Engineering with agents

Lately I keep hearing a sentence that would have been absurd three years ago: "I can't do it now — I ran out of tokens." These are my notes from digging into Zero Token Architecture — the idea Kelsey Hightower took from a throwaway post to a PlatformCon keynote — and the principle I want to build on it: every AI call is an architectural decision, and the costs that matter most were never the tokens.

Once agents write a meaningful share of the code, my output is no longer typed code — it is delegation decisions. These are my notes on the human discipline that makes that work: sizing every handoff to the review I can afford, the brief I hand over instead of big tasks, and the four habits that keep me connected to a system I am no longer typing into — from Bainbridge's 1983 ironies to a METR result that has since reversed its own sign.

My feeds are full of screen recordings of developers watching an agent write code — and I want to name that posture kindly: it is spectating, not productivity. Closing the line of thinking from Zero Token Architecture and The Handoff Is the Unit of Design, these are my notes on the control plane a developer should never leave: small parallel handoffs instead of accept-all, research and side-effect mapping automated ahead of implementation, and the Log4Shell-shaped warning about shipping code nobody understands — with the costs of the conscious handoff named as honestly as its benefits.

The sharpest objection to "read every diff" is arithmetic: agents write faster than humans read. My answer is to stop arguing about review and name what review actually was — the profession's control point, the one place where observation, decision, and enforcement coincided. That point is saturating, and a saturated control point does not slow a system down; it gets bypassed and turns nominal. These are my notes on what a control point requires to function, why the arithmetic broke this one, and how each industry response — agents reviewing agents, verify-don't-review, risk-routing — is really a relocation that gives up a different property. No answer at the end. Three questions instead.

The last post asked where the control point went. Here is the first answer I am willing to defend: it did not go away — part of it compiled. Architectural fitness functions, pointed at coding agents, become the control plane that lets a developer stay in charge without becoming the bottleneck: judgment compiled once into deterministic gates that enforce at machine speed, with failure messages written as prompt engineering for the retry loop. Then the complication that shapes the whole post: the moment an agent optimizes against the compilation, the compiled control becomes an object of attack — and fitness function design inherits an arms race, with a Kotlin/ArchUnit constitution to make it concrete.

Every codebase carries two maps: what the tests verify, measured to two decimals, and what the humans still understand, measured by nobody. For twenty years the second map came free with git blame — authorship implied understanding. Agents deleted that axiom. Starting from Naur's forty-year-old warning about programs dying with their theory, through the forgetting-curve research and a 2026 preprint arguing the entire authorship-metric family collapsed at once, these are my notes introducing comprehension coverage: a per-module, per-person, evidence-based, churn-decaying map of which humans still understand which parts of a system — with its closest prior art named, its refutation conditions attached, and the instrument that builds it coming next.

The last post introduced comprehension coverage as a concept. This is the field report: the instrument exists, it is open source, and its first run was on a repository I own — a small library developed predominantly through coding agents. Four of six modules came back dark. The only entity the instrument recognizes as a comprehender of the signature module is a bot. This post walks the real map, the calibration run that argued with the spec and won, the trace of a dark module, the two failures the first run was required to produce, and the gate a CI pipeline can now enforce — with a break-glass valve whose every use feeds the map. The first five posts made the human layer explicit. This one makes it enforceable.