For the last few months I’ve used this blog to make a fairly unpopular argument: that software generated quickly by AI, without rigorous structure underneath it, is destined to rot into a Zombie Architecture. I called the frictionless, vibe-coded enterprise a zombie waiting to happen.
So when my family booked a week in New York this July, I decided to test my own thesis from the other side. Could I build a real, production app — fast, with an agent doing the work — and not create a zombie? Could I do it on nothing but free tiers? And how much of the job would actually be left for me?
The app itself is unremarkable: a phone-first trip planner for the six of us — itinerary, a live map, weather, shared comments. The interesting part is who built it, and how.
I Sat in the Architect’s Chair; the Agent Did the Typing
It began life as a Claude Design mock-up — a clickable prototype, no backend. From there an agent took over. It wrote the Next.js app, modelled the database, wrote the migrations, ran the builds and pushed the deploys. I didn’t write the code. I wrote the briefs, made the architectural calls, and reviewed the diffs.
That distinction is the whole point of this post, so let me be precise about it. The agent was not improvising a sprawl of code from a vibe. It was working inside a structure I set, against checks it could not skip.
This Wasn’t Vibe-Coding. It Was a Pipeline.
Every feature followed the same loop: brainstorm → spec → plan → build → review.
Before a line of code, we agreed a written specification and committed it to the repo. Then a detailed, bite-sized implementation plan — also committed. Only then did the build start, and it ran task by task: a fresh sub-agent per task, an adversarial reviewer after each one, and a whole-branch review at the end run on the strongest model available. Independent tasks ran in parallel in isolated git worktrees and merged cleanly.
If that sounds familiar, it should. The spec and the plan are architecture as code — version-controlled, reviewable, the source of truth that an LLM can actually act on. The thing the demos skip isn’t the code generation; it’s the spec and the review loop. That is the architecture, and it is exactly what keeps the output from becoming a zombie.
The Agent Ran the Stack
This is where it stopped being a coding assistant and started being an operator. It didn’t just write the app — it ran my infrastructure through their CLIs and APIs.
It provisioned and migrated the Supabase database, deployed to Vercel, wired up a custom domain through the Vercel API, managed the GitHub repo, and configured Google Cloud API keys. At one point — with my permission — it read my inbox to pull the actual British Airways e-ticket and our restaurant and Broadway confirmations straight into the itinerary, so the data in the app was real rather than placeholder. The grinding keyboard-and-dashboard work I’d normally lose an afternoon to, it simply did.
Where the Architecture Earned Its Keep
The most revealing moment was the access model, because it’s where “good enough” and “correct” part company.
I started with an open, unlisted URL — a deliberate, documented trade-off: security by obscurity for a private family app. Then I changed my mind and asked for real protection. That one sentence turned a comments feature into an access-model change: Google sign-in, a Postgres Row Level Security allowlist, and admin/member roles enforced in the database, not merely hidden in the UI.
Here’s the part I want the vibe-coding optimists to sit with. The final whole-branch review — the adversarial one — caught that the displayed author on a comment was being set from the client, so a member could post a comment that visibly appeared to come from someone else, even though the underlying identity was honest. It hardened it with a database trigger that pins the author to the verified JWT. That is precisely the kind of edge case I keep banging on about: the edge cases are the enterprise. The difference between a demo and a system is a hundred small decisions exactly like that one — and you only catch them if review is part of the pipeline, not an afterthought.
The Last Mile Nobody Demos
The unglamorous bit was, as ever, the most instructive. Pointing a real domain at it meant a GoDaddy DNS record and a Vercel redirect. Changing the domain instantly broke the map, because the Google Maps key was locked to the old referrer. The two API keys had to be scoped to least privilege — one browser key, referrer-restricted; one server key, locked to just the APIs it calls. And the migration that locks the database down had to be applied by me by hand, because the agent’s sandbox couldn’t reach the Postgres port.
I’d call that a feature, not a bug. The human stayed in the loop for exactly the things that should require one: the OAuth consent screen, the SQL that seals the database, the DNS that owns the front door. Accountability didn’t evaporate. It concentrated.
The Bill
The production stack costs £0. Vercel on the Hobby tier, Supabase on free, weather from keyless Open-Meteo, maps inside Google’s free credit. The only things that cost anything were the Claude subscription doing the labour, and a domain I already owned. A secure, real, family-grade app for roughly the price of the electricity.
What Actually Changed
Not the speed. The structure around it.
I’ve spent months warning that generating code is cheap while orchestrating something secure, compliant and maintainable is not. Building this app didn’t contradict that — it proved it. The agent was a tireless, genuinely capable builder, but everything that made the result trustworthy lived outside the code generation: the spec, the plan, the review loop, the RLS, the human signature on the irreversible steps.
The role that’s left when the typing is automated isn’t smaller. It’s just more honest about what it always was. Deciding what is correct, what is secure, and who is accountable — that’s the job. Which, conveniently, is architecture.
The accidental architect, it turns out, is now mostly just an architect.