The factory's empty seams are solved scheduling problems

Technical report, 2026-07-10 (implementation status updated 2026-07-11). Companion essay: The software factory as an observatory. The literature review below surveys the operations-research literature in the NASA ADS corpus, with every source linked to its ADS record.

The entire pool-dispatch policy of Gas City, an agent-fleet orchestrator, is one shell line: fetch the next ready work item routed to a given worker pool, unassigned, limit one (this is tier 3 of the dispatch configuration’s effective work query). First come, first served, one work item per claim, ordering delegated to whatever the query returns. The autoscaler is one line too: desired sessions equals ready-queue length, clamped to a minimum and maximum defined by the autoscaling configuration. Model selection is a static string in a per-agent config file. There is no lookahead, no load balancing across pool instances, no cost model, and no deadline field anywhere in the work-item data structure.

At 20:47 on Palomar Mountain, the marine layer starts climbing the ridge, and a computer in the dome of the 48-inch Samuel Oschin Telescope throws away its plan for the night. Nobody is alarmed. The Zwicky Transient Facility loses pieces of its plan most nights, to clouds, to seeing, to a target-of-opportunity alert from a gravitational-wave detector. The scheduler was built for exactly this: it chops the night into thirty-minute blocks, assigns work to blocks by solving an integer program that maximizes how much sky gets searched per unit time, then inside each block solves a traveling-salesman tour so the telescope wastes as little time as possible slewing between targets (2019PASP..131f8003B, 340 citations, still in production). When the clouds come, it re-solves. It has been doing this since 2018, on a problem with the same shape as agent-fleet dispatch: hundreds of tasks with priorities, time windows, precedence, sequence-dependent switching costs, shared serial resources, fairness constraints across competing programs, and an environment that invalidates the plan several times a night. Thirty-five years of observatory operations have field-tested nearly every mechanism a software factory’s scheduler needs. The literature review below lays out that arc in detail.

That dome is a working model of what a software factory is trying to become. An observatory is a factory whose raw material is photons and whose product is measurements. It has a backlog: approved observation requests, each with a scientific priority, each waiting for its moment. It has agents: telescopes and instruments, some interchangeable, some specialized, each with a cost to start up and a cost to switch tasks. It has a hard budget that renews daily and cannot be banked, the dark hours between dusk and dawn, which are to an observatory what wall-clock compute capacity is to a fleet of coding agents. It has a review committee upstream deciding what deserves time, an unreliable environment that fails jobs through no fault of the work, and, in many facilities, one shared serial resource everybody’s output must eventually pass through. We keep calling the software systems agent orchestrators. Functionally they are online schedulers, and astronomy has been fielding online schedulers, under harsher constraints and with better bookkeeping, for thirty-five years.

The claim of this report: the seams Gas City deliberately left empty, the constants Gas City Packs, its reusable-configuration layer, currently fills with hand-tuned values, and the threshold predicates Agent-Oriented Architecture (AOA), a code-architecture measurement toolkit, uses as gates are, one for one, the surfaces that operations research solved in those production systems. The corpus survey found zero papers applying any of it to continuous-integration systems, merge queues, or agent fleets. The transfer is untraveled, the machinery is proven, and the insertion points already exist as configuration seams that require no Go edits until late in the adoption path.

Literature review

The corpus and how it was surveyed

The evidence base is a survey of the SciX/ADS corpus run as six parallel research agents, one per operations-research facet: linear and mixed-integer programming, network optimization, stochastic and dynamic programming, nonlinear programming with duality and optimality theory, modeling languages and solvers, and metaheuristics with search-based software engineering. The agents made roughly 195 corpus tool calls in total and anchored every finding to a bibcode. The question was narrow: what does the optimization literature in this corpus teach about running an automated software factory, meaning a fleet of coding agents plus the deterministic systems that manage a codebase and its architecture? Six findings frame the rest of this report.

Thirty-five years of observatory scheduling

The corpus’s production optimization domain is observatory and spacecraft scheduling, and it is structurally the same problem as agent-fleet dispatch. The arc runs from SPIKE’s constraint satisfaction for the Hubble Space Telescope (1990aisi.conf....5J) through the first production integer-linear-program telescope-network scheduler at Las Cumbres Observatory (2015arXiv150307170L), the Zwicky Transient Facility’s ILP (2019PASP..131f8003B, 340 citations, in production since 2018), and the 2021 to 2025 mixed-integer wave: the Deep Space Network scheduling antenna time with setup and teardown brackets and cross-mission fairness terms (2021arXiv211111628C), ALMA re-solving 5,000 to 10,000 scheduling blocks to optimality under dynamic conditions (2016A&C....15...90S), ZTF target-of-opportunity handling (2022ApJ...935...87P), and the UVEX and M4OPT work (2025PASP..137g4501S). Each of these systems schedules tasks with priorities, time windows, precedence, sequence-dependent switching costs, shared serial resources, fairness across competing programs, an environment that invalidates the plan without warning (weather, which plays the role that agent nondeterminism plays for a software fleet), and continuous replanning. Every element of the factory-scheduling problem has a deployed, published solution in this literature.

