Sixteen weeks from demo to enterprise

Four terms, fifteen modules. Take the whole programme or any module on its own.

Term 1Foundations

Module 00

Orientation: The Vibe Engineer Mindset

A demo has one user who is you, on a good network, with clean data, doing the happy path once. Production has thousands of users, bad networks, hostile input, concurrent clicks, flaky dependencies, a cloud bill and a regulator. AI tools are excellent at demos. The gap between demo and production is exactly the 111 items on the poster.

Module 01

The AI-Assisted Engineering Workflow

Rule: write or review the tests yourself; let the AI write the implementation. If the AI writes both, it can make both wrong in the same way.

Module 02

How the Internet Actually Works

Module 03

Data Foundations

// Fixed: 2 queries total (or a join) const orders = await db.order.findMany({ include: { customer: true } }); Detect with query logging in tests: assert the number of queries per request.

Module 04

APIs and Contracts

Pattern (as popularised by Stripe):

Term 2Security

Module 05

Application Security: OWASP Top 10:2025

New in 2025: Supply Chain became its own category at A03, and Mishandling of Exceptional Conditions entered at A10. Both are exactly where AI tools are weakest.

Module 06

AI and Agent Security

OWASP's two design principles: least agency (limit not just access but how much the agent can do without checking back; autonomy is earned) and strong observability (see what the agent does, why, and with whose identity).

Term 3Reliability and scale

Module 07

Resilience Patterns

Module 08

Async, Events and Real-Time

Module 09

Performance and Scaling

Module 10

Distributed Systems Correctness

Term 4Production operations

Module 11

Shipping: CI/CD, Supply Chain and Infrastructure

Module 12

Observability and SRE

Module 13

Disaster Recovery and Incident Management

Module 14

Compliance, Governance and Audit

Engineering patterns: data inventory/map, classification (public, internal, confidential, restricted), field-level encryption for restricted data, PII redaction in logs and in prompts sent to LLM providers, deletion that propagates to backups on a schedule, DPAs with every sub-processor (including AI vendors, with training/retention terms checked).