Karpathy's four coding-agent principles are useful defaults, but production agents need scoped edits, test-gaming controls, trust-boundary calibration, and a fifth rule for calibrated reporting.