Autonomous Software Company (ASC)

ASC orchestrates 14 specialized AI agents that collaborate, negotiate, plan, build, review, test, deploy, and document software from a single user request

Comment

Inspiration

We kept noticing the same gap: AI coding assistants are brilliant at snippets but fall apart at shipping. A real product isn't one prompt — it's a company. Someone decides the vision, someone writes the PRD, someone designs the architecture, engineers build in parallel, security and QA push back, a reviewer says "not yet," and only then does it deploy.

So we asked: what if you didn't hire a single AI assistant, but an entire AI software company? One request in — a researched, designed, built, reviewed, tested, and deployed product out — with humans able to step in at the moments that matter.

What it does

ASC turns a single sentence like "Build a hospital management SaaS with an admin dashboard and payment integration" into a full software lifecycle, run by 14 specialized agents:

CEO → Product Manager → Researcher → Architect → UI/UX → Frontend + Backend + Database → DevOps → Security → QA → Reviewer → Documentation → Memory → Deploy. Agents collaborate and negotiate: QA and Security findings are routed back to the Frontend/Backend engineers for a structured fix pass, and the revised code replaces the originals — real feedback, not just logging. Human-in-the-loop via three modes (Autonomous, Approval, Manual) with approval gates. A live dashboard shows every agent's status, the workflow DAG, the agent conversation transcript, token/cost metrics, and deployment state in real time. Multi-tenant and role-aware: each user only sees their own workflows and memory; the first user becomes an admin with cross-user visibility and an audit log. A 5-tier memory system (working → session → project → organization → long-term) lets ASC recall a user's preferred stack and prior decisions across projects. An extensible tool system lets agents call real, sandbox-safe tools during a run.

How we built it

Backend: FastAPI + Python 3.12, Pydantic v2, async SQLAlchemy, Celery for background runs. A central workflow engine orchestrates the agent pipeline, tracks progress/cost, enforces a per-workflow token budget, and persists state. Agents: a BaseAgent abstraction over the Qwen (DashScope) OpenAI-compatible API, with 14 specialized subclasses and a shared message bus. Memory: a 5-tier store with importance scoring, semantic recall (Qdrant-ready), and an optional Neo4j knowledge graph — all with in-memory fallbacks. Auth & security: JWT bearer auth, bcrypt hashing, RBAC (admin/user), CORS allow-list, SlowAPI rate limiting, and an audit log. Observability: Prometheus /metrics and opt-in OpenTelemetry tracing across HTTP requests, workflow phases, and LLM calls. Frontend: Next.js 15 + React 19 + Tailwind + Recharts, talking to the API over HTTP and a WebSocket for live updates. Resilience: LLM retries with exponential backoff; Postgres/Redis/Qdrant/Neo4j are all optional — the platform fast-fails and degrades to in-memory stores so it runs anywhere. Quality: 83 backend + 21 frontend tests, running fully offline (LLM mocked, persistence best-effort).

Challenges we ran into

Making agents genuinely collaborate. A pipeline that just chains prompts is easy; making QA/Security findings loop back and actually change the engineers' output — without risking an infinite or failing loop — took a careful, best-effort feedback design. Multi-tenancy after the fact. Retrofitting per-user scoping across workflows, memory, and every read/write endpoint (and proving cross-user isolation with tests) required threading user_id end-to-end while keeping background Celery runs visible. Running without infrastructure. We wanted instant demos with no Postgres/Redis. Building a fast-fail, timeout-guarded persistence layer that never blocks the event loop — then falls back to memory — was subtle to get right. Deterministic tests around an LLM. Mocking the model, keeping exact agent call counts stable as the pipeline grew, and making RBAC's "first user = admin" bootstrap deterministic across a shared-process test suite. Cost and safety guardrails. Adding token budgets, rate limits, and an AST-validated tool sandbox so an autonomous system can't run away with cost or execute unsafe input.

Accomplishments that we're proud of

A 14-agent society with a working feedback loop — agents that review and revise each other's work, not just a linear chain. True multi-tenancy + RBAC with tested cross-user isolation. Production hardening end-to-end: retries, token budgets, rate limiting, audit logging, metrics, and tracing. Zero-dependency demo mode — it runs and passes its whole test suite with no external services. A green, meaningful test suite (83 backend + 21 frontend) that runs offline. An extensible tool framework already wired into the pipeline (QA computes deterministic code metrics via a real tool call).

What we learned

Orchestration is the product. The intelligence isn't in any one prompt — it's in the choreography: who talks to whom, when humans approve, and how disagreements get resolved. Design for absent dependencies. Best-effort persistence and graceful degradation made the system both demo-friendly and more robust in production. Guardrails enable autonomy. Token budgets, rate limits, and sandboxed tools are what make "let it run on its own" actually safe. Tests are how you move fast on agents. Mocking the LLM and asserting on pipeline structure let us refactor aggressively without fear.

What's next for Autonomous Software Company (ASC)

An admin UI panel in the dashboard for users, roles, and cross-project workflows. Real tool integrations behind an allow-list — read-only git/filesystem, then scoped write access. Per-user rate-limit tiers and quotas for true SaaS multi-tenancy. Self-improving agents that learn from production telemetry and past reviews. IDE extensions and enterprise SSO, plus multi-cloud deployment orchestration. A marketplace for reusable agents, tools, and workflows.

Built With

Share this project:

Updates