From Human to Agent: Why DevSecOps Platforms Must Restructure for AI-Native Software Factories

Background: Factory and the Four Stages of AI Development Tools

The author references a report on Factory , a U.S. AI-native software development platform that raised $200M at a $5B valuation. Factory positions itself not as an AI coding copilot but as an AI Software Factory . The report outlines four evolutionary stages:

Stage 1: Code completion — local efficiency gains.

Stage 2: AI programming assistant — longer context, code explanation, bug fixing, test generation, simple feature development.

Stage 3: AI programming agent — autonomous multi-step task execution.

Stage 4: Software factory — multiple agents collaborating under a unified governance system that manages infrastructure, model selection, security scanning, and continuous optimization.

The shift from stages 1–3 to stage 4 moves competition from "who generates better code" to "who reconstructs the complete software production process."

Factory's Eight Design Points

The author distills Factory's public architecture into eight independent design decisions:

Unified Governance System: Enterprise adoption hinges on security, compliance, permissions, controllability, observability, and deployment flexibility — not raw model capability.

Sovereign Intelligence: Enterprises control learning mechanisms, model selection, and deployment environment (vendor cloud, self-hosted, or air-gapped). Critical for finance, government, defense, healthcare, energy, and manufacturing.

Multi-Agent Task Orchestration: Automatic infrastructure provisioning per agent, coordination to avoid interference, real-time monitoring dashboards.

Readiness Report: Pre-flight check of repository "agent-friendliness": code structure clarity, documentation completeness, dependency explicitness, test coverage, security guardrails. Low readiness predicts failures even with strong models.

Automatic Model Selection & Failover: Cost-effective model routing per task step; automatic fallback on primary model failure.

Quality/Security Scanning & AutoWiki: Post-generation engineering and security validation; documentation auto-updated with code changes.

Droid Computers (Agent Virtual Work Environments): Persistent environments with libraries, configs, dependencies — agents operate in context-rich execution environments, not isolated chat windows.

Self-Optimization Flywheel: Anonymous usage signals from thousands of daily sessions drive iterative improvement of agent strategies, task decomposition, and model adaptation.

The internal logic: governance frame → agents inside → real usage data feeds back to agents .

Agreement: Overall Usage Pattern and Process Logic

The author's own project at a research institute uses a "Agent Production + Platform Governance" model. The "Wanxiang" (万象) agent system schedules a coordinator agent that orchestrates requirement, design, development, test, summary, and review agents across the full lifecycle. The R&D management platform handles process, asset, quality, and collaboration management. Both sides interconnect via MCP and OpenAPI for bidirectional flow of requirements, designs, code, tests, docs, and review records. This mirrors Factory's "multi-agent collaboration under unified governance" and the same five-phase segmentation with inner loops and rollback on change or failure.

Disagreement: Build New vs. Restructure Existing

Factory builds a brand-new AI-native R&D OS from scratch. The author argues that in China — especially defense and critical industries — the realistic path is restructuring existing DevSecOps platforms to become the agent execution base and governance hub. Three reasons:

Governance isn't built from zero. Existing platforms embed processes bound to standards, regulations, and roles: requirement itemization, design review traces, code merge gates, test case/defect closure, version baselines, delivery approvals. Rebuilding these in a new platform underestimates the cost.

Governance capabilities can't grow on sand. Factory itself stresses security, compliance, permissions, controllability, observability, deployment flexibility — exactly what existing platforms have accumulated over a decade: identity/access, multi-tenancy, audit logs, branch control, artifact gates, version baselines. Re-implementing them on an unproven system creates asymmetric risk.

Agent outputs must be forced into the existing controlled loop. Agent-generated requirements, code, tests, docs only become auditable deliverables after passing through the unified management system's gates and reviews. The platform is the sole channel converting "AI productivity" into "organizational delivery capability."

Summary: AI-native software factory direction is correct, but the platform should be restructured, not replaced.

The Real Watershed: Platform Service Object Shifts from Human to Agent

Traditional DevSecOps platforms assume a human operator at the UI. When the executor becomes an agent, three fundamental changes occur:

(1) Interface-First: Every Platform Capability Must Answer "How Does an Agent Call This?" First

Requirements read/write, design docs pull/push, repo branch creation and review initiation, pipeline triggering, test management writes — all must be exposed via standard interfaces. Building MCP is not optional; it is step one of platform restructuring. MCP and OpenAPI enable agents to "read context, write results" bidirectionally, bringing the entire R&D process into a unified, digital, traceable system.

(2) Human Role Shifts from "Operator" to "Confirmer and Supervisor"

Humans no longer step through processes; they confirm at key gates: requirement entry confirmation, design review by leads/architects/chief designers, code merge approval. The UI transforms from an "operation console" to a "governance console" — process visible, state queryable, results auditable, behavior traceable.