What a decade of operations settled

The survey’s most transferable results are negative and comparative, the kind that save years. Two great survey telescopes answered the same question, how much planning is enough, in opposite ways, and the disagreement itself is the lesson. The Zwicky Transient Facility is the planning monastery: a deterministic integer program solved fresh whenever conditions change, the whole night laid out block by block, provably good against its objective. Rubin Observatory’s LSST, whose survey is bigger and whose nights are more valuable, committed the opposite heresy and holds no plan at all, replacing the machinery with a memoryless feature-based policy (2019AJ....157..151N) that scores every candidate as a weighted sum of handcrafted features and re-decides at every step, absorbing weather loss for free because any state is a valid restart point. A decade of operations vindicated both approaches over scenario-tree stochastic planning, which appears in this literature only as a 2025 preprint (2025arXiv250403666R). Seen clearly, neither monastery is really a planner; both are closed-loop controllers that watch the sky, decide the next thing, and watch again, one closing the loop at the block boundary and the other after every exposure, and the architecture either one settles on is the one an agent fleet converges on once it stops treating a plan as a commitment and starts treating it as the current output of a control loop over live state. The lesson reads directly onto a fleet’s re-decision loops: cheap re-decision on current state beat explicit uncertainty modeling in every deployed system. The upgrade a software factory should chase is not “add a stochastic planner”; it is “make the re-decision informed.”

Two more results constrain any build. Bold and Goerigk’s compact robust resource-constrained project-scheduling formulation solves 93.1% of benchmark instances to proven optimality against 65.0% for an improved Benders decomposition, at 100 to 200 times the speed (2022arXiv220306983B); price-based Lagrangian decomposition (2022NatSR..1222417B) only pays off at genuinely large separable scale. A work queue of 100 to 10,000 items fits in one open-source solver process. And every production astronomy mixed-integer program runs anytime: hard time limit, ship the incumbent, treat the optimality proof as a luxury. The target-of-opportunity scheduler MUSHROOMS caps at 500 seconds and accepts 2 to 11% optimality gaps where proofs do not close (2022ApJ...935...87P). The plan will be stale before the proof lands; the observatories stopped paying for proofs years ago.

Two results constrain the objective and its gates. Weighted-scalar fitness is empirically wrong and Pareto sets are right: Chen, Li, and Yao showed a weighted-sum genetic algorithm converges to points that Pareto search dominates (2020arXiv200108236C), and Dunbar showed even dual bounds for multi-objective integer programs must be bound sets, not scalars (2023arXiv230908801D). Any single “architecture health score” repeats a documented mistake. And Goodhart’s law is documented here with its fix attached: at Adyen, across 5.5M lines of code, search operators learned to game the modularity metric monotonically by moving single classes into fresh modules, metric improvement did not predict developer acceptance, and human review had to be the real gate (2021arXiv210200701S). Deterministic metric gates select candidates; an independent judge that was not the optimization target accepts them.

A reference architecture the deployed systems imply

Read together, the deployed systems imply a four-layer architecture, each layer grounded in a system from the survey.

The first layer is a declarative constraint core, the algebraic-modeling-language pattern that Pyomo (2009orci.book....3H) and JuMP (2015arXiv150801982D) exist to provide, with a solver-agnostic intermediate representation between model and solver (2020arXiv200203447L). Rules and scheduling policy live in a declarative model; queue and repository state is the data instance; agents regenerate the data every cycle and touch the model rarely. MCP-Solver (2025arXiv250100539S) is the existence proof for the write path: a language model edits a MiniZinc model item by item, every edit validated before acceptance, solve strictly separated from edit, model state held server-side. On infeasibility, an exact solver emits an irreducible infeasible subsystem, the minimal conflicting constraint set, so the agent’s job reduces to proposing which rule to relax. Solver logs of bounds, gaps, and timing are the audit trail a model’s judgment cannot provide: reproducible and appealable.

The second layer is planning in epochs by a compact anytime mixed-integer program, warm-started. Re-solve on every queue event under a hard time limit and accept the incumbent; freeze in-flight agent sessions as fixed constraints, the way ALMA treats a scheduling block as atomic. The reoptimization regime is literally “same formulation, perturbed data every tick,” which the MIPcc23 competition (2023arXiv231114834B) defines and scores, and it measures schedule stability as a first-class quantity rather than a hope. Several formulation pieces lift over with almost no translation: reservation-start binaries with occupancy maps for merge-queue and CI-slot booking (2015arXiv150307170L); a two-level assignment-then-sequencing decomposition to batch work into agent sessions and order it inside each session to minimize context-switch cost (2019PASP..131f8003B); disjunctive interval constraints with an order binary to treat file-set conflicts as a scheduling constraint the solver plans around rather than a pessimistic lock (2025PASP..137g4501S); and setup and teardown brackets with fairness terms balancing satisfaction across programs (2021arXiv211111628C). The work-item dependency graph is a multi-mode resource-constrained project schedule, where the modes are model-tier choices with different duration and cost, and budgeted uncertainty guards the makespan against “at most a bounded number of items blow up simultaneously” rather than all-worst-case (2022arXiv220306983B).

The third layer is dispatch between epochs by a memoryless feature policy. Naghib’s LSST scheduler (2019AJ....157..151N) scores each ready task as a weighted sum of handcrafted features (age, expected cost, retry count, dependency criticality, historical success by task-type and tier) and tunes the weights by black-box optimization against replayed traces. Evaluation costs microseconds, and any state is a valid restart point, so the same property that made it robust to weather loss makes it robust to agent crashes. Deadline-sensitive queues get a Whittle index, a single near-optimal priority scalar per task trading urgency against completion probability (2016arXiv161000399Y).

The fourth layer treats agents as mutation operators inside a deterministic selection loop. The automated-program-repair pattern (ARJA, 2017arXiv171207804Y) has agents propose edit scripts and a deterministic evaluation select on tests plus Pareto objectives including diff size. PIKAIA’s convergence detector, population fitness contrast driving the mutation rate (1995ApJS..101..309C), is a ready-made premature-convergence alarm: when parallel attempts collapse onto the same local fix, raise the temperature through prompt variance, model mix, or fresh context seeds. And gravitational-wave searches run multiple independent particle swarms specifically to bound the probability of missing the global peak (2010PhRvD..81f3002W), which is the quantitative argument for the fleet’s diverge flow, several independent no-crosstalk agent attempts on uncorrelated context, merged only at selection by its converge counterpart.

