Agentic Factory
A local experiment in running a fleet of coding agents safely: the layer that routes the work, records what happened, and governs what a worker is allowed to touch. Still a spike, on purpose. Everything below was learned on a laptop, not in production.
Standing up a fleet of coding agents is easy to start and hard to trust. Each worker reports its own success, the work happens inside containers you cannot see into, and nothing holds a single account of what actually landed.
The planning layer and the worker runtime already existed as separate pieces. What was missing was the control plane between them: routing, an audit record, and a governance boundary deciding which paths a running worker can write to.
Running it locally is the point, not a limitation. A fleet that can write to disk is worth understanding at small scale, where a mistake costs an afternoon instead of an incident.
- 01PlannerDecomposes the goal and owns the plan of record, driving the control plane over MCP.
- 02Control planeRoutes every task and admin command over sockets, and records the run as it happens.
- 03GovernanceWorkspace grants are allowlisted and fail closed. An ungranted path is never writable.
- 04WorkersExecute one unit each inside isolated container runtimes, inspected read-only.
- 05MonitorSupervises live runs from the record, not from what a worker claims.
Four dead knobs in one day, all the same shape
A capability built and unit-tested on one side of a boundary, never wired to the other, with both suites green because nothing tested the seam. A wall-clock budget the worker read and the host never forwarded. Fields the contract demanded that the finish schema could not express, so the whole fleet was instructed to emit something structurally impossible. Passing tests on each side proved only that each side worked alone.
The governance layer was finished; the execution layer did not exist
Workspace grants were built, gated and unit-tested, and 0 of 89 recorded runs had ever carried one. The permission system was complete and unreachable end to end, because nothing mounted a granted path into the container that needed it. It had been silently degrading instead: workers just created new files.