Everyone is building an AI software factory. Funny how things come full circle

From Gary Shaffer at TruStacks.

We keep hearing about software factories lately. Every AI company seems to be building one, and the way people talk about it you'd think the idea showed up this year. If you haven't run into the term, in 2026 a software factory usually means a delivery pipeline where AI agents take work from a spec all the way to release, while people set the goals and the checks.

What makes us laugh is that we've been through this before. We worked on Secure Software Factories within the DoD and with Red Hat, back before anybody was talking about agents. Take a look at this definition and guess when you think it was written:

"A software assembly plant for development and integration that contains multiple pipelines, equipped with a set of tools, process workflows, scripts, and environments, to produce a set of software deployable artifacts with minimal human intervention."

That's the Department of Defense, in its Software Modernization Strategy, and it could pass for something from a launch post this quarter.

What people mean by it today

Most of the definitions we've read land in about the same place. Sonar describes an agentic software factory as a repeatable delivery system "in which AI agents perform coordinated development tasks, while people define the intent, the constraints, the acceptance criteria, and the approval policies." That one seems pretty reasonable to us.

Then you've got the extreme version, the dark factory. Dan Shapiro wrote up five levels of AI coding in January, modeled on the levels of self-driving cars, and the dark factory is level 5. The name comes from manufacturing plants that run with the lights out, and he says it's dark "because it's a place where humans are neither needed nor welcome."

Addy Osmani has a nice way of splitting the two. In a dark factory, code ships that nobody has read. A lit factory is "the same pipeline with the lights left on where judgment lives." He also traces the term back to a paper Bob Bemer gave in 1968, "The economics of program production," so if this feels like a new idea, it's about 58 years old.

1. 1968

   Bob Bemer writes about the software factory in “The economics of program production.”

2. 2017

   The Air Force stands up Kessel Run, usually cited as the DoD's first software factory.

3. 2019

   The DoD CIO publishes its Enterprise DevSecOps Reference Design.

4. June 2022

   The Pentagon's plan is to turn its 29 software factories into one ecosystem. The next day, Nebula opens at Quantico.

5. January 2026

   Dan Shapiro's five levels of AI coding put the “dark factory” at the top.

6. October 2026

   Kessel Run's leader: “we're no longer a software factory.”

We were part of a place at Quantico called the Nebula

Back in 2022 we were one of the partners, alongside Insight, in a place at the Quantico Cyber Hub called the Nebula. Chenega Applied Solutions and the Cyber Bytes Foundation announced it that March, and it opened in June on the second floor of the hub. It was a working software factory with the tools, development platforms, and cloud access a government program would need, and DoD teams could come in and build MVPs and proofs of concept at no cost. The goal, in the words of the announcement, was to become the "birthplace" of software factories across the DoD and the US government.

The idea was to help the government design software factories that meet the DoD's standards, and those standards were real. The DoD CIO had put out its Enterprise DevSecOps Reference Design in 2019. Red Hat's description of a defense software factory would fit right into an AI pitch deck today: an assembly line "of tools, policies, processes, and people that functions in an automated fashion."

If you go back and read the announcement, it calls an earlier version of TruStacks "a deployable 'software factory in a box,'" so we've been using these exact words for a while now.

This wasn't some side project inside the DoD either. Kessel Run, the Air Force effort usually cited as the department's first software factory, started in 2017, and by June 2022 the Pentagon was reported to have 29 of them and a plan to bring them together into one department-wide ecosystem.

Nebula never took off the way we hoped, and there are reasons for that we can get into in another post.

But look at where things have landed. In October, the leader of Kessel Run told Air & Space Forces Magazine "as far as organic delivery for Kessel Run, we're no longer a software factory," and he called continuous delivery pipelines a "commodity these days." Not everyone agrees with how that change went, and plenty of DoD factories are still running, but it's funny how trends come full circle. Right around the time Kessel Run stopped calling itself a software factory, everybody else started.

So what's actually different?

The big change is who's doing the work. In the factories we helped design, people wrote the code and the pipeline carried it. Now agents can write it too, and a lot faster than anybody can read it. We don't want to wave that away, because it really is new.

A lot of the rest came over as is, and that includes the hard question the old factories had to answer, which is who's responsible when this thing ships.

Question	DoD software factory	AI software factory, 2026
The definition	“A software assembly plant… that contains multiple pipelines”	“A repeatable delivery system in which AI agents perform coordinated development tasks”
Who writes the code	Development teams	AI agents
How far people step back	“Minimal human intervention,” in the pipeline	At the far end, “humans are neither needed nor welcome”
Who answers for what ships	A named authorizing official assumes responsibility for the risk	Whoever you decide. Decide before you turn the lights off.

When the DoD said "minimal human intervention," it was talking about the pipeline. It wasn't talking about accountability. Before a system goes live, an authorizing official, a senior person with a name, has the authority to "assume responsibility for" running it at an acceptable level of risk. You could automate a lot of what led up to that moment, but you couldn't automate that person.

That's what bothers us about the dark factory idea. "Neither needed nor welcome" might be fine for a robot welding a car door, but we wouldn't want to be the one reading that sentence to an auditor.

Why we still care about this

If pipelines really are a commodity now, and we think they mostly are, then standing up agents and a pipeline isn't going to be the hard part for anybody. The hard part is going to be deciding what you refuse to ship and who signs off on what you do ship.

That's what we tried to hold on to with TruStacks. The agents draft the delivery work, every proposal gets checked against signed policy before anyone sees it, and if it's denied it never opens. Then somebody on your team merges it, or nothing happens. We should be clear that TruStacks isn't a DoD program and doesn't carry any DoD authorization. We just spent enough time around these factories to remember what they were for.

Agents propose. Policy decides. Humans approve.

So by all means, build the factory. Just leave the lights on at the merge.