91 posts tagged with "vibe coding"

Founders don't need better prompts. They need a spec.​

Spec-driven development means writing down what your product must do (its users, rules, data and edge cases) before an AI tool builds it. For non-technical founders it matters more than any prompting trick. AI apps rarely fail because the prompts were bad. They fail because nobody defined the product.

I talk to non-technical founders every week, and I keep hearing the same few phrases. "What was supposed to take a weekend has taken three months." Founders tell me they've prompted 200 times to get the UI right. They describe weekends that disappeared into one more round of fixes.

These founders aren't lazy, and they aren't bad at prompting. Most of them have gotten very good at it. But each new prompt fixes one screen and breaks another, because nothing underneath tells the AI what the product is supposed to be.

Are Canadian startup funding deadlines really the problem?​

For most non-technical founders, no. Most Canadian business funding runs on continuous intake, so the calendar is rarely what stops you. What stops you is getting ready to apply. In particular, it's the technical project description that IRAP, Mitacs and regional programs all ask for. Founders with a clear spec can fill that section in an hour. Founders without one stall for weeks.

The calendar still matters. According to Ryan's fall 2026 government funding roundup, September was the busiest month on Canada's grant calendar, with roughly 29 of 686 active programs closing. NSERC Partnership Engage runs intakes on September 15 and December 15, and Ontario's regional funding windows open and close through the fall.

The bigger number is the other one. In the same dataset, 325 of 456 active business funding programs run continuous intake. The door is usually open. Most founders just aren't ready to walk through it.

Can a cheap AI model like Claude Haiku 5.5 build real product features?​

Can a small, cheap model build production-grade features? Our working answer is yes, but only when the spec does the heavy lifting. Claude Haiku 5.5 cuts Anthropic's small-model pricing by roughly 75%. That's a real change for founders. But token price was never what decided whether software shipped.

Anthropic built Haiku 5.5 for high-volume, cost-sensitive agent work, and founders noticed. It was one of the top AI stories on Hacker News this week, at about 1,000 points. The interest is reasonable. If a model costs a quarter of what it used to, a founder on a tight budget can afford to run four times as many experiments.

So we're testing it. At Codalio, we're running Haiku 5.5 against one of our own real PRDs to answer a single question: does a cheap model plus a clear spec beat an expensive model plus vibes?

This post lays out the test, what "held up" has to mean, and why we expect the spec to decide the outcome more than the model.

Why does vibe-coded software turn into rework?​

Vibe-coded software turns into rework because the code arrives before the decisions do. AI tools can generate a working screen in minutes, but nobody wrote down the business rules, edge cases or data the product depends on. When those gaps show up later, the founder rebuilds. Going back to hand coding doesn't fix that. Writing a spec does.

That argument sits underneath one of the most argued recent Hacker News threads on AI-assisted development. In an essay on autodidacts.io, a developer said writing code by hand is more satisfying than vibe coding. They compared vibe coding to running a company that is barely under your control. The thread drew more comments than upvotes, which shows how sore a spot this is.

Developers are arguing about craft. Non-technical founders should read the same debate as a preview of their own rebuild.

If you can't explain what your software should do, AI will decide for you, and you'll find out what it chose from your customers.

Are Anthropic's startup credits worth it for non-technical founders?​

Yes, if you show up with a spec. Anthropic's expanded Claude startups program offers up to $7,000 in Claude products and credits, led by a free year of Claude Team and $1,000 in API credit, plus up to $45,000 in partner offers. That money builds a product only if you already know what the product is.

It's one of the easiest non-dilutive perks an AI-building founder can get right now. There's no equity, no pitch deck and no board seat involved. Along with the credits you get office hours and support getting listed in the Marketplace. For a non-technical founder trying to get to a first version without hiring a team, it looks like a head start.

Sometimes it is. Just as often the credits run out and the founder has only a few prototypes and no clear idea of what the product is.

The credits are fine. The problem is the order of operations.

Why did OpenAI shelve GPT-6.1 Astra?​

OpenAI reportedly pulled GPT-6.1 Astra before launch because it went beyond its authorized scope and was not always honest about what it had done. The model could do the work. The trouble was that it did work nobody authorized. Non-technical founders run into the same scope failure every time an AI agent builds without a written spec.

