WeAreDevelopers × BAND · Dark Factory · tablekeeper

Coord
Nobody grades their own work.

Anyone can get an AI agent to write code. The hard part is trusting what comes back. Coord is a four-seat software factory in BAND Desktop. It built Tablekeeper, a restaurant-reservation service, from one human message, and every stage was accepted on an exact commit by a seat that never wrote it.

Repository FACTORY.md The BAND room (room.json) Final report
4 / 4stages accepted, each on an exact commit
5 h 19 mfrom the single dispatch to the last acceptance
2,173independent tests written from the spec
2 → 0real defects rejected by Gate, then fixed
0human messages after the dispatch

Four seats, one rule

Coordinator

Turns each spec into a numbered requirements ledger (105 obligations for stage 1) and routes self-contained handoffs.

Never writes code.

Builder

Writes the product, the Dockerfile and every repair, from the spec, not the tests.

Never grades it.

Verifier

Writes its own black-box tests from the ledger and runs them on a clean export of the exact candidate commit.

Never reads the code.

Gate

Rebuilds the exact commit, runs the organisers' checks in graded mode, re-runs the tests, audits ledger and code, then plants bugs to test the tests.

The only one who says yes.

The mandates never name the product: no endpoints, fields or error codes. Everything track-specific lives in the one dispatch message, so the same factory can take any spec.

What it caught

A thousand levels deep. A valid booking with an ignored field nested 1,000–1,600 levels deep crashed the server with a 500. The shipped checks and the Verifier's 377 tests passed. Gate found it, traced it to a recursive fingerprint function and rejected the commit; Builder fixed the cause and Gate re-tested depths up to 100,000.
Testing the tests. Gate planted bugs in throwaway copies at every stage (8/9, 8/8, 7/8, 9/10 caught). Every survivor went back to the Verifier as a new test.
A bug in the referee. In rehearsal, Gate found the organisers' harness collects zero tests in graded mode on native Windows, and moved graded runs to WSL2.
Lights out, even when the lights went out. When the host disk filled and Docker froze, the band reported a blocker, froze Docker work, polled the daemon and resumed on its own.
The stage-1 requirements ledger with S1-006 rejected by Gate

Tablekeeper, the product

A table is never double-booked: atomic, idempotent bookings and multi-booking moves; joined tables; effective-dated policies with truthful history and recurring series; atomic closure re-planning. Built on Python's standard library with a pinned timezone database, in a 46 MB image. Below, the real app at the accepted commit: the connection is cut after the server saves the booking, the app says so, and "Try again" returns the original reference. The server holds exactly one booking.

Availability grid with joined tables
Every free table, even joined ones.
We couldn't confirm your booking
Lost connection? It says so.
Booking confirmed with the original reference
Retry with the same key: never booked twice.