What Is a Software Factory? The Agentic Operating Model, Defined

A software factory is an agentic software-delivery operating model in which AI agents write, test, and ship code inside a pipeline whose specifications and merge approvals stay under human control.

Why Agent Output Outruns Review Capacity

Engineering teams adopting enterprise coding tools keep hitting the same wall. Agents open pull requests faster than developers can review, verify, and merge them, so review queues lengthen, context switches multiply, and deployment throughput stays flat while code generation gets cheaper. Faros AI's 2025 telemetry, covering more than 10,000 developers across 1,255 teams, found that teams with high AI adoption merged 98% more pull requests and completed 21% more tasks, while pull request review time rose 91% and average pull request size rose 154%. The same telemetry found no significant correlation between AI adoption and company-level improvement.

That is the operational problem the factory model exists to solve, and it is a coordination problem before it is a tooling one, which is the line that separates agents from CI/CD. Augment Cosmos, a unified cloud agents platform available on all paid plans, sits at that layer: it runs agent work across a whole workflow instead of inside one editor session, which makes intake, verification, and sign-off reviewable as a system. This guide defines the term's 2025 and 2026 usage, walks the factory floor stage by stage, quantifies reported benefits against their counter-evidence, and surveys the platforms running factories in production today.

What Is a Software Factory in 2026?

Software factory, AI software factory, and agentic software factory all describe a repeatable delivery system for planning, coding, testing, review, and deployment. The agentic version changes where the automation reaches: the pipeline now automates the coding step itself, not just the work around it.

One company published its own version of that structure in early 2026, and a law school commentary described it. Writing in Stanford Law School's CodeX blog on February 8, 2026, a commentator summarized a post StrongDM's AI team had published two days earlier: "Coding agents write, test, and ship production software... The humans design specifications, curate test scenarios, and watch the scores." That post states the rules directly: code must not be written by humans and code must not be reviewed by humans, which the commentary places at what Dan Shapiro's taxonomy calls Level 5, the dark factory.

Two boundaries keep the term usable. NVIDIA uses "AI factory" for data center infrastructure, which is hardware, not an operating model. And the phrase does not describe an agent working alone in an IDE; a factory implies stages, gates, and a record of what happened at each one.

Where Did the Term "Software Factory" Come From?

The term predates AI agents by more than five decades, and two older usages still circulate.

In a 1968 position paper, R. W. Bemer proposed that General Electric build a "software factory." At the NATO software engineering conference in Garmisch that October, M. D. McIlroy of Bell Telephone Laboratories argued that modular decomposition opened the way to mass-produced software components. Hitachi first applied the label to a real facility, founding its Software Works in 1969. Michael Cusumano of MIT documented the Japanese factory programs at Hitachi, Toshiba, NEC, and Fujitsu in IEEE Software in 1989 and in his 1991 book Japan's Software Factories. Microsoft revived the label in 2004 with Greenfield and Short's book Software Factories, which became a product-line methodology in its Visual Studio tooling later that decade.

The second legacy usage is the defense sector. The Department of Defense's October 2024 Enterprise DevSecOps Fundamentals defines a software factory as a collection of people, tools, and processes that "enables teams to continuously deliver value by deploying software to meet the needs of a specific community of end users." Its March 2025 State of DevSecOps report counts over 50 software factories using DevSecOps to deliver code into production, including Platform One and Kessel Run. Those organizations ship human-written code under strict compliance regimes.

Both historical models industrialized everything around coding. The agentic model claims agents can perform the coding step itself, and that is what makes 2025 and 2026 an inflection point and not another turn of the CASE-tool cycle.

How a Software Factory Works, Stage by Stage

Every change passes through intake, specification, build, verification, and shipping, with specification approval and merge as the two human gates. The stages matter because they localize the constraint: generation capacity sits in stages two and three, and the queue forms in stage four.

Stage 1: Intake Turns Signals Into Assignable Tasks

Intake converts raw signals into structured, agent-assignable tasks, and the quality of that conversion sets the ceiling on everything downstream.

