开发者复盘：如何修复编码 Agent 留下的一致性漏洞

This article is a follow-up to a series about handing work to coding agents, joining earlier posts titled "Fix the build" is not a task, Show your work, and Where should a coding agent stop and ask?. All three posts draw on the same September session on schoolCRM, the author's own school operations platform. In that session, the author typed only a bare instruction—"fix it"—and an agent turned the previously failing test green. It did so, however, by leaving behind an inconsistent API, along with middleware vulnerabilities, that the author did not address at the time.

In November, the author went back to the project to repair those leftovers properly. This time, before handing the task to the agent, the author wrote out the complete, rigorous brief that should have been written back in September. The article walks through the specific case: what kind of inconsistencies the agent had left in the API and the middleware once it had quickly turned the test green, and how the repair proceeded once the agent was given a properly specified brief rather than a one-line instruction.

On the basis of this experience, the author stresses that providing a complete and rigorous brief before delegating a task to a coding agent is essential. As of the post, the retrospective on how to properly repair the inconsistencies a coding agent leaves behind stops here: what the article shows is precisely this round of fixes, carried out after the missing brief was supplied. What it does not yet answer is how often the same pattern appears when a coding agent is handed a task without a brief in other projects. The story is a case study of one session, not a general rule, and it is written from the author's own experience on schoolCRM rather than from measurements across multiple codebases.