THE COMPLETE AGENTIC ENGINEERING CHEAT SHEET

One sitting. One reference. The whole curriculum.

PART 0 — THE MATHEMATICAL PRELUDE

Probability and Evaluation

Concept	Formula / Rule	Use
Hoeffding	$\Pr(	\bar X-\mu
Bernstein	$\Pr\le 2e^{-nt^2/(2\sigma^2+2Mt/3)}$	Sharper near $p=0$ or $1$ — agent evaluation’s regime
McDiarmid	$\Pr(	f-\mathbb{E}f
Paired bootstrap	Resample $(x_i^A,x_i^B)$ jointly	$\Delta$ confidence interval; exploits within-task covariance
Power	$n\ge(z_{1-\alpha/2}+z_{1-\beta})^2[p_1(1-p_1)+p_2(1-p_2)]/\Delta^2$	~4,100 per arm for 3 points at 60%
Holm	Step-down, $\alpha/(m-j+1)$	FWER control when false positives are costly
Benjamini–Hochberg	Largest $k$ with $p_{(k)}\le k\alpha/m$	FDR control for screening

POMDPs and RL

Concept	Formula	Use
POMDP	$(\mathcal{S},\mathcal{A},\mathcal{T},\mathcal{O},\mathcal{Z},R,\gamma)$	Formal agent object
Belief	$b_t(s)=\Pr(s_t=s\mid h_t)$	Context is a lossy, non-Bayesian surrogate
Context as observation	$c_t=\phi(h_t)$ ; $\mathcal{Z}_\phi(c\mid s,a)=\sum_{h:\phi(h)=c}\Pr(h\mid s,a)$	Harness defines the POMDP
Load-bearing theorem	$J(\pi;\mathcal{M}_{H_1})\neq J(\pi;\mathcal{M}_{H_2})$	Harness-controlled comparison is mandatory
Policy gradient	$\nabla J=\mathbb{E}[\sum\nabla\log\pi_\theta\,A^\pi]$	RL foundation
GRPO	$\hat A_i=(r_i-\bar r)/\mathrm{std}(r)$	Default for verifiable agentic RL; small- $G$ bias
Entropy collapse	$dH/dt\approx-\eta,\mathrm{Var}(\hat A)\mathbb{E}[	\nabla\log\pi
KL regularisation	$\mathbb{E}[R]-\beta D_{\mathrm{KL}}(\pi_\theta	\pi_{\mathrm{ref}})$

Information Theory

Concept	Formula	Use
DPI	$X\to Y\to Z\Rightarrow I(X;Z)\le I(X;Y)$	Compaction cannot create information
Tool-cost bound	$\mathbb{E}[\text{tokens}]\ge H(T,A\mid C)+\ell(s)$	Interface efficiency’s lower bound
Interface inefficiency	$\eta=(\mathbb{E}[\text{tok}]-(H+\ell))/(H+\ell)$	Tool surface’s diagnostic

Verification (The Core)

Concept	Formula	Use
TPR / FPR	$\Pr(V=1\mid C=1)$ , $\Pr(V=1\mid C=0)$	Verifier’s operating point
Precision	$\mathrm{TPR}\cdot\pi/(\mathrm{TPR}\cdot\pi+\mathrm{FPR}(1-\pi))$	Base-rate dependent; 99%/1% is a coin flip at $\pi=0.01$
Autonomy threshold	$(1-\mathrm{TPR})\pi C_f<C_h$	Autonomous release is rational iff missed-failure cost < review cost
Cost per correct task	$(C_g+C_v+C_f\mathrm{FPR}(1-\pi))/(\mathrm{TPR}\pi)$	Optimise over the ROC
SPRT	Accept if $\Lambda_n\ge\log\frac{1-\beta}{\alpha}$ ; reject if $\le\log\frac{\beta}{1-\alpha}$	Optimal sequential verification
Sensitivity order	FPR is most sensitive (typically), then TPR	Calibration priority

