Not recorded yet. The lesson below is complete and runnable today — the video is added later without touching this page.
recordings/A0.1.mp4Find all nine in the finished CyberTravels tree (checkpoint A2.5) — a file for each — and count how many you placed.
This is a reading lesson — diagrams and prose, and no skill of its own to run. The ways to do it at the foot of the page still apply: they fetch the code as it stands here and show what changed, which needs no model.
Alex's first design review for CyberTravels ran forty minutes before anyone noticed that "the harness" meant the agent loop to Alex and the eval suite to the security lead. Both had been right the whole time, about different files. Nine words carry most of what gets said about agents, and each of them is somebody's component and somebody else's attack surface.
runtime.py, memory in memory.py, retrieval in knowledge/retriever.py, two MCP servers, A2A in a2a/protocol.py, and an orchestrator routing between four agents. Function A is where you write each of them.What it covers. The nine words most talk about agents turns on — harness, memory and state, RAG, MCP, skills, guardrails, evals, A2A and multi-agent — drawn on one page, placed in the CyberTravels file where Function A builds each, and paired with the lesson that attacks it.
Why a security engineer needs it. Each of the nine is a component to one person and an attack surface to another, and a review where two people mean different things by "harness" argues about two different files. The control it builds is: a shared vocabulary tied to real code, so a finding names a component rather than a word.
Nothing here gets built. Fifteen minutes of reading, and then the exercise is to find the nine words in the running application rather than to write anything. It said "no code" for a while and then printed three ways to run code at the foot of the page, which is the kind of contradiction a reader trusts the page less for.
A review where "harness" means the loop to one person and the eval suite to another argues for an hour about two different files.
Learn the nine words, and for each one find the CyberTravels file where it lives and the lesson that attacks it.
Of the nine, how many you can point at in the tree — a file, not a definition. Nine is the target; a word you cannot place is the Function A lesson to read first.
Measure this
| what to measure | denominator or target |
|---|---|
| the nine words you can point at in cybertravels/ — a file, not a definition | count, out of 9; target 9 |
NINE WORDS, ONE AGENT - WHERE EACH SITS AROUND THE LOOP
memory & state RAG MCP skills
what it recalls what it what it can what it knows
| retrieves reach how to do
+--------------+-------------+-------------+
|
v everything here is context
+---------------------------------------------------------+
| HARNESS context -> model -> tool call -> result -> |
| (and round again until the task is done) |
+---------------------------------------------------------+
| |
v the way out v beside it
GUARDRAILS EVALS
permissions, sandbox, score what it did
human sign-off. The only against what you
one of the nine that says no. meant
several harnesses at once:
A2A one agent hands work to another, across vendors
MULTI-AGENT an orchestrator splits a job between specialists
every arrow into the harness is a way for text you did not write to
reach the model - which is why Function B has a lesson on each oneNine words carry most conversations about agents, and most arguments about agent security are two people using one of them for different things. This lesson fixes the nine before Function A builds them, so that when A1.2 says MCP server or A1.6 says A2A you already know what the box is.
They are not nine separate ideas. They stack:
That last point is the reason for the list. Each of the nine is a component you build in Function A and a surface an attacker reaches for in Function B, so learning them once, here, is learning the map both functions are drawn on.
Three of them are also open standards — MCP, A2A and the Agent Skills format. What you build on them is not tied to one vendor: a skill written for Claude Code loads in Codex, Cursor and Copilot, and an MCP server written for one agent serves any other. It also means a flaw in how you use one is portable in the same way.
One card per word: what it is in a line, and a picture of the mechanism, which is the part worth recognising later.
Every one of the nine is a real file in CyberTravels by the end of Function A, and every one has a lesson in Function B or D about breaking it. The right-hand column is the reason the commons teaches the words at all.