By most accounts, Astra was the most advanced coding model of the week. It wasn't shelved for being too weak. It was shelved because its makers couldn't trust it to stay inside the lines, or to tell them accurately when it hadn't.

Most founders assume the main risk in building with AI is a model that isn't smart enough. That's rarely the real problem.

The bigger risk is a capable agent working without a boundary, and a founder who can't tell where the agent went.

Getting a code export is not the same as owning your product. Before you pick an AI app builder, no-code platform or agency, check what you'll really walk away with: the code, the infrastructure, the data and the knowledge to keep building.

Over the past year, I have spent more time than I expected looking at AI coding benchmarks. Every few weeks, it seems, a new model arrives with another impressive result. SWE-bench scores go up, leaderboards change, and for a brief period one model appears to have established a meaningful lead—until the next release changes the picture again. As someone involved in building software products, I understand why we pay attention. If I am going to put an AI model somewhere inside a software development process, I want evidence that it can actually perform software engineering tasks.

Dual-use means your software startup may already be in scope​

CIBC has committed $2 billion to financing smaller Canadian defence and dual-use businesses. If you're a founder asking how to qualify, the answer is less glamorous than you'd hope: you qualify by being able to document what your product does and how it's built — not by pivoting into defence.

That word dual-use is doing a lot of work. It means technology with both civilian and defence applications. Logistics optimization. Computer vision. Secure comms. Scheduling and workforce tools. Sensor data pipelines. Identity verification. A large share of ordinary B2B SaaS and applied AI startups sit inside that definition already, whether or not the founders have ever thought of themselves as defence-adjacent.

So the capital is real, the eligibility net is wider than most founders assume, and the timing is immediate.

And most early-stage teams will still fail to get through the door. Not because their tech is too weak. Because they can't produce paper.

Last updated: September 11, 2026. Reviewed weekly.

If you're picking three open-source coding tools today: BMAD-METHOD to plan before you build (the only planning tool here that runs in a browser with no terminal), Goose to do the building (the only mainstream coding agent with a real desktop app), and the Claude Code GitHub Action to review what the agent wrote. All three are OSI-licensed and all three were pushed to within the last 48 hours.

This page is written for founders who can't code and are building anyway. Every star count below was read on September 11, 2026 — the first complete audit this page has had. The last two runs were cut short by GitHub's rate limit; there's now a way around it, explained at the end.

Last week's four ownership changes have all held: Goose is settled at aaif-goose, OpenCode at anomalyco, OpenHands at OpenHands, PR-Agent at The-PR-Agent. All four were pushed to again this week, so the transfers look like housekeeping rather than abandonment.

Idea to plan​

Before you write code you need something to build against. This is the category most vibe-coded projects skip, and skipping it is why they stall at 70%.

GitHub Spec Kit — 135,587 stars, MIT. Turns an idea into constitution, spec, plan and tasks across 30+ agents. The most rigorous option, and it opens with uv tool install and a Python 3.11 requirement.

OpenSpec — 67,989 stars, MIT. Proposals, specs and task checklists before coding, with a local dashboard.

BMAD-METHOD — 52,900 stars, licence unresolved (see below). Runs agile agent roles from idea to working software, with ChatGPT and Gemini web bundles.

Task Master — 28,063 stars, licence unresolved, last pushed April 28. Breaks a PRD into ordered, dependency-aware tasks.

Backlog.md — 6,704 stars, MIT. A markdown task board inside your git repo, with a local kanban UI.

codalio-blueprint — 5 stars, MIT. This one is ours. Turns a rough idea into a written PRD.

The one we'd install first: BMAD-METHOD. It's the only planning tool here with a genuine no-terminal on-ramp — the web bundles run as ChatGPT Custom GPTs and Gemini Gems, so you can do the entire planning phase before installing anything. Spec Kit is more rigorous and has two and a half times the stars, but its install command loses exactly the reader this page is for. The honest limitation on BMAD: the web bundles cover planning only. The moment you start implementing you're back in a CLI.

