You build the brakes first: a sandbox, hooks, hidden tests and a kill switch. Then the triggers. You finish with a line that takes a labeled issue to a verified draft PR, and a human merges it.
A Haiku triage station that turns GitHub issues into validated JSON work orders
Hook gates plus a Docker sandbox with one allowed host, tested with a red-team drill
A verify script with holdout scenarios and a test-tamper check
A TypeScript Agent SDK orchestrator that runs builder, verifier and retries under caps
A GitHub line where a 'factory' label produces a verified draft PR that a human merges
From Bemer's 1968 'software factory' to Hitachi, Toshiba, SDC and Microsoft's 2004 Software Factories — what worked, what failed, and why AI makes the generator cheap but leaves the organizational failure modes intact.
How the DoD's software factories, cATO and supply-chain security turned 'factory' into an attested pipeline — and how StrongDM, OpenAI and Anthropic redefined it in 2026 around agents.
METR, DORA and real incidents separated from vendor hype. Then audit your own work: which tasks belong on an unattended line and which never should.
Design the factory before building it: intake, triage, build, verify, review and merge stations, their inputs/outputs, and the stop conditions that halt the line.
CLAUDE.md as a map not a manual, structural tests, linters and fast feedback — the harness-engineering lessons that make unattended agents succeed on MeetingMemo.
Run Claude Code without a human: claude -p, --bare, output formats, permission modes, tool allowlists, budgets and exit handling — the station worker's contract.
Turn GitHub issues into validated JSON work orders with --json-schema, Haiku-tier cost, and a replayable run you can inspect without spending tokens.
PreToolUse denies, PostToolUse checks and Stop gates: enforce 'tests are read-only', 'never push main' and 'lint must pass' deterministically — not by asking nicely.
Run the builder in a non-root, network-restricted Docker container with credentials kept outside the agent's reach. Includes Windows (WSL2 + Docker Desktop) setup.
Plant a malicious issue, watch what an unguarded agent does, then prove your hooks, sandbox and least-privilege tokens contain it.
Unit tests, scenario tests the builder never sees, and LLM-judged satisfaction — StrongDM-style holdouts adapted to MeetingMemo.
Agents delete tests and special-case fixtures. Build a separate verifier with its own context and permissions, and detect test tampering automatically.
When a bash loop is enough, when to use subagents or dynamic workflows, and when to drop to the Agent SDK — with a decision table and costs.
Write a TypeScript or Python orchestrator that runs a builder, hands off to a verifier, retries with feedback, and stops on budget or round caps.
Parallel isolated runs with git worktrees, bounded retries, and clean escalation: when the factory gives up, it hands a human a useful draft and a diagnosis.
claude-code-action on issue labels, bot tokens so agent PRs trigger CI, timeouts, concurrency and subscription vs API-key authentication.
Nightly sweeps and on-demand runs: scheduled cloud tasks, cron in Actions, and firing the factory from an API call — with guardrails on frequency and spend.
When CI fails on a factory PR, route the failure back to the line for a bounded fix attempt — and know when to stop.
Instrument every run: total_cost_usd, tokens, retries and outcome. Model tiering, caching and budgets — and the one number that matters: cost per merged PR.
OpenTelemetry for Claude Code, per-producer DORA metrics, change-failure alarms and a one-command kill switch for the whole line.
Write the operating charter (what the factory may and may not do), regression-test your prompts and skills with evals, and run a weekly factory review.
Assemble everything: a GitHub issue labeled 'factory' becomes a draft PR that passes hidden scenarios, stays under budget, and waits for a human merge.
Software Factories with Claude Code isn't sold separately. The $45/month subscription includes it and every other course, plus everything we add next.
Docker is required for the sandbox labs. You also need Node 22, the GitHub CLI, jq and a private GitHub repo for the trigger labs. Windows works through WSL2 and Docker Desktop. You pick the Next.js or FastAPI track of the practice app.
Measured lab runs cost $0.01 to $0.20 each. A Claude subscription or an API key both work. On a subscription, the reported cost is an API-equivalent figure and spend comes out of your plan quota.
It is included with the subscription ($45/mo). It is not sold separately, and there is no one-time purchase.
Claude Code Hidden Power, or equivalent knowledge. The course does not reteach CLAUDE.md, hooks or permission rules. It links back to those lessons (T602, T608, T610, T617) when you need them.