Skip to main content
Toyota’s cars do not build cars. This factory’s outputs staff the factory — its products are also its workers. That recursion is the plant’s compounding advantage and its most dangerous failure mode: a bad specification can cause agents to produce coherent-looking garbage at scale. The answer borrows the biological firewall. Everything in the factory splits into two classes:
  • Germline: the templates, base protocol, station gates, validators, work-order schemas, the standard work itself — anything that shapes future units. Changes here are congenital: a defect propagates into every unit ever produced afterward. Germline changes get the strictest control in the plant — PR-only, human sign-off, versioned with a changelog, evals re-run against fixture units before merge.
  • Soma: deployed unit instances and their run-state. Faster iteration, lighter gates, recoverable by recall and re-issue.
The asymmetry is deliberate. A somatic defect costs one unit; a germline defect costs every future unit and hides while it compounds. So the review weight follows the blast radius, not the diff size — a one-line edit to a template outranks a hundred-line edit to a deployed instance.

​
The compiled form

This thesis runs as code. The germline path list lives in a machine-readable manifest; germline/check-changelog.py fails any change to a germline path that does not carry a dated changelog entry in the same diff — and it reads the manifest at both ends of the range, so a change cannot ungate itself by deleting its own listing. Fail closed: a range the gate cannot evaluate is a FAIL, never a pass. The gate runs on every pull request as one of the four CI gates (Gates). The standard work itself carries the changelog this gate demands; the discipline is documented in Standard Work. The founding wound this heals: the factory’s most important document — the standard work — once had no changelog. The document that shapes every unit could not show its own history. Under this thesis that is not an oversight; it is a germline violation, and it is fixed. Self-improvement without change control is self-corruption on a delay. The firewall is what lets the factory improve itself and stay itself.

​
Self-audit

ClaimSource
Outputs staff the factory; recursion is the compounding advantage and most dangerous failure mode; “coherent-looking garbage at scale”docs/factory-design.md:60
Germline definition and strictest controls: PR-only, human sign-off, changelog, fixture evalsdocs/factory-design.md:64
Soma definition: lighter gates, recoverable by recall and re-issuedocs/factory-design.md:65
The standard work’s missing changelog was a germline violationdocs/factory-design.md:67
Changelog now exists and is enforcedworkflows/production-line.md:95–99
Gate mechanics: manifest-driven, both-ends read, fail closedgermline/check-changelog.py (module docstring)