This website was built and shipped by an agent running Coding OS

The website you are reading — this blog, the docs, the prompt library, the community forum, the CI/CD pipeline behind them — was built and deployed by an AI agent running Coding OS, across a handful of sessions on a single VPS.

That sentence is easy to write and easy to disbelieve, so this post is about the part that made it true: not the model, the discipline.

What the agent actually shipped

• A Next.js site (standalone container) with docs, blog, a prompt library with variable-fill, and auth.
• A self-hosted Supabase slice — GoTrue and PostgREST only, fronted by Caddy — on a shared Postgres cluster.
• A Discourse forum with single sign-on against the site, so one account works everywhere.
• Push-to-production CI: tests gate the build, the server pulls, builds, health-checks, and swaps the container.
• The observability layer: analytics, error tracking, sitemaps, structured data.

Total idle RAM for everything: about 2.5 GB. Monthly infra cost: roughly what two coffees cost in Toronto.

The three rules that did the work

Verify by executing, not by reading. The standing rule for every "it works" claim: run it the way a user would. The deploy pipeline was watched end-to-end before it was called done. User flows were clicked through in a real browser — which is how a CORS bug was caught that every curl-based check missed: the API answered curl perfectly and failed only under a browser's preflight. "Tested with curl" and "works in a browser" are different claims; the process forces the second one.

Docs move with the change, in the same session. Every infra decision landed in a runbook the moment it was made — the bootstrap, every fix, every gotcha (like the reverse proxy that silently ignores reloads and must be restarted). The next session — or the next human — inherits decisions, not mysteries. This is what made multi-night autonomous work possible at all: each morning's context was a readable timeline, not a 400-message transcript.

Smallest correct change, even at 3 a.m. One night's debugging queue was: an auth redirect bug, a broken email-verification path, and that CORS issue. Under Coding OS each one had to be classified, scoped, fixed, and committed separately — no heroic rewrite, no "while I'm here" cleanup. The git history from that night reads like a surgeon's log, and every fix was individually revertable.

What this means if you run agents

None of the above required a smarter model. It required a system that makes the good path mandatory: gates before code, verification before "done", documentation before the session ends. That system is open source and installs on the agent you already use.

The punchline isn't that an agent built a website. It's that a disciplined agent left behind something a team can actually maintain.