Control and Systems

Concept	Formula	Use
Guide vs sensor	Feedforward (prevent) vs feedback (detect)	Internal model principle: harness detects only what it models
Stability	$\eta<2/(L(1+2d))$ ; steady-state $\sim\eta\sigma^2/(2n)$	Harness evolution loop’s stability
Little’s law	$L=\lambda W$	Throughput ceiling
Kingman	$\mathbb{E}[W_q]\approx\frac{\rho}{1-\rho}\frac{c_a^2+c_s^2}{2}\mathbb{E}[S]$	Agent tail latency is structurally worse
Prefix caching	$C=hC_{\text{cached}}+(1-h)C_{\text{prefill}}+C_{\text{gen}}$	Cache-aware layout
Three-term cost	$\mathbb{E}[\text{tok}]p_{\text{tok}}+\mathbb{E}[\text{tools}]\bar c_{\text{tool}}+\mathbb{E}[\text{ver}]c_{\text{ver}}$	Diagnoses cost regressions

Security

Concept	Rule	Use
Lethal trifecta	Private data + untrusted content + external comms	Architecture-elimination gate
Confused deputy	Privileged agent used on adversary’s behalf	Capability scoping’s target
Capability	Unforgeable, scoped, expiring, attenuable	Least-authority mechanism
IFC	Labels + flow policies	Provable-by-construction

PART I — FOUNDATIONS AND EVALUATION

Module 1: The Harness’s Four Elements

Element	Function	Necessity
Agent loop	Calls model, dispatches actions, feeds observations back	Iteration
Tool interface	Typed action space + dispatcher	Effect on environment
Context management	Assembly, trimming, formatting	Bounded, usable observation
Control mechanisms	Termination, permissions, retry, bounds	Safe termination and action

Key theorems:

Harness determines return at fixed model — the harness defines the action space, transition kernel, and observation function.
Finite truncation is not sufficient — the scrolled-out-action construction.
Context is a lossy, non-Bayesian belief surrogate — three losses: truncation, summarisation, formatting.

Workflow vs agent: workflow if the step sequence is knowable at design time (information test); agent otherwise. Value of feedback $V_f=J(\pi^*)-J(\pi_w)$ .

Architecture decision tree: (1) knowable at design time → workflow; (2) high failure cost → workflow with gates; (3) distinct large contexts → multi-agent; (4) low structure variance → single agent + router; (5) else → single agent.

Module 2: Tool Interfaces

Concept	Rule	Use
Parsing pipeline	Extraction → syntactic parse → schema validation → semantic validation → dispatch	Each stage’s failure mode
Grammar-constrained decoding	Mask logits to $A(q)$	Eliminates syntax/schema failures; grammar tax
Decision rule	Constrain iff $p_f c_r>c_g+q$	Expected-cost comparison
ACI thesis	Tool ergonomics dominate raw capability at the margin	SWE-agent, tier R
Four ergonomic properties	Low spec cost, informative feedback, consistent semantics, discoverable preconditions	Design checklist
Coarse / fine-grained / code-execution	Trade-off between description and disambiguation cost	Crossover complexity $c^*$

Protocols: MCP (tools; stdio/HTTP+SSE; OAuth 2.1); A2A (agents; agent cards; card-rewriting risk); skills files (procedures; progressive disclosure; 9/11 vs 8/11 adoption).

Protocol decision: local registry → MCP → A2A → skills, biased to simplest.

Module 3: Context Engineering

Concept	Rule	Use
Lost in the Middle	U-shaped attention; primacy and recency	System prompt first, instruction last
Distractor sensitivity	Irrelevant content degrades performance	Include less, not more
Nominal vs effective context	$L_{\text{eff}}(\epsilon)$ : the length where performance holds within tolerance	The useful budget is a fraction of the nominal
Compaction policy	$\kappa:\mathcal{H}\to\mathcal{C}$	Lossy projection
Projection error	$\varepsilon(\kappa)=S(\kappa_{\text{full}})-S(\kappa)$	The operational loss
Oracle summary	The upper bound: $S(\kappa_{\text{oracle}})$	Compaction inefficiency’s measure
MemGPT	Main + external context, paged by model	When memory exceeds context
Evolving playbook	Accumulated strategies (tier P)	The hypothesis
Retrieval decision	JIT iff $(p_{\text{jit}}-p_{\text{pre}})V>c_{\text{jit}}-c_{\text{pre}}$	Pre-load vs JIT
Cache-aware layout	Stable first, volatile last	Matches U-curve AND caching

Summarisation quality trap: good summary ≠ good task outcome. Measure downstream success.