GitHub's Copilot cloud agent takes an issue assigned to Copilot, a task handed over from the Agents panel, or a prompt from Copilot Chat in an IDE, and automations added in June 2026 also let it run hourly, daily, or weekly, or fire when an issue is created or a pull request is created or updated. OpenAI's Symphony spec, published April 27, 2026, maps each open Linear issue to a dedicated agent workspace and keeps an agent running against every active task until it is done. Google Jules starts from a repository, a branch, and a prompt, cloning the codebase into a secure Cloud VM per task so tasks can run concurrently.

Cosmos handles the same surface as platform configuration, not per-tool setup. Its Triggers and Subscriptions start an agent session from a new GitHub pull request, a Linear status change, a Slack message, a PagerDuty P0 incident, a cron schedule, or a custom webhook, and keep that session listening for follow-up events after it starts. Intake stops depending on whether someone remembered to hand off the work.

Context quality at intake decides the rest. GitHub's cloud agent guidance advises treating an assigned issue as a prompt and including complete acceptance criteria for what a good solution looks like, and Cognition's Devin guidance asks for clear scope, boundaries, and success criteria, and warns against leaving verification steps undefined. Those same requirements shape any agent workflow implementation.

Stage 2: Specification Separates Planning From Execution

The specification stage separates planning from execution so a misread requirement gets caught before code exists. Reviewing a plan takes minutes. Reviewing a 2,000-line pull request built on a misread requirement takes days.

GitHub Spec Kit formalizes a sequence of specify, plan, tasks, and implement, preceded by an optional constitution step that records a project's governing principles. Jules presents a plan for approval before changing code, then returns a diff afterward. A January 2026 preprint on spec-driven development describes an emerging self-spec pattern, where an agent produces a specification from a high-level prompt, humans review and refine it, and an agent then implements against it.

In Auggie CLI, Plan Mode enforces strict read-only access and saves plans to ~/.augment/plans/, which makes the investigation step auditable on its own terms. A reviewer can read what the agent believed about the codebase before any file changed.

Stage 3: Build Runs in Parallel Isolated Environments

The build stage is where agents do what CI/CD never could: write changes in parallel inside isolated environments.

• The Copilot cloud agent works on a branch it creates under copilot/* and opens a draft pull request tagged [WIP] for issue-assigned work, pushing commits as it goes. Teams customize its environment with a GitHub Actions workflow at .github/workflows/copilot-setup-steps.yml.
• OpenAI Codex runs by default in a sandboxed environment with network access disabled, and OpenAI reports that container caching cut the median completion time for new tasks and follow-ups by 90%.
• Claude Code delegates specialized work to subagents for parallel development, and hooks fire at fixed points in its lifecycle, such as formatting files after an edit.

Isolation is only as good as its definition, which is why the environment an agent runs in belongs in version control alongside the code, with its base image, reachable repositories, and variables recorded rather than assumed.

Stage 4: Verification Is the Binding Constraint

Verification is the factory's binding constraint, so it combines automated and human layers, with neither replacing the other.

The Copilot cloud agent reviews its own changes with Copilot code review and attempts to resolve what it finds before completing the pull request, alongside code scanning, secret scanning, and dependency vulnerability checks. OpenAI reports that Codex provides verifiable evidence of its actions through citations of terminal logs and test outputs, and a separate GitHub integration lets a reviewer comment @codex review on a pull request against rules the repository declares in its AGENTS.md.

Automated review is where the queue clears or does not, so its quality is a capacity input, not a convenience. Augment reports 59% F-score review quality for Augment Code Review, at 65% precision and 55% recall, on a company-run benchmark of 50 pull requests across five open-source codebases. Those two numbers pull in opposite directions for a reviewer: precision keeps them out of noise; recall decides whether a defect reaches production. Which findings need a human at all is a separate question, and the difference between code review and static analysis settles most of it.

The audit trail is the part teams underbuild. A Cosmos Session holds the conversation with an agent, every message, turn, and tool call, saved indefinitely and either private or shared across the organization. That is what lets a team reconstruct why a change was made six months after the reviewer who approved it moved teams.

Stage 5: Shipping Keeps a Human at the Final Gate

Published policy at companies running agents in production keeps a human at the final gate. Dropbox described its approach in a May 2026 engineering post: define the task, allow the agent to execute within established guardrails, validate the result, and have a human make the final judgment before any code reaches production.

