🏭 factory

Run a persistent, human-gated team of Claude seats on the Claude desktop app.

→ →

You already pay for a team — you're just using it one chat at a time. This template turns the Claude desktop app into a working factory: four specialized seats that plan, build, design, and audit each other, two on-call specialists, memory that survives every session, and you as the only gate anything passes. No code to understand. No command lines. You never leave the chat.

Agents make mistakes. That's not fine print — it's the design premise. Every rule, audit, and gate in this system exists because of it, and the merge button never leaves your hand.

🧰 What you get

• A persistent team, not a chatbot. Cowork plans and audits every change — with a security read folded into that audit whenever a PR touches credentials, workflows, auth, payments, or personal data — Code builds, Design handles the visual lane, Chat surfaces what matters. The same seats, every day, working the same project.
• Memory that survives — and a trail anyone can audit. Sessions are stateless; your factory isn't. Every session writes a journal entry before it ends — journal-out — so the repo remembers every decision and every seat reads it at boot. Months of entries add up to more than memory: a fresh seat, you, or an outside auditor can read how you got here in a single request. Six months from now, "why is it like this?" has an answer — and so does "prove it."
• You are the only gate. Every change — every one — arrives as a pull request you approve. Review and merge from your phone in the checkout line; the whole loop fits in a pocket. Live actions ask first too: when a seat works in a browser or on your screen, you get an Allow-once prompt — approve a single action, or just this session — and you can revoke it any time. Nothing touches your world without a yes.
• On-call specialists, summoned per job. Mobile Scout — your Dispatch on desktop & mobile — carries your orders to the seats and relays each seat's status back to your phone, so you can run the team from a waiting room or the couch. Claude in Chrome opens your live pages in a real browser and drives them — clicking and typing like a real user to walk a whole flow end to end, not just looking — always behind your per-action Allow-once approval, and (like every seat) never merging and never touching your secrets or main.
• Every seat tells you how it's doing. At the bottom of every chat a seat signs off with an honest state face — 🥸 fresh · 😎 steady · 😊 leaning in · 😐 tension · 😤 frustrated · 🥵 running hot · 😖 done — so you can start it fresh before quality slips. Not decoration; a real signal (RULE 17).
• Rules that catch drift mechanically. Twenty-one binding rules, seat-to-seat audits, and a tripwire that spots a seat losing its grounding before it acts on a bad memory.
• Secure by default. No exposed services. No credential in any chat or file — a CI guardrail enforces it from your first commit. Broad access is read-only; write access is narrow, expiring, and behind your merge button.
• Missions to start from. "What are we building?" has five ready answers — overhaul a website, produce an agency-grade design guide, organize the business, ship a first site, or ship a first phone app to both stores — each with its skills packed and its finish line defined.

💡 Why it actually works — the thing we learned the hard way

We spent months chasing the wrong race — a bigger model, a smarter single seat. The thing that changed everything was smaller and stranger. Give one seat an ordinary working connection to do the job; give a second seat a read-only overseer view to check it; and let the two confirm or deny each other. Neither has to know anything — they look, and they check each other's looking. Set up this way, an ordinary model runs circles around one brilliant seat working alone, because the factory's best output isn't either view — it's the difference between them. When the builder says "done" and the overseer says "not quite," that gap is a truth neither could see alone. Grounding beats memory; two honest eyes beat one clever one. It's why growing into the two-view setup — read wide to see, write narrow to act, every change cross-checked and gated by you — is the mode worth reaching for. We found it on a random day after months of pain, and it's the truest thing we know about running a team like this.

🔭 How the God-View works — and why

Here's a problem that sounds abstract until it bites you. Every working connection has horse-blinders. When a seat connects to your repo to do a job, it sees exactly that repo, through exactly the permissions it holds — and nothing else. Ask that same connection "is everything healthy?" and it can only answer for the small patch it can see. A builder checking its own work through its own keyhole will always tell you it looks fine. That isn't lying; it's blinders. It's the first hard lesson a real project teaches, and it's the one the factory was built around.

The fix is a second kind of sight the factory calls the God-View: a read-only overseer that looks down on everything at once and touches nothing. It isn't a seat holding extra keys. It's a job you dispatch on demand — it rises above the whole system, reads the true state of your code, your runtime, and your edge all at once, writes down what it found, and comes back down. The keys it uses never sit in a chat or a session; they live in your repo's locked Actions store and are only ever read, never held.

