The Software Factory Above the Code: How a Real iPhone and Watch App Was Built on Agentic-Nets

Every screenshot in this article was taken on 31 October 2026, from the Agentic-Nets desktop app on my Mac and from the iPhone and Apple Watch simulators. The subject is Poweeer, a readiness app for iPhone and Apple Watch: its first commit is from 25 September 2026, its last from 30 October, 500 commits in 35 days, 190 Swift files and 51,575 lines across the iPhone app, the Watch app, the widgets and the complications. I did not type that code. I prompted, decided, answered questions and managed the context, and since the middle of October I have done all of that one level above the code, in a hierarchy of nets on the Agentic-Nets runtime. This article is the case for that way of working: Agentic-Nets as the software factory, with people and agents on every level and the code as the lowest one.

The claim: software development is leaving the code

For sixty years the unit of software work was the line of code. Everything else, the requirement, the design, the decision, the reason, was a document about the code, and documents drift the moment someone touches the code without them. Coding agents have now made the bottom layer cheap. A model writes a Swift file in seconds, rewrites a module in minutes, and does it well. What it cannot do is hold the top: the intent, the rules with their dates and reasons, the structure of the thing, the open questions, the facts that were measured and the ones that were only assumed. Those live in prompts and chat transcripts, and a transcript is the worst place a decision can live.

So the interesting layer is no longer the code. It is everything above it: the layers that describe what the code does, why, and how it hangs together, in a form that is checked against the code and not just written next to it. If those layers exist, are navigable, and are kept true by machines, then people can work on them instead of on the code, agents can be sent down from them into the code, and the complexity of a real system becomes something you can see rather than something you must read. That is what Agentic-Nets does when it is used as a software factory, and this article shows it on a real application that ships to my own wrist.

What came out of the factory

Poweeer answers one question several times a day: how ready am I, right now, for hard physical work and hard thinking? It reads heart rate, heart rate variability and steps from the Apple Watch, finds the night on its own from the heart’s recovery phases (Apple’s sleep record is shown for comparison but is no input to any formula), and turns that into a Power index, Body and Mind readiness rings, a Recovery HRV ring, sleep debt, a nervous system verdict and a daily piece of advice. It has an activity side as well: every Health workout becomes a record, areas such as running, cycling and strength get a status from Declining to On a streak, strength workouts can be planned and logged on the Watch, and alcohol, caffeine, sauna and pauses can be logged with one tap because they change what the measurements mean. Both devices compute every value with the same shared code, and the Watch works on its own for ninety days of history without the phone.

It is a real application with the usual four Apple targets: the iPhone app, the Watch app, the iPhone widgets and the Watch complications. The repository has a logic check suite that compiles the shared code without any user interface and runs it on a simulator; its main file calls its check function 818 times, one for every rule, with the parameter values read from one parameter file. A string check refuses product words that the concept document has retired. The concept document itself is a single page that names every value the person sees, in English and German, with the date and the sentence of mine that decided it, and the exact code location where it lives.

The pace was the pace of the agents, not mine. Counting commits per week from the first one: 78, 137, 108, 117, 56, and 4 on the last day measured. Thirty-three of the thirty-five days have commits. None of those commits was typed by me; all of them were asked for, and in the second half, asked for from above the code.

Two phases: with coding agents, then above them

The first eighteen days were what everyone does today. I talked to coding agents, Claude Code mostly, Codex at times, in the repository. The app grew fast and the knowledge about it grew faster, but it grew in the wrong places: in the chat, in commit messages, in a concept document I kept by hand and in parameter tables inside Swift files. Every time I came back to a rule I had to find the reason for it again. Every time an agent touched a formula I had to check whether the document still said the same thing. The code was the only thing that stayed true, because the compiler and the logic checks forced it to.

On 12 October I described the whole application as one model on the Agentic-Nets runtime: the product at the top, the code at the bottom, one level of detail per band, one net per level. The levels are these, and a fact lives on exactly one of them:

The mechanism underneath is the one the runtime already had for subnets. A transition in one net can be refined by a whole net one level down; the child’s input and output places carry the same ids as the places around the parent’s transition, so both drawings share those places and the runtime stays flat. The parent transition is abstract and never fires. Applied level after level, that is an abstraction hierarchy, and the Model Explorer is the view that makes it readable: levels as bands, nets as cards, refinement edges between the bands, shared places as the data that connects them.

