[JacobStephens2]

Summary

A new research note, docs/research/open-source-factories.md, answers #836's question: which practices of other open-source software factories would thirdshift benefit from, which does it already have, and which conflict with its ADRs. No code changes.

docs/research/open-source-factories.md
├── Method       # six repos read at pinned commits; every link checked
├── TL;DR
├── §1 The six at a glance   # what each is, how it's driven, auth, who merges, licence, maturity
├── §2 Practice by practice  # one table per factory: source → thirdshift → mark
│   ├── 2.1 addyosmani/factory
│   ├── 2.2 ProPR (integry/propr)
│   ├── 2.3 Anneal (mosonlab/anneal)
│   ├── 2.4 AI Software Factory (Cole Medin, on Archon)
│   ├── 2.5 Agentic Orchestrator (DoorDash)
│   └── 2.6 pocock-agents
├── §3 Patterns across the six   # where the field agrees with, is behind or is ahead of thirdshift
├── §4 Suggested follow-ups      # ten suggestions: six belong under open issues (#429, #321, #710, #583/#584/#969, #322, #883/#1092), four are new
├── §5 Conflicts with thirdshift's ADRs   # 0004, 0006, 0009, 0013; one worth reopening
└── §6 Uncertainties

Each practice is marked Have, Adopt, Conflicts (ADR NNNN) or Skip. Skip is for practices that thirdshift lacks, wouldn't benefit from, and no ADR rules out. The Method says why the three marks the issue names couldn't place these.

The top suggestions:

1. Another model family for the Standards and Spec review (Multi-family review: have another model family review a Run's work #429).
2. Protected paths that hold a Self-merge (new).
3. Factory sessions that don't load the user's personal agent config (new).
4. A mechanical red-without-the-fix check for new tests (new).

Gas Town and Sandcastle are left out, since warp-factories-and-alternatives.md and sandcastle-fit.md already cover them.

Evidence

• Primary sources. Every claim about another factory links to a file at a pinned commit of its repository: README, docs or source. Every claim about thirdshift cites GLOSSARY.md, an ADR or a source file.
• Links checked. A script fetched every GitHub file link at its commit and checked its #L range against the file's length. It also fetched every issue and web link, and resolved every relative link.
  • Before: no note on these six factories.
  • After: 163 unique URLs, 0 failures; all relative links and line anchors resolve. The Spec reviewer re-checked all of them independently, with the same result.
• Tests. scripts/affected-tests origin/main picks the full Rust suite for any docs/research/ path. On this host, every failure comes from the host's environment, and none could come from a Markdown file:
  • socat is not installed. 21 sandbox::tests unit tests fail with "sandbox failed to start: socat is not on PATH". So do 5 sandboxed integration tests: 1 in experiments, 3 in scoring and 1 in bug_origins.
  • tests/trial.rs: 14 failures, from the same missing socat. bwrap is installed, so the harness picks the Trial sandbox, and the sandbox can't start. With a failing bwrap first on PATH, the harness takes its documented no-sandbox fallback, and all 26 tests pass.
  • The global git config sets tag.gpgsign=true. Three worktree::synchronization_tests fail with "no tag message?". All 36 tests in that module pass with GIT_CONFIG_GLOBAL=/dev/null.
  • Python is 3.9, without tomllib. bug_origins::settlement::historical_review_and_reclosed_origin_regressions fails on ModuleNotFoundError: No module named 'tomllib'.
  • Every other unit and integration test passed. cargo test --no-fail-fast was killed by a session time limit after tests/spec_push_race.rs. A second run covered tests/spec_run.rs through tests/user_config.rs. CI runs the full suite on this PR too.

Merge Danger

Door: two-way

A new Markdown file under docs/research/. Nothing reads it at build or run time.

Blast Radius: none

Unaddressed findings

Standards

• The ADR 0013 ~/.claude/ fact and the adopt and conflict lists are repeated across the TL;DR, §2-§3 and §4-§5 (Duplicated Code, a judgement call). Declined. Each place serves a different reader: summary, evidence, action list, ADR register. The repository's research notes repeat the same way; sandcastle-fit.md's TL;DR restates its §1-§7.
• Some cells hold two marks (a judgement call). Declined. A cell holds two marks only where a practice splits into a part thirdshift has and a part it lacks, such as "Have, in part. The rest: Adopt". The Spec reviewer's finding (a)1 asked for exactly that split to be marked.

Spec

• A fourth mark, Skip, goes beyond the criterion "Each practice is marked as already in thirdshift, worth adopting, or conflicting with an ADR (named)". Declined. The note's Method, under "How practices are marked", gives the reason: a practice that thirdshift lacks, wouldn't benefit from, and no ADR rules out fits none of the three. One example is ProPR's validation that reports a failure but still opens the pull request. Forcing it into Adopt or Conflicts would misreport it, and every Skip row states its reason. The finding's other half was fixed: two "Have, in part" rows that left a part unmarked.

Security

• None. The change adds one Markdown file under docs/research/ that no build, test, prompt or site page reads; its external links all point at github.com, and it holds no scripts, HTML, hidden characters, credentials or local paths.

Security review outcome

No unaddressed introduced findings.

Review coverage

The fixed point was origin/main. Local main was two days stale, and would have pulled 405 unrelated commits into the review. Both reviewers read the one changed file, docs/research/open-source-factories.md, in full. No changed file was left unread, and nothing was excluded as generated output.

Closes #836

Built with claude · claude-opus-5-5 · high