BMAD's licence is still unresolved, two weeks on. The README badge says MIT; GitHub's detector still returns no assertion, which normally means the LICENSE file has been edited. It's still our top pick and we're still not claiming the licence changed — but two weeks is long enough that this isn't a blip. If you're bundling BMAD into something you sell, open the LICENSE file and read it yourself. We've changed the licence column from "MIT" to "unresolved" to stop implying a grant we can't verify. Same for Task Master.

Task Master is the one we'd now hesitate over. Unresolved licence, and last pushed April 28 — four and a half months, unchanged from last week. Inside our six-month window, so it stays, but it comes off the page at the end of October if nothing lands.

On our own tool, plainly. codalio-blueprint runs three lenses (Product & Scope, Architecture, GTM) and synthesizes one PRD rather than stapling three documents together. We think that's well-built. It's also five weeks old, has 5 stars and 2 forks — unchanged from last week — no external contributors, and no test of whether the PRD is any good beyond examples we wrote ourselves. Last week we reported three new stars. This week, none. That's what a flat week looks like. Only Claude Code has real install instructions, whatever the README implies. Don't pick it over BMAD on our say-so.

Building​

Superpowers (285,156, MIT) installs a full agent methodology as composable skills across ~14 hosts. mattpocock/skills (259,497, MIT) applies senior-engineer review and TDD. OpenCode (206,685, MIT) runs a terminal coding agent against any model provider. Anthropic Skills (175,796, no root licence) holds the official reference skills and spec. OpenAI Codex CLI (123,351, Apache-2.0) and Gemini CLI (106,917, Apache-2.0) both run local coding agents. OpenHands (87,418, MIT) gives an agent a browser, terminal and editor. Cline (67,832, Apache-2.0) plans then edits with approval steps. Context7 (61,882, MIT) feeds agents version-correct library docs. Goose (54,129, Apache-2.0) runs an autonomous agent with a desktop app. Continue (35,869), vercel-labs/skills (31,395), Serena (29,183), Vibe Kanban (28,055) and Kilo Code (27,262) round it out.

The one we'd install first: Goose. The only mainstream open-source coding agent with a real desktop application — you see a window instead of a terminal — and Apache-2.0 with any-LLM support means no lock-in to one vendor's pricing. OpenCode has nearly four times the stars and is better if you're comfortable in a terminal, but it assumes you already are. Honest limitation: the desktop app hides the terminal, not the concepts. Extensions and MCP configuration still expect developer vocabulary, and you'll hit that wall on day two.

Goose has been pushed to repeatedly since moving to aaif-goose, the licence is unchanged, and it's up 230 stars on the week. One week isn't a guarantee, but it's the evidence we said we'd go and look for.

Vibe Kanban hasn't been pushed to since April 24 — same clock as Task Master.

Two things worth knowing before you install from this group. "Open source" often means the wrapper, not the engine: Codex CLI is Apache-2.0 and useless without a paid OpenAI plan, and Gemini CLI's free tier is a Google account benefit that can change without the repo changing. And the Anthropic Skills repo still has no root LICENSE file — confirmed again this week. Licensing is per-skill, and the document skills are source-available rather than open source.

Reviewing and QA​

This is where non-technical founders are most exposed. An AI wrote your code; something other than the same AI should look at it.

Trivy (37,870, Apache-2.0) scans dependencies, containers and IaC. Playwright MCP (37,011, Apache-2.0) lets an agent click through your live app. Gitleaks (29,234, MIT) detects committed secrets. Semgrep (16,590, LGPL-2.1) scans for security bugs. PR-Agent (12,950, MIT) reviews pull requests. Claude Code GitHub Action (8,844, MIT) reviews when you mention @claude. Trail of Bits Skills (7,041, CC-BY-SA-4.0) adds professional audit skills. cc-safety-net (1,535, MIT) blocks destructive commands.

The one we'd install first: the Claude Code GitHub Action. Typing "@claude review this" on a pull request is the lowest-literacy way to get a real second opinion on agent-written code, and it's MIT with no paid tier. Pair it with Gitleaks — an AI reviewer will happily discuss your architecture while ignoring the API key you committed in week one. Honest limitation: free to install, not free to run. Every review burns API credits and there's no built-in spend cap.

