Run telemetry, operator-only factory teardown, reliable improvement self-edits, multi-provider agents

[stempeck]

Closes #91.

What you get

See where your runs spend time and money

New af telemetry [on|off|status|report|usage] command family. Recording is off by default and factory-wide when you opt in. Once on:

• af telemetry report prints a per-step timing table right in the terminal — find the slow step of a formula run without leaving the shell.
• quickstart.sh now installs a bundled, pinned, checksum-verified dashboard (loopback-only) seeded with six views: step duration, tokens per agent/model/step, cost per agent/model, spend outside steps, and two honesty views that show you when the accounting doesn't reconcile instead of rounding the gap away. --no-telemetry skips all of it.
• Prefer your own observability stack? Point endpoint in .agentfactory/telemetry.json at any OpenTelemetry address — the bundled dashboard is a convenience, not a dependency. Secrets and factory-specific endpoints stay untracked.
• The web console gains a Telemetry panel — step timings, token usage, session metrics — readable from your host browser over the console's existing connection, no tunnels. Every degraded state is a plain-language sentence telling you what's wrong and what to do next; an unprobed backend is never shown as healthy and an empty pane always says why.
• Quality/fidelity gate grader calls are attributed as overhead instead of being invisible spend.
• The bundled backend is relaunched automatically (by af up and the watchdog) if it dies while recording is on.

The factory can no longer be torn down by accident

Factory-wide teardown — bare af down, --all, --reset, af install --agents, af dispatch stop — is now operator-only: run from inside any agent session (this has happened, twice) it refuses with clear guidance to skip, continue, and escalate to you. Scoped stops still work, in three tiers: an agent can stop itself, a dispatcher can stop the specialist it dispatched, and the interactive manager can stop any autonomous worker — so you can direct crisis teardown through the manager. --reset carries the same authority as the plain stop. Documented honestly as a guardrail against accidents, not a security boundary (accepted bypasses are listed in ADR-021), with drift tests keeping the doc claims accurate.

Improvement self-edits actually land

A dispatched agent running in a worktree used to write its formula self-improvement to a worktree-local copy that nothing validates or promotes — the edit silently vanished. It now always edits the factory-root store formula, so the verdict you're mailed and the af install --agents promotion route see the same file the agent touched.

Run agents on non-Anthropic models

A litellm gateway route (codex in models.json, key kept in an untracked secrets file, --litellm bootstrap flag) lets you assign any agent to GPT models per-agent. Ships with working variants — gpt-fable-review and gpt-rootcause-all — plus two new formulas: fable-secure (fixed-checklist security-program coordinator) and multi-agent (two persistent analysts on different models, findings synthesized independently).

Wider watchdog coverage

startup.json now watches the full autonomous-worker roster by default, not just mergepatrol, so wedged workers get noticed and restarted.

Notes

• 230 files, +42k lines — the bulk is the new internal/telemetry package and its recorded-real test corpus (actual pinned-backend responses, rejection shapes, golden DTOs for every degraded state).
• No behavior changes when telemetry is off and no dashboard is installed; teardown from an operator shell is byte-for-byte unchanged.
• CI gains a conformance job that drives the shipped console JS with real backend DTOs to assert the exact banner lines an operator would see.

🤖 Generated with Claude Code

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ stempeck
❌ agentfactory

---

agentfactory seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}