Session 15: Loop, Harness & Graph Engineering (posted as 'Securing Vibe-Coded Apps')

The trainer's ladder: beginner vibe coding is describing what you want to a prompt-first builder (Lovable, Bolt — 'peanuts' once you know Claude Code); Cursor sits just above beginner; Claude Code and Codex are intermediate; and the advanced level is building ENGINEERING SYSTEMS — systems that prompt, test, check and correct so you don't.

The framing authority is Karpathy himself. February 2025: vibe coding coined — 'fully give in to the vibes… forget that the code even exists.' February 2026, his own retrospective: back then LLM capability was low enough that vibe coding suited 'fun throwaway projects, demos, and exploration' — and the MIT figure that 95% of GenAI products aren't making money is cited as the receipts. Now 'programming via LLM agent is becoming the default workflow for professionals… with more oversight and scrutiny,' and his name for it is AGENTIC ENGINEERING: '99% of the time you are orchestrating the agents,' with real craft and depth to learn. Telling AI to write code hasn't changed; the way we do it is what leveled up.

Before any machinery, the trainer plants the stake: through every level up to AGI, the constant is solving a real business problem for a real user. 'You need to build a usable product… clarity and product thinking capabilities.' The 80/20: understanding customer requirements, product requirements, and usability is 80% of the work; the AI that builds it is the 20%.

His receipts are personal: NEM memory, built to solve his own Claude Code pain (context lost between sessions, endless re-explaining). A non-tech founder shipping a developer tool for developers — 244 clones in 14 days, ~119 GitHub stars, and inbound traffic from Google, Bing, and even Perplexity citing the product. 'If you don't have a solution for your own problems, how can you solve other people's problems?'

The definition: loop engineering is designing an autonomous system that prompts, evaluates, and guides agents UNTIL A SPECIFIC TASK IS COMPLETE — removing manual turn-by-turn prompting. You supply the goal; the loop supplies the prompts. The lineage cited: Peter Steinberger coined the term's current wave, and Boris (of Claude Code) describes his own workflow as 'I have a claude that prompts other claudes — I don't even talk to claude.'

The load-bearing element is the CHECKER — the piece vibe coding never had. Until now the human was the checker ('Claude told me it is correct. I believed it'). In a designed loop, a separate check judges the doer's work and refuses completion until requirements are met. And a reassurance on cost: the trainer runs loops daily nearly free by smart tool choice (OpenClaw/Hermes on GLM 5.2) — 'having that fear of tokens is holding you back.'

Turn-based: you prompt, the agent works, YOU verify, you re-prompt — no checker, the human closes every loop. Goal-based: you state the goal once and the loop runs until a verifier confirms requirements are met — today's build. Time-based: scheduled recurrence ('every morning, check my GitHub for bugs and PRs, address reviews') — /loop in Claude Code is this flavor; /goal (also in Codex) is the goal flavor. Proactive: the autonomous frontier — trigger-started, runs continuously across recurring streams of work (bug triage, migrations), no human needed to declare done; it runs until you turn it off.

The sharp contrast: n8n is NOT a loop in this sense. 'It does not self-adjust. It does not improve. If there is a problem, it is a problem' — a workflow follows fixed instructions; a loop evaluates and corrects itself. Adding an AI node adds brain to one step, not to the system.

The goal states what to build, what goes in, what comes out, and what 'finished' means. Act builds. Check compares the result against the goal. Adjust relays what to fix ('boss, it is not correct — tell act where the code should improve'). Finish only fires when check signs off: 'you cannot go home without my permission until I sign off.'

The two main elements are act (the doer) and check/adjust (the verifier) — separated deliberately. Before this, 'it was only doer… we weren't sure what Claude was doing is correct or not. Claude told me it is correct. I believed it.' The separation is the security story of the session's title, delivered structurally: correctness is enforced by an element whose only job is to refuse.

The goal-prompt template: build [what it is]; I give it [inputs]; it returns [outputs]; it must follow [rules, plus the tricky ones]; WRITE REAL TESTS that check all of this; then build and keep fixing until every test passes. The tests clause is where the checker gets built — 'people asking about security: you don't have to write tests. AI will do that for you.'

The demo made the loop visible: a hidden test file defining secret password rules, with the prompt forbidding reading it ('do not open it, do not read it, do not print it — I'm keeping the rules secret from you on purpose'). Claude had to attempt, run the check command, read ONE failure message, fix that one thing, and repeat — capped at 20 tries. It discovered every rule in 7 iterations. Ancestry acknowledged: this is TDD (test-driven development), the decades-old discipline, with the tedious part — writing the tests — now done by the agent. Contrast case: the Antigravity bill-splitter used 'work in a loop and don't stop until it's done' as an INSTRUCTION, not a /goal — the agent still planned, tested and delivered, but it's an instruction-loop, not a goal-loop. And scale: one of his demos ran 261 tests in minutes.

The question the demo begs: run it again — does it repeat the 7 iterations? With memory off, yes: 'starts over every time, repeats the same mistakes,' burning tokens and time. With memory on, it 'reads its own notes, never solves the same problem twice' — one round.

