Code Factory
Code Factory + ForgeLine (CF/FL) is a robust, local-first code-audit factory. It starts by collecting local software review evidence for the candidate change. It connects requirements, architecture checks, Python AST security analysis, behavioral test evidence, workflow integrity, specialty AI review, and actionable repair. Its receipts support review; the tool does not certify software, guarantee that defects are absent, or approve a release.
0.47.0 audit workflow preview
Fixed: editor audit views now expose missing and incomplete checks.
Changed: Junie's route connects a diff to bounded evidence and a concrete
repair handoff. Added: project-neutral factory audit workflows contracts
with hash-bound candidate and execution evidence, plus VS Code/Open VSX 1.1.0
evidence tree, JetBrains 1.1.0 CF + ForgeLine tab, and a native
OpenCode plugin.
Candidate detection fixes: the Python scanner flags tests without a local
assertion, constant-true assertions, and reflexive comparisons. Declared tenant
reads can be checked with factory audit security --tenant-read-call db.get;
this checks the declared tenant_id parameter binding, not tenant authentication.
The unchanged eight-case public regression corpus now gives 6 true positives,
2 true negatives, and no false positives or false negatives locally, with the
same tenant-read contract applied to defective, repaired, and clean inputs.
This is a small development regression result, not independent accuracy,
runtime coverage, or release approval. CI verification is still required.
The autonomous ops plan explains the
proposed Observer Agent loop and its gates. These versions remain release
candidates until each channel has a verified provider publication receipt.
Graph Ops in action
This full-page local capture shows Graph Ops tracing a change from sealed lineage through a forensic finding to a proposed recovery path. The guarded action remains locked; the dashboard is a read-only inspection surface.
The Counterfactual Arena compares repair candidates and shows their evidence and risk. Winner controls and the Evidence Frontier show how a reviewer can inspect the rationale and choose the next proof.
The current Graph Ops UI also separates native deep-scan progress, evaluated deep-audit receipts, six runtime lanes, and individual JUnit test cases. Each panel labels its evidence state and next repair. Filter or search the recorded tests, then load more cases as needed; an inventory or a missing report never appears as a passing run. The JUnit reader accepts up to 10,000 cases and marks larger or malformed reports incomplete. A JUnit report is local observation without a current-candidate binding.
This local UI capture shows each reported test case with its status. The audit cards keep checks without a bound result explicitly marked not run.
Supplement: annotated live Assembly telemetry
The labels explain an original local Assembly capture. That pictured run is waiting for human input; it does not imply release approval or that every check passed.
Install and start
python -m pip install factoryline-code-factory
factory --help
factory guide
In an interactive terminal, factory checks PyPI and caches the result for up
to 24 hours, then prints a notice when a newer version is available. Two
simultaneous first runs can both check. It never downloads or installs the
update. The check is quiet in CI, JSON output, server/MCP, help, version, and
non-interactive runs; set FACTORY_DISABLE_UPDATE_CHECK=1 to turn it off. The
plain PyPI request does not include a project path, account identifier, or
usage data.
Run repository commands from the project being reviewed. factory guide is a
read-only orientation; it does not run tests or agents.
Inspect this repository
These commands show the current architecture policy, the bounded static security scan, and the runtime-audit setup:
factory architecture health --root . --json
factory audit security --root . --json
factory runtime-audit status --root . --json
factory audit security checks a limited set of source patterns. It is not a
penetration test. The runtime audit needs a separately reviewed plan and its
own environment evidence. A status of NOT_RUN or a clean static scan is not a
complete project audit.
To display individual tests in Graph Ops, run your suite with a JUnit report at
.factory/test-reports/pytest.xml (for example,
python -m pytest --junitxml=.factory/test-reports/pytest.xml). The local
Studio reads the report and labels its candidate binding UNBOUND; it does
not infer that those results still apply after source changes.
The prior snapshot's repository self-audit receipt records A (97.9/100) and 1,055/1,085 functions attributed to test intent (97.24%). That static measurement applies to its recorded source digest; it is not a grade for later edits, runtime coverage, or certification.
ForgeLine 0.10.8 computes Python complexity for public module functions and
public class methods in its recorded metrics.scope.code_files; names starting
with _ are excluded. Its AST metric counts branches, boolean alternatives,
exception handlers, with, and assertions. Ruff C901 uses a different McCabe
metric and also checks private functions. CI therefore runs
python -m ruff check --select C901 factoryline tests separately at limit 10.
The ForgeLine maximum must not be read as the maximum of every Python function.
CI also checks action and reusable workflow references for immutable commit
pins; the generic workflow evidence validator alone does not inspect those refs.
Release controls
Candidate preflight requires release-cadence admission and strict architecture health. Protected main requires CI and a separate specialty AI source review; the coordinator records that assessment, separately from test evidence. It is not a second human approval. Provider publication and marketplace approval are separate outcomes. See release channels.
Architecture health checks growth budgets. ForgeLine's repository inventory
and feature QA are separate checks. The current gap review
records how the published ForgeLine 0.10.7 graded this source F/70.7 while
parser-corrected ForgeLine 0.10.8 grades it A/95.1. CF 0.47.0 requires 0.10.8
and checks real MJS, TS, and TSX feature QA during factory doctor --strict.
Static signals are neither executed coverage nor a security certification.
More detail
1 maintainer
Metadata
1 maintainer
Release files for factoryline-code-factory 0.47.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| factoryline_code_factory-0.47.0.tar.gz | 8.0 MB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| factoryline_code_factory-0.47.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 9.6 MB
Release files / factoryline_code_factory-0.47.0.tar.gz
| Download URL | factoryline_code_factory-0.47.0.tar.gz |
|---|---|
| Size | 8.0 MB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
8ac2148cebe6b6e3c92b0661f54ce7713b5208939b66d78565c567d047879bd5
|
|
BLAKE2b-256 checksum How to use checksums |
58866ff3a64b599a76c4de52fa1bcd2757c8924c0a4690650a817b17582f9e41
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 4, 2026.
Transparency logRelease files / factoryline_code_factory-0.47.0-py3-none-any.whl
| Download URL | factoryline_code_factory-0.47.0-py3-none-any.whl |
|---|---|
| Size | 1.6 MB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
087e2f09d5bca530784f25c0e7650791f59264e92a30068da8ab7ddf3dfa507b
|
|
BLAKE2b-256 checksum How to use checksums |
f8ea401fdd894afff03ea4b8762f5d13393266132306df2877afa9a9d1f2e814
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 4, 2026.
Transparency log
