Simulated Singularity Factory

Version 1.0.0

A reproducible, credential-isolated autonomous software factory for blakedehaas/simulated-singularity.

The repository is intended to survive complete loss of the development computer. No local-only 0.x image is a prerequisite: every component is rebuilt from source or a pinned public upstream.

What it runs

GitHub Issues
      |
      v
Symphony controller 1.0.0
      |
      | SSH
      +-------------------------+
      |            |            |
      v            v            v
 worker 1      worker 2      worker N
 Codex         Codex         Codex
      \            |            /
       \           |           /
        +---- constrained ----+
              publisher
                  |
                  v
          agent/gh-N branches
                  |
                  v
               GitHub PR

One controller can schedule multiple workers. Scale workers, not controllers: the current Symphony scheduler does not provide a cross-controller distributed lease, so multiple controllers polling the same label could race.

Internal version policy

Every Simulated Singularity Factory component starts at 1.0.0:

• controller: simulated-singularity-factory-controller:1.0.0
• worker: simulated-singularity-factory-worker:1.0.0
• publisher: simulated-singularity-factory-publisher:1.0.0
• GitHub App renewer: simulated-singularity-factory-renewer:1.0.0

External dependencies retain their real upstream versions:

• OpenAI Symphony v0.0.2, commit 653f8b3cc476db03420479ba6f95b2ed7281c401
• OpenAI Codex CLI 0.155.1
• Ubuntu 24.04 locked by OCI digest

Fast local recovery

Prerequisites:

• Linux/amd64, or Windows + WSL2 + Docker Desktop
• Docker Compose
• the existing GitHub App installed on the target repository
• a newly generated private key for that GitHub App
• one interactive Codex login per worker

cp .env.example .env

mkdir -p state/github-app
cp /secure/path/private-key.pem state/github-app/private-key.pem
chmod 600 state/github-app/private-key.pem

./scripts/bootstrap.sh
./scripts/codex-login.sh
docker compose up -d
./scripts/verify.sh

bootstrap.sh creates SSH material, the constrained publisher capability, renders the Symphony workflow, and builds all 1.0.0 images.

Dispatch

Create an issue in the target repository and apply the symphony label. The controller will create an isolated issue workspace on one worker, run Codex, publish only the committed agent/gh-N branch through the constrained publisher, and permit controller-side GitHub tooling to create the PR/handoff.

Multi-computer mode

Use one controller/publisher computer and any number of worker-only computers on a trusted private network or VPN.

On the controller:

./scripts/export-worker-enrollment.sh

Securely transfer the generated enrollment archive plus this Git repository to the worker computer. Then on the worker:

./deploy/bootstrap-worker.sh /path/to/worker-enrollment-....tar.gz
# edit .env.worker and set FACTORY_PUBLISHER_URL
./deploy/start-worker.sh
./deploy/codex-login-worker.sh

Add the private/VPN worker SSH address to WORKER_SSH_HOSTS in the controller's .env, rerender, and restart the controller:

python3 scripts/render-workflow.py
docker compose restart controller

See docs/scaling.md.

Common commands

make bootstrap
make up
make status
make logs
make verify
make budget
make codex-login
make test

Secrets

Git never contains the GitHub App private key, installation tokens, Codex auth, SSH private keys, or publisher capability. Everything runtime-sensitive lives under ignored state/.

See SECURITY.md and RECOVERY.md.