Economics runs across all four layers. Budgeted bandits route tier and strategy choices, where each pull has random cost in tokens and wall-time and random reward in landed fixes, and the objective is to maximize merges before the budget is exhausted (2020arXiv200300365C; 2019arXiv190407272S). Shadow prices rank which binding constraint to relax next, but they are local marginal quantities, so the discipline is relax, re-solve, repeat, and never extrapolate a multiplier over a finite budget change (2022arXiv221103591K). Capacity planning is adaptive two-stage stochastic programming, a committed baseline plus one revision point after observing early demand, whose gap bounds say the cheap two-stage structure captures most of full multistage’s value when demand drifts slowly (2019arXiv190603513B); reserve-plus-burst is the two-settlement demand-response Markov decision process (2016ecc..conf..204R), and the useful lookahead depth has a computable answer, the shortest horizon meeting a target optimality gap (2021arXiv210204874S). When full CI is the expensive fitness call, surrogate-guided evaluation spends real CI only on predicted-best candidates (2017arXiv170505018N) or runs test subsets and extrapolates (2016arXiv160507079K).

The codebase itself as an optimization problem

The survey also treats the managed codebase as a feasible region: valid architecture states under layering rules, size caps, coverage floors, dependency-direction acyclicity, and budgets. Local cleanup versus restructuring is local versus global optimization, and the chemical-physics energy-landscape corpus is the underexploited source on when greedy search fails. Funnel topography predicts difficulty (2000cond.mat..7338D): a single-funnel codebase improves safely under greedy local cleanup, while a multi-funnel one, several plausible decompositions separated by large-diff barriers, traps greedy agents in locally-clean-but-globally-wrong states. Basin-hopping (1998cond.mat..3344W) is the protocol for crossing a barrier: take a deliberately disruptive perturbation, immediately run local cleanup, then accept or reject on the post-cleanup score, never the raw perturbed one. For the graph structure, community detection proposes module and ownership boundaries, and the algorithm choice matters because Louvain can emit disconnected communities, nonsense as package boundaries, while Leiden guarantees connectivity (2019NatSR...9.5233T); refactoring via community detection is published practice (2018arXiv181110171R). Boundary placement between two subsystems is a minimum-cut query, and the almost-linear max-flow result (2022arXiv220300671C) makes per-commit min-cut affordable at monorepo scale. Edit scripts, not target states, are the representation three literatures converged on independently: academic remodularization (2020arXiv200506510W), the Adyen work (2021arXiv210200701S), and program repair (2017arXiv171207804Y). And the DALiuGE dataflow scheduler (2018arXiv180507568W) supplies the caution that partitioning the whole static graph is wasteful and ill-posed, because only the temporal working set matters: the unit of architecture optimization is the active frontier under an agent’s context capacity, not the global dependency graph.

The evaluation discipline and the open ground

The survey’s most portable findings are about evaluation, not any single formulation. Decima’s variance-reduction trick (2018arXiv181001963M) generalizes past reinforcement learning entirely: when comparing two dispatch policies on an input-driven system, replay the identical recorded arrival trace under both, because otherwise arrival noise swamps the policy signal. SWAY (2016arXiv160807617C), random oversampling plus recursive halving, matches evolutionary search at orders of magnitude fewer evaluations and was proposed as the mandatory baseline precisely because clever optimizers embarrassingly often tie it. Las Cumbres validated its scheduling kernel on constructed instances with known optima, oversubscribed and undersubscribed regimes both, before trusting it. Exact solvers give trustworthy negative results: in Handley’s runs the heuristic reported infeasibility on 7 of 360 instances, six were genuinely infeasible, and on the seventh the mixed-integer program proved a feasible schedule the heuristic had silently missed (2024AJ....167...33H). And across an independent astronomy result, a genetic algorithm and a tuned local search tied, and the scientific policy encoded in the fitness function decided the outcome (2003A&A...403..357G): version the policy like code.

The open ground is wide. The survey found no in-corpus paper applying mixed-integer programming, stochastic programming, restless bandits, or minimum-cut to continuous-integration systems, merge queues, agent fleets, or architecture decomposition; the nearest neighbors are datacenter reinforcement-learning schedulers (Decima) and search-based remodularization (Adyen). The mixed-integer formulation of agent-fleet dispatch with model tiers as modes, flow-based module-boundary placement, irreducible-infeasible-subsystem-driven rule-conflict diagnostics in a development-infrastructure loop, restless-bandit merge-queue prioritization, and chance-constrained service-level gates for CI are each claimable rather than citable.

Observatories are only physical instances of what operations research has worked on for the better part of a century: online scheduling, stochastic and robust optimization, fair division, bin packing under deadlines. Almost none of it has been within arm’s reach of the people building orchestrators. The astronomers reached for it because a night is finite and expensive and they had no other option; a software factory has the same structure and, so far, less of an excuse. The right reading list for someone building a software factory is the same thirty-five years of scheduling papers the astronomers already read. The remainder of this report maps those proven mechanisms onto the specific seams of one running system.

Three systems externalize policy; none optimizes it

The least flattering pattern in the observatory literature is also the most familiar to anyone who builds infrastructure. Las Cumbres built a production integer-program scheduler in 2014 (2015arXiv150307170L), the Zwicky Transient Facility built one in 2018 (2019PASP..131f8003B), and group after group has rebuilt recognizably the same slot-assignment program from scratch, teams who share conferences, journals, and in some cases hallways. Every dome reinvented the scheduler for the same reason every company reinvents the build system: it looked like glue between the real work rather than a product worth building once and sharing. The first deliberately multi-mission, open-source scheduling framework arrived only in 2025 (2025PASP..137g4501S). The software-factory ecosystem is speed-running the same pattern, every orchestration project hand-rolling its own priority heuristics, its own retry logic, its own capacity math, none of it cross-communicated, most of it unexamined. The correction, when it comes, is to design the scheduler as a shared declarative product before noticing the fifth reimplementation, and the machinery below is what that product externalizes rather than hard-codes.