Module 4: Reasoning and Test-Time Compute

Concept	Rule	Use
ReAct	Thought → action → observation	Harness configuration, not capability
ToT	Search over partial solutions; value function is the bottleneck	Expensive; needs reliable value function
Reflexion	Reflection after failure, stored in memory	Works when external signal makes failure legible
Self-correction without signal	Not guaranteed to improve; can decrease correctness	The central limit
Design rule	Verifier-gated loop, not free-standing refinement	The harness implication
Process vs outcome supervision	Dense per-step vs sparse terminal	PRM resists “right answer, wrong reasoning”
Oracle bound	$1-(1-p)^n$	Best-of-n ceiling
Verifier-limited asymptote	$\Pr\to\pi_v$	The verifier’s precision is the bottleneck
METR time horizon	Task length at 50% success	Error bars ~2×; domain variation 40–100×; 50% ≠ delegable

Delegable horizon $t_r$ : where success = $r$ (98%+ for critical tasks).

Module 5: Evaluation Science

Concept	Rule	Use
Benchmark triple	$(\mathcal{T},\mathcal{V},\mathcal{P})$	A number is a property of the triple
pass^k (iid)	$p^k$	Baseline
pass^k (heterogeneous)	$\approx p^k+\frac{k(k-1)}{2}p^{k-2}\sigma^2$	Heterogeneity inflates
Harness confound	Significant $(\alpha\beta)_{ij}$	Model ranking depends on harness
Variance decomposition	$R^2_{\text{harness}}=\hat\sigma_\beta^2/\text{total}$	The load-bearing measure
Pre-registration	Analysis plan before data	Discipline
Contamination	Benchmark data in training	Temporal split is the evidence
Held-out family	Non-public tasks from deployment distribution	The deployment defence
Best-of-k vs pass^k	$1-(1-p)^k$ vs $p^k$	30× difference at $p=0.5,k=5$
Evidence tiers	A/B/C; R/S/P/C	Applied to the curriculum’s own citations

Module 6: Harness Anatomy and Classification

Concept	Rule	Use
ETCLOVG	Execution, Tooling, Context, Lifecycle, Observability, Verification, Governance	Analytical taxonomy
Four necessary elements → ETCLOVG	Loop→L/O/G; Tools→T/E/G; Context→C/O; Control→L/G/V	Many-to-many mapping
Eleven-system study	arXiv:2609.00006, S	Empirical anatomy
90-line scaffold	Minimum-viable harness	The addition obligation
Convergence and imitation	Behaviour migrating into config	The unresolved interpretation
Irreducible	Required for every model	Permissions, verification, audit
Capability-compensating	Unnecessary with perfect model	Scaffolds to shed
Performance-tuning	Improves metric without being required	Routing, compaction thresholds
Counterfactual test	“If the model were perfect, would $c$ be required/improve?”	Classification procedure
Classification is relative	To (model, deployment)	Must state referents
Three confusions	Retry (mixed), verifier (irreducible if autonomy), scaffold (compensating)	Diagnostics

Module 7: Execution Environments

Concept	Rule	Use
Five adversary classes	Erroneous, manipulated, compromised tool, compromised model, compromised harness	The threat model
Container	Shares kernel	Class 1–2
microVM (Firecracker)	Own kernel	Class 3–4
gVisor-class	User-space kernel	Class 3–4; compatibility cost
Five filesystem vectors	Path traversal, symlink, TOCTOU, hard link, device	The checklist
Canonical path check	Resolve, compare components, check the fd	TOCTOU-safe
Egress default	Deny, positive allowlist	The architectural defence
Five egress bypasses	DNS, IP literal, proxy, side channel, tool ingress	The checklist
Reproducibility	Pinned deps, base images, deterministic builds, tool versions, spec artefact	The five components
Verifier taxonomy	V1 (tests), V2 (types), V3 (property-based), V4 (differential), V5 (judge)	The composition
Policy engine	Deterministic pre-execution function	Irreducible component
Fail closed	Minimise false allows, accept false denies	The asymmetry
Idempotency	$T(T(s,a),a)=T(s,a)$	Retry safety
Retry safety	Safe iff idempotent or keyed	The proposition
Loop detection	Repetition, progress, cycling	Cost bound

