session cap | internal/ (stronger_after), infra:factory/ | internal/ | Scenes 08 and 10 |
8. No model call runs without its cost covered
The money is held before the call, and the caps stop the factory with a question.
| Guarantee | Enforced by | Tested by | Proven by |
|---|---|---|---|
| The worst case is held before the call under a database lock, and the real cost is booked after | internal/, internal/ | internal/, internal/ | Every model call of every run. Stage 18 costed 17 cards at 0.019 to 1.24 EUR each |
| Caps at task, day, month and project, each refusal named | internal/, internal/ | internal/, internal/ | Scene 20: the budget question with fund and end. Scene 28: the costs page |
| A missing cap reads as zero and stops all spend | internal/ | internal/ | not yet |
9. You hold the roadmap and the money
One dial sets what asks, and money beyond a budget always reaches a human.
| Guarantee | Enforced by | Tested by | Proven by |
|---|---|---|---|
| Four autonomy levels, each removing named confirms | internal/ (ConfirmFor) | internal/, internal/ | Scene 25: the dial moved to full auto |
| Forbidden paths and migrations stay human at every level | internal/, internal/ | internal/, internal/ | Every merge of every stage run (section 4) |
| Every ask gets one model attempt, recorded, before a human sees it | internal/ (attach_analysis), internal/ (ask, escalate) | internal/ | not yet |
| Money beyond a card's budget comes from a named pool or asks a human | internal/ (FundCard), internal/ (fund) | internal/, internal/ | Scene 24: three asks answered from the phone view |
10. The sandbox is the guardrail
Every session runs in a throwaway pod with its own identity, and the network is closed.
| Guarantee | Enforced by | Tested by | Proven by |
|---|---|---|---|
| Each session runs in its own throwaway gVisor pod: uid 1000, no capabilities, read-only root, emptyDir volumes, quota | internal/ (sandboxPodSpec) | internal/, internal/ | Every session of every run. Scene 32 shows the pod's life |
| Egress is denied by default and allowed by name, and the metadata address is denied outright | internal/ (workerEgressSpec) | internal/ | Every session, by the probe below |
| The egress probe proves the closed network before the agent starts, or the start fails | cmd/ | cmd/ | Every session start of every run |
| The agent never holds a push token: the read token lives in the clone init container, the write token is minted after the agent process is dead, used once and revoked | internal/, internal/, internal/ | internal/, cmd/, internal/, TestTaskHistoryCarriesNoCredential in internal/ | Every push of every run |
| The gateway identity is a projected token that expires in one hour and is verified against the cluster | internal/, internal/ | internal/ | Every model call of every run |
| The gateway dials out, resolves once and refuses non-public addresses | internal/ | internal/ | Every external tool call |
| Model keys are per task, carry no budget and die with the run | internal/ | internal/ | Every run mints and blocks its key |
11. Three layers: the factory, your process, your prompts
The process is a file with a floor, the prompts are the project's own, and the harness is an adapter.
| Guarantee | Enforced by | Tested by | Proven by |
|---|---|---|---|
| The process is a YAML file with a floor, and two processes ship | internal/, infra:factory/, infra:factory/ | internal/ (its testdata holds both files) | Stage 11 ran the spec process end to end |
| AGENTS.md is seeded from a template into the project's repository | internal/, infra:factory/ | internal/, internal/ | not yet |
| The writing guide ships as a file compiled into the binaries | internal/, embedded by internal/ | No dedicated test. The build fails if the file is absent | Every CI build of the binaries |
| The harness is an adapter behind one interface | internal/ (the interface), internal/ (the adapter) | internal/, internal/ | Every session runs through the adapter |
12. The numbers
The pages read the same ledger the board reads.
| Guarantee | Enforced by | Tested by | Proven by |
|---|---|---|---|
| The metrics and costs pages read the same ledger as the board | internal/, internal/ | internal/, internal/ | Scenes 26 to 28: the pages beside the board |
| Costs are booked per card and per call, with a dated window | internal/, internal/, internal/ | internal/, acceptance/ | Stage 18: cost per card 0.019 to 1.24 EUR |
Rows that say not yet: hold-outs, the stale-plan refusal, cheat detection, the no-verdict finding, outsider screening, routines, the missing-cap stop, the model attempt on an ask and template seeding. Nine of forty-three guarantees wait for their run.