What has changed at the factory.

Security patch: hardening the repo/remote coupling

An adversarial re-review of v0.18 found three findings in the new remote-sync layer — all closed:

• Remote URL as a trust boundary: project remote URLs are now validated centrally (host allowlist, scheme whitelist) — the shared GitHub token never leaves for a foreign host.
• Hardened git transport: only the required protocols, no remote-helper abuse.
• Branch isolation: the merge-conflict correction stays strictly on the run branch.

Repo reality: PR/CI feedback, remote sync, multi-version

The iterative SDLC loop is coupled to the real world of the Git repo:

• PR/CI feedback: a build run now completes only once the pull request is merged and CI is green — a red CI automatically triggers a correction round.
• Remote sync & conflicts: the state is reconciled with the remote before each run; merge conflicts go into the correction loop instead of aborting.
• Multi-version: milestones group backlog items into iterations and release them (per-project changelog + Git tag + GitHub release); backlog items can depend on each other.

Security patch: governance hardening after internal re-review

An adversarial multi-agent re-review of v0.17 found four multi-tenant issues — all closed:

• Global policy floor: a tenant policy can now only tighten the operator baseline (EU AI Act / BAIT / VS-NfD), never weaken it.
• Operator surfaces sealed: tenant management and budget caps are consistently reserved for the platform operator.

Patch: Tomcat security update

Embedded Tomcat bumped to 11.0.23 (CVE-2026-55276, CVE-2026-53434, CVE-2026-53404 — rated low by Apache, patched immediately as a precaution).

Enterprise hardening: full tenant isolation, container sandbox for build & scans

v0.17 closes the hardening work packages deliberately left open after v0.16:

• Full tenant isolation: separate active governance policy per tenant, audit events attributed to their tenant as part of the signed hash chain, tenant-scoped database queries instead of in-memory filtering. Operator surfaces (attestation, costs, policy, export) show tenant users only their own view.
• Container sandbox for build & scans: the build of generated code and the trivy scans run in an ephemeral container when the container variant is active (read-only, resource limits, only the workspace mounted) — with real Docker isolation tests.
• Key rotation: Ed25519 signing keys are rotatable; old attestations remain verifiable via the key ring.
• Costs per user (seat): every run records the triggering user — consumption can now be evaluated per seat, in addition to the per-tenant view.

Patch: all findings of an adversarial multi-agent re-review fixed

An internal re-review of v0.16 (security + architecture with Opus 4.8, adversarially cross-checked) found five residual gaps — all closed in this patch:

• Validation approval enforced: regulated profiles (BAIT/MaRisk/DORA, BSI-VS-NfD) now actually stop before merge for four-eyes approval — previously signed but not enforced.
• Two IDOR write gaps closed: prompt artifacts and per-project budgets were writable via a foreign project ID; now tenant wall + role guard.
• Attestation integrity: the actually enforced policy version is attested at execution time; mandatory attestation forces real signing (no silent no-op) and a durable key.
• Fail-closed: ambiguous gate configuration blocks (instead of silently downgrading to advisory).

Security & honesty hardening before the test-user handover

Consolidation from an internal 5-pass review (security, architecture, docs, onboarding): governance is now actually enforced, authorization is sealed, and the limits are named honestly.

• Governance enforced: the active, signed policy-as-code makes gate strictness, mandatory approvals and mandatory attestation genuinely effective (strictest value wins) — compliance profiles like the EU AI Act now actually take effect instead of being decorative.
• Authorization & isolation: role-based protection on all write endpoints, closed IDOR gaps, OIDC login via a stable subject claim, operator surfaces shieldable against cross-tenant visibility.
• Audit hardening: a signed chain head detects truncation of the newest audit entries; the unsigned mode is clearly marked “not tamper-proof”.
• Honesty & onboarding: cloud gateways marked experimental, current model defaults (Opus 4.8 / Sonnet 5), single-seat default “manual approval before merge”, a mock-adapter hint and a new “Known Limitations” page.

From funnel to sovereign product: multi-tenancy, attestation & supply chain

The big enterprise/sovereignty expansion (roadmap P0–P4): team operation with hard tenant isolation, cryptographic provability of every AI-assisted decision, and supply-chain integrity for the generated code.

