# What is a dark software factory, and where do people still stand?

> A dark software factory ships code that no person reads, and only machines check it. See where the term comes from and what 260 agent missions show.

- URL: https://letsship.ai/blog/what-is-a-dark-software-factory
- Author: Önder Ceylan
- Published: 2026-10-15

A dark software factory is a pipeline of AI agents that ships code no person reads, and only machines check each change before it merges. The name comes from factories that run with the lights off, because only machines work on the floor. SHIP runs the same agent line, but you choose how dark it runs. By default a person accepts every pull request, and auto-merge stays off until you turn it on. In SHIP's 260-mission [SWE-in-a-team](https://letsship.ai/blog/swe-in-a-team) study, 4 runs passed every gate and were still wrong.

## Trace the term to lights-out factories

The term comes from factories that run without people on the floor. Addy Osmani's essay [Software Factories, Light and Dark](https://addyosmani.com/blog/software-factories) is from July 2026. It describes a dark factory as one that "runs with the lights physically off, because the only things on the floor are machines". The essay names FANUC in Japan as a company with lights-out factories since 2001.

Software has no floor, so the essay moves the image to the code: "In software, the floor is the diff". Its definition of a dark software factory follows from that. Code ships that no person reads, and only other machines verify it.

This page uses that narrow meaning: agents write the code, and no person reads it before it ships.

## Place the dark factory on five levels of adoption

Dan Shapiro's post on [five levels of AI adoption](https://www.danshapiro.com/blog/2026/01/the-five-levels-from-spicy-autocomplete-to-the-software-factory/) is from January 23, 2026. It puts AI adoption in software on a scale from Level 0 to Level 5, and compares each level to a type of car. The last two levels are the ones this page needs.

| Level                     | Shapiro's description                                                  |
| ------------------------- | ---------------------------------------------------------------------- |
| Level 4                   | "Level 4 is a robotaxi", and you can do something else while it drives |
| Level 5, the Dark Factory | "It's a black box that turns specs into software."                     |

The difference between the two is where your attention goes. At Level 4 the work runs while you do something else, and you still look at what comes out. At Level 5 you give a spec and take the software.

## See how a dark factory replaces code review

A dark factory removes the person who reads the diff, so something else has to judge the change. Simon Willison wrote about [StrongDM's AI team](https://simonwillison.net/2026/Feb/7/software-factory) on February 7, 2026. In his words, the team implemented "what Dan Shapiro called the Dark Factory level of AI adoption". The post quotes two rules from that team:

* "Code must not be written by humans"
* "Code must not be reviewed by humans"

StrongDM's own post, [The StrongDM Software Factory](https://www.strongdm.com/blog/the-strongdm-software-factory-building-software-with-ai), says where the people went. In its words: "Humans define intent: what the system should do, the scenarios it needs to handle, the constraints that matter". It names the change in one line: "It's what happens when validation replaces code review."

The checks that replace the review are scenarios, which are end-to-end user stories. Willison describes them as "often stored outside the codebase (similar to a 'holdout' set in model training)". The agents cannot see those checks, so they cannot write code that passes only the tests they know. Osmani's essay puts the same shift in two short lines: "Notice that the person never left the factory. They moved."

## Compare a lit factory with a dark one

A lit software factory and a dark one run the same agent line, and they differ in one seat. Osmani's essay puts it this way: "A lit factory is the same pipeline with the lights left on where judgment lives". The table compares the two, from the sources above.

| What differs                       | Lit software factory                 | Dark software factory                                    |
| ---------------------------------- | ------------------------------------ | -------------------------------------------------------- |
| Who writes the code                | Agents                               | Agents                                                   |
| Who reads the diff before it ships | A person                             | No person                                                |
| What decides that a change merges  | Automated gates, then a person       | Automated gates and scenarios that the agents cannot see |
| Where people work                  | Intent, the gates and the final read | Intent and the scenarios that judge the result           |

Both need the same parts, such as intake, gates, a deploy step and cost records. [What is an AI software factory](https://letsship.ai/blog/what-is-an-ai-software-factory) lists each part and what it hands to the next one. A dark factory changes only who sits at acceptance.

