Build a software factory

    fn write(&self, path: &str, content: &str) -> Result<Value> {
        simple_path(path)?;
        anyhow::ensure!(
            self.editable.iter().any(|p| p == path),
            "File is outside the worker's editable set"
        );
        anyhow::ensure!(content.len() <= 32_000, "File exceeds 32000 bytes");
        let destination = self.directory.join(path);
        anyhow::ensure!(
            !destination.symlink_metadata()?.file_type().is_symlink(),
            "Refusing to replace a symlink"
        );
        chio_agent_os_shared::runtime::files::replace(&destination, content.as_bytes())?;
        self.writes
            .fetch_add(1, std::sync::atomic::Ordering::SeqCst);
        Ok(json!({"path":path,"candidate_sha256":self.digest_unlocked()?}))
    }

        let root = host.root("factory-workers", &["implement", "test", "review"], 3)?;
        let implement = host.delegate(&run, &root, "implement", &["implement"], 1, 3000)?;
        let test = host.delegate(&run, &root, "test", &["test"], 1, 3000)?;
        let review = host.delegate(&run, &root, "review", &["review"], 1, 3000)?;
        let tasks = [
            ("implement", &implement),
            ("test", &test),
            ("review", &review),
        ];
        let bundle = host.mint_graph(SwarmFanoutRequest {
            graph_id: run.id()?,
            root_transaction_ref: planned.receipt_id.clone(),
            parent_receipt_id: planned.receipt_id,
            session_anchor: run.id()?,
            parent: root.token,
            tasks: tasks
                .iter()
                .map(|(task, cap)| SwarmFanoutTask {
                    task_id: task.to_string(),
                    capability: (*cap).clone(),
                    protocol_target: "local://factory-workers".into(),
                    reserved_units: 1,
                })
                .collect(),
            policy_digest: chio_core::sha256_hex(b"factory-signed-task-graph-v1"),
            now_unix_ms: chio_agent_os_shared::events::now_ms(),
            lifetime_ms: 110_000,
        })?;
        run.emit("graph.issued","planner","Issued authority for three bounded responsibilities",json!({
    "graph":bundle.task_graph,
    "continuations":bundle.continuation_tokens,
    "trusted_issuer":host.signer.to_hex(),
    "scheduling":"The application orders implement, test, and review; the graph assigns authority and joins their results"
}))?;

            "test" => {
                anyhow::ensure!(
                    input["candidate_sha256"] == self.repository.digest()?,
                    "Tests requested for a stale candidate"
                );
                let result = self.repository.test(false).await?;
                *self
                    .tests
                    .lock()
                    .map_err(|_| anyhow::anyhow!("Test result lock failed"))? =
                    Some(result.clone());
                Ok(result)
            }
            "review" => {
                let candidate = self.repository.digest()?;
                anyhow::ensure!(
                    input["candidate_sha256"] == candidate,
                    "Review requested for a stale candidate"
                );
                let tests = self
                    .tests
                    .lock()
                    .map_err(|_| anyhow::anyhow!("Test result lock failed"))?
                    .clone()
                    .context("Run tests before requesting review")?;
                anyhow::ensure!(
                    tests["candidate_sha256"] == candidate,
                    "Tests belong to another candidate"
                );

    fn publish(&self, args: Value) -> Result<Value> {
        anyhow::ensure!(
            args == self.proposal["arguments"],
            "Publication parameters differ from the reviewed proposal"
        );
        let files = read_files(
            &self.directory.join("project/candidate"),
            &self.proposal["files"],
        )?;
        anyhow::ensure!(
            digest(&files)? == args["candidate_sha256"],
            "Candidate changed after approval; run the tests and review the new candidate"
        );
        let destination = self.directory.join("release");
        anyhow::ensure!(
            !destination.exists(),
            "Release already exists; reconcile it instead of publishing again"
        );
        let staged = chio_agent_os_shared::runtime::files::StagedDirectory::new(&self.directory)?;
        for (name, contents) in &files {
            chio_agent_os_shared::runtime::files::create(
                &staged.path().join(name),
                contents.as_bytes(),
            )?;
        }
        write_json(
            &staged.path().join("release.json"),
            &json!({
                "candidate_sha256":args["candidate_sha256"],
                "test_receipt":args["test_receipt"],
                "review_receipt":args["review_receipt"],
                "files":files.keys().collect::<Vec<_>>()
            }),
        )?;
        staged.publish(&destination)?;
        Ok(
            json!({"published":true,"candidate_sha256":args["candidate_sha256"],"files":files,"release_directory":"release"}),
        )
    }
}