Architecture

forge-dark-factory is an integration layer over primitives that already exist in forge-lcdl and forge-workcells, plus the one missing write-side piece (apply_fn) and a dual-wiki trace. It is a sequential loop (no parallel orchestration in the PoC).

The L1 loop

goal + target
   |
   v
[classify]      Cynefin domain + t-shirt + value        (classify.py)
   |
   v
[route]         cheapest tier that clears the bar        (router.py + capability.py)
   |            deterministic | local | escalate
   v
[context]       bounded context pack                     (forge_lcdl.context.build_context_pack)
   |
   v
[plan]          ordered patch units                      (forge_lcdl.coding.create_patch_units)
   |
   v
[draft]         propose file edits                       (worker.py: fake | local)
   |
   v
[apply]         write edits inside a git worktree        (apply_fn.py, path allowlist)
   |
   v
[verify]        pytest / checks                          (forge_lcdl.coding.execute_patch_unit + PytestVerifier)
   |
   +-- fail --> [repair]  bounded retry hints            (forge_lcdl.repair)
   |
   v
[proof]         proof report                             (forge_lcdl.coding.proof_report_*)
   |
   v
[trace]         write M, generate H, freeze gate         (wiki/)
   |
   v
[escalate?]     on ambiguity / exhaustion -> human

The outer decision shape (score -> verdict -> next / stop / escalate) follows the prior art in forge-cockpit-web/scripts/converge-autopilot.py.

Inward-dependency rule (why nothing else breaks)

forge-dark-factory  --depends on-->  forge-lcdl, forge-workcells (pinned submodules, read-only)
        (owns: driver, router, apply_fn, dual-wiki, sandbox, tests)

Other repos NEVER import forge-dark-factory  =>  they cannot be broken by it.

• forge-lcdl / forge-workcells are consumed as pinned git submodules and installed editable. They are not modified.
• The missing primitive - applying a patch to disk - lives here in apply_fn.py. forge_lcdl.coding.execute_patch_unit already accepts a caller-supplied apply_fn, so no forge-lcdl change is needed.
• In the PoC, apply_fn only ever writes inside a throwaway git worktree of the sandbox target. It never edits a real repo. When later phases target real repos, the factory proposes a reviewed PR from a worktree branch - never an in-place edit.

Offline-first

The fake worker returns a fixture-backed patch so the whole loop is deterministic with no model and no network. The local worker (opt-in) runs the same interface against a local Ollama / certificator model via forge_workcells.local_llm_worker. The green demo uses fake.

Roadmap placeholders (later programs)

• lmeta execution mode — implemented behind FORGE_DARK_FACTORY_VIA_LMETA (default off). See LMETA-MODE.md and design/LMETA-BRIDGE.md. The legacy sequential driver in driver.py remains the rollback path.
• Fleet-distributed dispatch — containerized worker steps via Forge Fleet; arrives in Program D.
• LLM priority — governed model routing and priority queues across backends; arrives in Program E.