Self-recovering agents, durable memory, live statuslines, trustworthy config, and an honest console

[stempeck]

Closes #103.

This release makes the factory self-recovering, self-remembering, and honest with its operator. Agents that fill their context window now recover on their own instead of wedging forever; what they learn survives teardowns; and every surface you watch — pane, CLI, telemetry, web console — now tells you the truth, including when it has no data.

What you get

Agents recover from context exhaustion — automatically and safely

• The watchdog now watches every agent's context occupancy and recycles an exhausted agent with its state checkpointed, so a filled window no longer means a wedged agent burning tokens indefinitely.
• A durable circuit breaker stops recycle loops: repeated re-stalls halt the agent and escalate to you instead of destroying work over and over. af recovery reset <agent> re-arms it after you investigate.
• Supervision is always on: default-configured factories are no longer unsupervised, a heartbeat file proves the watchdog itself is alive, and hung agents are detected even with a busy statusline rendering.
• Steps that end with a nearly-full window hand off to a fresh session cooperatively, so the next step starts clean instead of inheriting exhaustion.

Agents remember what they learn

• A durable memory vault (af memory add/list/check/status/export) survives step close, teardown, reset, and worktree removal. Learnings are re-injected at session start, bounded so they never bloat context.
• Teardowns tell you what was preserved before destroying anything, you're reminded to export when backups are stale, and quickdocker.sh can bind the vault to a host directory so docker rm can't take your learnings with it.
• Improvement sessions now read past learnings first and record new ones — no more rediscovering last month's lesson every run.

A live statusline in every agent pane

• af statusline renders model, directory, git branch, diff size, elapsed time, a context-fill bar, and session/daily spend — with accurate token accounting (no negative totals, no fabricated $0.00, survives compaction and transcript rotation).
• af statusline status diagnoses its own pipeline and warns about config drift that would mis-aim recovery.

Config editing you can trust

• Setters now reject unknown keys loudly instead of silently erasing them on write-back, validate agent-name references across files, and accept an optional content-hash precondition so concurrent edits conflict instead of silently clobbering each other.
• New setters for messaging and statusline config; af config fingerprint lets any consumer detect schema skew before writing.
• af config models check verifies per-class model coverage before a dead sub-agent does it for you; profile switches leave no environment residue; malformed keys, placeholder secrets, and silently-capped values are rejected at write time.

Quality gates that judge fairly

• Gate judges now see exactly the turn being graded — calls paired with their results, in order, sub-agent noise excluded, gaps disclosed — and block only on contradiction, never on absence of proof. No more re-doing finished work because the judge couldn't see it.
• You can exempt a single misfiring agent (af fidelity off --agent) instead of disabling oversight fleet-wide, every gate toggle is attributed in a provenance log, and af fidelity status shows per-agent gate activity. Agents can no longer switch off their own grader.

Telemetry that tells the truth

• Step records now carry context occupancy, consumption, and budget verdicts; interrupted steps show up as INTERRUPTED instead of vanishing; and "not measured" is always distinct from "zero" — in the table, the JSON, and the web console.

A more capable, safer web console

• Settings covers more files (messaging, statusline, model-profile pins) and can no longer silently erase keys it doesn't understand — unknown config rides through untouched, proven by round-trip and secret-canary tests.
• Per-panel saves with write preconditions and an audit line; absent files stay absent instead of being materialized with invented defaults.
• The Floor now shows context-fill and recovery badges, so an exhausted or halted agent is visibly distinct from a healthy one.

Sharper formulas, docs, and CI

• Formula fixes: no more literal {{placeholder}} text in operator mail and PR titles, artifacts survive to the PR, and an unavailable review sub-agent is recorded as unavailable — never as a clean pass.
• The operator manual is restructured with the destructive-teardown warning in plain text, README/CLAUDE.md match the real command surface, and CI now runs the web module, client-JS conformance lanes, and the hook end-to-end tests it was silently skipping.

🤖 Generated with Claude Code

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ stempeck
❌ agentfactory

---

agentfactory seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}