P/02 · The software factory

SOFA

From ticket to merged commit: agents write, code decides every gate, and you approve the intent.

Request an intro call See the mechanism

SOFA in a run: a bar of twelve stages from Intake to Reflect, below it a terminal showing the command “sofa intake acme/shop#42” and its reply, beside it the append-only ledger. The footer reads “Waiting for you: Admit the request”. — A run at the admission gate. The code has checked the shape of the request and stops — approval is a human decision, and the ledger records both.

Problem

What goes wrong today.

The model grades its own work

An author who verifies does not verify. “Green” then only means the author is satisfied.

The acceptance tests drift with the code

A test that adapts to the defect measures nothing — and the run stays green.

Afterwards nobody knows who approved what

With no append-only ledger, every approval is a memory.

Control points

What the code refuses.

No agent moves a gate. A gate is closed by code or by a person.: The verdict comes from a run with an exit code, not from an assessment.
The author never verifies. Acceptance tests are frozen from your approval onward; if an agent touches one, the attempt aborts.: So a failed attempt cannot be rewritten into a passing one.
What the system may do unasked is ticked off one at a time. Not granted means it waits for you.: The degree of autonomy is a list, not a two-state switch.
Every gate, verdict and waiver lands in an append-only ledger. A row changed after the fact is visible.: That is the difference between a log file and evidence.

Limits

Where it does not hold.

Where the host cannot tell sessions apart, one of the rules is only an instruction and not a block. The documentation says so, and so does this page.: On a host with separated sessions it bites as a block. We tell you in discovery which case you are in.
One section of the linked mechanism shows a draft that is not built. It is marked as such there.: We roll out nothing that does not exist. What is built runs on the command line.

Delivery

What you get.

In scope

Discovery on the existing repository.
Gates and grants configured to your risk cut.
One complete run from request to merged commit, accompanied.
Operations agreement.

Three phases. The first is paid and ends in a decision.

Discovery

Paid analysis phase: objective, information gaps, sources assessed technically and legally. The output is a defensible estimate — or the advice not to build it.

Build

We build the system and integrate it into your infrastructure. Fixed price based on the Discovery.

Operations

Sources and criteria change. A monthly operations agreement keeps the machine running.

Tram rails at night after rain, from low down: two rails converging into the distance, lamplight reflected in the wet cobbles.

Deep dive

The mechanism, in full.

The run is documented publicly, stage by stage, with the role matrix and the ledger. What it does not contain is your risk cut: which gates close hard at your place and which action needs a signature.

See the factory

A run, the role matrix, the safeguards and the ledger, all clickable. English, about 15 minutes. External page, opens in a new tab.

Contact

Bring us the question.

In discovery we establish whether it can become a system that holds. If it cannot, we say so.

Enquiry