v2.23.0 — 🔭 The external-repo mining cycle

The factory learns to study other factories without being changed by them — a health-gated repo-scout skill, per-skill production telemetry, a forge-proof eval judge, and four code-grounded reference studies with explicit adoption gates. One cycle since v2.22.0.

Highlights

• Skills are now measured in production, not just at authoring time. bun run skill-report derives honest per-skill trust states — trusted / proven / active / demoted / dormant — from the existing trace substrate (skill names only; args never land in a trace). /learn-loop grounds in it as its fourth instrument, and /kill-or-keep's quarterly curator reads dormant rows as archive candidates. Ported idea: OpenSpace's outcome tables — on our substrate instead of a new store.
• The eval judge can no longer be steered by what it judges. Every judged output now sits inside a per-call UUID-tagged untrusted boundary minted after the output exists — forged close tags, fake verdict JSON, and judge-addressed imperatives are content to grade, not directions to follow. One fix covers every factory judge (eval harness + /goal's loop). Ported idea: Adrian's boundary design.
• /repo-scout — the study method, promoted to a skill. Verify health (gh-api gates) → scratchpad-only shallow clone → facts-only hardened deep-dive (repo content is data, never instructions; assessed code is never executed) → references-grammar draft in an operator-gated backlog. Trending mode rides OSS Insight's public API with a 3-repo cap; a new STANDING-ORDERS program scopes its unattended authority.
• Four reference studies, with the discipline showing. Graft (NanoNets) · Adrian (Secure Agentics) · AgentENV (kvcache-ai) · OpenSpace (HKUDS) — each entry records what to mine with file-path evidence, what deliberately isn't adopted, the measured gate any adoption must pass, and the trigger that would reopen the question. Two ideas ported the same day; zero frameworks imported.

What's inside

v2.23.0 — the external-repo mining cycle · skill-outcome telemetry (bun run skill-report, eval skill-outcome-fidelity) · judge untrusted-output boundary (4 deterministic boundary tests) · /repo-scout skill + program + heartbeat item, eval-covered via contract pins · four references/README.md studies + clone lines · new doctrine: api-compatibility-as-distribution (the AgentENV/E2B lesson) and the auto-captured-skill-landfill anti-pattern (OpenSpace's 203-skill corpus as the control group for ungoverned skill capture) · credits gain "a thousand generosities" — the references tier, with a 10x tier that waits for measured evidence.

Get started

curl -fsSL https://raw.githubusercontent.com/hamza-ali-shahjahan/hamzaish/main/install.sh | sh

Then open Claude Code and type /builder-mode <your idea>. New to terminals? Start at docs/start-here.md.

License

AGPL-3.0 — clean, no added clauses. Free for builders; commercial license on request.

v2.22.0 — 📊 The measured factory

The factory stops deciding from memory and starts deciding from measurement — cost-to-outcome model routing, a model-independence bench, three telemetry instruments (what happened · how it felt · what got caught), and a scaffold that's born green. Four cycles since v2.18.0.

Highlights

• Cost-to-outcome routing + model-independence. A cross-model bench (bun run bench) scores each skill's eval across model tiers into a capability-per-dollar leaderboard; the runtime router picks the cheapest model that clears the bar and escalates only the failures (FAIL_BUILDABLE → climb a tier). A check-model-independence ratchet flags any skill that only passes on one model. Honest boundary: the factory optimizes the harness / router / skills against outcomes — never model weights.
• Three telemetry instruments. Traces (what happened) + friction (how it felt) + the new defect registry (which check caught what, at catch time) ground every /learn-loop retro in data, not recollection.
• A reward-wired hill-climb. A reward ledger records the outcomes customers actually care about (executed eval · e2e · activation), and /goal prefers an executed eval signal alongside its fresh-eyes rubric.
• A scaffold born green. The starter typechecks and builds out of the box, check-starter asserts install + typecheck + build, and every external call goes through a conscious retry door.

