Level 5: You Run the Software Factory
Level 5 on the autonomy ladder is the software factory: a pipeline where agents pull work from a queue, build and verify it, and open pull requests without a human writing code. Stripe’s Minions merge more than 1,300 pull requests a week (stripe.dev, February 2026). The factory has six stations, intent, harness, loop, graph, verification and release, and this page maps each to what Claude Code, Codex and Cursor ship.
Shapiro’s name for this rung (The Five Levels, January 2026) is the dark software factory, and his description of it is blunt: “It’s a black box that turns specs into software”, where “humans are neither needed nor welcome”. He places a handful of people there, in teams of under five. Treat what follows as an inventory of parts, not a route: the parts are documented, the whole is rare.
The six stations come from splitting the agent pipeline by decision. Intent decides what the agent knows before it starts. Harness decides what it may run. Loop decides when it stops. Graph decides who does what once there is more than one. Verification decides what counts as proof. Release decides how work leaves the building. Every cell below was fetched from the vendor’s own documentation on 28 August 2026; a cell reading not documented as of 2026-08-28 is a gap in the docs, not proof the tool cannot do it.
What does the Intent station need, and what does each tool ship for it?
Section titled “What does the Intent station need, and what does each tool ship for it?”| Capability | Claude Code | Codex | Cursor |
|---|---|---|---|
| Persistent project instructions | CLAUDE.md and auto memory | AGENTS.md | Rules |
| Reusable procedure | Skills | Skills | Agent Skills |
| Distributable bundle | Plugins | Plugins | Plugins |
| Plan before implementing | Plan mode | /plan | Plan Mode |
| Guidance on framing a verifiable objective | Not documented as of 2026-08-28 | Long-running work | Not documented as of 2026-08-28 |
The three context files are equivalent in job and different in mechanics: Codex “reads AGENTS.md files before doing any work”, Cursor’s rules “bundle prompts, scripts, and more together”, and Claude Code adds accumulated memory to the file you write. Only Codex publishes advice on the objective itself, and it is the sentence to copy: outcome, constraints, verification.
What does the Harness station need, and what does each tool ship for it?
Section titled “What does the Harness station need, and what does each tool ship for it?”| Capability | Claude Code | Codex | Cursor |
|---|---|---|---|
| Permission modes | Permission modes | Permission modes | Run modes |
| Approval policy | Auto mode | Approvals | Not documented as of 2026-08-28 |
| Operating-system sandbox | Sandboxed Bash tool | Sandbox | /sandbox |
| Lifecycle interception | Hooks | Hooks | Hooks |
| External tools | MCP | MCP | MCP |
| Managed remote environment | Cloud environments | Cloud environment | Builds |
| Self-hosted compute | Self-hosted environments | Not documented as of 2026-08-28 | Private workers |
| Push external events into a live session | Channels | Not documented as of 2026-08-28 | Not documented as of 2026-08-28 |
This is the station a team can actually finish in an afternoon, and the one that decides how much of the rest is safe. Two rows are worth reading closely. Claude Code’s auto mode routes “tool calls through a classifier that blocks anything irreversible, destructive, or aimed outside your environment”, which is a judgement call made by a model; Codex’s approval policy is a named mode — on-request, never, untrusted, granular — which is a judgement call made by you. Both beat an agent running with whatever permissions the last session left behind.
What does the Loop station need, and what does each tool ship for it?
Section titled “What does the Loop station need, and what does each tool ship for it?”| Capability | Claude Code | Codex | Cursor |
|---|---|---|---|
| Goal or stop condition | /goal | /goal | /goal |
| Interval loop | /loop | Absent from the command list (checked 2026-08-28) | /loop skill, bundled since 3.5 (20 May 2026) — not in the CLI slash-command reference (checked 2026-08-28) |
| Scheduled unattended runs | Routines | Scheduled tasks | Automations |
| Headless invocation | claude -p | codex exec | Print mode |
| Programmatic SDK | Agent SDK | Codex SDK | TypeScript SDK, Python SDK |
| Isolated cloud run | Claude Code on the web | Codex cloud | Cloud Agents |
The triggers differ more than the runners. Claude Code’s routines “run on a schedule, trigger on API calls, or react to GitHub events”, and run “as full Claude Code cloud sessions: there is no permission-mode picker and no approval prompts during a run” — which is exactly why the harness has to be right first. Codex’s automations name Gmail, Slack and GitHub pull request activity as event sources. Cursor’s automations run “on a schedule or in response to events from GitHub, GitLab, Slack, webhooks, Linear, and more”, with Sentry and PagerDuty in the trigger list. If your factory pulls from a queue, that trigger list is the queue.
What does the Graph station need, and what does each tool ship for it?
