Turning spfx-factory Into an Evidence-Gated SPFx Agent

AI can generate an SPFx project. That is not the same as proving the project is ready.

The latest spfx-factory release adds an evidence ledger around the existing generation workflow:

• SCAFFOLD — whether the official scaffold completed;
• CODEX — whether implementation was requested and completed;
• POLICY — whether static policy checks passed;
• LOCAL — whether requested local npm checks passed;
• ASSURANCE — whether an independent spfx-assurance check ran;
• TENANT — always explicitly not-tested.

Every check reports one of:

• verified;
• warning;
• blocked;
• not-tested.

The existing factory report status remains backward compatible. Evidence is recorded in a parallel evidence field rather than silently changing the old contract.

Independent assurance without hidden installation

The factory can invoke spfx-assurance when it is already available through SPFX_ASSURANCE_BIN or PATH.

It does not:

• call npx;
• download a dependency;
• import the ESM checker into the CommonJS factory;
• access a tenant;
• claim permissions or App Catalog approval;
• fabricate a successful check when the tool is unavailable.

When the checker is absent, the result is not-tested with an actionable explanation.

Inspect evidence

spfx-factory inspect --output ./generated
spfx-factory inspect --output ./generated --json

The inspection command is read-only. It reads the existing factory-report.json, prints the evidence, and does not rerun generation or verification.

Warnings do not break an otherwise green run by default. Teams that want warning-gating can opt in:

spfx-factory generate \
  --spec specs/document-review.json \
  --output ./generated \
  --fail-on warning

Verification boundary

This is local evidence, not tenant validation. A green local report does not prove:

• SharePoint permissions;
• App Catalog approval;
• tenant deployment;
• production data access;
• runtime behaviour in a specific tenant.

That limitation is part of the report, not a footnote hidden outside it.

Why this matters

The useful product boundary for AI-assisted SPFx development is not “the model wrote code.” It is:

The system cannot call the work complete without showing what was checked, what passed, and what remains unknown.

The project is open source:

https://github.com/vystartasv/spfx-factory

The release adds an evidence layer to the factory while preserving its existing generation and policy behaviour.