Gas City follows the design rule that application code does transport, not reasoning, so if a line of code contains a judgment call, it is a violation. Scheduling policy is therefore pushed out through shell interfaces (the work query, the dispatch query, the scale check, the scheduled controller task check, and the gate condition) and prompt text, where it lands as either transport-grade first-come-first-served or model reasoning. Gas City Packs enforces the same split at the policy level: its scripts are plumbing, and semantic decisions belong in declarative workflows and prompts. What actually fills the interfaces today is a set of constants and switches: a cap of five active sessions per worker pool, a single active slot for the merge-integration stage, scheduled controller task backoff capped at 300 seconds, a two-way metadata switch in the dispatch formula that routes “criteria-only” work to one model and “prescriptive” work to another, lexicographic sort keys in pull-request triage (“priority label, then recency”), and a wake budget of five sessions per controller cycle.

AOA is the same story at the measurement layer. It computes four real metrics from agent traces (retrieval locality, edit locality, invariant discoverability, and mutation surface), then makes every decision with a threshold predicate or a lexicographic sort: audit findings rank by tier, descending measured cost, and title; migrations are admitted one at a time when held-out improvement is positive and the reward-hacking gap does not widen; and the top-level gate is a majority vote over at least five repositories. A targeted search across the project workspace finds no scheduling, routing, bandit, or multi-objective machinery at all.

None of this is an accident, and the fix is not to violate the transport-only invariant. That invariant’s own allowed list includes deterministic math, policy enforcement, and mechanical transforms. A priority index computed from declared features, a mixed-integer program solved over declared constraints, a bandit updating declared posteriors: these are deterministic mechanisms over versioned data, closer in spirit to clamping a desired value between a min and a max than to a hidden heuristic. The judgment stays where the invariant wants it, in what the model writes into the model; the solving becomes transport. The Bitter Lesson test passes for the same reason: solvers such as HiGHS, SCIP, and CP-SAT improve on their own compute curve independent of the language model, and the model’s role in the loop, authoring and revising the declarative model, gets better as models improve. There is already a published existence proof of exactly this division of labor: MCP-Solver (2025arXiv250100539S) has a language model edit a MiniZinc model item by item, every edit validated before acceptance, solve strictly separated from edit, model state held server-side. That is the write path the invariant wants, built by someone else, fourteen months ago.

Dispatch: a priority index in the work-query seam

The lowest-friction insertion in the entire stack is replacing tier 3 of the effective work query with a ranked claim. This is a pure configuration change by Gas City’s own design because the dispatch configuration is fully overridable per agent, and the replacement policy is Naghib’s LSST scheduler transplanted: score each ready work item as a weighted sum of features (age, priority, dependency criticality measured as downstream unblocked work, expected cost for this task class, retry count, historical success rate for task-type and model tier), claim the argmax, and tune the weights offline by black-box optimization against replayed queue traces. Evaluation costs microseconds, no transition model is needed, and the policy inherits the crash-robustness property that made it survive weather: a worker that dies mid-claim leaves a state from which the next claim is just as valid.

Deadline-shaped work wants one refinement. Yu, Xu, and Tong showed that scheduling jobs with deadlines and stochastic service times decomposes into a per-job Whittle index, a single priority scalar that near-optimally trades urgency against completion probability (2016arXiv161000399Y). The work-item data model currently carries an optional priority and nothing temporal, which is the one schema gap worth closing early: a due-date metadata key, or a first-class field, is the prerequisite for any urgency-aware index and costs nothing to add now.

Epoch planning: the work-item graph is a resource-constrained project schedule

When two neutron stars collide and a gravitational-wave detector issues an alert, the follow-up scheduler has seconds, not minutes, to choose which fields to image before the kilonova fades. ZTF’s target-of-opportunity solver caps at 500 seconds; across 951 simulated alerts most reached proven optimality inside the limit, and the rest shipped whatever the best-found schedule was when the clock ran out, a 100-second cap costing only 64 truncated solves (2022ApJ...935...87P). Every production scheduler in this literature follows that pattern: a hard time cap, the incumbent taken as the answer, the optimality certificate treated as a luxury nobody waits on. A plan a few percent off but in hand now beats a perfect plan for a night that has already changed. The software factory inherits the constraint exactly. The epoch planner gets a deadline measured in seconds, ships the best schedule it found, and nobody waits on a proof, because the merge queue, like the sky, keeps moving.

Between claims, the software factory periodically wants a plan, and the work-item graph is literally a resource-constrained project-scheduling instance: activities with finish-to-start precedence (declared dependencies), renewable resources (agent seats per pool, integration-stage slots, CI runners), and non-renewable budgets (daily tokens). The multi-mode variant maps model-tier routing into the same solve: each item offers modes (a heavier model, a mid model, a cheaper model, an external model) with different duration and cost, and the solver picks mode and schedule jointly, which turns the dispatch formula’s two-way routing switch into data. Duration uncertainty gets the Bertsimas-Sim budgeted treatment, guarding the makespan against “at most a bounded number of items blow up simultaneously” instead of the useless all-worst-case (2022arXiv220306983B). The natural host is a scheduled controller task on a cooldown trigger, recomputing assignments each epoch and re-dispatching; the scheduled-task mechanism already exists and runs without an agent on each controller cycle.

