Andy OngWorkHot TakesAbout
← Selected work
2026 · Local exploration: control plane, governance, audit

Agentic Factory

A local experiment in running a fleet of coding agents safely: the layer that routes the work, records what happened, and governs what a worker is allowed to touch. Still a spike, on purpose. Everything below was learned on a laptop, not in production.

Multi-AgentPythonMCP

Standing up a fleet of coding agents is easy to start and hard to trust. Each worker reports its own success, the work happens inside containers you cannot see into, and nothing holds a single account of what actually landed.

The planning layer and the worker runtime already existed as separate pieces. What was missing was the control plane between them: routing, an audit record, and a governance boundary deciding which paths a running worker can write to.

Running it locally is the point, not a limitation. A fleet that can write to disk is worth understanding at small scale, where a mistake costs an afternoon instead of an incident.

  1. 01PlannerDecomposes the goal and owns the plan of record, driving the control plane over MCP.
  2. 02Control planeRoutes every task and admin command over sockets, and records the run as it happens.
  3. 03GovernanceWorkspace grants are allowlisted and fail closed. An ungranted path is never writable.
  4. 04WorkersExecute one unit each inside isolated container runtimes, inspected read-only.
  5. 05MonitorSupervises live runs from the record, not from what a worker claims.

Four dead knobs in one day, all the same shape

A capability built and unit-tested on one side of a boundary, never wired to the other, with both suites green because nothing tested the seam. A wall-clock budget the worker read and the host never forwarded. Fields the contract demanded that the finish schema could not express, so the whole fleet was instructed to emit something structurally impossible. Passing tests on each side proved only that each side worked alone.

The governance layer was finished; the execution layer did not exist

Workspace grants were built, gated and unit-tested, and 0 of 89 recorded runs had ever carried one. The permission system was complete and unreachable end to end, because nothing mounted a granted path into the container that needed it. It had been silently degrading instead: workers just created new files.

  • Test the seams, not the sides. A static test that asserts every value one component reads is actually sent by the other found a fourth dead knob on its first execution.
  • Record a known gap as a ratchet, not a mute: a second test fails if the gap is closed without removing it from the list, so it can be neither silently forgotten nor silently half-fixed.
  • Ship both halves of a feature or neither. I wired the planning half of workspace grants, then reverted it. Without the mount it would have turned quiet degradation into confusing mid-run failures, which is worse than the bug it fixed.
NextProject IRIS