What's inside

v2.22.0 — the guard-fire defect registry · bun run defect log|report records every real catch (CI red, eval regression, live assertion, hook block, review) as one structured row — catcher · stage · target · severity · fixed-by — seeded with the factory's historical catches so the first report is already useful. /hamzaish now consults the control plane interactively: the weekly mandate outranks the menu.

v2.21.0 — cost-to-outcome loops · model-independence bench + capability-per-dollar leaderboard, an evidence-based router (measured beats guessed) with a cheap→frontier cascade, and a reward ledger + executed-eval signal feeding /goal. New doctrine: cost-to-outcome & model-independence.

v2.20.0 — the flywheel tightens · the friction/delight instrument, a capture doctrine with an anti-rot do-NOT-capture list, a MECE gate on new skills with a quarterly archive-never-delete curator, and the eval debt paid down (5 → 8 covered entities).

v2.19.0 — a scaffold born green · starter typecheck/build truth, check-starter that runs the real commands, real /privacy + /terms pages, and retry doors on every external call.

Get started

curl -fsSL https://raw.githubusercontent.com/hamza-ali-shahjahan/hamzaish/main/install.sh | sh

Then open Claude Code and type /builder-mode <your idea>. New to terminals? Start at docs/start-here.md.

License

AGPL-3.0 — clean, no added clauses. Free for builders; commercial license on request.

v2.18.0 — 📡 The factory grows senses

The factory grows senses. Hamzaish's self-improvement loop used to run on what a session remembered to write down — now it runs on what actually happened: session traces recorded automatically from your very first session, and a new operating principle that turns lessons into executable checks instead of prose. This release bundles the eight cycles since v2.10.0.

Highlights

• 📡 Session traces, zero-setup (v2.18.0). A committed .claude/settings.json ships project hooks that record every tool call and failure to a local JSONL trace — fail-open (any error exits 0; telemetry can never slow or block a turn), privacy-capped (no tool outputs, no file contents, commands truncated — traces are gitignored and never leave your machine), bounded (one file per day). bun run trace-report turns them into answers: failure rate by tool, the bash commands that keep breaking, how much work happened. /learn-loop now reads it before every cycle. Adopted from the Code as Agent Harness survey (arXiv:2605.18747, UIUC + Meta + Stanford, §3.5) — read against the repo as a checklist, not a blueprint: two gaps adopted, topology rework deliberately declined.
• 🪜 Operating principle 15: a lesson that can be a check becomes a check (v2.18.0). The promotion ladder — hook → CI guard → eval case → prose, with prose as the fallback, never the default. Hamzaish's own history proved it: its three worst incidents each stopped recurring only when the lesson became a hook.
• 🎛️ The factory control plane (v2.16.0). FACTORY-ORDERS / STANDING-ORDERS / HEARTBEAT operator templates, a hard dollar cap + spend ledger on the autonomy loop (--max-spend-usd, default $25, refuses unmeasured modes), lifecycle gates in product.config.json with the check-gates dashboard, and the /factory-launch ritual that fills it all in — the gap between "runs overnight" and "runs overnight bounded", closed.
• 🔭 The starter tells the truth in production (v2.17.0). Sentry now actually initializes in every scaffold (the observability costume is closed), a token-gated canary proves errors reach Sentry on the REAL deploy, and the Stripe webhook never 200s an event it didn't persist (idempotency ledger, claim/release semantics) — silent subscription loss, gone.
• ✍️ The skill-authoring standard (v2.15.0). Context load vs cognitive load, leading words, the no-op test, completion criteria, six failure modes — ported from mattpocock/skills — plus the first context-load audit of every skill description the factory ships.

