The compiler checks three of the seven things your coding agent had to get right

The corpus a model sampled is a repository's history, not its head commit. go-admin has been public for several years ^[1], and the hand-written Api-and-Service style was the only style for most of them ^[2]. The Actions pattern is what the codebase recommends now ^[3], which means it is thinner in the public record purely as a function of calendar time. The project's own writeup argues the retired style is a large share of what is visible on GitHub and is therefore overrepresented in training ^[5]. That is an assertion, not a measurement, and no numbers are offered. It is still the right shape of claim, and it applies to any repository whose current convention is younger than its git log.

Both styles compile, and nothing warns you ^[4]. Worth sitting with: a module that a user can actually reach spans at least seven artifacts, three code files plus rows across four tables, and only the three files are validated by anything that runs automatically ^[17]. Route registration, menu mounting, the menu-to-API relationship and the casbin policy all have to be seeded ^[7], and if one is missing the result is a sidebar with no menu item or a button that does nothing, with no error emitted ^[8]. The compiler and Postman both report success ^[15]. Debugging that means checking four candidates against one indistinguishable symptom, across two repositories.

The layering in the mitigation is ordered by decay rate, which is the part that generalises. The AGENTS.md files in both repos are kept deliberately short, restricted to rules that break something when ignored, with stack versions and commands left to go.mod and package.json so the file cannot fall out of sync with the code ^[9]. Underneath that is a reference implementation at app/demo/ that compiles, has tests, and runs in CI ^[10]. The stated reasoning is that prose goes stale and CI-exercised code does not ^[11]. A reference implementation has a failure mode that a document lacks: it can go red. A convention file is only ever as current as the last person who remembered to edit it.

The Skill layer turns adding a module into one invocable procedure covering table design, migration, scaffolding and the seed-data step, with each step pointing at a runnable file rather than asking the model to reconstruct one ^[12]. The frontend has a matching skill for list and form pages, and the coupling between them is a single string, the permission identifier ^[13]. The framework's deterministic generator still handles standard CRUD from a table definition, with generation reserved for business logic, refactors and tests ^[14].

The cost that gets underpriced is not the 403. It is that two weeks later nobody can tell which parts of the module were written by a person ^[16]. Review depends on being able to distinguish, and a model that writes your codebase's past writes something that reads like it belonged there.