Countersign: nothing ships on one signature

A band of coding agents that plans, builds and accepts its own work can sign off on a misread spec, a test suite that cannot fail, or a race it never exercised. The challenge asks for a dark factory: one dispatch in, accepted stages out, no human steering in between. The hard part is knowing when to trust the result. Countersign derives every artifact twice and ships only when both agree. Two seats read the spec blind and reconcile their clause ledgers. An Oracle that never sees the code writes a reference model and acceptance suites, and the service is differential-tested against the model. The tests are tested: a mutation kill-rate gate, and a race proof per concurrency guard that must fail with the guard removed. The shipped checks run last, and only the Auditor, which may not write fixes, can accept a stage. Five BAND Desktop seats share one room, each a Claude Code agent with its own git worktree and identity: Foreman, Builder, Stylist and Auditor on claude-opus-5-5, the Oracle on claude-fable-5-1, a different model for less correlated mistakes. @mentions wake only the seat that must act, and handoffs carry the full requirement text. A guard hook enforces seat boundaries in code; no mandate names anything from the track. One dispatch covered all four tablekeeper stages, and the Auditor accepted all four; the run took 12 h 59 min. The final stage passed all 158 shipped checks for stages 1 to 4 in isolated mode, killed 34 of 38 mutants (81 to 90 percent across stages), and proved all 10 concurrency guards red without them and green with them. Of 11 rejections, 8 changed the work; the one holdout escape, at stage 1, came from a ruling that was withdrawn and fixed before acceptance. Estimated spend: about $296 API-equivalent. Honest limit: at stage 4 the seats deadlocked, each waiting on another, and the operator sent one liveness note, disclosed in FACTORY.md; kit v1.1 adds the missing rule.