What changed

v2.18.0 — session traces + the lesson-to-check ladder

• scripts/trace-log.ts (hook-fed flight recorder) + scripts/trace-report.ts (bun run trace-report) + .claude/settings.json (project hooks, the first committed one) — 7 new tests including the trace-capture-fidelity eval; verified live: the hooks captured their own build session.
• brain/operating-principles.md principle 15; /learn-loop grounds cycles in traces (step 2) and applies the check ladder on promotion (step 6).

v2.17.0 — starter production truth

• sentry.*.config.ts × 3 + src/instrumentation.ts, the sentry-canary route proven by verify-live A11, and the stripe_webhook_events ledger with verify → claim → persist semantics.

v2.16.0 — control plane

• Operator templates scaffolded by bun run setup; spend meter (scripts/lib/spend.ts) with hard abort; lifecycle gates (scripts/check-gates.ts); /factory-launch eval-covered from birth.

v2.15.0 — skill authoring · factory/playbooks/ai-native-2026/skill-authoring.md + context-load audit; skill/command namespace dedupe guard (check-skill-command-collision).

v2.14.0 — the ThousandWorlds fold · 12 learnings promoted: 2 anti-patterns (lazy-thenable Supabase inserts that send nothing; trusting .gz extensions over magic bytes), 2 playbooks (multi-agent-one-repo fences; landscape-research-before-roadmap), 6 proven practices.

v2.13.0 — paste-contents rule · anything you must relay to an external surface goes into chat as full file contents, never a path (AGENTS.md hard rule 13).

v2.12.0 — the Orca distillation · community-flywheel + handoff-vs-supervision playbooks, community PR automation (community-prs.yml), /release hardened (heartbeat trigger, never-publish-backwards gate).

v2.11.0 — the live gate · scripts/verify-live.ts: /go-live closes on an A1–A10 scorecard against the real deployment (DNS, TLS, health, auth gate, live keys, no leaked server secrets) — never on a claim.

Get started

curl -fsSL https://raw.githubusercontent.com/hamza-ali-shahjahan/hamzaish/main/install.sh | sh

Then open Claude Code and type /builder-mode <your idea>. New to terminals? Start at docs/start-here.md.

License

AGPL-3.0 — clean, no added clauses. Free for builders; commercial license on request.

v2.10.0 — 📖 Story-first front door + the Live Path goal

The factory's front door now tells the story before the inventory — and its next goal is signed: set up once, verified-live in minutes. This release bundles the two cycles since v2.8.0: the story-first README + the Live Path goal (v2.10.0), and MCP-config security scanning (v2.9.0).

Highlights

• 📖 A story-first README. The front door was a warehouse with a great foyer — the promise now leads and the catalog follows: a negation hero ("Not another AI coding setup"), the demo up top, the 11pm thesis, three true vignettes, one 6-row what's-inside table (the full 35-agent / 66-command / 42-playbook catalog is preserved verbatim in collapses), a comparison table that now includes the AI-app-builder (Lovable-class) category, and a two-doors quickstart. The framing rule shipped with it: localhost is where products are born, not where they live.
• 🛣️ The Live Path goal (meta/goals/live-path.md, ACTIVE). The factory's next structural target, with agent-runnable evals: any scaffolded product reaches a verified live URL — domain, HTTPS, production-mode auth, verified email, analytics + error events, a real signup on the live site — in ≤15 minutes of human time with ≤5 dashboard actions (E1+E2), and product #2 ships with zero account-level re-setup (E3). Milestones: wire the live-assertion harness into /go-live → kill the four manual dead-ends (registrar/DNS, Neon, Clerk, Resend) → the account-aware fast path → scaffold the kill switch.
• 🛡️ MCP configs are now an audited surface. /security-check gained a deterministic scanner (scripts/check-mcp-config.ts): inline credentials in mcpServers blocks, wildcard permission allowlists, bypassPermissions, plaintext http:// servers, and moving-tag pulls are flagged — inline credentials and wildcard allowlists are BLOCK-class failures. Both true-positive and false-positive fixtures sit on the eval regression floor.

