"Autonomous" agents are like contractors with an unlimited credit card. Their default mode is Over-Provisioning. If I hadn't intervened, I would be paying for 40GB of empty space every month. You cannot just "set and forget"—you have to force them to optimize, or they will spend your budget to solve their inconvenience.

Day 1.5: Security and Tech Debt Check

Why did Claude Opus 4.5 pick these versions? Because LLMs are frozen in time. The agent "vibed" with Next.js 14.0.4 because it saw it often in its training data, ignoring the fact that a critical patch (14.2.35) had been released to fix a remote code execution exploit.

Look at the last row of the security table. I am still left with a High Severity vulnerability. Why? Because fixing it requires a major upgrade to Next.js 15 (Phase 4 in the upgrade table), which introduces breaking changes to the App Router that would require a complete rewrite of the frontend.

Day 2: The Networking Black Hole

1. Internal Reality: The backend services talk to each other via a private Docker network (http://minio:9000).

1. External Reality: The user's browser talks to the public internet (https://minio.sdp.vizops.ai).

The agent kept generating presigned URLs for the browser that looked like this:

The browser, naturally, tried to resolve minio:9000, failed, and the upload hung indefinitely.

I explained this to the agent three times.

I had to stop the "vibes," open VS Code, and architect a split-client solution that the LLM completely missed:

// src/lib/minio.ts

// 1. Internal Client: Used by the server to put objects
// fast, secure, stays within the Docker network
const internalClient = new Minio.Client({
  endPoint: 'minio',
  port: 9000,
  useSSL: false
});

// 2. External Client: Used ONLY to generate Presigned URLs for the browser
// accessible from the public internet
const externalClient = new Minio.Client({
  endPoint: 'minio.sdp.vizops.ai',
  port: 443,
  useSSL: true
});

The agent could write code, but it couldn't architect a network.

Day 3: The HTTPS & Cookie Nightmare

// src/lib/auth.ts

export const authOptions: NextAuthOptions = {
  // Agent missed this: Explicitly trust the proxy
  useSecureCookies: process.env.NEXTAUTH_URL?.startsWith('https://'),

  cookies: {
    sessionToken: {
      // I had to manually rename this.
      // The agent didn't know that 'Secure' cookies need this prefix.
      name: '__Secure-next-auth.session-token',
      options: {
        httpOnly: true,
        sameSite: 'lax',
        path: '/',
        secure: true
      }
    }
  }
};

Because I changed the cookie name from next-auth.session-token to __Secure-next-auth.session-token, every single user session was instantly invalidated.

The agent didn't warn me about this. It just applied the fix and wiped the slate clean.

Day 4: The Feature Flop (Google Drive Integration)

1. A button that said "Connect Drive."

1. A list of files.

• No Shared Drives: It only queried the user's personal drive. Corporate Shared Drives? Invisible.

• Broken Import: The buttons looked great, but clicking them did nothing.

{
  "error": {
    "code": 400,
    "message": "Invalid Value",
    "errors": [
      {
        "domain": "global",
        "reason": "invalid",
        "message": "Invalid orderBy parameter: 'folder,name'"
      }
    ]
  }
}

The agent didn't look up the documentation. It just hallucinated a parameter because it "vibed" with what I wanted. I spent 4 hours debugging a feature that should have taken 30 minutes, all because the agent guessed instead of checking.

Never get fooled by how smart the LLM seems.

If you don't write the PRD, the agent will write the MVP. And the MVP will suck.

The $203.55 Suprise

• Time: 4d 5h 23m (Wall clock). This confirms it: the "weekend" project took nearly a full work week.

Then there is the code itself: 9611 lines added vs only 784 lines removed.

But look closer. For a simple MVP, 10,000 lines is massive bloat. And for 5 days of intense debugging, 700 deletions is suspiciously low.

A human engineer fixes bugs by deleting bad code and simplifying logic. An AI agent fixes bugs by adding code—more guard clauses, more try/catch blocks, more distinct files to bypass errors. It didn't refactor; it just kept patching over the cracks, resulting in a bloated, expensive codebase that "works" but is a nightmare to maintain.

Could I Have Done Better?

1. Pinned Context: I should have used a tool that "pins" the canary test instructions so they survived memory compaction.

1. Mocked Production: I should have built a local environment that mirrored the Caddy/SSL setup 1:1 to catch the cookie issues earlier.

The "Lovable" Trap vs. The Control Imperative

• They handle the hosting.

• They handle the networking.

• They handle the environment.

These platforms give you a predictable, reliable experience because they restrict your choices.

We need Control.

• Data Sovereignty: I need my data in my private VPC, not a shared cloud.

• Compliance: I need custom security headers, specific encryption standards, and audit trails that walled gardens often obscure.

• Cost: I need granular control over my inference costs and infrastructure (spot instances, specific GPU types) which "easy" platforms markup significantly.

If you want the Ease of vibe coding but the Control of custom engineering, you are currently stuck in no-man's-land.

Closing the Prototype to Production gap with Vizops

1. State, Not Just Context: Our agents maintain a verified state of your architecture. They don't "forget" you are running on AWS when the context window compacts.