Agentic systems

Agentic Engineering vs Vibe Coding: What the Gates Cost

What do the two terms actually mean?

Vibe coding is Andrej Karpathy's phrase from a post of 2 Feb 2025. His description is specific about the habit: he presses "Accept All" every time and no longer reads the diffs, pastes error messages back in without comment, and says it is "not too bad for throwaway weekend projects". The definition is a behaviour, not a tool: you let the code outgrow your understanding of it.

"Agentic engineering" has a less tidy origin than vibe coding. In a post of 4 Feb 2026 Karpathy does not claim to have invented it. He says many people had tried to find a better name for professional agent use, that his "current favorite" is agentic engineering, and that the professional version differs by "more oversight and scrutiny": you stop writing the code yourself and orchestrate agents, but you still own the quality of what ships. That is the definition this page uses: agent-written code plus the work of making it trustworthy.

One caution if you read around the topic. A 2025 review on arXiv, Vibe Coding vs. Agentic Coding (26 May 2025), uses "agentic" for the other end of the oversight scale: goal-driven agents working with minimal human intervention, against vibe coding's conversational, human-in-the-loop style. Its conclusion is that successful practice combines the two rather than picking one. Karpathy's "agentic engineering" and the paper's "agentic coding" share a word and point in opposite directions on the question that matters here, how much a human checks. When someone says their team does agentic engineering, ask what they check.

The six gates, and the bill for each

Each row is a gate we run, the failure it exists for, and one number from this repository with its date. The sections after the table give the detail. Every figure below was re-read at its source on 19 Oct 2026.

Gate 1: does the spec exist before the prompt does?

Write down what done looks like, and what is out of scope, before the agent writes a line. Anthropic's own guidance for Claude Code separates exploring, planning, implementing and committing, and for larger work suggests letting the model interview you, saving the resulting spec as a file, and handing it to a new session. The same page names the exemption in its own words: "If you could describe the diff in one sentence, skip the plan" (read 19 Oct 2026). That exemption covers the plan, not the checking: the same page still expects the model to have a check it can run against its own output. For genuinely throwaway work, see when skipping every gate is right.

The price is one file per task and a review of it before any code exists. The limit of the gate showed up on 25 Jul 2026, when we wrote a spec from a ticket saying a degraded grading path left no record that the degrade had happened. The path already tagged those attempts (src/lib/grade.ts, migration 0007_attempt_context.sql). The implementing agent found that by reading the code, and the proposed schema change became a regression test. A spec reviews the plan, not the plan's inputs, which is what gate 2 is for. The workflow pages spec-first development and validating the validator carry the longer accounts.

Gate 2: is the task's premise still true at HEAD?

Before an agent edits anything, it greps the exact text the task quotes at the path the task cites and confirms the defect is live. On 11 Aug 2026 we measured 56 ledger rows dispatched to agents; 7 of them, 12.5%, had a premise that no longer held, and two of those would have introduced new errors if executed literally. One proposed replacement citation said the opposite of the claim it was meant to support, and one market figure was overstated on re-measurement. Every one of the seven was caught by an instruction written into the dispatch brief. Nothing mechanical caught any of them.

We tried to make it mechanical, and both attempts failed on the same day. The first was a path-existence check on every citation: in 36 citations it found no real breakage and still raised false alarms, at a 25% rate, because a bare filename is not a repo path. The second re-grepped every quoted string and flagged 35 of 49. Nearly all of those were false alarms, because the quotes were written correctly: a quote can be live text, text not written yet, text from another file or a proposal, and nothing in the ticket format says which. Our deciding what to build workflow has the longer account. So gate 2 remains an instruction, and its price is a sentence in every brief plus the discipline to put it there. Keep that in mind at gate 3. Not every rule should become a hook; a rule has to be decidable before a script can hold it.

Gate 3: where an instruction failed, is there a hook?