What changed

v2.10.0 — story-first front door + the Live Path goal (shipped 2026-07-05, recorded at release)

• README.md rebuilt promise-before-inventory; every count still real, every item still linked, every claim still badged.
• meta/goals/live-path.md + brain/decision-log/2026-07-05-live-path-goal.md — the goal contract and its decision record.
• stack/README.md honesty fix: the "product #2 in ~5 minutes" claim softened to measured reality (~25 min of per-product wiring today) and linked to the goal whose E3 earns the bold claim back with ledger receipts.
• brain/learnings/2026-07-05.md — the distilled rules: counts are receipts, not pitches; audit adjacent docs' numbers when repositioning copy; never let the on-ramp read as the product.

v2.9.0 — MetaHarness ingestion

• scripts/check-mcp-config.ts (new) + /security-check § 6 (new dimension) + two eval fixtures on the regression floor (12 → 14 cases).
• references/metaharness/ cloned with a mining guide (study-only, per references discipline); three candidate patterns captured in brain/knowledge/ — score-before-scaffold, the Darwin measured-retention rule, capability-per-dollar — as candidates, not builds, per the factory-change gate.

Get started

curl -fsSL https://raw.githubusercontent.com/hamza-ali-shahjahan/hamzaish/main/install.sh | sh

Then open Claude Code and type /builder-mode <your idea>. New to terminals? Start at docs/start-here.md.

License

AGPL-3.0 — clean, no added clauses. Free for builders; commercial license on request.

v2.8.0 — 🛡️ Self-governing autonomy

The autonomous manager loop becomes self-governing — it now enforces its own safety preconditions before it runs, and reaches a human the moment it's genuinely stuck.

New capabilities

A run refuses to start unsafely. Before the factory dispatches an unattended goal-pursuit, it now checks the floor: the secrets backend must be configured and valid, the dev-server state is verified rather than assumed, and it warns — loudly — if it has no spend meter. An autonomous run can no longer silently begin without safe secrets or a way to see the burn. The safety preconditions are self-enforcing, not a checklist someone has to remember.

A stuck run comes and finds you. When an unattended run hits a blocker it can't clear, or spends its budget without meeting the bar, it now escalates actively — a durable escalation record plus a desktop notification — instead of waiting silently in a log for someone to check back. Unattended work that needs a human decision surfaces immediately, and only then.

Honest by construction. The readiness checks report only what they actually verify — "configured," not "will decrypt"; "defined," not "live" — so a green precondition means what it says. The loop still never takes an irreversible or outward-facing action on its own; anything that needs a human, a credential, or a risky action stops and asks.

Together: autonomy you can leave running because it knows its own limits — it won't start without its safety floor, and it won't fail silently.

v2.7.0 — 🔐 Safe-by-default: fnox + pitchfork floor

Hamzaish becomes safe-by-default. This release adds the jdx/en.dev toolchain floor — the two tools that make unattended, multi-product work safe — on top of a wave of guardrails that close real incidents at the tool layer, not with reminders.

Highlights

🔐 fnox — secrets without a plaintext file (v2.6.0). The recommended secrets backend for /go-live. fnox.toml holds only ciphertext or remote-provider references (safe to commit), so there is no plaintext .env.local for the harness watcher to echo into a transcript — the root cause of a real key-leak incident, removed. AI agents reach secrets only through an exec-only MCP server that redacts resolved values (printenv → [REDACTED]). Piloted and red-teamed before shipping, with an honest, documented threat model: it closes accidental leaks; the real boundary against a determined agent is keeping the decryption key out of reach. The .env.local flow stays as a fallback, and the machine-wide guard hook stays as defense-in-depth.

🍴 pitchfork — supervised, self-verifiable dev servers (v2.7.0). Opt-in supervision for local dev servers: start-once (idempotent), survives across sessions, and MCP-drivable. /go-live now verifies a server is actually up before sharing a localhost link. Ships with a schema-validated config and an honest limit found in testing (an HTTP readiness check confirms "something answers," not "this server is alive" — mitigated by output-matched readiness + distinct ports). The stable-HTTPS reverse proxy is left deliberately opt-in, since it touches the system trust store.