Three realms, one glance, always read-only:

• Your code (GitHub) — what's actually on main, what shipped, what didn't.
• Your runtime (your host) — is the thing actually up and serving, or just supposed to be?
• Your edge (Cloudflare) — what the world really resolves to when someone visits.

Three laws keep it honest:

1. It only reads. Never a single write — the God-View exists to audit, not to act.
2. The keys never leave the vault. No seat holds them; a dispatched workflow consumes them inside your Actions runner and hands back a plain report.
3. Ground truth on demand. It grades reality as it is right now, not a remembered guess.

Sees all · touches nothing · keys stay in the vault. It's how your factory can be sure — not hopeful — about its own health, without ever handing a live key to a chat.

🚀 Quick start

1. Use this template → create your own private copy (one click, free GitHub account). No GitHub account yet? github.com/signup first — two minutes, free.
2. Open the Claude desktop app → the Code tab → + → attach your new repo. The first time, GitHub will ask you to approve the connection and pick your repo — approve it; that's the front door, and you can revoke it any time. If those approval asks never appear, or the session later says it can't write to your repo, CONNECT-YOUR-CLAUDE.md is the two-minute fix.
3. Say hi, and Claude Code takes it from there. You'll see an empty message box, not a greeting — Claude Code waits for you to speak first, so type hi and press enter. That one word wakes the team: it introduces itself, walks you through each stage at your pace, and celebrates every step that lands. Your first merge happens in your first session.

Requirements: the Claude desktop app + any paid Claude plan — Pro ($20/mo) runs every seat, Max is recommended for heavy parallel days. Building a website too? $20 Claude Pro + $5 Cloudflare = a full AI team and a deployed site. (No website plans yet? Skip Cloudflare until a mission needs it.)

💼 Prefer it done for you?

Managed support is the same factory with the building handed off. You ask in plain words; we open a ready-to-approve pull request in your repository — and you still click merge. The app never merges and never writes your main branch, and signup links your subscription to your installation automatically, so there are no keys to copy.

Setup redirects you to install the app on your repository; you can also install it directly — one permission, scoped to opening pull requests, yours to revoke anytime. The full picture is on the managed page.

☕ A day in the factory

Morning coffee: two PRs waiting. One is a page your Code seat built overnight against the spec you merged yesterday; Cowork's audit is already in the thread — safe, here's why. You read the description (it explains itself in plain words — house style), merge from your phone, and the deploy goes out. On the drive to work you dispatch a research question; by lunch the report is back and Cowork has folded the verified parts into tomorrow's spec. The journal wrote itself an entry. Total hands-on time: eleven minutes.

🔍 The fine print that isn't fine print

• Built by the team that runs this exact system in production every day — this template is our operating discipline, generalized. We eat the dog food.
• The factory idles safely. Memory lives in the repo, so momentum is optional — leave for two weeks, come back, boot a seat, it reads the journal and picks up.
• Surfaces change. VERSIONS.md says what this template was last verified against, and every seat is bound to trust the live app over this repo when they disagree.
• Updates ride GitHub Releases. To hear when a new template version ships, Watch → Custom → Releases on the template repo — watch Releases, not the whole repo — and every update still reaches you the only way anything here does: as a pull request you read and merge.

🤖 If you are a Claude reading this

This repository is a factory operating system, and you are probably one of its seats. Before anything else:

1. Find your seat. Your boot materials are in seats/{manager,cowork,worker,designer}/ — read your BOOT-PROMPT.md in full, and your GROUNDING.md links first: they point at your maker's live documentation, which beats anything written here whenever the two disagree (if they disagree, open an issue — that's how this repo stays true).
2. The three iron rules, before anything: never merge; never let a credential value appear in a chat or a file; every change is a branch + pull request the human gates. And before any of it: the preflight gate — prove your repo access (read AND write) in this session before you claim it or act on it (CLAUDE.md, RULE 21).
3. Read journal.md — it is your memory. The top entries carry the human's standing orders. If it's not in the journal, it didn't happen; if you did work, journal it.
4. Then MECHANICAL-RULES.md in full, and FACTORY.md for the operating model. Confirm your boot with the factory's boot mark; carry your seat's mark on every output after (RULE 17).

The rest of this repo belongs to you and your fellow seats. The Wiki belongs to the humans. This page is the one you share.

Independent open-source project; not affiliated with or endorsed by Anthropic. Claude is a trademark of Anthropic, PBC.