Since that day the development has moved up. A feature starts as a goal and a draft definition on the level where it belongs, hanging under the transition it refines. The personas of the levels above and below ask what they need to know, I answer in an inbox, the answers become decisions, the definitions turn ready, and a coding agent is sent down into the module level to realise them. The context net on the Work band keeps the reasons: my words, the decisions, the sources, the code, what was measured, what stays open. The activity page, the strength workouts, the activity status, the daily advice, the Watch’s ninety-day archive and the new complications all went through this path between 12 and 30 October.

The floor of the factory: nets you can read

Every net on every level is an ordinary Agentic-Net: orange places that hold tokens, glass transitions that act, arcs between them. On the upper levels the transitions are abstract and only describe; on the Work level they run. The same editor, Studio, shows both. Below is the architecture net for reading Health: the Watch’s sensors land in a Record place, go through the Apple Health store, and a Scan corrections step catches the values Apple changes after the fact. Each of these transitions is refined by a platform net one level down, which is refined by module nets that name the Swift files. The person reading this needs no Swift to understand how the app gets its data; the developer reading it knows exactly where to look.

Reading downwards is one half of the picture. Reading across is the other. Seventy-eight places are shared between nets; the day records place, for example, is drawn in the product net, in rules nets, in the persistence and device sync nets and in module nets. The Connections view shows every net that touches a piece of data, on every level, without opening a single drawing. The List view is a code map: the module level as a table, one row per net, with its domain, its responsible persona and the count of places it shares with other levels. Perspectives save a view, a filter or a slice of the model under a name, so the architect and the rule keeper open the same model and see different things.

The repository and the model are tied together by references. Every module net names the files it owns and the types and functions its transitions stand for. Every rules net states its parameter values. A checker reads the model and the repository together: every referenced file must exist, every named symbol must be declared in one of the net’s files, every parameter value must equal the value in the parameter file, and every quoted text must be present in the document it is quoted from. On 25 October the model carried 379 references, 247 checked symbols and 46 checked parameter values with zero findings. The checker takes a file and a pattern, not a programming language; nothing in it knows what Swift is.

Working on the layers: the AI asks, I answer, the AI refines

This is the part that changed how a day of development feels. In the Explorer’s Refine view I name a topic in plain words. On 25 October the topic was, verbatim, “lets talk about ow brain and body value drains over day”. The runtime resolves that sentence to a scope of nets across the levels (fourteen the first time, sixteen the second), hands the scope and the sources to a headless coding agent that can only read, and gets back a round of up to ten questions. Each question is about the thing itself, not about the nets: it has evidence (what was read or measured), reasoning (why it matters and what is recommended), and options to choose from. I answer one card at a time, with a choice, with my own words, or with “I don’t know, investigate”, which sends the agent back into the sources.

When the cards of a round are answered I press Refine, and the second half runs: the agent applies the answers to every layer above the code. It revises definitions, confirms what I agreed with, flags what contradicts the sources, raises the questions my answers opened, and records a pass with what it consumed and what it changed. Rounds are continuous since 26 October: while the refinement of one round is applied, the next round’s cards are prepared on the same topic, re-based on the refined nets, so the conversation about a feature never stops at a blank screen. Where structure is wrong rather than content, the agent proposes structure operations, attach, detach, abstract, split, merge, promote, move, each one repeat-safe and recorded in the definition of the net it creates, and none of them may touch a step that has a runtime inscription. The bottom level is the one the AI does not restructure.

The same hand-over works from a single card. Look, explain, check, draft, and diff the card against the current state are five commands that start a read-only coder on the Mac executor through a reusable tool net, with the runtime’s MCP server attached so every result lands in the model and not in a terminal. Measured on 14 October on the activity feature: explain in 61 seconds, look in 91, diff in 227, check in 287; the first real refinement pass of a whole level in 409 seconds, with 3 answers applied, 2 definitions revised, 3 flags and 4 new questions. A guided question of a round took between 134 and 140 seconds on 25 October; one Refine of two operations took 160 seconds to decide and 15 seconds to apply.

Three runners serve one contract. Claude Code reads the sources and changes the model through MCP, with receipts for every operation. Codex reads the sources but has no model access: its rounds return operations the master applies, its card tasks return proposals the master records under stable ids. The platform’s own LLM lane runs inside the runtime without any source files and sees only what the definitions quote. A model grants the runner access explicitly; the grant names the tools, the lanes and the reason, and when the tool set grows, the model has to consent again.