Governance evidence matters at this gate too, because a factory that cannot show its controls cannot ship into a regulated environment. Augment Code is SOC 2 Type II attested and holds ISO/IEC 42001 certification, the standard that sets certifiable requirements for an AI management system.

Software Factory Benefits and Their Counter-Evidence

Reported benefits concentrate on throughput and cycle time. Every figure below carries the population it was measured on, because the populations differ more than the headline numbers do.

The first row is Cui et al., published in Management Science, pooling three separate experiments at Microsoft, Accenture, and an anonymous Fortune 100 company, so no single trial in that paper has 4,867 developers. The second is Paradis et al., a November 2024 preprint measuring one complex task and not a workload, whose confidence interval spans zero, and whose authors caution that the effect may not transfer across tools or over time.

Counter-evidence defines what the factory has to prevent. A METR randomized controlled trial of 16 experienced developers working 246 real issues in repositories they had contributed to for years found they took 19% longer with AI tools, while still believing afterward that AI had sped them up by 20%. The 2025 DORA report, drawing on nearly 5,000 technology professionals, found a positive relationship between AI adoption and both delivery throughput and product performance, and a continued negative relationship with delivery stability. Teams without strong automated testing, mature version control, and fast feedback loops see rising change volume turn into instability. DORA describes AI's primary role as an amplifier, magnifying an organization's existing strengths and weaknesses.

Benchmarks belong in the same frame. Augment Agent v1 scored 70.4% on SWE-bench Verified, and Augment reports 51.80% for Auggie on SWE-bench Pro in February 2026. Verified is now close to saturated, which is why a production-representative task set beats a leaderboard when a team is sizing its own factory.

Software Factory Examples Running in Production

Named deployments and available platforms answer different questions. The first group shows what teams have run, the second what a team can adopt now.

Named deployments, 2024 or later:

• OpenAI Symphony, April 2026: an open-source orchestration spec that maps every open Linear issue to a dedicated agent workspace, with some issues producing multiple pull requests across repositories.
• Dropbox Nova, 2026: Dropbox's internal coding agent platform accounted for roughly 1 in 12 pull requests at the company as of May 2026, under the validate-then-human-judgment model above.
• Stripe Minions, February 2026: agents that take a task from Slack, write code, pass CI, and open pull requests for human review, accounting for more than a thousand merged pull requests each week in a mostly Ruby codebase.

Platforms available to teams, with each vendor's documented status:

At GitHub Universe on October 28, 2025, GitHub announced Agent HQ, a platform direction for orchestrating multiple coding agents from one mission control. That announcement, and the arrival of comparable primitives across vendors, is why orchestration platforms now read as a product category and not a feature.

The Difference Between a Software Factory and DevOps

DevOps automates work after a human commits code. A software factory puts agents inside the commit and moves the bottleneck downstream.

The permission row is where the two models diverge most in practice. A Cosmos Expert is a reusable template holding an agent's instructions, model, capabilities, and the triggers it reacts to, making a permission boundary a reviewable artifact rather than a runtime setting someone changed once. DORA's research on platform engineering reports that when platform quality is high, AI adoption strongly and positively affects organizational performance; when platform quality is low, that effect is negligible.

Audit Factory Gates Before Scaling Agent Throughput

DORA's finding on control systems makes an audit the next step, not a procurement decision. Identify which of the five stages currently use agents and document where the human gates sit. Then check whether the team shares one engineer's agent configuration or leaves it trapped in a personal setup, because a factory whose Environments and Experts exist only on one laptop cannot be reviewed or rolled back. Where the audit shows review queues outpacing merge capacity, the constraint is verification, and the fix is a shared workflow that assigns work, runs tests, and routes changes for review with the dependency graph attached.

Frequently Asked Questions About Software Factories

These are the questions engineering leaders ask when they are deciding whether an agentic delivery model is worth restructuring their pipeline for.

Related Guides

• 5 Hybrid AI Coding Workflows for Production
• 7 Benchmarks to Evaluate AI Security Tools for Enterprise
• 11 AI Agent Workflows for Legacy Java Apps
• 6 Change Management Strategies to Scale AI Adoption
• AI Agent Quality: 7 Frameworks to Go Beyond Vibe Coding