🛡️ A wave of tool-layer guardrails (v2.5.x). Secrets files are never touched by the agent; security-posture documents can never reach a public tree; commits can never wear a stranger's identity; multi-repo sessions address repos instead of navigating into them; and ambiguous instructions are never resolved silently. Plus real portfolio telemetry connectors (Stripe / PostHog / Sentry) surfaced via bun run telemetry.

What's inside

• New secrets backend: fnox.toml.example, exec-only MCP config, and a whole-tool shell deny-rule shipped in the product starter; /go-live and the secrets anti-pattern reworked around it.
• New dev-server layer: pitchfork.toml.example + MCP entry in the starter; go-live localhost-link verification.
• Guardrails: machine-wide secrets-file hook, security-doc publish gate, identity/attribution checks, ambiguity protocol.
• Decision logs + a retro capture the evaluation, the red-team evidence, and the config-schema bugs caught in review (why these are opt-in, and where the honest limits are).

Get started

Clone to ~/Claude/Hamzaish and run bun run setup. The jdx tools are opt-in per product (brew install fnox pitchfork); nothing is forced, and the plain .env.local + bun dev paths still work.

License

AGPL-3.0-or-later.

v2.4.1 — 🏁 The factory checks its own claims

The factory now checks its own claims. A frontier-model audit of every component (35 agents · 42 playbooks · 42 skills · 137 practices) produced a four-phase upgrade roadmap — and all four phases shipped, each one enforced by machinery rather than documentation, then sealed by the factory's own learning loop.

Highlights

🧾 Eval coverage is a CI-enforced ratchet. A new agent or skill cannot ship without a verified eval case; a covered component that loses its cases is a blocked regression. Everything pre-existing is grandfathered by name in a committed manifest — visible debt that can only shrink. First agent-level behavioral evals (problem-sharpener, devils-advocate) verified live and baselined.

🤝 Agent handoffs are typed contracts. The six core chains (idea→discovery→synthesis, architect→builder, keyword→SEO, pricing launch→scale, brand→landing copy) declare Produces / Shape / Preconditions / On-gap. The interview synthesizer refuses batches under 5; the builder refuses to build without written architecture; keyword briefs cannot invent search volumes.

🎛️ The model policy is wired, not declared. Every spawnable agent carries its model tier as frontmatter (15 opus / 15 sonnet / 4 haiku); a tested resolver reads it at the spawn boundary; stakes escalation is active and up-only — anything touching auth, payments, migrations, RLS, or data deletion runs on the top tier regardless of role.

🧠 Recall is push, not pull. /work-on and /full-cycle auto-inject brain recall at session start — anti-patterns first, because defenses beat context. Product-level learnings are indexed and feed the promotion pipeline.

🚁 The heavy verdicts go fleet-native. Validation, security checks, code review, devil's advocacy, and portfolio reviews can fan out as blind parallel workers, pass every blocking finding through an adversarial refuter ("default to refuted"), and synthesize with a judge that reports disagreement instead of averaging it away. Serial execution stays first-class.

🔁 The loop closed on itself. /learn-loop's first dual-scored run: five candidates scored independently twice, the fresh-eyes scorer rejected two of them, the operator ratified the survivors. The commit that introduced the retro rule had to pass the retro rule to merge.

Also inside

• Site-audit capability set (v1.33–v1.34): the "looks static, but it's live" trap — an env-gated backend is still a backend; the backend-reality check now runs first in /security-check, the 70-check security checklist, and the launch workbook.
• /pr stowaway guardrail: PR branches cut from origin/main explicitly, publish-set review before push — an unpushed parallel-session commit can never again ride into a squash-merge unreviewed.
• Retro + decision disciplines with teeth: every changelog entry needs a retro or a recorded skip (CI-enforced); decision capture is a forced end-of-session question.
• Practices ledger: 134 → 137 (35 ✅ proven with dated incidents); playbooks 41 → 42 (fleet-patterns).

