chapter 04 · the switchboard
Where the human goes
Nobody removed the person from the factory; the job relocated. Agents now hold the inner loop: investigate, implement, test, report. The outer loop stays human: deciding whether this is the right change at all, verifying the diagnosis, approving, and answering for the result. Evidence is the interface between the two loops (diffs, tests, logs, and a short explanation connecting them). You are no longer on the line writing changes; you design the line and guard its gate.
The lit factory makes one further move, and it is the one that pays: it shifts human judgment upstream, to the product, the design, and the architecture, before an agent starts a loop. An hour spent reviewing a two-hundred-line plan replaces a long crawl through two thousand lines of generated code hunting for what the decision even was.
§ 4.1What earns a loop the dark
A loop earns fully automated status only if its check is cheap, runs at high frequency, and cannot be faked out: green-or-red oracles, type gates, property tests, a review agent with a real rubric. The oracle must answer immediately and must not drift. Short loops verify cheaply (Horthy’s rule of thumb: agents hold up for three to ten steps and lose the thread past twenty), while sprawling loops hide mistakes in the corners.
Keep the lights on where a wrong answer is expensive and only a person can catch it: subtle production bugs no test sees, large blast radii, decisions that shape a year of work. Concretely:
| switch | loop | why |
|---|---|---|
| DARK | A nightly cron that fixes exactly one lint violation and opens one pull request short enough to read | Cheap unfakeable oracle, tiny blast radius, bounded loop |
| DARK | A mechanical migration whose transform ships with a deterministic checker over every call site | The transform is verifiable; taste is not involved |
| LIT | Anything touching auth, billing, or a public API contract | Wrong answers are expensive, delayed, and invisible to tests |
| LIT | Architecture and plan review before a loop starts | The cheapest gate in the whole pipeline buys the most leverage |
The danger is setting every switch to the same mode. All dark: you tear it down four months later, as chapter 2’s cautionary tale did. All lit: review becomes the bottleneck and nothing ships. The hard, skilled job, the actual work of factory ownership in 2026, is deciding where each switch goes, and revisiting the decision as evidence accumulates.
§ 4.2Robots are fine in the dark
None of the machinery that makes this safe is new. Good types and signatures so the compiler catches mistakes; test seams; legible layout and short call stacks; component boundaries that bound blast radius; dependency injection. The old unglamorous safety net does a second job now: with coding agents on the line, architecture doubles as a cheap, hard-to-fake harness against the mistakes the agent will make. The safety net deliberately lives outside the model.
Humans need to see what they are doing; robots do not. The design question is never “can the machines run without light” — they can — but “which parts of the floor can afford to go unseen.”