Five In-House Platforms Converged on the Same Architecture

Five platform teams that never compared notes built the same system.

• Stripe. Merges 1,300+ pull requests a week with no human-written code in them.
• Ramp. Inspect writes about 30% of merged PRs in its frontend and backend repos, with no mandate.
• Spotify. Honk reached roughly 1,000 merged PRs every 10 days.
• Uber. uReview runs on over 90% of roughly 65,000 weekly diffs, and its comments are addressed more often than human reviewers'.
• Shopify. River coauthors one in eight merged PRs across the company, running on Aquifer, an in-house agent substrate.

Each team hit the same constraints and arrived at the same design: cloud execution per task, the engineers' own toolchain inside it, work entering from chat or tickets, closed feedback loops, a pull request out, a human merging. They are the in-house tier of the five operating models.

Four of the five are background coding platforms that produce pull requests: Stripe, Ramp, Spotify, and Shopify. Uber's first-party writeup is the review side of the same operating model: an AI reviewer in CI, wired into production feedback and measured against human review. Do not flatten those into one product shape. The useful fact is narrower and stronger: five teams hit the same wall and built around cloud execution, real engineering context, closed feedback loops, and human gates. LangChain noticed the convergence and open-sourced the pattern as Open SWE in March 2026.

Independent derivation is the strongest evidence available that the shape is right. Nobody benchmarked their way here. Each team hit the same constraints, laptops do not parallelize, agents need real feedback, review capacity is finite, and credentials cannot be treated as ambient, and those constraints produced a recognizable design.

Stripe: the human dev environment was already the sandbox

Minions run in devboxes, the same disposable EC2 environments Stripe engineers SSH into, pre-warmed to be ready in 10 seconds with repos cloned and caches hot. Devboxes live in the QA environment with no access to production, real user data, or arbitrary network egress, which is why minions run with full permissions and no confirmation prompts: the blast radius is one box. Stripe's lesson is that the isolation work was already done for humans, and "what's good for humans is good for agents."

The harness is a fork of Block's goose, orchestrated by "Blueprints," a state machine interleaving agent loops with deterministic nodes (linters, git operations) so required steps always run. Feedback comes from Stripe's 3M+ tests, shifted left, with at most two CI rounds per run. Tools come from Toolshed, a central MCP server with more than 400 tools, of which each minion gets a deliberately small curated subset. More in the Stripe case study.

Ramp: full context, fast sandboxes, zero mandate

Inspect runs each session in a Modal sandbox restored from a snapshot rebuilt every 30 minutes, so the agent starts on a near-current checkout in seconds. The sandbox carries everything an engineer has locally (Vite, Postgres, Temporal) and is wired into Sentry, Datadog, LaunchDarkly, Buildkite, GitHub, and Slack. Ramp's bet is that agents fail from missing context and tools, not missing intelligence, so Inspect gets everything an engineer gets. Sessions are multiplayer, with each person's prompt attributed to them, and adoption hit ~30% of merged PRs in a couple of months with no mandate.

One detail the others do not publish: Inspect opens PRs with the requesting user's GitHub token rather than as the app, specifically so no user can approve their own agent's changes. That is the clearest segregation-of-duties mechanism in the in-house corpus. More in the Ramp case study.

Spotify: the agent replaced a 20,000-line migration script

Honk grew out of Fleet Management, Spotify's system for running code transformations across thousands of repos in containerized jobs. The motivating pain was specific: the deterministic Maven dependency updater had grown past 20,000 lines of corner cases. Honk swaps the transformation script for a prompt and keeps everything else, targeting, PR creation, review, merge, unchanged, with an LLM-as-judge evaluating diffs before the normal review path. The agent slotted into existing automation infrastructure rather than replacing it, reaching roughly 1,000 merged PRs every 10 days. Spotify is candid on the gap: agents need "robust guardrails and sandboxing" and "we don't have all the answers yet." More in the Spotify case study.

Uber: the review gate was the platform

uReview is not a background coding agent and should not be described as one. It is the in-house review platform built for the same scaling pressure: code volume went up, human review capacity did not. uReview reviews every eligible commit in CI, decomposes review into generation, filtering, validation, and deduplication, then measures whether its comments are useful and actually addressed. Its comments are addressed more often than human reviewers' in Uber's internal audit.

The convergence is in the operating discipline: put the agent where the engineering system already has context, instrument the feedback loop, delete low-signal categories, and keep engineers in control. The first-party uReview post is also a fence. Uber's broader AI developer platform, Validator, AutoCover, Code Inbox, Shepherd, and the LangGraph-based agent platform, appears only in secondary coverage. More in the Uber case study.

Shopify River: the substrate the other four only implied

River is one profile on Aquifer, which Shopify calls its "internal platform for running AI agents." Aquifer makes the convergence explicit by publishing the parts the others kept internal. The session is "an append-only event log, Postgres-backed," so "the work lives in Postgres, not in memory" and survives a process or host dying. The harness, the Go agent loop, runs outside the sandbox, so "the agent loop is not in the same blast radius as rm -rf." Every agent is a Nix-built profile, River for interactive work, a separate PR-review profile, a headless "pi" profile, on one reproducible substrate.

That is the reference architecture this guide assembles from Anthropic, Brex, and Intercom, derived independently and stated out loud. River runs only in public Slack channels, so each session is a searchable transcript by default. The gaps match the rest: attribution is asserted through co-authorship without a stated binding mechanism, and residency and dependency provenance are silent. More in the Shopify case study.

They converged on the environment, stayed silent on the evidence

The coding-agent cases instantiate the same shape Open SWE later codified: isolated execution environments, curated toolsets, work-where-the-team-is intake, rich context at startup, and subagent or workflow orchestration. Uber adds the review-side lesson: the gate itself becomes a system, not a best-effort human queue. Together they are Brex's pattern generalized.

What none of the four publishes is the whole compliance half. Ramp gives the best attribution and segregation-of-duties detail. Uber logs comments and ratings to Hive through Kafka. Spotify logs to GCP and traces in MLflow. Shopify publishes the most architecture of the five, a durable Postgres session log and a credentials proxy, but no more of the compliance mechanics than the rest. None publishes a complete agent identity model, audit retention policy, auditor-facing query interface, residency story, or dependency-provenance gate. These companies almost certainly have internal answers, because their PRs land in real repos under some identity, but the mechanics are unpublished. That silence is why the laptop never had to answer this, and the compliance case takes it up.

Coinbase remains a useful but thinner datapoint. Public material supports a Slack-native harness with the same tools and context as engineers, 5% of merged PRs by February 2026, and a human still reviewing and merging in the Mux flow. The widely repeated "agent councils plus auto-merge" story is defensible only for a narrow low-risk class, not as a general architecture claim.