Section titled “What does the Graph station need, and what does each tool ship for it?”| Capability | Claude Code | Codex | Cursor |
|---|---|---|---|
| Delegated subagents | Subagents | Subagents | Subagents |
| Documented concurrency cap | 20 per session by default | Configurable, no documented default | No documented maximum |
| Subagents on their own machine | Share the session’s machine; isolation comes from worktrees | Not documented as of 2026-08-28 | Yes, since 19 August 2026 |
| Peer agents that message each other | Agent teams, experimental | Not documented as of 2026-08-28 | Not documented as of 2026-08-28 |
| Script-driven orchestration | Dynamic workflows | Not documented as of 2026-08-28 | Not documented as of 2026-08-28 |
| Filesystem isolation | Worktrees | Worktrees | Worktrees |
| One screen for many agents | Agent view | Codex Micro | Agents window |
| Programmatic fleet control | Agent SDK | Codex SDK and app-server | Cloud Agents API |
Two rows are the state of the art rather than a checkbox. Claude Code’s dynamic workflows “orchestrate many subagents from a script Claude writes and you can rerun”, which is the closest any vendor comes to a factory floor you can version. Cursor’s 19 August 2026 changelog gives subagents “an isolated copy of the project with clean context in its own cloud environment”, which turns fan-out from a context problem into a scheduling one.
What does the Verification station need, and what does each tool ship for it?
Section titled “What does the Verification station need, and what does each tool ship for it?”| Capability | Claude Code | Codex | Cursor |
|---|---|---|---|
| Review the local diff | /code-review | /review | Agent review |
| Deep, verified multi-agent review | Ultrareview | Not documented as of 2026-08-28 | Not documented as of 2026-08-28 |
| Managed pull request review | Code Review | GitHub and GitLab review | Bugbot |
| Security scanning | Claude Security plugin | Codex Security | Security Agents |
| Undo or rewind | Checkpointing | Not documented as of 2026-08-28 | /rewind |
| Escalate to a stronger model | Advisor | Not documented as of 2026-08-28 | Not documented as of 2026-08-28 |
Nothing in this table is deterministic, and that is the station’s central problem. Ultrareview goes furthest — “every reported finding is independently reproduced and verified” — and still costs roughly $5 to $25 and 5 to 10 minutes per pass. The proof a factory runs on is the boring layer underneath: types, tests, lint, migrations that fail closed. Stripe’s Minions were built on “Stripe’s enormous preexisting battery of tests — over three million of them”, and bound to “at most two rounds of CI” before a human takes the branch back.
What does the Release station need, and what does each tool ship for it?
Section titled “What does the Release station need, and what does each tool ship for it?”| Capability | Claude Code | Codex | Cursor |
|---|---|---|---|
| Run in GitHub CI | GitHub Actions | Codex GitHub Action | GitHub Actions |
| Run in GitLab CI | GitLab CI/CD | GitLab | GitLab |
| React to repository events | Routines GitHub trigger | Cloud tasks from GitHub, GitLab, Linear, Slack | Automations source-control triggers |
| Trigger from your own systems | Routines API trigger | Not documented as of 2026-08-28 | Webhook triggers |
| Outbound notification of run status | Not documented as of 2026-08-28 | Not documented as of 2026-08-28 | Webhooks |
| Route and approve pull requests | Not documented as of 2026-08-28 | Not documented as of 2026-08-28 | PR routing and approval |
| Steer a run from a phone | Remote Control | Codex Remote | Mobile |
The gap that matters here is the round trip. Claude Code’s routines take an inbound HTTP trigger — “POSTing to the endpoint with the routine’s bearer token starts a new session and returns a session URL” — but publish no outbound webhook; Cursor publishes outbound webhooks with a statusChange event but is the only one of the three documenting a PR approval agent. A factory that cannot tell your systems what happened is a factory you have to poll.
Which stations may run dark
Section titled “Which stations may run dark”A level belongs to a loop, not to a company, and the same four questions decide every loop. They come from software factories, and they are the rule for which station may run unattended:
- What oracle decides “done”? Name the specific thing. “Tests pass” is an oracle. “It looks right” is not.
- Can the agent fake it? If the agent can edit the oracle, the oracle is a suggestion. Tests inside the repo fail this question by construction.
- How long until a wrong answer surfaces? Seconds is a green light. “A human notices in three weeks” is a red one.
- What is the blast radius if it is wrong? Reversible and contained, or a schema migration.
A loop that answers cleanly on all four can run dark today. A loop that fails question 2 or 3 stays lit no matter how good your harness is.
Where a factory rots first
Section titled “Where a factory rots first”The queue outruns the review capacity. Faros AI measured the shape of this in April 2026 across 22,000 developers: incidents per pull request up 242.7%, median time in review up 441.5%, and 31.3% more pull requests merging with no review. A factory that scales generation without scaling proof produces the same output as a broken one, slightly later.
The oracle drifts into the agent’s reach. Every station that verifies its own work eventually rewrites the check. Keep the decisive validator in CI, in a separate package, or behind a command the run cannot edit.
Unattended runs inherit yesterday’s permissions. Routines run with no approval prompts by design. Whatever the harness allowed the last time you looked is what runs at 3am.
Untrusted text reaches an agent with tools. Issue bodies, pull request comments, webhook payloads and scraped pages are inputs an outsider can write. Wrap them as data, never as instructions, and give the loops that read them the narrowest permissions in the factory.
Nobody owns the whole line. Six stations with six owners and no one reading the seams is how a green pipeline ships a wrong product. That job does not automate; it is the human’s job.