## Measure what machine gates miss

A dark factory depends on the checks that replace the person, and SHIP's own study measured where those checks fall short. [SWE-in-a-team](https://letsship.ai/blog/swe-in-a-team) gave 20 tickets to each of 13 builder configurations, 260 missions with one run each in one repository. Every mission went through CI, an agent Reviewer, a preview deploy and an agent Tester. Hidden acceptance tests then graded the result. The study kept those tests out of the repository the agents worked in, which makes them a holdout set.

The agent gates did most of the work. The loop corrected 40 of the 46 runs it objected to, with no person involved. But 4 of the 260 runs passed every gate and were still not complete, and only the hidden tests caught them.

One of those runs shows how. On a ticket that asked for class reminders to be queued (F5), the builder wired the live email provider into the request path. The endpoint then returned a 500 when the email API key was not set, though the ticket asked only for a queued row. The repository's own tests stayed green, so CI passed, and the Reviewer and the Tester both approved. The study's verdict: "It built the wrong thing, correctly."

A team that runs dark has to write checks like those hidden tests, independent of the agents and specific about behavior. Without them, runs like those 4 in 260 merge, and nobody reads them first.

## Choose how dark SHIP runs

SHIP runs the agent line with one gate for a person by default, at the end. The [human in the loop](https://letsship.ai/docs/configuration/human-in-the-loop) docs say that a mission waits at a pull request for a person to accept it. In their words: "That is the only gate, and it is at the end." You can add checkpoints, or remove that last gate.

| Setting     | Who reads before the merge                              | How to set it                                                           |
| ----------- | ------------------------------------------------------- | ----------------------------------------------------------------------- |
| Checkpoints | A person after each held stage, and at the pull request | `checkpoint: true` under the planner, builder or reviewer in `ship.yml` |
| Default     | A person at the pull request                            | Nothing to set                                                          |
| Auto-merge  | No person, when review and QA pass                      | Turn it on for a project, or for one mission                            |

A checkpoint holds the mission after the planner writes the plan, after the builder pushes and CI finishes, or after a clean review. QA cannot be a checkpoint, because the pull request after it is already a gate.

Auto-merge is the darkest setting SHIP documents. With it on, a mission that passes review and QA merges its own pull request. It is off unless you turn it on, and you can turn it on for a single mission from a terminal ([Command reference](https://letsship.ai/docs/cli/reference)):

```bash
ship mission auto-merge SHIP-412 on
```

A stuck mission still goes back to a person. After a gate fails the same way twice in a row, the mission shows **Needs attention**. The issue moves to **In Review**, and SHIP posts the reason on the issue. The pull request stays open, and a reply from you sends the agents back with the counters at zero ([Retry limits](https://letsship.ai/docs/configuration/retry-limits)).

Start with auto-merge on single missions whose acceptance criteria a test can check in full. Keep the default for the rest until your own checks catch what the hidden tests caught in the study. [Agentic SDLC, defined](https://letsship.ai/blog/agentic-sdlc) follows the full loop stage by stage.

## Questions

### What is a dark software factory?

A dark software factory is a pipeline of AI agents that ships code no person reads, and only machines check each change before it merges. People write the intent and the checks, and agents do the rest.

### What is a dark factory?

A dark factory is a plant that runs with the lights off, because only machines work on the floor. Addy Osmani's essay on software factories names FANUC in Japan as a company with lights-out factories since 2001.

### Where does the term dark factory come from in AI coding?

Dan Shapiro's January 2026 post puts AI adoption on five levels, and calls the top level the Dark Factory. He describes it as a black box that turns specs into software.

### What is the difference between a light and a dark software factory?

In a light software factory, agents write the code and a person reads the result before it ships. In a dark software factory, no person reads the diff, and machine checks alone decide if a change merges.

### Does a dark software factory need people?

Yes. In a dark software factory, people define the intent and write the scenarios that judge the result. In SHIP's SWE-in-a-team study, 4 of 260 runs passed every agent gate and were still wrong, and only hidden tests caught them.

### Can SHIP run as a dark software factory?

SHIP can merge without a person when you turn on auto-merge for a project or for one mission. Then a mission that passes review and QA merges its own pull request. Auto-merge is off until you turn it on.