Keeping the layers true: the bottom-up direction

A model that only describes would drift like any document. The hierarchy stays true because every level is checked against the one below it, down to the code, by machines, and the result shows on the cards.

• Confirm and flag. I read a net or one transition and agree that it describes what it claims. The confirmation records the definition revision and a hash of every file the definition references. A flag says something is stale, unclear, wrong, a contradiction, unmeasured or too coarse, and stays open until it is resolved. Today the model has 267 subjects under review, 254 of them confirmed, 3 open flags and 10 open questions.
• Source watch. A scan without any AI hashes the files each definition references, checks the quoted texts and reads the repository revision. What changed becomes a stale flag on the net, a “level below changed” flag on the transition it refines one level up, a contradiction flag where a value differs, and a drift card for the next round. “It still holds” confirms the net at the new hash. The watch runs on an interval, on a signal, or now.
• Ground. The ground view walks every chain from a bottom net up to the product and shows, per node, the claims, the references and whether anyone confirmed them. Today: 41 chains, 139 nodes, 23 still unconfirmed, 34 flagged, and not one bottom net without a reference into the code. A mechanical ground pass compares the model’s parameter values and symbols with the sources and turns every divergence into a contradiction flag and a “sources differ” card, with ids derived from the measured hash so a repeated run changes nothing.
• Code to model. On 25 October the whole model was reconciled from the current application source in one supervised operation. The source inventory, 187 Swift files, was hashed file by file; a read-only headless agent read the code and proposed complete net changes; a deterministic coordinator validated the proposal against the checker, backed up the model, applied the changes, verified all 74 refinement boundaries against the live catalogue, and only then replaced the canonical specification. Eleven new nets were created and eleven obsolete flags resolved. When the code changed during the audit, the guard caught both new commits and uncommitted edits before anything was applied; a proposal that referenced a type deleted minutes earlier was rejected before it could reach the model. The tool is installed as a net on the Work level and runs through the Mac executor when invoked; nothing runs on a schedule.
• Balance. A read that measures what “simpler from the bottom up” means: element counts per level, oversized nets, upper steps that no net below explains, and hub places touched by many nets. Today it lists 25 hub places, 15 unexplained steps, 4 levels heavier than the level below them and 2 oversized nets. These are the structure cards the AI can settle on its own.

Since the first pass on 13 October the digest counts 51 answers, 25 confirmations, 20 flags, 17 resolutions, 4 deferrals, 16 notes and 9 questions I raised myself, over 5 recorded passes. Every one of those is a token in a place with a timestamp and an author. Nothing here is a chat log.

The work itself: applications on the same runtime

Everything that is work rather than model has a home on the same runtime, as an application: a manifest with stores, guarded actions and a surface, over ordinary places and tokens. Nothing lives in a separate database. Installed on this model today: Persona Kanban, Interview, Goals, the Focus work page, Curation, and the refinement package that the Explorer brought into the core on 26 October.

The board is where the factory’s many hands become visible. The cards on it were created by me, by Claude Code sessions, by Codex and by the personas; the assignee column says who holds each one. Today it shows 29 active cards, 10 in the backlog, 4 in progress, 15 waiting for a verdict in review and 6 done. The cards in review are the features of the last two weeks: the Power index bar, the activity status per area, the Watch’s archive. The backlog holds the findings the personas filed in their rounds, such as five Swift files above a thousand lines, with the measurement and the date. A card is a token; a move is an event; the board is a projection, and so is the Explorer’s “needs me” filter that reads the same tokens.

The Interview is the inbox where agents ask and I answer, reshape the question or raise my own. Goals carry success criteria per level and the progress the personas report as they work. Context nets keep the reasons behind a feature as linked facts: my words, the decisions, the sources, the code, the measurements and the open points, connected by link transitions that never fire and only say how one fact relates to another. And the personas, one per level, are not running agents but charters: a prompt that says which level it owns, what sits above and below, how to read its level from the live model, what counts as a finding and where to record it. Whoever plays the persona, a coding agent through MCP or the platform’s own lane, follows the same charter.

