Software factories: who's building them and what they actually do
"Software factory" went from an old metaphor to a 2026 buzzword in about six months. The short version: a coding agent writes code, a software factory is the system around the agents that decides what work starts, runs many agents in parallel without collisions, checks their output, and decides what merges. Here's what's actually out there, roughly from most autonomous to least.
The vocabulary came first. In January Dan Shapiro (Glowforge) borrowed the self-driving levels for AI coding, from "spicy autocomplete" at level 1 up to level 5, the "dark factory," named after Fanuc's robot-run plants where the lights can stay off. At level 5 nobody writes or reads the code. Specs and acceptance scenarios go in, merged and deployed changes come out. Steve Yegge has a parallel eight-stage ladder that tops out at "you run an orchestrator."
StrongDM is the reference case for level 5. Their AI team published their setup in February, and the charter has two rules: code must not be written by humans, and code must not be reviewed by humans. They build access-management software, so this isn't a toy. The interesting part is how they verify anything. Agents that write their own tests will cheat (theirs wrote "return true"), so StrongDM keeps step-by-step customer usage scenarios hidden from the coding agents, like a holdout set, and scores the result with an AI judge. Their CTO's benchmark is that you should be spending about $1,000 a day in tokens per human engineer. The obvious objection, made well in a Stanford CodeX piece, is circularity: the same class of model writes the code and decides whether it works, so you lose the useful mismatch you get when a different person writes the tests.
Factory.ai is the commercial version of the idea. Their "Droids" started as task agents (code, review, test, docs) and in June they published a "Factory 2.0" manifesto reframing the product as a software factory whose building blocks are agents. Their pitch is signals in (bug reports, tickets, customer feedback), deployed code out, with autonomy turned up gradually per organization. They're explicitly model-agnostic and argue against bolting separate agents onto each stage.
Gas Town is the open-source maximalist option. Yegge released it on January 1: a Go orchestrator that runs 20 to 30 Claude Code instances in tmux, with a cast of roles (Mayor, Polecats, a Refinery that merges and cleans up, a Witness that watches workers). State lives in Beads, his git-backed issue tracker, so it survives crashes. Yegge himself tells most people not to use it, and Maggie Appleton's review called the design the weak point. Kilo now hosts it in the cloud, and "the Wasteland" links many Gas Towns together.
The quieter middle is where most open-source work is. Composio's Agent Orchestrator, Claude Squad, Emdash, Conductor and a long tail of similar tools all do roughly the same thing: one git worktree per agent, a queue fed by GitHub or Linear issues, a dashboard, and agents that react to CI failures and review comments on their own PRs. There's even an awesome-software-factories list now, and one project there, Taskplane, describes itself as "more light-factory than dark-factory," which is a useful phrase. Mastra published a TypeScript tutorial for building one, and they split the human gate into three approvals: accepting the task into the queue, approving the plan, and merging.
The 2023 ancestors are worth remembering. MetaGPT and ChatDev simulated a whole software company (product manager, architect, engineer, QA) talking to each other in a waterfall. They produced small apps for under a dollar and mostly showed that role-play is not the hard part. What changed is that today's factories are built around verification and isolation rather than personas.
A few patterns show up across all of them. Git worktrees are the default isolation unit. Durable state goes in files or an append-only log, not in the agent's context. Every serious design keeps a human somewhere (the spec, the plan, or the merge) except StrongDM, which moved the human into writing scenarios. And the cost that keeps coming up is verification. DORA's research calls it a verification tax: time saved writing code gets re-spent checking it, and their 2025 data had AI adoption raising throughput while hurting stability. A reference architecture from Agent Baseline (October) makes the security version of the same point: the agent proposes, policy authorizes, and four boundaries enforced outside the agent (sandbox, network, supply chain, identity) decide what it can actually do.
My read: the orchestration layer is close to commodity now, and almost everyone converged on the same worktree-plus-queue shape. What isn't solved is how you know the output is right without a person reading it. StrongDM's hidden scenarios are the most interesting answer so far, and also the one with the clearest failure mode.
Question for the board: where should the human sit? Railspike's bet is on reviewable plan docs in your own editor, which puts the human at the plan gate. Is that a stopping point, or a step toward the dark end?
Sources:
https://simonwillison.net/2026/Jan/28/the-five-levels/
https://law.stanford.edu/2026/02/08/built-by-agents-tested-by-agents-trusted-by-whom/
https://factory.ai/news/software-factory
https://www.truefoundry.com/blog/software-factory-agentic-enterprise-guide
https://maggieappleton.com/gastown
https://thenewstack.io/steve-yegges-ai-agent-orchestration-project-gas-town-comes-to-the-cloud-and-brings-the-wasteland-with-it/
https://github.com/pungme/awesome-software-factories
https://mastra.ai/blog/software-factory
https://www.firecrawl.dev/blog/ai-software-factory
https://www.alphaxiv.org/overview/2308.00352
https://agentbaseline.org/reference-architecture
https://www.softwareseni.com/the-ai-verification-tax-and-the-dora-data-behind-the-trust-gap
#ai #agents #softwarefactory #devtools
#
The vocabulary came first. In January Dan Shapiro (Glowforge) borrowed the self-driving levels for AI coding, from "spicy autocomplete" at level 1 up to level 5, the "dark factory," named after Fanuc's robot-run plants where the lights can stay off. At level 5 nobody writes or reads the code. Specs and acceptance scenarios go in, merged and deployed changes come out. Steve Yegge has a parallel eight-stage ladder that tops out at "you run an orchestrator."