• Operating mode & model backends: single-seat subscription vs. team API pool; OpenAI-compatible adapter (vLLM/Ollama), gateways (Bedrock/Vertex/Azure) (experimental), enforced per-project model policy.
• Multi-tenancy & RBAC: hard tenant isolation, roles (Viewer→Admin), SSO federation (OIDC), per-tenant cost attribution + monthly budgets (foundations; full multi-tenancy still to come).
• Provenance & attestation: signed, tamper-evident audit hash chain (Ed25519), reproducible “why” trace per run, versioned + signed policy-as-code, compliance profiles (EU AI Act, BAIT/MaRisk/DORA, BSI/VS-NfD), regulator audit export.
• Supply-chain integrity: SBOM per build (CycloneDX), signed artifacts, dependency/license scan as a blocking gate output in the correction loop.

Branch & pull request, self-correction, quality gate & auto-loop

The SDLC loop becomes production-ready: every build run on its own branch, optional push + pull request to GitHub, automatic correction on a red build, and a quality gate in the pipeline.

• Branch per build run (sdlc/run-…): success → merge into base, failure → work stays isolated, base stays clean.
• Push + pull request (GitHub): with a project remote URL and a GitHub token, a successful build run opens a PR automatically.
• Automatic correction loop: on a red build the feedback is fed back and the build retried (bounded).
• Quality gate in the pipeline (off/advisory/blocking) and auto follow-up proposals that close the loop by themselves.
• Wizard: .NET 10 (LTS) as default (9/8 still selectable).

Iterative SDLC: persistent workspace, memory & roadmap plans

The factory becomes a lifecycle manager, not just a project starter: follow-up runs continue on the existing code, learn along the way and plan the next steps.

• Persistent workspace + re-run: a follow-up run builds on the previous run's code (instead of starting empty) — real development across versions.
• Real repo import: an existing repository (local path or Git URL) is adopted and then developed further through the factory.
• Project memory: curated learnings/decisions per project that flow in as MEMORY.md before each run and are learned back afterwards.
• Roadmap/plans as a backlog: a plan run proposes next steps as plans/*.md; in the backlog menu you activate a plan and a build run implements it on the existing code.

Quarkus backend & comprehensive user manual

The wizard now knows Quarkus as a backend, and there is an extensive user manual (EN + DE) for the single seat.

• Quarkus as a backend stack (Java) next to Spring Boot — Quarkus REST + Hibernate ORM Panache, Maven/Gradle, optional native image. Combinable with the Java frontends and the agnostic SPA/client frontends.
• User manual: single-seat setup (Claude plan / Codex plan / API keys), project definition with examples, the run lifecycle, and an honest assessment of what the factory does today for the wider SDLC (development across versions) — and what is still missing.
• Polish: proper umlauts in the German wizard UI; clean cache headers (no stale pages after updates).

Stack wizard (platform × backend × frontend) & Codex plan

Two big building blocks: the project wizard now combines stacks freely, and OpenAI Codex runs — like Claude — on your plan instead of an API key.

Project wizard: target platform × backend × frontend(s)

• Three orthogonal dimensions instead of a single template choice: first the target platform(s) Web/Mobile/Desktop (multi-select), then a backend (0..1), then frontend stacks (0..N). This expresses full-stack and multi-target products — one backend with a web frontend and a mobile app.
• Compatibility filter + coverage warning: server-rendered frontends are language-bound (Vaadin/Thymeleaf → Java, Blazor/WPF → .NET); SPA/mobile/desktop clients are runtime-agnostic via REST. If a platform has no frontend, you get a warning.
• Multi-part objective prompt: backend base + frontend bases + integration snippets (SPA REST, server-rendered, shared API contract, monorepo layout). Catalog: 17 templates, 12 frontends.

OpenAI Codex on a ChatGPT plan

• Codex plan mode mirroring the Claude plan: SOFTWAREFABRIK_CODEX_AUTH_MODE=subscription runs Codex via the ChatGPT Plus/Pro login (codex login); OPENAI_API_KEY is stripped from the subprocess in plan mode, CODEX_HOME set optionally. Switchable in the Settings UI.

Windows-native single-seat operation & boot hardening

The Claude plan mode now runs natively on Windows — without the WSL detour — plus two boot fixes and a new mandatory gate against startup regressions.

