Dark Factory

The design decision

Refusing beats producing

Grading here is literal and automated — exact field names, exact status codes, exact data-testid values. A beautiful screen with a mistyped attribute scores zero. So the competitive advantage is not implementing faster. It is refusing to hand off anything that does not conform.

The crew

One implementer, three verifiers, one planner

The ratio is the design. Select a station to see what it holds.

Routing

Who talks to whom

Adding an agent to a room does not wake it. A message must mention it — so every handoff is an explicit mention, and that is the wiring.

Never hardcoded. each agent inspects the room and mentions the next role itself Re-crewable. a missing skill can be recruited into the room at runtime

The rehearsal

Built end to end from one paragraph

Before the build window opened, the band produced a complete reservation service — spec, conformance checklist, implementation, adversarial pass and gate. Nobody wrote a line of it.

87 tests passing, zero failing Run independently rather than taken from the agents’ own report — the whole design rests on not trusting reports.

“GATE GREEN — Ran the full gate myself from dry-run/, not reported to me.”

regression-guard

“VERDICT: CONFORMS — Phase-2 re-verification passed. No deviation, no bounce.”

spec-warden

“Invariant HOLDS on every vector. No double-book, no 201+409 split, no record/replay race, no 500.”

race-hunter

Emergent

Three things we never wired

None of this was in the brief. It came out of the persistent role instructions.

An agent withdrew its own false finding

The race-hunter raised a race, disproved it, and retracted it in the open. The architect recorded it as “the honest RH-5 ghost withdrawal”. Its role says: explain why it was not real, so nobody chases a ghost.

An agent corrected its supervisor

“One number to correct before it gets baked into the gate: the count is now 87, not 83.” It was right, and the architect accepted the correction.

Verdicts cite code, not prose

The architect signed off the atomicity chokepoint by file and line — store.js:54/75 — rather than accepting the builder’s summary of it.

The delete test

Take BAND out. What breaks?

The bounce

Customs cannot return work to the builder: there is no peer-to-peer channel. An orchestrator hardcodes every edge; here the customs post decides who to mention at runtime.

Hot recruitment

An agent can inspect the room, find the expertise missing, add another agent and delegate to it. A line that can hire is not a pipeline.

The evidence

The work board, the versioned plan and the mirrored traces are the verified result. Without the room there is code, but no proof of how it was produced.

The human as a peer

Permission decisions and product calls arrive through the same room as the work. There is no second channel to maintain.

Removing BAND does not degrade the factory. It removes it.

Declared limitation

This factory is not fully dark

An agent cannot approve another agent’s permission request, and there is no bulk approval. Operations that trigger one require a human.

Approval policies are set so routine file work needs no human. What remains are genuine exceptions, and those get a person. Claiming otherwise would be false.