v2.18.0 — 📡 The factory grows senses

The factory grows senses. Hamzaish's self-improvement loop used to run on what a session remembered to write down — now it runs on what actually happened: session traces recorded automatically from your very first session, and a new operating principle that turns lessons into executable checks instead of prose. This release bundles the eight cycles since v2.10.0.

Highlights

• 📡 Session traces, zero-setup (v2.18.0). A committed .claude/settings.json ships project hooks that record every tool call and failure to a local JSONL trace — fail-open (any error exits 0; telemetry can never slow or block a turn), privacy-capped (no tool outputs, no file contents, commands truncated — traces are gitignored and never leave your machine), bounded (one file per day). bun run trace-report turns them into answers: failure rate by tool, the bash commands that keep breaking, how much work happened. /learn-loop now reads it before every cycle. Adopted from the Code as Agent Harness survey (arXiv:2605.18747, UIUC + Meta + Stanford, §3.5) — read against the repo as a checklist, not a blueprint: two gaps adopted, topology rework deliberately declined.
• 🪜 Operating principle 15: a lesson that can be a check becomes a check (v2.18.0). The promotion ladder — hook → CI guard → eval case → prose, with prose as the fallback, never the default. Hamzaish's own history proved it: its three worst incidents each stopped recurring only when the lesson became a hook.
• 🎛️ The factory control plane (v2.16.0). FACTORY-ORDERS / STANDING-ORDERS / HEARTBEAT operator templates, a hard dollar cap + spend ledger on the autonomy loop (--max-spend-usd, default $25, refuses unmeasured modes), lifecycle gates in product.config.json with the check-gates dashboard, and the /factory-launch ritual that fills it all in — the gap between "runs overnight" and "runs overnight bounded", closed.
• 🔭 The starter tells the truth in production (v2.17.0). Sentry now actually initializes in every scaffold (the observability costume is closed), a token-gated canary proves errors reach Sentry on the REAL deploy, and the Stripe webhook never 200s an event it didn't persist (idempotency ledger, claim/release semantics) — silent subscription loss, gone.
• ✍️ The skill-authoring standard (v2.15.0). Context load vs cognitive load, leading words, the no-op test, completion criteria, six failure modes — ported from mattpocock/skills — plus the first context-load audit of every skill description the factory ships.

What changed

v2.18.0 — session traces + the lesson-to-check ladder

• scripts/trace-log.ts (hook-fed flight recorder) + scripts/trace-report.ts (bun run trace-report) + .claude/settings.json (project hooks, the first committed one) — 7 new tests including the trace-capture-fidelity eval; verified live: the hooks captured their own build session.
• brain/operating-principles.md principle 15; /learn-loop grounds cycles in traces (step 2) and applies the check ladder on promotion (step 6).

v2.17.0 — starter production truth

• sentry.*.config.ts × 3 + src/instrumentation.ts, the sentry-canary route proven by verify-live A11, and the stripe_webhook_events ledger with verify → claim → persist semantics.

v2.16.0 — control plane

• Operator templates scaffolded by bun run setup; spend meter (scripts/lib/spend.ts) with hard abort; lifecycle gates (scripts/check-gates.ts); /factory-launch eval-covered from birth.

v2.15.0 — skill authoring · factory/playbooks/ai-native-2026/skill-authoring.md + context-load audit; skill/command namespace dedupe guard (check-skill-command-collision).

v2.14.0 — the ThousandWorlds fold · 12 learnings promoted: 2 anti-patterns (lazy-thenable Supabase inserts that send nothing; trusting .gz extensions over magic bytes), 2 playbooks (multi-agent-one-repo fences; landscape-research-before-roadmap), 6 proven practices.

v2.13.0 — paste-contents rule · anything you must relay to an external surface goes into chat as full file contents, never a path (AGENTS.md hard rule 13).

v2.12.0 — the Orca distillation · community-flywheel + handoff-vs-supervision playbooks, community PR automation (community-prs.yml), /release hardened (heartbeat trigger, never-publish-backwards gate).

v2.11.0 — the live gate · scripts/verify-live.ts: /go-live closes on an A1–A10 scorecard against the real deployment (DNS, TLS, health, auth gate, live keys, no leaked server secrets) — never on a claim.

Get started

curl -fsSL https://raw.githubusercontent.com/hamza-ali-shahjahan/hamzaish/main/install.sh | sh

Then open Claude Code and type /builder-mode <your idea>. New to terminals? Start at docs/start-here.md.

License

AGPL-3.0 — clean, no added clauses. Free for builders; commercial license on request.