Why a net runtime, and not a chat window with a repository

Everything above could be imitated with files in a folder and a very disciplined team. It would drift within a week, because files do not know when they are out of date, do not know who may change them, and cannot be asked what happened. The reason it holds on Agentic-Nets is the runtime underneath, and the same properties are what make it a product for teams and not a personal trick:

• One control plane, state as facts. Every place is event-sourced. A card moved, a question answered, a definition revised, a pass recorded, a refinement verified: each is an immutable event with a time and an author, queryable later. The state of the development is not in anyone’s head or chat history; it is in the model, and the event trail says how it got there.
• Executors anywhere, egress only. The headless coders, the code-to-model tool, the widget renderer, the Xcode build all run as command transitions on an executor that polls the control plane for work. An executor sits wherever the work must happen: on the Mac that has Xcode and the repository, on a build server, next to a customer’s data. It opens no inbound port. Add a second machine and its executor shows up as another worker on the same net; a transition can name its executor or offer the work to any.
• Agents where they are useful, deterministic steps everywhere else. Seven transition kinds share one net: pass, map, HTTP, LLM, agent, command and link. The rounds and passes are agent and command lanes; the routing, the guards, the receipts, the hashes are maps and passes that cost no model call and cannot hallucinate. Over time the work that agents did first crystallises into deterministic steps; the source watch is exactly that, a scan that needed no AI once the recipe was known.
• Policy in the net, not in the prompt. Guarded actions refuse what the application’s manifest forbids, no matter who asks. A runner gets a grant that names tools and lanes and expires when the tool set grows. The coders are read-only on the repository by construction, not by instruction. Credentials come from the vault at fire time and never sit in an inscription or a prompt.
• Observe every state change. Metrics, traces and the event trail cover every transition fire; a stuck lane, a runaway loop or a token that never arrived is a question to the runtime, not an archaeology of logs. The Explorer’s counts, the ground view and the balance read are projections over the same events.
• Open to any client through MCP. The whole loop, explore, define, ask, answer, confirm, flag, refine, hand over, runs through the runtime’s MCP server, so a coding agent in a terminal, a chat client or an automation drives the same model with the same guards. Applications and capability packs are packaged and shared through the NetHub, private or public.

For an organisation this is the point. Different people own different levels: a product owner the top, designers the experience, domain experts the rules, architects the middle, developers and their agents the bottom. Each sees the model through their perspective, works on their level, and is told by the runtime when the level below them changed under their feet or when the level above them decided something they must carry down. A specification is a JSON file beside the code; the builder turns it into the live model and is idempotent; the checker finds the gaps before anything is written; the end-to-end script builds the same specification from nothing into a scratch model, verifies it and deletes it, 99 checks on 26 October. Software built this way is defined before it is written, checked against its definition while it lives, and explainable at every level afterwards. That is what quality means when the code is cheap.

Nothing in the factory knows what a Swift file is

Poweeer is an app, so its lowest level is code. That is a property of this model, not of the runtime. The levels, the refinement, the shared places, the definitions with their references, the confirmations, the source watch and the question rounds work the same when the lowest level is a checklist, a role description, a paragraph of law, a dataset or a lesson. A reference is a kind and a location; a hash is the hash of whatever local files the definition names; the checker takes a pattern. The design rule written down on 12 October still holds: domain words belong in a model’s specification and its level names, never in the platform. Code is one domain’s lowest level, and software development is the first factory this runtime was used for, not the only one it fits.

Measured on 31 October 2026

• The app: first commit 25 September 2026, last commit 30 October, 500 commits on 33 of 35 days; 190 Swift files outside the documentation folder, 51,575 lines; four targets (iPhone app, Watch app, iPhone widgets, Watch complications); 818 logic check calls in the check suite. Not one line typed by me.
• The model (live catalogue, version 8471): 8 levels, 108 nets, 302 drawn places and 116 runtime places, 378 transitions, 960 arcs, 74 refinements all verified, depth 4, 78 shared places, 29 link transitions, 110 authored relations, 99 definitions of which 93 realized and 6 archived, 59 inscribed transitions in the work and tool nets.
• The specification beside the code: 85 nets, 74 refinements, 372 references, 7 persona charters, 9 goals, 8 perspectives, 25 cards, 14 questions, 78 declared shared places, 187 source files hashed by the code-to-model tool at its last run.
• The review: 267 subjects, 254 confirmed, 3 open flags, 10 open questions; since the first pass 51 answers, 25 confirmations, 20 flags, 17 resolutions, 4 deferrals, 16 notes, 9 own questions, 5 passes.
• The ground: 41 chains, 139 nodes, 23 unconfirmed, 34 flagged, 0 bottom nets without a reference. The balance: 25 hub places, 15 unexplained steps, 4 levels heavier than the one below, 2 oversized nets.
• The rounds: two on one topic, 9 and 10 questions, scopes of 14 and 16 nets, 2 answered in each, both still interviewing. The board: 29 active cards, 10 backlog, 4 in progress, 15 in review, 6 done.
• The hand-over, measured earlier on this model: explain 61 s, look 91 s, diff 227 s, check 287 s (14 October); a level-wide refinement pass 409 s; a guided question 134 to 140 s; one Refine 160 s to decide, 15 s to apply (25 October).