Three formulation pieces from the observatory papers drop in with almost no translation. Lampoudi’s reservation-start binaries, where a variable equal to one means reservation i starts at slot k and an occupancy map enforces one reservation per resource-slot, model the merge queue and CI-slot booking in a number of constraint rows linear in reservations plus slots (2015arXiv150307170L); the merge-integration stage’s single-slot lock becomes a capacity row instead of a lock. Singer’s disjunctive interval constraints, requiring two intervals to be separated by at least a gap with an order binary (2025PASP..137g4501S), turn project-workspace conflict avoidance from today’s pessimistic serialization (one project workspace per item, then the merge-integration stage serializes every merge) into a constraint the solver plans around: two items whose file sets overlap simply must not overlap in time, and the solver decides who goes first by what the objective prefers. And ZTF’s two-level decomposition, an assignment integer program over 30-minute blocks followed by an exact tour within each block, is the template for session batching: assign items to agent-session blocks, then order work inside the session to minimize context-switch cost, because a warm project workspace, a loaded repository map, and cached build state are slew time under another name.

The operational discipline comes from ALMA and the MIPcc23 reoptimization competition. ALMA re-solves on every condition change but treats an in-flight scheduling block as atomic; the factory equivalent freezes running sessions as fixed constraints and never preempts them. MIPcc23 (2023arXiv231114834B) defines the warm-start regime the factory lives in, one formulation with perturbed data every tick, and its scoring makes schedule stability a measured quantity rather than a hope, which matters because a planner that reshuffles everyone’s assignments every epoch is worse than first-come-first-served in practice even when its makespan is better on paper.

Capacity is a queueing problem; tier routing is a budgeted bandit

NASA’s Deep Space Network schedules a handful of giant antennas against every active deep-space mission, including a spacecraft launched in 1977 that needs several antennas arrayed together just to be heard. Its scheduling model does not stop at throughput: alongside the visibility windows and the setup-and-teardown time bracketing every track, it writes fairness down as math, explicit terms balancing each mission’s share of satisfied time, validated against a real week of operations (2021arXiv211111628C). Most orchestrators expose priorities and queues and stop there; fairness, if it appears at all, emerges from tuning rather than from anything the optimizer is required to honor. The failure this prevents is familiar to anyone who has watched an agent fleet: one urgent epic arrives, every worker in the pool feeds it for days, and maintenance work rots while a smaller project’s tracked issues age past relevance. The defense in most systems is a human noticing. In the Deep Space Network’s formulation the defense is a coefficient, and a schedule that starves the small program pays for it in the objective, visibly, instead of hiding it in a queue nobody audits. The same model carries the rest of the session economics: setup and teardown are the clone-and-context-load tax, minimum track durations exist because a session too short to do useful work still pays full spin-up cost, and arraying several antennas on one oversized request is several agents co-assigned to one epic under a single completion constraint.

The scale-check interface currently implements a proportional controller with no plant model: desired equals queue length. Merge and review pipelines run intentionally hot, and the regime for sizing intentionally-hot service systems is heavy-traffic queueing, including the recent variant where service-time distributions themselves are unstable (2022arXiv220405733A), which is the honest description of agent runtimes across model versions. The concrete near-term wins are cheaper than that machinery suggests: hysteresis and dwell times for the unimplemented anti-flapping cooldowns, and a two-settlement structure for capacity, a committed baseline plus burst recourse, which is structurally the demand-response aggregator Markov decision process (2016ecc..conf..204R) and, in its simplest form, an adaptive two-stage stochastic program whose bounds say one revision point captures most of the value of full multistage planning when demand drifts slowly (2019arXiv190603513B). The static constants worth promoting to adaptive control are already enumerable: the wake budget of five per controller cycle, and the fixed stop and interrupt counts per lifecycle wave.

Tier routing has a stronger claim waiting. The pricing module already produces per-invocation cost estimates and is explicitly scoped as decision support; nothing consumes it for decisions. Each (task-class, tier) pair is an arm with random cost in tokens and wall-time and random reward in merged outcomes, and maximizing merges before the budget dies is the budget-constrained bandit objective exactly (2020arXiv200300365C; knapsack-bandit chapter of 2019arXiv190407272S). Thompson sampling on reward-per-cost replaces the static routing table, degrades gracefully to it under thin data, and inherits AOA’s construct-validity discipline for free: the reward definition (“merged and not reverted within N days”) is a declared, versioned choice, advisory until its correlation with an external outcome is confirmed, exactly as AOA’s construct module already does for metrics.

Acceptance gates: noisy constraints, documented Goodhart, unwired finalizer

The system has a sanctioned interface waiting for a deterministic acceptance rule: the review-quorum finalizer defines the durable verdict contract but is not yet invoked when declarative workflows are assembled. Two survey results say what to put there. First, gate signals are noisy, because flaky tests, nondeterministic benchmarks, and model-judge scores are noisy evaluations of the underlying constraint, and the noisy sequential-quadratic-programming literature (2021arXiv211004355O) supplies acceptance criteria that do not thrash on measurement noise; a verdict rule that requires signal exceeding a noise-calibrated margin, rather than a single reading, is the direct transfer. Second, the acceptance predicate should be dominance, not a scalar. Chen, Li, and Yao showed weighted-sum fitness converges to points that Pareto search dominates (2020arXiv200108236C), and AOA’s own “good” label (improves held-out pass and holds or shrinks the reward-hacking gap) is already a two-objective dominance check; the system-wide version keeps tests, diff size, coverage delta, and review findings as a vector and accepts on dominance within tolerance.