(3) Platform Boundary Shifts from "Tool Collection" to "Agent Asset Pool and Runtime Base"

Two new responsibilities:

Agent Asset Management: Agent code, Skills, Plugins, Prompt templates, configs versioned in repos. Platform builds an agent marketplace for centralized distribution; local and cloud modes pull specified versions from the same repo for consistency. Project kickoff freezes agent/Skill/Plugin versions into a project-specific repo, ensuring lifecycle consistency and traceability even as the marketplace evolves.

Execution Aggregation: All artifacts (requirements, designs, code, tests, docs, review records) and process data aggregated into the platform.

Implication: Agent capabilities themselves become governed assets. Without this, cross-project, cross-version consistency and traceability collapse.

Why Platforms Are Irreplaceable in Chinese Defense and Critical Industries

Three regulatory pillars make the platform unavoidable:

GJB5000B (CMMI for Defense): Demands defined, executed, recorded, measured processes with evidence chains — e.g., "which requirement confirmed by whom, when, through which reviews, linked to which change." A model cannot self-generate such evidence; only the platform can produce it during process execution.

Software Modernization: Requires continuous evolution, rapid iteration, versioned delivery, full lifecycle traceability. AI accelerates evolution speed, but the traceability constraint remains and intensifies.

Quality & Security/Confidentiality Systems: Hard constraints on data storage, transfer, audit. Realities include multi-network deployment, cross-network code collaboration and diff identification, classified media ferrying, external evaluation artifact delivery chains. These are platform deployment topology and flow mechanism problems, not model capability problems. Example: platform deployed in two isolated networks; cross-network diff via local version tool with manual conflict fallback; compiled artifacts pushed to external evaluation systems via interfaces ensuring trusted data flow.

Conclusion: In defense and critical sectors, AI agents change "who executes R&D activities," not the premise that "R&D activities must be governed." DevSecOps platforms don't disappear — they become "agent execution base" + "manager governance and evidence hub," more indispensable than ever.

Five Engineering Landing Points for Restructuring

Assetization and Versioning First: Foundation of restructuring. Three layers: repo versioning → platform agent marketplace for distribution → project kickoff version freezing.

Inner Loops and Human Confirmation Gates Co-Designed: Each of the five phases (requirement, design, dev, test, summary) needs an inner loop for output accuracy/consistency, plus explicit human confirmation gates at phase exits — not distrust, but compliance and accountability; the confirmation act itself is evidence.

Local and Cloud Capability Consistency: CLI, web assistant, IDE plugin — different UX, same underlying agent capability system. Prevents "capability fragmentation" governance nightmares.

Readiness Assessment Before Scale-Out: Factory's Readiness Report warns: agents aren't stable in every codebase. Assess structure, docs, dependencies, test coverage, permission guardrails first; remediate gaps (add docs, tests, permissions, security rails) before broad agent adoption.

Deployment and Network Realities Addressed in Architecture: Multi-network, offline, domestic hardware adaptation, cross-network collaboration, classified media ferrying, external evaluation interfaces — these are norms, not exceptions. Must be designed in from the start, not patched later.

Five Open Questions Requiring Ongoing Tracking

Human Confirmation Gate Load and Responsibility Boundaries: Will confirmation volume and judgment difficulty rise or fall? If every agent output needs item-by-item confirmation, humans become a new bottleneck. Review responsibility allocation and incident accountability need organizational redesign.

Agent-to-Production System Permission Boundaries: Agents need write ops (branch creation, code commit, pipeline trigger, requirement/defect writes). Least-privilege, error isolation, anomaly circuit-breaking lack mature patterns. Current conservative choice: critical actions like code merge still require human confirmation.

Multi-Agent Parallel Rewrite Conflict Governance: Parallel development agents modifying same file locations across networks/branches still conflict, requiring manual resolution — a real engineering efficiency ceiling.

Missing Quantitative Evidence: Neither Factory's public materials nor domestic peers provide credible efficiency/ROI metrics: how much faster, defect reduction, cycle compression. Absence is both a marketing convenience and a decision risk.

Platform Hollowing Risk: If model-side agent orchestration, memory, context management keep advancing, could the platform degrade to mere data storage? Author judges no — compliance evidence, permission systems, gate enforcement, metrics are organizational governance, not model capabilities — but needs continuous validation.

Final Synthesis: Humans Define Goals, Agents Produce, Platforms Govern

The answer to the opening question: DevSecOps platforms are not replaced; they become protagonists again in a new form. The landing method isn't "agents replace R&D platforms" but "R&D platforms change service object from human to Agent." This demands three platform actions: Make standard interfaces (MCP, OpenAPI) the primary interface so agents read context and write results. Turn human UI from operation console into governance console: process visible, state queryable, results auditable, evidence traceable. Govern agent capabilities as versioned, distributable, freezable organizational assets. In China's defense and critical sectors, GJB5000B, software modernization, and quality/confidentiality systems require process control and evidence retention that models cannot self-prove — only the platform can generate them in-process. Thus the platform becomes the sole channel converting AI productivity into organizational capability. The resulting tripartite division: humans define goals and make key confirmations, agents produce, platforms govern. In the author's words: "Agents responsible for production, platform responsible for governance, assets continuously accumulated, capabilities continuously reused."