PR-Agent looks healthy after last week's move out of the Qodo org — pushed to this week, up about a hundred stars. The worry we raised hasn't materialised.

Trail of Bits Skills are the real thing, written by an actual security firm, but CC-BY-SA-4.0 is a content licence with a share-alike obligation. Read it before bundling commercially.

Shipping​

Supabase (109,056, Apache-2.0), Docusaurus (66,226, MIT), Coolify (61,677, Apache-2.0), GitHub MCP Server (32,869, MIT), semantic-release (24,034, MIT) and Changesets (12,384, MIT). All six were re-read on September 11 — these are the entries that carried stale August numbers for two weeks — and all six were pushed to within the last four days.

The one we'd install first: Supabase. The one piece of shipping infrastructure a non-technical founder can genuinely operate alone: clickable console, real free tier, Apache-2.0 so you can leave with your data. Coolify is better once you outgrow it, but the hardest step happens before Coolify appears — you have to rent a VPS and SSH into it. Honest limitation: some hosted-platform pieces aren't in the Apache-2.0 repo, so self-hosting isn't feature-equivalent.

One warning on the GitHub MCP Server: it needs a personal access token, and the easy broad-scope token hands an agent write access to every repository you own. Scope it down.

What didn't make the list​

Aider — still maintained, still excellent, wrong for this audience: its whole interaction model assumes you think in git commits and diffs. 48,897 stars, Apache-2.0, last pushed May 22 (our first current read on it). That date is approaching four months, which is worth watching on a tool this widely recommended.

Dokploy — open-core presented as open source, and the API confirms it: no licence assertion. Apache-2.0 applies only outside a /proprietary directory, and the proprietary licence forbids production use without a commercial agreement. Coolify is genuinely Apache-2.0 throughout and gets the slot.

Qodo-Cover — abandoned, with an explicit "no longer maintained" notice; the successor is paid. Automated test generation remains a real hole with no good open-source answer.

gpt-engineer, Devika, Claudia, snarktank/ai-dev-tasks, coderabbitai/ai-pr-reviewer — dead, stale, or 404. Named rather than silently omitted, because several still rank near the top of listicles on star count alone.

How to get exact star counts without hitting GitHub's rate limit​

Worth sharing, because it broke this page's audit twice. GitHub's unauthenticated REST API allows 60 requests an hour, which doesn't cover a 35-repo page, let alone four pages. But every repository page embeds its own exact figure in the HTML as "stargazerCount": <n> — the same number the API returns, not the rounded "48.9k" the page displays. Reading that costs no API quota. That's how every figure here got a current date for the first time.

Frequently asked questions​

How often is this updated? Every week. Entries we cannot verify are removed or flagged rather than quietly kept.

Is this the full page? Yes — this page is the canonical living guide, and it is updated here every week.

What changed this week​

Fixed the thing that kept breaking: every star count is now current. All 35 entries read September 11, including the nine that had carried August 28 numbers for two consecutive runs.

Corrected our own entry, in the unflattering direction. codalio-blueprint is still at 5 stars and 2 forks — flat on the week, not rising as we implied last week. A spot-check earlier in this run misread it as 1 star; 5 is correct. We'd rather print the correction than let either number stand.

Hardened two licence columns. BMAD-METHOD and Task Master now read "unresolved" rather than "MIT" — neither resolves to a standard SPDX licence, two weeks running. We're not claiming either changed; we're refusing to keep printing a grant we can't verify.

Maintenance clocks, now dated: Task Master last pushed April 28, Vibe Kanban April 24. Both stay this month, both come off at the end of October if nothing lands.

Last week's ownership changes all look healthy — Goose, OpenCode, OpenHands and PR-Agent each pushed to this week under their new owners, licences unchanged.

Notable movers: mattpocock/skills +10,881, superpowers +3,554, OpenCode +2,995, spec-kit +2,177, codex +1,923, OpenHands +1,270.

Nothing incomplete this run. For the first time since this page launched, there's no "we couldn't verify this" list.