The Goodhart evidence deserves standing citation because it is the strongest empirical support for a design decision all three systems already made. At Adyen, 5.5M lines of code, search operators learned to game the modularity metric monotonically by moving single classes into fresh modules, metric improvement did not predict developer acceptance, and developer review had to be the real gate (2021arXiv210200701S). Metric gates select candidates; an independent judge that was not the optimization target accepts them, which is the job the fleet’s stress-test flow does before a sensitive change ships, an adversary run whose only mandate is to break the candidate. The merge-integration stage’s reject-to-pool loop, the pull-request-ship workflow’s three-iteration convergence cap, and AOA’s held-out conditioning are all instances of the same defense, now with a published industrial failure mode behind it.

The redundant-independent-attempts stance, where redundant independent attempts are the reliability mechanism and premature convergence is intentionally tolerated, also picks up quantitative footing here. The fleet already runs it as a pair of named flows: diverge fans out N independent agents on uncorrelated context windows so their errors do not correlate, and converge takes the divergent findings into a structured debate that selects and merges only at the end. Gravitational-wave searches run multiple independent particle swarms specifically to bound the probability of missing the global peak (2010PhRvD..81f3002W), which is the argument for that fan-out, N no-crosstalk attempts merged only at selection, stated with a number attached; and PIKAIA’s convergence detector, population fitness contrast driving the mutation rate (1995ApJS..101..309C), is a ready-made alarm for the exact failure mode diverge exists to prevent, where the parallel attempts have all collapsed onto the same local fix and the fleet should raise its temperature through prompt variance, model mix, or fresh context seeds.

Agent-Oriented Architecture supplies the objective vector; OR hardens its gates

The relationship between AOA and the optimization layer runs both directions. Forward: AOA’s four metrics are the best available candidates for what the system’s architecture-management objective vector should contain, because they are trace-grounded measurements of agent-legibility rather than proxies for human taste, and they come with declared parameters (the retrieval cutoff, mutation depth, floor and ceiling) already emitted as data. A boundary-placement optimizer needs edge weights; retrieval and edit locality, computed per module from real traces, are principled coupling weights for the graph work in the next section, which is a materially better story than co-change counts alone.

Backward: AOA’s own premortem flow, six independent failure-lens agents each writing a prospective postmortem (“it is six months out and the project failed”) without seeing the others, returned a central finding, all six lenses breaking the same single blocking gate, with the shared theme that declaring the over-approximation as data makes ambiguity visible without making verdicts robust; that is a problem with known operations-research shapes. A majority vote over five repositories is a point verdict; the alternatives are interval verdicts with certificates. Duality gives bounds (this migration’s held-out improvement is at least X under the declared weights, at most Y under the adversarial ones); flat-truncation-style certificates (2011arXiv1106.2384N) model the pattern of proving a verdict insensitive to the contested parameter choices rather than asserting it; and the rankings-flip-under-floor-versus-ceiling failure is precisely what reporting a dominance region instead of a scalar rank prevents. The migration roadmap’s one-at-a-time admission policy (never batch, each candidate admitted only on the “good” label) is a sequential decision process currently run as a fixed ordering; with reward equal to the good label and cost equal to evaluation spend, it is a budgeted bandit over the candidate fix set, and the exploration it adds is exactly what a fixed ordering forecloses.

One correspondence is close enough to be checked rather than argued. AOA’s budget module enforces a token ceiling over the transitive closure of context files; the SKA’s DALiuGE scheduler (2018arXiv180507568W) partitions a dataflow graph under the constraint that concurrently-active resource demand per partition stays under node capacity, and its published negative result is that partitioning the whole static graph is both wasteful and ill-posed because only the temporal working set matters. Same constraint, same warning: the unit of architecture optimization is the active frontier of the repository under an agent’s context capacity, not the global dependency graph.

Architecture management: cluster with Leiden, place boundaries with min-cut, restructure like basin-hopping

For the codebase itself, the survey’s graph results give the deterministic half of an architecture loop. Community detection over the symbol and file dependency graph, weighted by AOA’s locality metrics, proposes module and ownership boundaries; the algorithm choice matters because Louvain can emit disconnected communities, which as package boundaries are nonsense, while Leiden guarantees connectivity (2019NatSR...9.5233T), and refactoring via community detection is published practice (2018arXiv181110171R). Boundary placement between two specific subsystems is a minimum-cut query, and the almost-linear max-flow result (2022arXiv220300671C) makes per-commit min-cut affordable at monorepo scale; the survey found no paper applying flow-based boundaries to software, so this transfer is claimable. Edit scripts, not target states, are the representation for the resulting refactoring plans, a choice three literatures converged on independently (remodularization, Adyen, program repair 2017arXiv171207804Y) because incremental fitness on diffs is cheap and plans map one-to-one onto reviewable pull-request-sized changes, which is also the representation AOA’s migration plans already use.

For restructuring that greedy agents cannot reach, the chemical-physics energy-landscape corpus is the underexploited source. Funnel topography predicts difficulty (2000cond.mat..7338D): a single-funnel codebase improves safely under greedy local cleanup, while a multi-funnel one, several plausible decompositions separated by large-diff barriers, traps greedy agents in locally-clean-but-globally-wrong states. Basin-hopping (1998cond.mat..3344W) is the protocol for crossing: take a deliberately disruptive perturbation, immediately run local cleanup, and accept or reject on the post-cleanup score, never the raw perturbed one. That acceptance rule is the principled version of “let an agent attempt the big move, then judge the cleaned-up result,” and it is what justifies temporarily holding a worse intermediate state inside a multi-step workflow whose gate only fires after the cleanup step.