Claude plan native on Windows (no WSL)

• OS-aware env allowlist: on Windows, USERPROFILE, APPDATA, LOCALAPPDATA, SYSTEMROOT, COMSPEC, PATHEXT … are passed through and matched case-insensitively — otherwise claude wouldn't find its %USERPROFILE%\.claude. The ANTHROPIC_API_KEY stripping in plan mode is case-insensitive too. Unix/WSL behavior unchanged.
• OS-aware claude default: if claude.cmd is on PATH (npm installer) it is named explicitly; otherwise the bare claude stays, which Windows resolves to claude.exe itself. Explicitly configured commands are left untouched.
• Verified end-to-end on a real Windows 10 machine: native plan run via the Max subscription, a set dummy API key was correctly stripped.

Boot hardening & fixes

• Boot crash in all non-demo profiles fixed (local/container/prod): a disabled FilterRegistrationBean with a null filter crashed the Tomcat start since Spring Boot 4.0.7. The suppression bean is now bound to @Profile("demo").
• /teams/{id} 500 fixed: LazyInitializationException on team.members when rendering the detail page — members are now loaded via @EntityGraph.
• Boot smoke as a mandatory gate: a new CI job starts the app via docker compose in the container profile against real Postgres and waits for /actuator/health=UP — catching boot-time regressions that MOCK-based tests miss.

Single-seat license: 30-day lease with refresh

• Community lease raised from 7 to 30 days; best-effort lease refresh on every app start. If the license server is unreachable, the factory keeps running with the existing lease + 30 days grace — startup is not blocked. Air-gap mode unchanged.

Hardening & quality: coverage, ArchUnit, cleanup

0.9.1 is a pure quality release on top of 0.9.0 — no new features, but more safety through tests and a pinned-down architecture.

• More test coverage: a targeted issuer security test in LicenseVerifier (the issuer validation was previously untested) and testable CSV escaping in the analytics export. Branch coverage 0.815 against a ≥0.80 gate.
• Extended ArchUnit rules: hexagonal ports-and-adapters rules plus a freeze ratchet against module cycles and web→repository shortcuts — architecture violations break the CI run.
• Docs and DRY cleanup: package-info files, doc fixes and de-duplicated code.

Claude plan auth & Prometheus observability

Two improvements for nicer single-seat operation and better maintainability.

• Claude plan instead of API key: Coding runs can use your Claude Max/Pro subscription instead of a separate ANTHROPIC_API_KEY — toggle via SOFTWAREFABRIK_CLAUDECODE_AUTH_MODE=subscription. Full guide: Single seat with Claude plan. Bring-your-own-subscription for multiple Pro users is prepared.
• Prometheus metrics (observability level 1): Scrape endpoint /actuator/prometheus for JVM, HTTP and DB-pool metrics as a basis for Grafana & alerting. Restricted to ROLE_ADMIN, scraped via HTTP Basic, with a shared application label.

Both are test-covered and don't change existing API-key setups.

Wizard polish: stepper, objective preview, validation

Pure UX update for the project assistant. Four visible improvements lifting the wizard from "works" to "feels polished".

• Progress stepper: visual indicator 1→2→3→4 on top of every step; completed steps are links back.
• Objective preview in step 4: collapsible card with the fully composed initial-objective prompt.
• Server-side required-field validation: missing fields lead to a redirect with an error list, already entered values stay.
• Version cache empty state: "loading versions..." + link to the admin cache page, instead of a silently empty field.

Wizard cost estimate, inline diffs, browser notifications

Two deferred building blocks closed: the wizard shows roughly what a run will cost before it even starts, and the approval view shows a real diff of the workspace changes instead of "approve/reject" buttons.

Wizard step 4 — cost estimate (phase 4.5)

• WizardCostEstimator wires PromptComposer, the phase-9 TokenEstimator (JTokkit) and ModelPricingProperties. Local EUR estimate, no LLM call.
• Default claude-sonnet-4-6, output assumption 1.5x input. Unknown models show "no price table configured".

Inline diffs before approval (phase 7.5b)

• GitService.diffSeit() shells out git diff --no-color <sha> from the workspace, capped at 256 KB.
• At WAITING_FOR_APPROVAL the detail view embeds the diff since the earliest run checkpoint as a collapsible card.

Browser notifications (phase 7.5a)

• LogStreamService emits a status SSE event per poll cycle on status change.
• Notifications fire on COMPLETED, FAILED, TIMEOUT, CANCELLED, NEEDS_CORRECTION, WAITING_FOR_APPROVAL.

