ZeroTrust Factory

ZeroTrust Factory is a software factory built in BAND Desktop. Four Claude Code seats plan, build and independently verify a clean-room restaurant reservation service (tablekeeper), one stage at a time. No seat trusts another seat's claim that work is done. The band Architect (Opus): the only seat that talks to the human. Splits each stage spec into handoffs with the full task pasted in. Never asks for clarification or approval. Developer (Sonnet): implements one scoped item at a time, builds to spec only, posts the committed revision. Reviewer (Sonnet): checks each revision against the full requirements, not the developer's summary. Rejects with a concrete reason or accepts. Release-verifier (Sonnet): rebuilds and runs the harness itself in isolated mode (no outbound network, 2 vCPU, 2 GiB). Confirms only from output it read. How it works Each stage folder is a complete, buildable service, copied forward and extended from the last, so earlier behavior must keep passing. The submitted run's only human input was 8 messages: 4 mandates, 4 stage dispatches. Mandates are fully generic, no mention of reservations, tables or endpoints, the track detail lives only in the dispatched task. What it built: all 4 tablekeeper stages, API with idempotent writes and atomic moves; browser UI with stale-state recovery; effective-dated policies and recurring series; closure replanning with atomic apply. Bad work it caught: in the graded run, reviewer rejected a stage 2 revision for a UI defect ("null" in the header), fixed and re-accepted. In the dev run: two stage 1 rejections (missing validation, a cutoff bug), one stage 2 rejection (422/400 mismatch), one stage 4 rejection (crash on extreme timestamps). FACTORY.md has commit hashes for all. Verification: every stage reconfirmed via isolated harness on a clean container and again on a fresh clone. room.json is submitted unedited. Result: all 4 stages, zero-steering run, 1h14m total.