Module 8: Long-Horizon State

Concept	Rule	Use
Useful window	$W_{\text{useful}}=\min(W,L_{\text{eff}})$	The real budget
Window count	$n_w\approx\lceil L_{\text{nom}}/W_{\text{useful}}\rceil$	Long-horizon size
Handoff	$\mathcal{H}:\mathcal{H}\times\mathcal{P}\to\mathcal{C}$	Cross-window compaction
Three failure modes	Omission, corruption, inconsistency	The diagnosis
Progress file	Task, plan, completed, current, discovered, open, decisions, risks, references	The sufficiency condition
Initialiser vs worker	Exploration separable vs interleaved	The pattern choice
Delegation criterion	$\Delta_{\text{isolation}}>C_{\text{coord}}$	The decision
Delegation costs	Spawn, specification, result, integration	The four
Instruction file	What, build/test, conventions, constraints, structure	AGENTS.md
Instruction rot	Stale, contradictory, irrelevant	Curation problem
Task graph / checklist / spec	Dependencies vs sequential vs outcome	The representation choice
Voyager skill library	Discovery → abstraction → retrieval	arXiv:2305.16291, R; Minecraft-specific

Module 9: Constraints and Entropy

Concept	Rule	Use
Three-part decomposition	Context engineering, architectural constraints, entropy management	Tier B/C hypothesis
Violation count	$V(X)=\sum v_i(X)$	Static coverage
Birth-death model	$V^*=\lambda/\mu$	Stable if $\lambda<\mu$
Control levers	Reduce $\lambda$ (guides), increase $\mu$ (cleanup)	The two levers
Guide	Feedforward, prevents	Linter, allowlist
Sensor	Feedback, detects	Test suite, monitor
Complementarity	Guides prevent, sensors detect	The balanced design
Optimal allocation	Marginal cost = marginal benefit for each	The conditions
Internal model principle	Detect only what you model	The coverage bound
CI	Whole constraint layer, clean env, merge gate	Ground truth
Mutation testing	Killed/total	TPR on mutation distribution
Deceptive cleanliness	Low violations, low mutation score	The dangerous case
Legibility	Agent’s cost to find, understand, modify	Navigation, comprehension, modification
DORA	Deployment freq, lead time, failure rate, restore time	The delivery metrics
Stability margin	$M_s=2/(L(1+2d)\eta)$ ; $>1$ stable	The change’s stability
Goodhart	A measure used as target is gamed	The four games; the basket defence

Module 10: Automatic Harness Optimisation

Concept	Rule	Use
Search space	Structured, discrete, too large for exhaustive	The optimisation problem
Objective	Noisy, expensive, non-stationary, partially observable	The four properties
The guardrail	Edit compensating and tuning, not irreducible	The loop’s permission
AHE	arXiv:2604.25850, P; 69.7%→77.0% Terminal-Bench 2	Unreplicated
Three pillars	Component, experience, decision observability	The trace’s requirements
The loop	Observe → propose → predict → evaluate → verify → record	The six steps
Self-declared prediction	$(\mu_p,\delta_p,\text{metric})$ before evaluation	One-sided test, no post-hoc, mechanism check
Self-Harness	Failure-trace mining, minimal edits, regression validation	P
Harness-Zero	Distillation into student via SFT	P; the exploit’s risk
AlphaEvolve / Darwin Gödel Machine	Evolutionary / self-modifying	P; the guardrail is necessary
Overfitting	$\hat\Delta_{\text{held}}<\hat\Delta_{\text{eval}}$ beyond noise	The held-out check
Credit attribution	The prediction and the minimality	The devices
Stability	$\eta<2/(L(1+2d))$	The four levers

