Fabricio Santecchia

Factory: coding agents, run like a production service

Most teams use one AI coding assistant at a time, with a person watching it. Factory runs a crew of them on its own. A teammate asks in Slack, and agents plan the work, write it in an isolated copy of the codebase, prove it on a real iPhone simulator, have a second model check it blind, and come back with a pull request and screenshots.

Most of the engineering is operations: leases, health checks, failover between model vendors, and gates the agents can't talk their way around. Try breaking it.

factory simulation

mailbox, append-only0 letters

watchdogok

checks every 5 min
here every 5 s
checks run: 0
restarts: 0

Simulated, with timings compressed. The structure is real; the data is made up. Open the console and type factory.status().

Engineering decisions

Rules live in code, not prompts

Shell shims and gates refuse any push, simulator or approval an agent isn't leased for.

Letters, not pushes

An append-only mailbox is the single source of truth, so a crashed agent loses nothing.

No single vendor

Agents fail over between Gemini and Claude on outages or when quota runs low.

Every UI change comes with proof

Simulator screenshots and a blind review from a different model family.

Pull requests from Factory jobs

Opened from Slack requests, Sept 16 to Nov 5, 2026

121 of 131merged

Slack request to decision

Slowest 1%, after moving the Slack door to its own worker thread. During a slow-disk incident: 151 s to 2 s

31.6s → 0.45sp99

A silent failure, now caught

On Oct 26 an expired login left 17 agents running empty turns for about 2.5 hours, unnoticed. The watchdog now alerts after two failures in 30 minutes

2.5h → 30mto detect

Memory per agent simulator

A slimmed iOS simulator profile built for agent walks

4.3 → 1.6 GBper simulator

Read-your-writes on Postgres replicas

I moved our reads onto self-hosted Postgres replicas on Kubernetes. The classic catch: you save something, read it back from a replica, and it isn't there yet. The fix is a token. Step through it.

read-your-writesillustrative trace, real mechanism

Median wait for a fresh read

After tuning how often the primary flushes its write-ahead log

110 → 53 msp50

Replica replay lag

Measured overnight

1 to 5 mslag

Also built

Atlas, a product map agents keep current

816 catalogued screens across four apps, walked by agents on simulators and browsers. Each pull request shows the screens it can change, worked out from the import graph.

270automated PRs merged

An MCP server for AI-safe admin work

Staff change the product through an AI assistant. Each tool is exactly one confirmed, audited change, behind OAuth 2.1. I started it; the team has grown it since.

73write tools

Money paths tested against double-pays

An append-only ledger for athlete balances, and Athlete Merch payment, refund and shipping writes that decide inside their own transaction. With Richard Zheng and Atif Mumtaz.

11money paths, each tested

Measured AI design QA

Checks built screens against Figma, evaluated with planted defects on held-out seeds.

92.7%defects caught; 0 false flags on a clean build

Talk proposals

From one coding agent to a 13-Mac agent factory: what broke, and what we automatedproposal

Read-your-writes across logical and physical Postgres replicationproposal

Designing MCP write tools a human can actually confirmproposal

How to measure an AI QA tool: planted defects and confidence intervalsproposal

I built Factory, the system my team's AI coding agents work in, and the Postgres and payment code under our apps.