Factory v5 architecture
The cloud software factory as designed on the roadmap, against what is built to date. Source: project docs and step files; counts below are computed from the step files.
Summary: 27 components built and live, 3 built and unit-tested only, 10 designed and not built (40 total). Build steps: 45 done, 1 open (of 46, steps 5 to 50 in the step files).
Built and live (solid green, "live")Built, unit-tested only; live proof deferred (dashed amber, "unit")Designed, not built (dotted grey, "plan")
Flow, top to bottom: GitHub deliveries reach the controller; the controller starts runner VMs; the coder and gate run on them; the merge train and checks land changes; the release controller promotes them; the policy layer will decide and escalate (shadow only today).
Build steps
| # | Title | Status |
|---|---|---|
| 5 | Worker entry + D1 store | done |
| 6 | Getting the JIT config onto the VM | done |
| 7 | Snapshot, A4, live end-to-end | done |
| 8 | Two VM sizes and recovery of stuck VMs (Stage C, C1 items 1-2) | done |
| 9 | Commission the pool live (Stage C, C1 items 2-5) | done |
| 10 | C2 shadow gate as a replay of 10 studio-gated factory-v3 SHAs (Stage C, C2) | done |
| 11 | C4 G1: instrument the shadow gate (per-phase times, junit, slowest tests) + runner SSH fix | done |
| 12 | live shadow auto-trigger: every factory-v3 main push replays on v5 by itself | done |
| 13 | C4 G2: duration-balanced shards + collect-only count proof | done |
| 14 | R2 archive: every completed job's junit artifact is copied to R2 before GitHub expires it | done |
| 15 | Cloudflare Queues ingest: POST /gh verifies, enqueues, returns 202; a queue consumer runs the handlers | done |
| 16 | read-only ops dashboard at GET /ops, behind Cloudflare Access | done |
| 17 | Cloudflare Workflows VM lifecycle: one durable instance per VM, behind a flag | done |
| 18 | C4 G3: staged fail-fast (lane A) | done |
| 19 | Speed justification: is studio faster per dollar than the VMs? | done |
| 20 | Gate instrumentation: per-test spans, resource peaks, and the push-to-result span chain | done |
| 21 | Profile the 122 s floor test and spec its fix | done |
| 22 | Coder dispatch: approved task -> Codex on a fresh coding VM -> trusted PR publisher | done |
| 23 | isolation policy: trust domains, credential audit, hostile isolation probe, gate-policy protection | done |
| 24 | merge authority: the App's factory/merge-ready and factory/post-push check runs | done |
| 25 | flaky-test policy: classify failures, one diagnostic rerun, quarantine | done |
| 26 | Release controller: staged, gated, gradual Worker promotion with rollback, plus a D1 migration policy checker | done |
| 27 | P0 Measure: telemetry v2, critical-path profile, VM setup breakdown, flake census | done |
| 28 | Diagnose the ~4 s per-container floor in factory-v3's tests | done |
| 29 | automatic leak check and alert rules (B8 + B2 detection) | done |
| 30 | gate before main: a controller-run next branch (N1, Bors pattern) | done |
| 31 | failed-first early signal on a re-push (G4a) | done |
| 32 | infra failures labelled and auto-redelivered once (G4c) | done |
| 33 | Runner snapshot keyed by content and rebuilt automatically (G5a) | done |
| 34 | agent run outcome, stop reason and per-stage wall_ms (V2 + V3) | done |
| 35 | per-test history (B3), good merges per runner-hour (N10), Worker health (B5) | done |
| 36 | pytest-testmon shadow run on replayed SHAs (N9) | done |
| 37 | speed levers, tmpfs scratch (N4) and baked caches (N5), measured per shard | done |
| 38 | gate/fast and gate/full scripts (G5b) and the B9 reader audit | done |
| 39 | Cloudflare AI Gateway in front of every coder and reviewer LLM call (N2) | done |
| 40 | the Worker posts alerts to Matrix directly (B2) | done |
| 41 | tessella onto v5 end to end (D24), sub-steps 41a to 41e | open |
| 42 | a queued coding job must not starve behind idle cpx22 VMs at the VM cap | done |
| 43 | delete a spent untrusted VM at once, not after the 55-minute rule | done |
| 44 | reuse an untrusted VM by Hetzner rebuild between jobs | done |
| 45 | compare in-VM sandbox (option B) with rebuild (option A, step 44) | done |
| 46 | a factory-studio runner class, and a benchmark against the Hetzner VM scaler | done |
| 47 | reconcile jobs that D1 still thinks are running after GitHub finished them | done |
| 48 | T0, a selective test preflight that feeds failures back to the coder | done |
| 49 | policy evaluator in shadow mode, then Slice 1 (merge, coder_dispatch, retry) | done |
| 50 | add gh to the runner snapshot (follow-up to the step 41 live-run finding) | done |
Step 41 is open. Workers release path is proven on a canary Worker (staging and production Workers, health endpoint returns 200). Pages release path is unit-tested; live proof is deferred.