QA.tech: the AI software factory blueprints all leave out the QC station
A testing vendor lines up the software-factory pictures from Gartner, BCG, Stripe and OpenAI and finds the same gap: every check reads code, none opens the running product, and the teams closest to lights-out built that station anyway.
Source: What is an AI software factory, and where does verification sit in it?
In What is an AI software factory, and where does verification sit in it?, QA.tech compares the factory descriptions that Gartner, BCG, Stripe, OpenAI and tool vendors started publishing in 2026. They share five stations: intent, build, checks, ship and observe. Agents do the building; people design the line, set the acceptance criteria and review what comes out.
The gap is in the checks station. The usual list is tests the agent wrote, structural checks on the code, and a review agent that reads the diff. All three read code. None of them opens the product and uses it, so in testing-standards terms the line has verification but no validation. The post notes that the two teams that went furthest toward running unattended, StrongDM and BCG's model, both added the same missing piece: behavioural scenarios kept outside the codebase the agents can edit, checked by something other than the agent that wrote the change.
Their proposal for where that station goes is concrete. It runs at the pull request against a running preview, or on staging right after merge if there is no preview. It is run by something that didn't build the change. It is scoped to the user flows the change can affect rather than re-running everything. It reports three outcomes, pass, fail with evidence, or unable to verify, because a green run that never touched the change is worse than no check. And the verdict goes back to the coding agent as well as the human reviewer. QA.tech sells this kind of PR testing, so read the argument with that in mind.
Why it matters for code review
The case for agents that keep working around the clock depends on checks that don't need a person present. If every automated gate only reads code, a human is still doing the behavioural pass by hand, and that is the layer that stops scaling as PR volume rises. The "unable to verify" outcome is the most portable idea here: an always-on pipeline should be able to say it never looked, instead of letting silence count as a pass.