Lights on, lights off
The term is borrowed from factories that run in the dark because robots do not need to see. Carried into software, it makes a claim about one specific thing — and it is not rigour.
FANUC has run robot plants in Yamanashi since 2001 with the lights physically switched off, and Xiaomi opened a lights-out smartphone plant in 2024reputable. The lights are off because only machines are on the floor, and machines do not need light to see. The name is not a metaphor about sophistication. It is a literal description of an empty room.
“Software factory” itself is much older than any of this — the idea traces to Doug McIlroy’s 1968 proposal for reusable off-the-shelf components, and the phrase was a trademark by 1974reputable. The AI era repurposed it rather than coining it, which is worth knowing when someone tells you the concept is new.
Carried into software, the floor is the diff. A dark software factory ships code no human has read, verified only by other machinesprimary. That is the whole claim, and it is worth being precise about what it does not say. It says nothing about how carefully the code was checked; a dark factory can be checked far more thoroughly than a lit one. It is a claim about where reading happens: nowhere.
The lit factory is not the slow one
The obvious reading of the diagram is that the lit pipeline is the dark one with a person wedged in as a brake. That reading is wrong in a way that costs teams a year.
A lit factory is the same pipeline with the lights left on where judgment livesprimary. Agents still do most of the building. But the lit version does something the diagram cannot show: it moves human judgment upstream — to the product, the design, and the architecture — before an agent starts a loop.
The arithmetic favours it heavily. An hour spent reviewing a two-hundred-line plan replaces a long crawl through two thousand lines of generated code hunting for what the decision even wasprimary. Judgment applied before generation is cheap and directive. Judgment applied after generation is expensive and archaeological. Same person, same hour, an order of magnitude difference in leverage.
The safety net lives outside the model
The second thing the lit version does is unglamorous and easy to skip, because it looks like ordinary engineering hygiene: good types and signatures so the compiler catches mistakes, test seams, legible layout and short call stacks, well-defined component boundaries that bound blast radius, dependency injectionprimary.
None of it is new. What is new is the second job it now does. Architecture used to be about human comprehension and change cost. It is still about those — and it is also a cheap, hard-to-fake safety net against the specific mistakes an agent will make. A tight interface does more than document intent: it makes a whole category of confident, plausible, wrong changes impossible to express. Thoughtworks’ framing of the moment is that the inflection point is about technique rather than technologyprimary, and this is what that means in practice.
Why going dark feels free
Removing the review gate is easy and immediately rewarding, because the missing step was in everyone’s way. Throughput appears to break the sound barrier. Nothing bad happens on day one, or in week three.
Day shift — the lit factory. Agents do most of the building; judgment moves upstream, and a person still reads what comes out.
Second shift — the dark factory. Throughput appears to break the sound barrier, because the missing station was in everyone's way. The costs are buried, and they arrive late.
The costs are buried and they arrive lateprimary. Horthy reports running a fully automated code factory for about four months with no human reading the output; the failure that ended it required painstaking manual debugging to even locateprimary. Note the shape of that sentence. Not “it produced bad code” — the failure was hard to find, in a system nobody had read. That is a different class of problem, and chapter 6 gives it its name.
There is a selection effect worth naming here, because it makes personal experience misleading. Weekend projects never live long enough to collect the debt. Decade-old brownfield systems are made of itprimary. If your evidence that darkness works comes from a greenfield project three months old, you have evidence about three-month-old greenfield projects.
The legal reading
One counterpoint deserves its own paragraph because it is not an engineering argument and therefore does not get resolved by engineering. The Stanford Law CodeX essay Built by Agents, Tested by Agents, Trusted by Whom? asks who answers for unreviewed security codereputable. “The model wrote it and the tests passed” has not been tested as a defence, and the organisations most able to run dark factories are the ones with the most to lose if it fails.
If you are about to turn a gate off, first find out what it has caught in the last three months. A gate nobody can produce a catch for may genuinely be redundant — that is worth knowing. A gate you turn off without looking is not a decision, and you will not be able to tell the difference later.