Module 11: Observability and Cost

Concept	Rule	Use
Three queries	Clustering, attribution, cost per success	The schema’s derivation
Minimal trace schema	Identification, harness state, context, model call, tool calls, decision, outcome, cost	Every field’s role
OTel GenAI	Standard fields; evolving (B)	Interoperability
Trace hierarchy	Run → step → sub-operation	Drill-down
Prefix-tree clustering	The trie’s largest subtree	Failure signature
Attribution	Version split, comparison, drill-down	Diagnosis (revert is the proof)
MAST preview	Multi-agent failure taxonomy	arXiv:2503.13657, P
Single-agent taxonomy	Context loss, retrieval, tool, verification, loop, budget, model, specification	The label set
Retention tiers	Hot, warm, cold	The storage policy
Drill-down	Aggregate → trace → step	The prerequisites
Error analysis at scale	Automated classification (audited) + stratified sampling	The screen + the audit
Failure-mode distribution	The diagnostic; the shift is the leading indicator	The progress measure
Cost diagnosis	Measure, attribute, decompose, fix, re-measure	The procedure
Latency sources	Model, tool, queueing, orchestration	The p95’s problem
Parallelism forms	Tool calls, subagents, samples	Latency vs cost
Routing	Contextual bandit	The criterion
Cascade	$(C_c+C_v)+(1-p_c^{\text{ver}})(C_s+C_v)$ ; escalation iff $C_c<p_c^{\text{ver}}C_s$	The condition
Pareto frontier	Non-dominated pairs	The deployment’s choice
Verification budget	The cost-per-correct optimisation over ROC	The bridge
Non-determinism’s problem	Statistical reproduction; distribution’s framing	The postmortem’s core
Four causes	Model, harness, environment, specification	The classification
Learning levels	Specific fix, class’s fix, process’s fix	The depth

PART III — MODELS AND INFERENCE

Module 12: Selection

Concept	Rule	Use
Total vs active parameters	Memory vs compute	The MoE’s two numbers
Sparsity	$P_{\text{total}}/P_{\text{active}}$	The ratio
KV cache	$2n_{\text{layers}}n_{\text{kv\_heads}}d_{\text{head}}Lb$	The long-context cost
MLA	Latent-compressed cache; 5–10× saving	The long-context enabler
DSA	Indexer + top- $k$ ; $O(Lk)+O(L^2)$	The compute estimate, not speedup
Prefill/decode asymmetry	Compute-bound prefill, bandwidth-bound decode	The latency’s two phases
Three licence classes	OSI-open, custom, non-commercial	The first gate
Per-checkpoint rule	The licence is the weights file’s, not the brand’s	The design principle
Conditions	Revenue caps, scale caps, acceptable-use, attribution, pass-through, geography, no indemnity	The verdict
The dossier	Licence, BOM, reproduction, parse-failure rate, format notes	The five fields
Deletion rule	A field that cannot be filled in a week deletes the candidate	The discipline
Hardware BOM	Weights + KV + activations + framework	The fit’s arithmetic
Reproduction rule	A vendor number is not an input until reproduced	The tier-C discipline
Parse-failure impact	Effective TPR falls; cost rises by $1/(1-p)$	Proposition 12.12.1
Four format decisions	Chat template, reasoning tokens, stop tokens, tool-call serialisation	The compatibility
Four format tests	Template, reasoning, stop, tool call	The CI
Go/no-go gates	Licence → hardware → reproduction → parse → format	The cost’s order