Get started

curl -fsSL https://raw.githubusercontent.com/hamza-ali-shahjahan/hamzaish/main/install.sh | sh

Then open Claude Code and type /builder-mode <your idea>. Full beginner path: docs/start-here.md.

License

AGPL-3.0-or-later. Built on a thousand generosities — see ACKNOWLEDGMENTS.

v2.0.0 — 🚀 Self-contained, and it only builds what it can prove

🚀 The self-contained build OS

This is the big one — and it's built for first-timers, not just developers. 🌱 You don't need to know how to code, and you don't learn a CLI: you enter Builder Mode, and it picks the right approach for where you are. Clone it, type one sentence in plain English, and it builds. Never used a terminal? There's a "Start here" on-ramp that walks you from zero — no coding required, you just talk to an AI and it does the techie parts.

And as of v2.0 the whole engine ships in the repo, so a fresh clone is complete. 🛠️

git clone https://github.com/hamza-ali-shahjahan/hamzaish
# open in Claude Code, then type:
/builder-mode <your idea>

(It routes on context and asks when it's unsure — gates, not guesswork.)

---

✨ Highlights

• 🌱 Built for beginners too. No dev experience needed — a "Start here" on-ramp takes a total first-timer from zero to building. You talk; it does the techie parts.
• 🚪 One front door, it routes. /builder-mode (or /hamzaish, or plain English) reads what you're building and where you are, then drives the right path — a quick change, the gated full cycle, or an autonomous self-verifying loop toward a goal. The ~65 skills & commands are the gears; you never drive them by hand.
• 🎯 Goal-first, eval-gated — it only builds what it can prove. The cycle pins what "done" means, slices the goal into features, and keeps only the ones it can prove — each ships with an eval and an end-to-end test. A feature it can't evaluate or test doesn't get built. "Done" is a green eval, not an opinion.
• 📦 The whole engine ships in the repo. spec → plan → build → test → review → ship, plus autonomous modes — 22 engineering skills + 3 subagents. No separate install; the clone is the whole thing.
• 🔒 Honest by force. 35 agents · 41 skills · 24 commands · 41 playbooks · 133 practices — and a CI guard derives every count from the filesystem and fails the build if a doc drifts, a path leaks, or the version disagrees across files. The counts are the filesystem, not the marketing.

---

🔢 New & improved: real versioning (why this is v2.0, not v1.33)

Hamzaish now follows semver with a documented policy (docs/versioning.md), and a CI guard keeps the number honest across the whole repo (it used to read four different ways 😅 — never again):

• MAJOR = a milestone or a change in how you use it → v2.0 = the self-contained build OS. 🎯
• MINOR = a new capability · PATCH = a fix.
• Frequent changelog entries roll up into deliberate releases — no more drift.

So the jump from v1.2 → v2.0 is on purpose: this is a milestone, not an increment. 🚀

---

📦 What's changed since v1.2

• 🧩 The engineering engine (/full-cycle, /auto, /goal, /spec, /plan, /build, /test, /review…) consolidated into the repo — the front door is now self-contained on a fresh clone.
• 🎯 Goal → Slice → eval-gated build flow + the new feature-slicing skill; /goal self-verifying loop shipped in-repo.
• 🔒 The count / path / version CI guard — believability, mechanized.
• 🖼️ Rebuilt Builder Mode banner + the versioning policy & drift guard above.

Full log → the changelog.

---

Works with Claude Code, Cursor, Codex & Windsurf · 📜 AGPL-3.0 · needs a paid Claude plan (no free tier).