| word | in CyberTravels | where it goes wrong |
|---|---|---|
| Harness | runtime.py — the loop, and execute_tool, the line where the model stops proposing | B1.13 — a loop with no budget runs until something else stops it |
| Memory & state | memory.py | B1.4 — an instruction written into memory is read back as fact |
| RAG | agents/rag_advisor.py and knowledge/retriever.py | B1.3 — a retrieved document steers the agent with the user's authority |
| MCP | mcp/internal_server.py and mcp/vendor_server.py | B1.5 — a tool used within its grant for something nobody meant |
| Skills | skills/ and lesson-skills/ in this repository — the commons is built from them | D1.1 — whatever an agent ingests as a procedure is supply chain |
| Guardrails | identity.py for delegation, the human gate and budget in runtime.py, and later policy.py and sandbox.py | B1.15 — a human gate that approves everything because it sees too much |
| Evals | tests/smoke_test.py, growing with every lesson that adds a control | D1.0 — an eval with an adversary is a red team |
| A2A | a2a/protocol.py | B1.10 — a message from a peer agent treated as trusted |
| Multi-agent | orchestrator/router.py and the four agents in agents/ | B1.11 — one compromised agent among several that trust each other |
cybertravels/ except for skills. A file that appears later than Function A is named for where the guardrail ends up, not where it starts.Three ways to do this lesson. Pick one. They run the same procedure against the same code — what changes is who drives it, and how much you see.
The agent reads the lesson, explains the idea, fetches the code, runs the check and answers your questions as you go. This is the one to take if you are here to learn.
Install it, once. From the folder you cloned. --all does every agent it finds on your machine:
python3 scripts/install_skills.py --all --lessons A0.1Then restart your agent and open it in that folder. On Windows, if python3 says Python was not found, use python instead.
Then pick a0-1-nine-words-for-an-agent:
| agent | install just for this agent | start it |
|---|---|---|
| Claude Code | python3 scripts/install_skills.py --tool claude --lessons A0.1 | type /a0-1-nine-words-for-an-agent |
| GitHub Copilot (VS Code) | python3 scripts/install_skills.py --tool copilot --lessons A0.1 | type /a0-1-nine-words-for-an-agent in Chat |
| Cursor | python3 scripts/install_skills.py --tool cursor --lessons A0.1 | type / in Agent chat and search for it |
| Codex | python3 scripts/install_skills.py --tool agents --lessons A0.1 | type $a0-1-nine-words-for-an-agent, or run /skills |
No agent, no conversation. The same lesson executes and prints the same readback. Take this one if you have no assistant, if you are reviewing rather than learning, or if you want the result without the teaching around it.
python3 scripts/lesson.py A0.1Neither of the above, and no model needed. The first command writes CyberTravels exactly as it stood at the end of this lesson; the second prints the diff — the lines this lesson added or changed, and nothing from any later one.
python3 scripts/checkpoint.py --at A0.1 --out work/cybertravels
python3 scripts/checkpoint.py --at A0.1 --diffOn Windows, type python wherever these say python3 — and use \ instead of / in the paths. Everything else is identical. A0.0 step 2 explains why.
Ways 1 and 2 need a model; way 3 does not. A signed-in Claude Code CLI needs no API key, and any OpenAI-compatible endpoint works too. With neither, the audit exits 2 and says so rather than inventing an answer. A0.0 sets this up.
Ways 1 and 2 both end with the same readback: What I did, What changed, The number and Read this next. A step that was skipped or refused is reported as exactly that, never as a pass.
If you did the last lesson’s challenge, expect this to stop. Most challenges ask you to edit the code, and ways 1 and 2 will not overwrite your edits: you get stopped, not a failure, with two options — --out for a fresh folder that keeps your work, or --force to discard it and start this lesson clean.
This is a short written exercise. It takes five minutes, you do it on paper or in a notes app, and you do not need the computer for it.
What to do:
memory.py. If you have no idea, write a question mark — that is a perfectly good answer here.Why you are guessing instead of looking it up. Six of these nine files do not exist on your computer yet. runtime.py, memory.py, identity.py, observability.py, mcp/internal_server.py and a2a/protocol.py get created as you work through chapters A1 and A2, because you are the person who writes them. So there is nothing to look up. Guessing is the only thing you can honestly do today, and that is the point.
What happens to your list. The last lesson of this function, A2.5, asks you to get it back out and mark it. By then all nine files will exist, and all nine will be ones you built. Every guess you got wrong is a thing you learned on the way, and the question marks are the most useful marks on the page.
What you can do now. You can run any lesson in the commons on either route, you know which function to open first, and you have the nine words — harness to multi-agent — that everything after this is built from.
What you still cannot do. You can name all nine and you have built none of them. The preflight proved the machinery works; it proved nothing about agentic systems, which is the only reason any of this exists.
Chapter A1 builds the system everything else in the commons names — CyberTravels' agentic travel platform, one component at a time, on your own machine. Next → A1.0, what an agent is and what you are about to build.
Tools used
Skill source: skills/