This is the trainer's home turf: NEM memory exists because Claude Code kept forgetting context between sessions. His architecture stance is radical simplicity and privacy: memory is local text/JSON files ('people are complicating it… they're storing your memory in their cloud server — your privacy is not private anymore'), with context-scoped retrieval so fetching memory doesn't itself burn tokens reading everything. And the AGI aside lands the point: whatever intelligence arrives, 'how will something beat human intelligence if it doesn't have memory?'

Route models by role, not by habit. Goal parsing: a cheap model (Gemini Flash-class) — it's reading goal.md. Act: a good model — it writes and rewrites the code; this is where capability pays. Check: cheap, in the trainer's argument — it reads the test report against the goal text, a summarization-grade task ('if you submit a PDF to ChatGPT to summarize, why do you need [the frontier model]?'). Adjust: a good model — it reads CODE and must say what to change.

'Frontier model' defined for the cohort: the expensive reasoning tier (Opus, 'Sonnet 5.5', 'GPT 5.5' as heard). His broader practice: daily driving on near-free routes (OpenClaw/Hermes on GLM 5.2) and saving the expensive tier for the seats that write or diagnose code. The closing stance is characteristic: 'don't listen to me — you experiment; that is how you learn.'

The machine, in restaurant terms: orchestrator.md is the CHEF — instructions to read goal.md as 'the single source of truth,' split it into independent parallel subtasks ('as many as the work naturally needs, no more, no less' — 2–3 simple, 6 max by his own guard rail, 'or it can create an army'), and write for each 'a complete standalone prompt that a fresh Claude with zero prior knowledge could carry out on its own.' dispatch.py is the WAITER — a small script reading tasks.json and starting a brand-new Claude per task, routing each order to its station. checker is the FOOD INSPECTOR — verifies each task's definition of done, pass or fail, and sends failures back. The orchestrate loop file is the MANAGER — wraps it all in one loop: run workers on unpassed tasks, run the checker, feed failures back to fresh workers, repeat.

Operations: the four files are permanent — never delete them. Per product: copy the folder, rename it, write your goal.md, and fire a custom /run-lab slash command (you create it once; global if you like). Auto mode plus remote control, and 'go wherever you want on vacation — your product is built.' This is Boris's 'claude prompting other claudes' as a folder you own.

The employee-onboarding analogy carries every component. CLAUDE.md = the employee handbook (rules: what to do, what never to do). The TEAM = role agents ('create these agents': planner turns requests into steps, coder implements one step at a time, security reviewer checks secrets and risky permissions, tester writes and runs tests — 8–10 max, scaled to the goal). SKILLS = the checklist for the forgetful employee — reusable procedures the setup invokes automatically (his plug: install superpowers; 'this setup will launch that skill automatically'). GUARDS/HOOKS = the safety lock on the database button: 'a rule is followed most of the time; a hook is followed EVERY time. Rules are advised. Hooks are enforcement.' MEMORY = no dementia patients on staff. LOOP + CHECK = 'done is a hope until it's proven.'

Packaged as a plugin (his is 'Forge' — shown, not shared: 'why should I give my sweat and blood to you for free?… if I give everything free, it becomes spoon feeding'), the harness persists across projects: 'you tell claude code in plain English, create this. You will not write a single one of these files by hand.' And here the title's promise is honestly kept: security shows up as the security-reviewer agent, agent-written tests, and guards — 'everyone who was asking about security: the agent will do that for you.'

The day-old frontier (the naming tweet was ~24h before the session — Steinberger again: 'are we still talking loops or did we shift to graphs?'). Nodes are agents; edges are dependencies — 'not conversation, but a signal that this agent is done,' which is how an orchestrator knows to spawn the next worker. Demonstrated in Agent Grid (agentgrid.sh), a desktop canvas where Claude Code, Codex and Antigravity run TOGETHER — 12 agents on screen, spawn-on-right-click, prompt 'spawn 3 workers in parallel' and watch notes/ideas/tests workers file their outputs.

Two ideas ride along. First, CODEX AS JUDGE: 'a lot of people don't recommend using the same model [as judge] because it can be biased' — agent evals with a different model checking the builder's work. Second, sobriety about hype: 'these people's job is to create hype so that AI stays up… when you test it, you consume tokens, and this is how they make money.' Graph isn't new — loops weren't either (TDD is decades old); what's new is agents doing the tedious parts. His production case: CV-TAS, a self-hosted private org-intelligence product (DPDP/GDPR-sensitive), built by a graph including a demo-tour agent that opens a browser, clicks through the product like a user, and records the launch video unattended.

The session ships with its own learning protocol. Nobody absorbs this live — 'whoever found this loop [couldn't] either.' The method: watch the recording multiple times ('first live session, I understood zero'), build alongside it rather than note-taking, feed the guides to AI and ask for five-year-old explanations, screenshot errors and iterate. Homework is deliberate and unresolved: does the lab port to Codex? Does it run in Agent Grid, Hermes, Paperclip? 'Instead of asking me, you do it.'

The three Ps — practice, persistence, patience — plus a 30-day contract: two hours a day, level 4 reachable in a month. Follow the practitioners, not the vendors (Steinberger, Karpathy, the Claude-adjacent builders): 'people don't follow OpenAI… people follow people. People trust people.' And Q&A was pushed two weeks out on purpose — come back with attempts, not questions.