Gas City Packs already separates model from data; add the solver and the certificates

Gas City Packs has, without naming it, rebuilt the algebraic-modeling-language pattern that Pyomo and JuMP exist to provide (2015arXiv150801982D): declarative manifests and workflow variables hold the model, project-workspace state holds the data, executable code is forbidden from holding policy, and composition is by import. What is missing is the two things a modeling language buys beyond structure. The first is a solve step: the constants in the agent configuration and the routing predicates in workflows become decision variables and constraints the epoch solver reads, so a cap like “five active sessions” stops being a hand-tuned guess and becomes either a solver output or a declared hard constraint with a known shadow price. The second is infeasibility certificates. When the declared rules admit no schedule, an exact solver emits an irreducible infeasible subsystem, the minimal conflicting constraint set, turning “the system is stuck” into “these three rules cannot hold simultaneously; relax one.” Configuration-name collisions already fail with a clear diagnosis (a collision, not a composition); an irreducible infeasible subsystem extends that courtesy to every policy conflict, and the survey found this technique underused even among operations-research practitioners, so a system that surfaces conflict certificates routinely is ahead of the field that invented them. Solver logs complement the event bus the same way: bounds, gaps, and timing per decision, replayable and appealable, where model judgment offers neither.

Shadow prices close the economics loop, with the documented caution attached. At an epoch optimum, the dual on each binding constraint prices what relaxing it buys: another merge-integration-stage slot, another CI runner, another point of token budget. Khabarov showed extrapolating those multipliers over finite changes produces an arbitrary number (2022arXiv221103591K), so the discipline is relax one constraint, re-solve, read the new prices; the factory gets a principled answer to “what should we buy next” without ever trusting a multiplier beyond the margin.

Evaluation: replay fixed traces and beat the dumb baseline first

A telescope gets each patch of sky exactly once, which is why survey teams lean so hard on simulators: the only way to test a scheduler against last year’s conditions is to synthesize them, because the real sky is gone. This is the one door the astronomers cannot walk through and a factory can. A software factory records every arrival, every claim, every outcome, most of it already sitting in audit ledgers kept for other reasons: each work item’s arrival time and priority, which worker claimed it and when, how long it ran, what it produced, whether review accepted it. That ledger is an experimental instrument. Replay an identical recorded week under two dispatch policies with the arrival trace held fixed, and whatever differs between the runs is the policy, because the arrivals need no simulator; they were captured the first time. Unlike the sky, your nights will hold still while you measure them.

Nothing above should ship on argument alone, and the survey’s most portable finding is the evaluation discipline, not any formulation. Decima’s variance-reduction trick (2018arXiv181001963M) generalizes past reinforcement learning entirely: when comparing two dispatch policies on an input-driven system, replay the identical recorded arrival trace under both, because otherwise queue-arrival noise swamps the policy signal. The system records everything needed for this already; the work items and the event bus are the trace. The second gate is SWAY (2016arXiv160807617C): random oversampling plus recursive halving matches evolutionary search at orders of magnitude fewer evaluations across search-based-software-engineering benchmarks, and its authors proposed it as the mandatory baseline precisely because clever optimizers embarrassingly often tie it. Every claim that the mixed-integer program or the bandit beat first-come-first-served must also report the margin over a trivially-tuned priority queue on the same replayed traces. Third, Las Cumbres validated its scheduling kernel on constructed instances with known optima, oversubscribed and undersubscribed regimes both, before trusting it; the factory’s scheduler deserves the same fixture set. And exact methods earn their keep on negatives: in Handley’s runs the heuristic failed to schedule 7 of 360 instances; six were genuinely infeasible, and on the seventh the mixed-integer program proved a feasible schedule the heuristic had silently missed (2024AJ....167...33H), which is the same silent-loss class as the dispatch-drop risk the config-layer architecture already flags. Solvers certify; heuristics shrug.

What not to build

The negative space is as load-bearing as the proposals. No scenario-tree stochastic planner: the deployed systems that faced the most quantifiable uncertainty in this literature chose deterministic re-solve or memoryless policies, and the factory should exhaust those before touching recourse models. No Benders or price decomposition before a compact model has actually hit a wall; at work-queue scale the monolith wins by two orders of magnitude. No solver in the hot loop: the index dispatches in microseconds, the mixed-integer program runs on epochs with a hard time limit and ships incumbents. No scalar architecture-health score, ever; the weighted sum has a published failure mode and AOA’s dominance-shaped “good” label is already the right pattern. No shadow-price arithmetic beyond the margin. No commercial-solver dependency: the astronomy literature runs almost entirely on Gurobi academic licenses and never benchmarks alternatives, a reproducibility monoculture worth not importing when HiGHS, SCIP, and CP-SAT are open, strong, and consistent with a no-paid-API posture. And no belief in any of it without the replay harness; the evaluation section is a prerequisite, not an appendix.

Adoption in four phases, config-first

Phase	Change	Seam	Code touched
0	Trace replay harness; deadline metadata; SWAY and FCFS baselines; known-optimum fixture instances	work items plus event bus (read-only)	none (tooling only)
1	Feature-based priority index replacing FCFS claim; weights tuned on replayed traces	work-query / dispatch-query interface in the dispatch configuration	none (configuration plus one scoring script)
2	Epoch mixed-integer program (RCPSP plus reservation binaries plus disjunctive project-workspace windows plus tier modes), anytime, warm-started; stability scored	scheduled controller task; merge-integration-stage capacity as constraint rows	new scheduled controller task plus solver sidecar (HiGHS/CP-SAT)
3	Budgeted-bandit tier router fed by the pricing module; deterministic quorum finalizer with noise-margin verdicts	workflow variables or session setup; the review-quorum finalizer	Go: wire finalizer, add routing hook
4	Architecture loop: Leiden and min-cut boundaries weighted by locality metrics; basin-hopping restructure protocol; irreducible-infeasible-subsystem surfacing for policy conflicts	metrics pipeline plus migration plans	new analysis tooling; metrics stay measurement-side

Phases 0 and 1 are deliberately boring: they change no Go, they produce the measurement substrate everything later is judged against, and phase 1 alone, on the observatory evidence, is where most of the value of “informed re-decision over FCFS” lives. Each subsequent phase is admitted the way the toolkit admits migrations, one at a time, on replayed-trace evidence against the phase-0 baselines, never batched.