Anthropic's best-practices page says CLAUDE.md instructions are advisory, while hooks "are deterministic and guarantee the action happens" (read 19 Oct 2026). Our own record is more mixed. In July 2026 we wanted a session to reach for the claims reviewer unprompted, and three tries all missed. The original description missed, and so did one rewording. The third try reworded it again and added a PreToolUse hook in .claude/settings.json, which fires on every Edit or Write to a page under public/. The hook did its job, but the eval's scenario never edits a file, so no edit hook could fire on it, and the eval failed. The founder log has the entry.

Be exact about what that hook is: its payload is a reminder to dispatch the reviewer, not a block. The backstop is step 8 of the release runbook, which sends every copy-bearing diff to the reviewer, and it is run by hand. That is discipline, not an invariant, and we have logged a decision not to build a check that would make it one. Deterministic delivery of an advisory message beats a sentence in a prompt, and it is still a different thing from a gate that can refuse. The deterministic gate pattern separates the two cases and says when not to gate at all.

A refusing gate earns its place by finding what people did not. The content linter's first run, on 10 Jul 2026, turned up 208 quiz items, spread over 52 of the then 67 modules, where the right answer was also the longest option. Human review had passed that cue, and a script reads it for free. The deterministic gate pattern has the full account. Gates also need fixtures of their own (test/gates.test.mjs): until you have watched a check fail on purpose, you do not know that it can.

Gate 4: did you reproduce what the reviewer told you?

A reviewer produces a finding and a severity, and the severity is the softer half, because it comes from reading code, not running it. One of our reviewing agents rated a weakness in how a classifier's output was parsed "Minor, defer". Running the function took about thirty seconds. The real trigger was wider than the rating assumed, and the weakness failed open on a security path. The four inputs and the whole case are on the AI-assisted review workflow.

The price is those thirty seconds, per finding on any path that touches security or money. Anthropic's best-practices page warns about the opposite error: a reviewer told to hunt for gaps tends to find some whether or not they exist, and acting on every one produces over-engineering. So test a reviewer's output as a claim in both directions, and limit its findings to what breaks correctness or the stated requirements.

Gate 5: does every dispatch name its model?

When you fan work out to subagents, anything left blank takes a default someone else chose. By 15 Aug 2026 our session pin had moved to the top model tier while the dispatch guidance still said judgment work should inherit the session's model, a rule written when that model was Opus. Until the rule changed that day, a dispatch that omitted model: ran at the top tier, which the decision record prices at twice Opus, and no run said so. The top tier lists at $10/$50 per million input/output tokens, against $5/$25 for Opus 5, the Opus of the day; against today's Opus 5.5 at $4/$20 the multiple is 2.5. Since that day model: is a required field on every dispatch, and the tier table names a model where it once said "inherit". Forks are out too: a fork runs on its parent's model.

The price of this gate is one field per dispatch. The less obvious price is upkeep: the dispatch note that records which model the session is pinned to says of its own sentence that it has gone stale five times, and tells the reader to read the settings file instead. The mechanics, and the other defaults a harness chooses for you, are in what your agent harness decides before you do.

Gate 6: who checked that "clean" is clean?

Authors grade their own work generously, and an agent author is no exception. A draft of issue 014 of our weekly Brief went through four rounds of originality review on 19 Oct 2026. The first flagged 11 passages in its table, verbatim or near-verbatim text from vendor release notes, changelogs and docs, and one EU page. The second, after a rewrite pass, flagged 13: the pass had rewritten with the source open and kept its sentence shapes, and in one place pasted in about thirty words of the source's own tool list. The third flagged 4 passages, two of them plain synonym swaps. The fourth checked 5 rewrites, passed 4, and flagged one more passage that no fix pass had touched. The draft carried a note claiming vendor wording was limited to identifiers and attributed quotes. That note was wrong in each of the first three rounds.

What moved the count, from 13 flagged passages to 4, was a different drafting method, not a better prompt. Extract each item's facts as bullets, close the source, write the prose from the bullets, then grep six-word runs of the prose against the source. Be careful with the ending, because the record is careful: the last two rewrites were made by the coordinating session and were not re-reviewed, so as of the 19 Oct record the final state was unverified. The price of the gate was four review rounds on one issue. Without it, the draft would have reached owner sign-off carrying the passages the first round flagged, under a note saying there were none.