Built on Claude Code and a lot of generous open source. 💛

v1.2.0 — ⚡️ The 100× faster start

⚡️ The 100× faster start

Three releases, one mission: collapse the distance between "saw the repo" and "a product running on your screen." Everything below is on main, public, and checkable.

curl -fsSL https://raw.githubusercontent.com/hamza-ali-shahjahan/hamzaish/main/install.sh | sh

---

✨ Highlights

• 🪄 One command from a bare machine. curl … | sh installs Bun (if missing), clones Hamzaish, and runs setup — then prints your first command. (Read it first; it's short and commented.)
• 🟢 Local-first scaffold — zero accounts to start. /builder-mode <idea> now scaffolds a product that runs in ~60 seconds with zero env, zero signups (dev-auth stub, integrations off). Build first; the app boots before you create a single account.
• 🚀 /go-live — accounts, but guided. When you're ready to ship, /go-live <slug> walks the production stack service-by-service: deep-links each signup, validates each key's format, writes .env.local, and tracks a resumable ledger so you can stop and pick up later — then hands off to /security-check → /ship.

Put together: curl … | sh → /builder-mode <idea> → building locally in a minute → /go-live when you want the stack → /ship. The path that used to be a dozen friction-filled steps is now a handful of commands.

📦 What's changed

• install.sh (new) — POSIX-sh bootstrap, idempotent, safe to re-run.
• Starter is local-first by default: env vars optional, a Supabase dev-stub, LOCAL_MODE flag; SETUP.md is now the go-live checklist, not a prerequisite.
• /go-live command + skill; the chain /builder-mode → /go-live → /security-check → /ship → /web-launch is complete.
• Inventory: 29 skills & commands (17 skills + 12 commands), counts computed from the filesystem.

🚀 Get started

curl -fsSL https://raw.githubusercontent.com/hamza-ali-shahjahan/hamzaish/main/install.sh | sh
# then, in Claude Code:
/builder-mode a tip calculator for freelancers

License

AGPL-3.0 — free to use, study, fork, and self-host. A commercial license is available for closed-source use.

v1.1.0 — Builder Mode + the honest judge

Builder Mode at the core — plus the factory's first honest judge.

Since v1.0.0, Hamzaish has made its mission public, gained a way to prove its own quality, and added a launch system. Everything below is on main, public, and checkable.

---

✨ Highlights

• 🧭 Builder Mode — the mission. Strategy-first kills more builders than bad ideas do. With AI, building is cheap, fast, and reversible — the ship is the test. The full piece lives at docs/builder-mode.md, and the README now opens on it.
• ⌨️ /builder-mode — the front door. Your first action literally enters the mode: /builder-mode <your idea>. Same momentum router as /hamzaish (now its alias); strategy rails stay opt-in and skippable.
• ⚖️ An honest, agent-blind eval harness (Selection). The factory can now be wrong in a way it can't hide. bun run eval returns a four-outcome verdict per case — PASS / FAIL_BUILDABLE / GAP / UNCERTAIN — with a committed regression floor. The thing being judged can't see or edit its own tests (cases are excluded from the brain index). 9 cases across 3 skills, including an LLM judge that is a gate, never an oracle — no judge verdict can turn a failing case green.
• 🚀 The web-launch plugin. A verification-gated website-launch system (/web-launch) — a per-project workbook with a refuse-to-launch sign-off gate, plus launch-gotchas and pseo-at-scale skills. Portable: install via the marketplace, or use it as plain skills.
• 🤝 Community-ready. Code of conduct, issue + PR templates, and Discussions — GitHub community profile at 100%.

📦 What's inside / changed

• README rearchitected around a "What's inside" inventory — every agent, skill, command, and playbook catalogued, counts computed from the filesystem.
• The practices ledger (BEST-PRACTICES.md) — practices for shipping products with Claude Code, each badged ✅ proven / 🟡 partial / ⏳ research-baked, sourced and linked.
• /release factory step added (this release was cut with it).
• Self-evolution milestone: variation ✅ · heredity ✅ (scored) · selection ✅ — all three ingredients now exist. See meta/SELF-EVOLUTION.md.

🚀 Get started

git clone https://github.com/hamza-ali-shahjahan/hamzaish.git
cd hamzaish
bun run setup

Then, in Claude Code: /builder-mode a tip calculator for freelancers

License

AGPL-3.0 — free to use, study, fork, and self-host. A commercial license is available for closed-source use.