The open experiment is the one the toolkit already knows how to frame. Its top-level question asks whether repository structure moves agent outcomes more than harness choice does; the scheduling analog asks whether solver-informed dispatch moves factory throughput and latency more than the dumb baseline does, on identical replayed traces, across enough recorded weeks to power the comparison. The corpus says nobody has published that experiment for software factories. The instruments to run it are three config files and a replay script away.

Assembled, the four phases are one closed-loop controller, the shape both observatories converged on: observe the queue and the repository, plan an epoch under a deadline, dispatch and execute between epochs, measure the outcome, and re-decide. The plan is never the commitment; it is the current output of the loop, discarded and recomputed the moment the state moves, which is the whole reason ZTF can throw away its night at 20:47 and lose nothing.

Where the implementation stands (2026-07-11)

Phase 1 has a complete, ready-to-implement design spec as of July 11: a priority-index dispatch policy in the work-query interface. The spec re-verified this report’s premises against the current codebase and sharpened two of them. The interface has moved from the general dispatch configuration to the dedicated work-query configuration, and a custom work query replaces the full three-tier discovery contract, not just tier 3, so the scoring script reproduces the crash-recovery and pre-assigned tiers verbatim and changes claim order only. The claim contract turns out to be exactly “first eligible element of the JSON array the script prints,” which means the entire dispatch policy is the sort order of that array.

The score is Rubin’s shape transplanted without modification: a weighted sum where declared priority carries weight 1.00 and the secondary features (due date, unblocking value, age) carry 0.10, 0.08, and 0.06, each normalized to the unit interval from fields the ready-work query already returns. The initial weights encode a band-dominance invariant: adjacent priority bands sit 0.25 apart and the secondary weights sum to 0.24, so declared priority strictly dominates and the index only reorders within a band, which is where FCFS was actually leaving value (an aged, heavily-blocking, due-tomorrow item sitting behind a fresh isolated one). The missing deadline field lands as a due-date metadata convention read only by the scoring script, never enforced. Rollout is three gated stages: shadow mode (log what would have been claimed, change nothing), a one-project canary, then fleet, each admitted on replayed-trace evidence, and FCFS is a point in the weight space, so the tuned index can only lose to it by overfitting, which the temporal holdout catches.

Phase 0 is the current frontier. The system’s event bus holds about 7.5 weeks of full work-item snapshots (2026-05-19 onward), enough to replay recorded arrivals under FCFS, a trivially-tuned priority sort, and the index on identical traces, reporting priority-weighted flow time, unblocking-value throughput, and per-class p95 tails. That replay harness is the first artifact to build: it gates everything else, produces the baseline numbers this factory has never measured, and needs no approvals to run read-only. Nothing is in production yet; dispatch fleet-wide today is still the one-line FCFS this report opened with.

---

References

The literature review above is the survey in full; it draws on a survey of the SciX/ADS corpus run as six parallel research agents across the operations-research facets. Every bibcode resolves at NASA ADS.

Key bibcodes, resolvable at ADS: 1990aisi.conf....5J (SPIKE/HST), 1995ApJS..101..309C (PIKAIA GA), 1998cond.mat..3344W (basin-hopping), 2000cond.mat..7338D (funnel topography), 2003A&A...403..357G (policy-in-fitness), 2009orci.book....3H (Pyomo), 2010PhRvD..81f3002W (independent-swarm PSO), 2011arXiv1106.2384N (flat-truncation certificates), 2015arXiv150307170L (Las Cumbres ILP), 2015arXiv150801982D (JuMP), 2016A&C....15...90S (ALMA), 2016arXiv160507079K (FABOLAS), 2016arXiv160807617C (SWAY), 2016arXiv161000399Y (deadline restless bandits), 2016ecc..conf..204R (two-settlement MDP), 2017arXiv170505018N (FLASH surrogate), 2017arXiv171207804Y (ARJA), 2018arXiv180507568W (DALiuGE), 2018arXiv181001963M (Decima), 2018arXiv181110171R (remodularization via community detection), 2019AJ....157..151N (LSST feature scheduler), 2019PASP..131f8003B (ZTF ILP), 2019arXiv190407272S (bandits survey), 2019arXiv190603513B (adaptive two-stage SP), 2019NatSR...9.5233T (Leiden), 2020arXiv200108236C (SBSE weighted-sum failure), 2020arXiv200203447L (MathOptInterface), 2020arXiv200300365C (budgeted bandits), 2020arXiv200506510W (academic remodularization), 2021arXiv210200701S (Adyen remodularization), 2021arXiv210204874S (lookahead depth), 2021arXiv211004355O (noisy SQP), 2021arXiv211111628C (DSN MILP), 2022ApJ...935...87P (MUSHROOMS), 2022NatSR..1222417B (SLBLR), 2022arXiv220300671C (almost-linear max flow), 2022arXiv220306983B (compact robust RCPSP), 2022arXiv220405733A (high-uncertainty heavy traffic), 2022arXiv221103591K (shadow-price caution), 2023arXiv230908801D (multi-objective dual bound sets), 2023arXiv231114834B (MIPcc23 reoptimization), 2024AJ....167...33H (Traveling Telescope Problem), 2025arXiv250100539S (MCP-Solver), 2025PASP..137g4501S (UVEX/M4OPT), 2025arXiv250403666R (scheduling under night-loss uncertainty).