The gate is code too

Everything above assumes the gate itself is right. Ours were not, twice over. A script that validated our coordination ledger split table rows on every pipe character, so two rows containing a correctly escaped \| parsed as nine cells instead of eight and were reported as broken. The permanent gate written to prevent that had the same bug on its first pass, and the fix is one lookbehind in scripts/lint-monday-artifacts.mjs: line.split(/(?<!\\)\|/). A checker that manufactures defects costs trust faster than one that misses them. The cases, and the opposite failure where a gate reports green it never earned, are in validating the validator. If what you ship is an agent rather than code written by one, the corresponding gate is an eval harness written before the feature, covered in eval-first development.

When is skipping every gate the right call?

When the blast radius is you, for a weekend, with no data worth keeping and no one downstream. Karpathy's own description of vibe coding scopes it to throwaway projects, the 2025 arXiv review places it in early-stage prototyping and education, and Anthropic's guidance narrows only one gate, skipping the plan when the diff fits in a sentence, while still expecting the result to be verified. The first two draw the same boundary; the third points the same way on a smaller scale.

A working test for the boundary: could you delete the folder and lose nothing but an afternoon? If yes, vibe away and do not feel guilty about it. If the answer involves a user, a credential, a bill, a published claim or a migration you cannot reverse, the work was never in that zone, and reaching for the exemption there is the failure, not the freedom. Do not buy all six gates for every change either. The overhead should scale with what a wrong merge costs: gate 2 and gate 4 are nearly free, gates 1 and 6 are not.

Where these numbers come from, and where they stop

Every figure above comes from the repository that builds this platform: its dispatch notes, decision log, changelog and review records, plus our published workflow and pattern pages. Three limits matter before you transfer any of it to your team.

• No control group. We never ran this repository without the gates, so none of these numbers says a gate reduced defects by some percentage. They say what each gate caught or cost when it ran: 7 of 56 tasks, 208 items, 30 seconds, 4 rounds.
• A ledger of tasks is not a stream of pull requests. The 12.5% is a rate over ledger rows dispatched to agents, and a row can wait before it is picked up, which is how a premise expires. A team that dispatches fresh work from live conversation may well see a lower rate; we have not measured it.
• The estate is unusual. One owner, a Cloudflare Worker, a content site, and much of the code and prose drafted by agents and reviewed by other agents. Gate 6 in particular reflects a publishing workflow with a weekly deadline. A product team with a staging environment and on-call has other gates available and different failure costs.

If your numbers differ, that is the useful result. The gates are cheap to instrument: write down, per gate, what it caught and how long it took, and you have the same table.

Frequently asked questions

Is vibe coding bad?

It is bad for anything someone else depends on, because the habit that defines it, not reading what you accept, removes the only point at which a human could notice a problem. For a throwaway project it costs nothing and the speed is real. The failure is applying it outside that zone.

Who coined "agentic engineering"?

Karpathy does not claim it. In his post of 4 Feb 2026 he says many people have tried to come up with a better name for professional agent use and that agentic engineering is his current favorite; the post does not say who used it first. He coined "vibe coding" a year earlier.

Is agentic engineering just vibe coding with tests?

Tests are one gate. The others catch failures tests cannot: a task built on a premise that was already false, a reviewer's wrong severity, a default model you did not choose, an author's mistaken all-clear.

Do I need all six gates?

No. Start with the two that cost almost nothing, the premise check and reproducing a reviewer's finding on any security or money path, then add the others where a wrong merge is expensive.

What is the difference between agentic coding and agentic engineering?

Usage is not settled. The 2025 arXiv review uses agentic coding for goal-driven agents with minimal human intervention. Karpathy's agentic engineering puts oversight at the centre. Ask which one a source means before comparing its claims.