Course guide and working practices

This guide organizes the working practices in the 4 November 2026 draft. Staff-provided repositories, datasets, hidden tests, answer keys, and server access are dependencies of the course plan, not artifacts included on this site.

One repository, two agents

Each team builds its own agent in one repository and uses a coding agent to help write that code under explicit controls. Changes accumulate across all twelve classes. Part 3 starts from part2-ref, applying the same controls to the team's agent and the coding agent.

The domain notices introduced in Class 2 supply the corpus for Classes 3–6. JSONL run records introduced in Class 3 are reused in Classes 6, 8, 10, and 11. Keep these interfaces stable so later comparisons can read earlier results.

Part 1 setup

• Install Ollama or llama.cpp and a 3B local model in the first 30 minutes of Lab 1.
• The draft assumes a laptop with 8 GB RAM; a staff LAN model server is the fallback for other laptops.
• Use the supplied test skeleton and 200 Bangla–English sentence pairs for the tokenizer experiment.
• Use pre-downloaded, ungated Qwen2.5, BLOOM, and o200k_base tokenizers.
• Class 2 needs 50 domain notices, a versioned JSON schema, a contract-test skeleton, and the staff KV-cache answer key.
• Class 3 needs staff loop.py, scripted-LM tests, and a 20-task evaluation set with code graders.

Later labs require a bilingual retrieval corpus, MCP tooling, context-policy tasks, seeded configuration faults, probe suites, and a local judge. Docker or WSL2 support is an open infrastructure decision in the draft and must be checked before the security lab.

Test first and keep a verification log

From Class 1 onward, a coding agent may write code only after the student writes the test. Each lab adds three lines to the verification log:

1. What the coding agent wrote.
2. Which test proves it.
3. What the student reviewed.

Tests, architecture gates, and peer checks provide evidence; a successful demonstration alone is insufficient. The precise test locks and gates for later work are specified in Lab 8.

Results ledger and run records

Every lab ends with an in-room check and a numerical result in the ledger. Use the measurement specified by that lab: tokenizer cost ratio, invalid rate, recall, pass^3, fault detection, bypass count, calibration, or cost/time per accepted task.

Class 3 introduces a JSONL run record per task containing steps, tool calls, tokens, cost, and wall-clock time. Keep transcript paths and experiment arms alongside measurements when the lab requires them. These pages do not prescribe an additional schema beyond the draft; use the course team's schema when provided.

Local models and API budget

Local models come first. Required API spend is limited to Classes 7, 8, and 11 in the draft; other required labs use local models or deterministic probes. The draft estimates US$1–11 per student as an upper-bound range for required work and asks whether a US$15 per-student cap is acceptable. Funding, key ownership, model choice, and the cap remain open decisions.

The Class 1 wrapper must refuse calls over its budget cap. Later coding-agent experiments also set turn and dollar limits. These are planned experimental controls, not a commitment that a particular provider or key has been supplied.

Schedule and staffing caveats

• The draft schedules 12 Sunday classes, 8 November 2026–24 January 2027.
• Part 1 has an assigned instructor; no instructor name is supplied.
• Parts 2–4 list instructor assignments as open. The draft asks the Part 2 instructor to start preparation by 15 November and for Part 3 to be taught by a daily coding-agent user.
• Teaching availability on 20 December, 27 December, and 24 January is uncertain. If a class is lost, Class 12 may move to 31 January or merge into Class 11.
• The Part 3 coding-agent choice is due by 22 November; the draft's configuration faults assume Claude Code. Choosing an open/local agent requires redesigning the coding-agent exercises in Classes 7 and 9.
• The academic committee has not yet approved the proposed assessment weights.
• A preceding software architecture/design course is an open prerequisite question. If absent, Class 1 must supply minimum quality-attribute, ADR, and C4 vocabulary.

My progress

Current stage: taking Part 1 classes. Personal class notes, lab completion, measured results, and study dates remain to be filled in. Later parts are published here as the planned syllabus.