The Agentic Software Factory Needs an Isolation-and-Handoff Contract

The next agent-platform control surface is not autonomy. It is the contract between autonomous stages.

A coding agent can now move from a single prompt to a repository, tests, CI, a database, and a deploy. Shared-agent products are persisting context across people and tools. The pattern is no longer "try an agent"; it is "compose a factory from agents, runtimes, context stores, and delivery stages." When that factory ships in production, the program risk moves to the seams: what the agent may touch, what artifact it must produce, how state crosses a boundary, and who can prove the next stage received the right context. The TPM job is no longer to keep the agent productive. It is to keep the factory governable. That requires an isolation-and-handoff contract, and most teams shipping multi-stage agentic software today do not have one.

The threshold that matters

The threshold is six stages. Research, planning, implementation, testing, deployment, and handoff. Above that count, every additional stage multiplies the number of boundaries a context package has to cross, and the probability that something the agent never saw, or never should have seen, ends up in the next stage. The factories that landed together on August 21 — Jake Saunders's self-hosted sandboxed software factory, the Show HN shared-brain product for Claude and ChatGPT, and Oasis's cross-runtime session sharing — all sit above that threshold. What is missing from each is the contract that names what crosses the boundary, what artifact has to be there, and who can prove it. The MarkTechPost AutoFigure report on cross-stage agentic document-intelligence pipelines is the same pattern in a different domain: research to figures, with no published contract for the seams.

The framework

The contract is five parts. Every TPM running a multi-stage agentic software program should be able to read each one out loud and answer "yes, ours does that" or "no, here is the gap." Gaps are where production incidents start.

1. A stage contract for every transition. For each of research, planning, implementation, testing, deployment, and handoff, the contract names the required inputs, the required outputs, the evidence the stage must produce, and the stop conditions that abort the chain. "Stop conditions" is the part most teams skip. A stop condition is the thing the agent is forbidden to do next without human approval, written down before the stage runs. Without it, the agent will improvise the stop, and improvisation is what makes a release-governance audit possible. The release contract framing from DevOps.com is the load-bearing reference here: the contract is what the pipeline inspects, and the pipeline is the only thing allowed to dispose a proposal.

2. Isolation by default at every execution environment. Every agent stage runs in a sandbox. The sandbox has documented network, filesystem, credential, and production-access boundaries. Containment is testable, not aspirational. Saunders's factory write-up is the cleanest published example of the pattern: the agent's metal is physically separated from the production homelab, and network isolation is the guardrail. If your team cannot name the network boundary for a given stage in a sentence, you do not have isolation. You have a permission to hope.

3. A versioned context package at every handoff. The thing crossing the boundary is not "context." It is a context package: source files, instructions, tool permissions, model/runtime versions, prior decisions, and the artifact the previous stage produced. Every package has a content hash and a stage-of-origin tag. If a stage fails a downstream test, the team can replay with the exact same package and the exact same runtime, and the replay will reproduce the same failure. Without the package, replay reproduces "something close," which is the engineering definition of non-reproducible.

4. Inspectable artifacts and handoff-failure instrumentation. Every boundary needs an artifact: a plan, a diff, a test report, a deployment manifest, a provenance record, a rollback point. A human must be able to read it without re-running the agent. Track handoff failures separately from model failures: missing context, stale context, unauthorized access, artifact mismatch, non-reproducible replay. A factory that reports 99% model accuracy and 30% handoff success has a real failure mode that is invisible until the dashboard separates the two.

5. A weekly golden-workflow replay. The contract is only as strong as the last time it caught a bad tool call, a runtime upgrade, or a corrupted shared-context state. Pick the smallest end-to-end workflow that exercises every stage and every handoff artifact, and replay it every week against the current production runtimes (Codex `rust-v0.150.0-alpha.6` and Hermes `v2026.8.19` both landed in the same window). If the replay produces the same artifacts and the same evidence packet as the recorded baseline, the contract is still holding. If it does not, the gap is named, dated, and assigned before next week's replay. A contract that has never caught a real regression is a contract that has never been tested.

What this does not solve

The upstream prompt and spec problem. The handoff contract does not solve whether the agent was given a good prompt, an accurate spec, or a well-scoped task. That is a human-before-the-proposal problem and it sits outside the factory.

The alignment and bias problem. The contract does not solve alignment, adversarial prompting, or systemic bias. NIST AI RMF 1.0 covers those at the governance layer, and the factory contract is one control under that layer, not a replacement for it.

The shared-brain safety problem. The contract does not solve the "which context is safe to carry" problem on its own. A shared brain across runtimes with different retrieval, tool, and permission semantics cannot be a single source of truth without a classification scheme for what context is safe at which boundary. That classification scheme is the next TPM deliverable, not this one.

Adoption checklist

• [ ] Write the five-part contract into the launch PRD before the agent gets write access to any repository in the factory.
• [ ] Name the sandbox boundary for every stage in one sentence: network, filesystem, credentials, production access.
• [ ] Define the context-package schema with content hash, stage-of-origin tag, runtime version, and the artifact the previous stage produced.
• [ ] Configure the evidence-packet schema per stage: what the pipeline inspects before promotion.
• [ ] Separate handoff-failure metrics from model-failure metrics in the dashboard.
• [ ] Schedule the first golden-workflow replay for the end of week one. The contract is not real until it has been tested against a real runtime upgrade.

The agentic software factory is not a research project. It is a production system with a release process. The TPM job is to make the seams inspectable. The isolation-and-handoff contract is how.

Sources: Jake Saunders, "Building an (almost) fully self-hosted, sandboxed, agentic software factory" (August 21, 2026); OzBrain Show HN launch (August 21, 2026); Oasis HQ cross-runtime session sharing (August 21, 2026); OpenAI Codex release notes, `rust-v0.150.0-alpha.6` (August 21, 2026); Nous Research Hermes Agent release notes, `v2026.8.19` (August 21, 2026); MarkTechPost, AutoFigure agentic document-intelligence pipeline (August 21, 2026); DevOps.com, "The Agent Proposes, the Pipeline Disposes" (August 13, 2026).

Send me the five-part contract from your agentic factory — the stage names, the sandbox boundaries, the context-package schema, and the evidence-packet fields. DM me on LinkedIn (Doron Katz). I am collecting working patterns into a public software-factory playbook; ten contracts would let me ship the first chapter next month.