What is not true yet

The continuous programme is built and gated but has not been started on this model; both rounds are waiting for my answers, and the refinement package’s grown grant is waiting for my consent, which the Explorer shows as “needs consent”. The source watch is configured for the repository but switched off, so stale flags today come from explicit scans, not from an interval. The platform’s own LLM lane was degraded on the day of the screenshots, which is why every round so far ran on a headless coding agent. Marks keyed to an element that a split or move relocated keep their old key. And none of this says anything about physical-device behaviour or physiological truth: the model knows what the code does and what I decided, not whether my readiness formula is right. That is the next topic for a round.

Try it

The Model Explorer with its Refine view, the applications and the MCP tools are part of the current Agentic-Nets desktop app and of the open-source repository. A model starts as a specification beside your sources; this is the shape of one net in it, a rules net refining one transition of a concepts net and naming the code it is implemented in:

{
  "key": "rules::power-recovery-rules",
  "name": "Power recovery rules",
  "refines": {"net": "concepts::understanding", "element": "t-power-recovery"},
  "places": {"p-phases": "Recovery phases", "p-health": "Health readings",
             "p-phase-groups": "Phase groups", "p-candidate": "Longest group",
             "p-recovery": "Power recovery and night"},
  "transitions": [
    {"id": "t-group-phases",  "label": "Group phases",  "in": ["p-phases"], "out": ["p-phase-groups"]},
    {"id": "t-longest-group", "label": "Longest group", "in": ["p-phase-groups"], "out": ["p-candidate"]},
    {"id": "t-refine-edges",  "label": "Refine edges",  "in": ["p-candidate", "p-health"], "out": ["p-recovery"],
     "symbols": ["refinedEdges"]}
  ],
  "parameters": {"powerSleepGapMinutes": 60},
  "definition": {
    "acceptance": ["Only the Power recovery drives the asleep rules; smaller groups recharge with their phase gains."],
    "references": [{"kind": "doc",  "uri": "Docs/CONCEPTS.md", "contains": "Power recovery"},
                   {"kind": "code", "uri": "Shared/PowerSleep.swift"}]
  }
}

Check it, build it, verify it, then open the Explorer, pick the model, go to Refine and name a topic:

python3 -I check_spec.py  model.json                 # 0 findings, or the list
python3 -I build_model.py model.json                 # creates what is missing, changes what differs
python3 -I e2e_model.py   model.json --scratch       # the same spec from nothing, verified, deleted
python3 -I curate.py      model.json status --needs any
python3 -I source_sync.py --config sync.json --request-id review-001          # plan: what the code says the model should be
python3 -I source_sync.py --config sync.json --request-id apply-001 --apply   # apply, verify, then replace the spec

The first card the round gives you will be about the thing you are building, not about the nets. Answer it, press Refine, and watch the layers above your code change while the code stays exactly where it was. Then send the coder down.

Built and measured on the Agentic-Nets desktop app, version 2.61.0 with the development builds of 26 October 2026, and on the Poweeer repository at its commit of 30 October. The model, the persona charters and the specification live in the app’s own repository; the Explorer, the refinement package, the builder, checker and synchronisation tools are domain-neutral and ship with the runtime. The app’s screenshots show example data on the iPhone 17 Pro and Apple Watch Ultra 4 simulators.

Related: One Net per Level: Developing a Real App as a Hierarchy of Agentic-Nets, Built by AI, steered by the net: a guided tour of the Agentic-Nets runtime, Hermann: A Twelve-Factor Developer That Lives in a Net.