Run templates, container sandbox, live token stream

Three outstanding building blocks from the security and reuse track.

Run templates (phase 7.5)

• From a finished run you can save a RunTemplate (adapter, team, objective). It becomes the preferred suggestion on the next quick-start.
• Audit events RUN_TEMPLATE_CREATED/UPDATED/DELETED.

Container sandbox per run (phase 8, ADR-0011 B)

• ContainerProcessSandbox starts every agent in an ephemeral Docker/Podman container with --cpus 2 --memory 4g --pids-limit 512 --read-only --network=none.
• Workspace via bindmount to /workspace; everything else is invisible.
• Selection via setting execution.sandbox.variant=container; fallback to local with log warning if Docker is missing.

Live token stream + local estimation (phase 9, ADR-0013)

• ClaudeStreamJsonParser reads --output-format=stream-json line by line, emits a typed ExecutionEvent.Usage per event.
• TokenEstimator (with com.knuddels:jtokkit:1.1.0) provides local estimates before a run starts.

Conductor: model routing, plugin sync and repo import

The platform stops being a wrapper around Claude Code and becomes the conductor of the entire setup.

Per-role model routing (phase 5)

• Default mapping: Architect & Documentation → claude-opus-4-7; Developer/QA/Merge-Release → claude-sonnet-4-6; Reviewer/Security → claude-haiku-4-5.
• AgentDefinition gets a nullable preferredModel field (V14). The Claude Code adapter appends it as a --model flag. Drift detection emits an OUTPUT event on model mismatch.

Plugin and skills sync (phase 6)

• Module conductor scans ~/.claude/plugins/ and ~/.claude/skills/ with path-traversal guarding.
• Before every run the platform writes .claude/settings.local.json and .claude/agents/<role>.md per team member into the workspace.

Repo-import template (phase 7, partial)

• Sixth wizard template existing-repo-import: instead of bootstrapping a new skeleton it instructs Claude Code to inspect an existing repo and write an IMPORT_REPORT.md.

Project memory via PROJECT_NOTES.md

The freeText field of the ProjectDefinition is auto-written as PROJECT_NOTES.md into the workspace root at run start.

Polyglot: the wizard now covers five stacks

Three new wizard templates for the most common solo-dev backend stacks: dotnet-backend (ASP.NET Core), python-fastapi and node-express. Proof that the phase-4.5 architecture (templates as code-as-data plus snippets) really is extensible for further families.

Settings, wizard, version cache

Four major feature packs: Settings UI at /einstellungen, project assistant at /wizard with two templates, daily version cache from Maven Central / npm / GitHub, quick start in the run list. Plus pgJDBC 42.7.11 (CVE fix) and Postgres loopback pinning.

Tokens, costs, live logs: from black box to cockpit

A frontend leap: dashboard with 14-day token and cost charts, a dedicated analytics page (tokens, costs, budget, adapter comparison), live logs via Server-Sent Events plus pause/resume and batch cancel for runs. Includes a run-metrics schema (migration V7), a model price table, and a monthly budget per project with a soft threshold and an optional hard block (V8).

Review layer and quality gate: from "writes code" to "checks code"

The platform's second pillar: a read-only review layer with an aggregating quality gate. aider-review and claude-review run read-only; security, architecture-reviewer and hallucination-review run as static heuristics. Configurable policy (strict/lenient), special rules for SECURITY/HIGH and ARCHITECTURE/CRITICAL, a quality-gate UI, and a demo profile for demo.softwarefabrik.io.

Four adapters instead of one: Codex, Gemini and Aider have joined

New adapter registry: pick the agent per run. Adds OpenAI Codex (codex exec), Google Gemini (gemini -p) and Aider (configurable model backend). Mock stays the DEMO default — no license, no external tools. All vendor adapters are unlocked from Community upwards; a new /changelog page and an adapter-ID column on the run table (V3).

First production-capable release

Ships as a local control plane for AI-assisted software development — with Claude Code as the initial development agent, a lease-based licensing stack (Keycloak + Spring-Boot license service) and an accessibility-conscious Thymeleaf UI. Project-idea wizard with a Markdown generator, run lifecycle with phases and audit log, workspace bootstrap with git init and a build gate (mvn verify), approval policies, and an air-gap-capable lease system with COMMUNITY/PROFESSIONAL/ENTERPRISE tiers.