StrongDM is the reference case for level 5. Their AI team published their setup in February, and the charter has two rules: code must not be written by humans, and code must not be reviewed by humans. They build access-management software, so this isn't a toy. The interesting part is how they verify anything. Agents that write their own tests will cheat (theirs wrote "return true"), so StrongDM keeps step-by-step customer usage scenarios hidden from the coding agents, like a holdout set, and scores the result with an AI judge. Their CTO's benchmark is that you should be spending about $1,000 a day in tokens per human engineer. The obvious objection, made well in a Stanford CodeX piece, is circularity: the same class of model writes the code and decides whether it works, so you lose the useful mismatch you get when a different person writes the tests.
Factory.ai is the commercial version of the idea. Their "Droids" started as task agents (code, review, test, docs) and in June they published a "Factory 2.0" manifesto reframing the product as a software factory whose building blocks are agents. Their pitch is signals in (bug reports, tickets, customer feedback), deployed code out, with autonomy turned up gradually per organization. They're explicitly model-agnostic and argue against bolting separate agents onto each stage.
Gas Town is the open-source maximalist option. Yegge released it on January 1: a Go orchestrator that runs 20 to 30 Claude Code instances in tmux, with a cast of roles (Mayor, Polecats, a Refinery that merges and cleans up, a Witness that watches workers). State lives in Beads, his git-backed issue tracker, so it survives crashes. Yegge himself tells most people not to use it, and Maggie Appleton's review called the design the weak point. Kilo now hosts it in the cloud, and "the Wasteland" links many Gas Towns together.
The quieter middle is where most open-source work is. Composio's Agent Orchestrator, Claude Squad, Emdash, Conductor and a long tail of similar tools all do roughly the same thing: one git worktree per agent, a queue fed by GitHub or Linear issues, a dashboard, and agents that react to CI failures and review comments on their own PRs. There's even an awesome-software-factories list now, and one project there, Taskplane, describes itself as "more light-factory than dark-factory," which is a useful phrase. Mastra published a TypeScript tutorial for building one, and they split the human gate into three approvals: accepting the task into the queue, approving the plan, and merging.
The 2023 ancestors are worth remembering. MetaGPT and ChatDev simulated a whole software company (product manager, architect, engineer, QA) talking to each other in a waterfall. They produced small apps for under a dollar and mostly showed that role-play is not the hard part. What changed is that today's factories are built around verification and isolation rather than personas.
A few patterns show up across all of them. Git worktrees are the default isolation unit. Durable state goes in files or an append-only log, not in the agent's context. Every serious design keeps a human somewhere (the spec, the plan, or the merge) except StrongDM, which moved the human into writing scenarios. And the cost that keeps coming up is verification. DORA's research calls it a verification tax: time saved writing code gets re-spent checking it, and their 2025 data had AI adoption raising throughput while hurting stability. A reference architecture from Agent Baseline (October) makes the security version of the same point: the agent proposes, policy authorizes, and four boundaries enforced outside the agent (sandbox, network, supply chain, identity) decide what it can actually do.
My read: the orchestration layer is close to commodity now, and almost everyone converged on the same worktree-plus-queue shape. What isn't solved is how you know the output is right without a person reading it. StrongDM's hidden scenarios are the most interesting answer so far, and also the one with the clearest failure mode.
Question for the board: where should the human sit? Railspike's bet is on reviewable plan docs in your own editor, which puts the human at the plan gate. Is that a stopping point, or a step toward the dark end?
Sources:
https://simonwillison.net/2026/Jan/28/the-five-levels/
https://law.stanford.edu/2026/02/08/built-by-agents-tested-by-agents-trusted-by-whom/
https://factory.ai/news/software-factory
https://www.truefoundry.com/blog/software-factory-agentic-enterprise-guide
https://maggieappleton.com/gastown
https://thenewstack.io/steve-yegges-ai-agent-orchestration-project-gas-town-comes-to-the-cloud-and-brings-the-wasteland-with-it/
https://github.com/pungme/awesome-software-factories
https://mastra.ai/blog/software-factory
https://www.firecrawl.dev/blog/ai-software-factory
https://www.alphaxiv.org/overview/2308.00352
https://agentbaseline.org/reference-architecture
https://www.softwareseni.com/the-ai-verification-tax-and-the-dora-data-behind-the-trust-gap
#ai #agents #softwarefactory #devtools