00 / AGENTIC ENGINEERING
Agentic Engineering
This page documents how AI actually fits into my development process. Like most people I started with vibe coding — describe what you want in a sentence, accept whatever code appears to run. That holds for throwaway scripts and breaks down on systems with real users: output isn't reproducible, bugs hide in code nobody read, and nothing stands between the AI and production.
The approach now treats agents as collaborators that need engineering management: specs come first, context is controlled, and no output counts until it clears a verification loop and human review. Below is the method itself, and the two places it demonstrably runs — this website, and two systems in production at NKUST.
01 / FROM VIBE TO AGENTIC
From vibe to agentic
The difference isn't whether AI is used — it's whether the process has engineering properties: verifiable, reproducible, with a human accountable.
VIBE CODING
AGENTIC
SPEC
VIBEOne-line prompts; requirements invented mid-generation.
AGENTICSpec and acceptance criteria first; the agent works against them and gets sent back on drift.
CONTEXT
VIBEEvery conversation starts from zero, re-explaining the project.
AGENTICAGENTS.md plus cross-session memory: conventions, hard constraints and past decisions ride along in context.
VERIFY
VIBE“Looks like it runs” is the bar.
AGENTICTests, E2E, accessibility and performance gates form a loop; failures go back to the agent instead of being hand-patched.
REVIEW
VIBEOutput lands in the codebase unread.
AGENTICHuman review is a hard gate: each phase ships only after sign-off.
REPRODUCE
VIBEResults are one-off; the next project starts over.
AGENTICThe spec and the process are themselves documents; the same method reruns on the next system.
02 / THE LOOP
03 / EVIDENCE / THIS SITE
This website: the process is the artifact
This site was built through a ten-phase process — research, IA, wireframes, visual design, motion, SEO, frontend architecture, build, verification, acceptance — each phase producing a document that had to pass review before the next began. The case studies aren't hand-written marketing either: a sourcing spec came first, agents were dispatched into each project repo to verify facts, and the write-ups were rebuilt from what survived verification. All of it sits in public git history.
- docs/phase-1…7
- Per-phase spec and review documents — the process left a paper trail.
- docs/content-request.md
- Content-sourcing spec: case studies were rewritten only from repo-verified facts.
- AGENTS.md · memory
- Agents work with project conventions, hard constraints and cross-session decisions in context.
- commit 7fd3e21
- Verification loop in action: a contrast audit caught 3.13:1, fixed to WCAG AA (≥ 4.5:1).
- commit bf3fa85
- Performance gate in action: case-study screenshots to WebP, 1.5 MB → 218 KB (−86%).
- github.com/NameCallBob
- Source and full commit history are public.
04 / EVIDENCE / PRODUCTION
Campus systems: agents touch production only behind gates
Both systems — the NKUST alumni platform and the equipment-borrowing system — have real users, so every agent change clears gates first: the borrowing repo carries its own AGENTS.md, with 1,112 backend tests and an RWD validator standing before merge. Security hardening on the alumni platform ran as a six-stage audit pipeline — system understanding, backend and frontend findings, a remediation backlog, verified-fix versus needs-verification triage, then rollout. UI/UX got the same treatment on each system: page inventory, top-30 issues, launch blockers, fix list.
- SECURITY_REVIEW
- Six-document audit pipeline: SEC-001–030 remediations; permission model flipped to default-deny.
- UIUX_AUDIT × 2
- One full pass per system: page inventory → top 30 → launch blockers → fix list.
- AGENTS.md(borrow)
- In-repo agent playbook: structure, test commands, naming and commit conventions.
- 1,112 tests · RWD
- The gates agent output must clear: backend integration tests plus a Puppeteer RWD validator.
- aaic.nkust.edu.tw
- Both systems are live: the alumni platform, and equipment-borrowing.binbinbob.work.
05 / BOUNDARIES
Boundaries
What agents don't get to do — as important as the loop itself.
- 01
Architecture and data-model decisions are not outsourced: agents propose options and analysis; I make the call and record it.
- 02
Personal data and company-internal material never enter agent context; anything published is scrubbed to a confidentiality boundary first.
- 03
Output is not done: it counts only after tests, E2E and human review — and security fixes ship only after manual confirmation.