Module 13: Inference Engineering

Concept	Rule	Use
Continuous batching	Iteration-level scheduling	The throughput’s gain
Gain	Effective batch vs naive’s	The heterogeneity’s penalty
Paged attention	Fixed blocks + block table	Memory utilisation
Prefix caching	Longest matching prefix	The reuse
Speculative decoding	Draft proposes, target verifies	$\mathbb{E}[\text{tok}]=(1-\alpha^{k+1})/(1-\alpha)$
Speedup	Expected tokens / combined cost	The draft’s cost is the limit
Disaggregation	Separate prefill and decode pools	The transfer’s cost
Expert parallelism	All-to-all; load balancing	The MoE’s communication
Four engines	vLLM, SGLang, TensorRT-LLM, llama.cpp	The measurement, not the benchmark
Quantisation formats	FP16, FP8, FP4, GGUF K-quants, AWQ, GPTQ	The memory/accuracy trade-off
Short benchmark blind spot	Errors compound, format fragility, long context	The agent’s measurement
Quantisation measurement	Long-horizon tasks, paired design	The protocol
Chat template	$T:$ messages → string	The model’s expected format
Three template failures	Wrong template, missing tokens, placement	The diagnostics
Reasoning formats	Separated vs mixed	The parser’s problem
Stop tokens	The model’s EOS and the turn’s end	The truncation risk
Tool-call approaches	Native template vs grammar	The two
Agent characteristics	Long prefixes, bursty arrivals, variable service, multi-turn	The capacity’s inputs
Two throughput bounds	Compute and memory-bandwidth	The binding one
Capacity	$N_{\text{GPU}}=\lceil\text{target}/\text{per GPU}\rceil$	The plan’s number
Replay	Captured trace against the stack	The harness’s own measurement

Module 14: Co-Adaptation and Fleets

Concept	Rule	Use
Co-adaptation	Better together than with comparable alternatives	The interaction effect
Four surfaces	Tool schemas, reasoning formats, compaction thresholds, retry policy	The adaptation
Foreign-harness taxonomy	Parse, truncation, leak, overflow, over-compaction, retry loop, recovery failure	The checklist
Co-adaptation matrix	$A_{ij}=\hat J(M_i,H_j)$	The measurement
Adaptation cost	$c_i=\max_j A_{ij}-A_{i,j^*}$	The left-on-table
Adaptation decision	$c_i V>T_{\text{adapt}}$	The investment
Tiered architecture	Planner, executor, verifier	The roles
Tiered cost	$C_p+n(C_e+C_v)$	The arithmetic
Success model	$p_p\cdot p_e^n\cdot p_v$	The compounding
Verification-gated escalation	Verifier’s rejection triggers planner	The cascade
Roles’ requirements	Planner’s reasoning, executor’s reliability, verifier’s precision	The assignment
Cost per correct	$C_{\text{fleet}}/p_{\text{fleet}}$	The economics
Distillation (Harness-Zero)	Teacher’s trajectories → student’s SFT	P
What distils	Format (reliably), behaviour (partially), knowledge (least)	The scope
Amplification	Student’s exploit rate ≥ demonstrations’	Proposition 14.14.1
Sovereignty drivers	Regulation, IP, latency, cost	The boundary’s decision
Three patterns	Full air-gap, VPC, hybrid	The deployment
3×3 factorial	Three models × three harnesses × $K$ tasks	The Part III capstone
Variance decomposition	$y=\mu+\alpha+\beta+(\alpha\beta)+\varepsilon$	The interaction’s measure
Ranking flip	The models’ order depends on the harness	The interaction’s content
Four research questions	Convergence, general/overfit, minimal safe, automation	The agenda
Longitudinal design	Two tiers, same component, effect’s comparison	The classification’s test

PART IV — TRAINING AND RL

Module 15: Trajectory SFT

Concept	Rule	Use
Trajectory	Context, output, tool call, observation	The SFT’s unit
The whose-tokens rule	Mask 1 for assistant, 0 elsewhere	The loss’s target
SFT loss	$-\sum m_i\log\pi_\theta(t_i)/\sum m_i$	The masked loss
Mask test	Masked tokens = assistant’s content	The CI
Observation exclusion	Prevents hallucination	The discipline
Five quality dimensions	Outcome, format, process, efficiency, diversity	The filters’ targets
Rejection sampling	$n$ samples, verifier keeps	The data’s generation
Acceptance rate	$\mathrm{TPR}\cdot p+\mathrm{FPR}(1-p)$	The cost’s multiplier
Six filters	Verifier, format, length, diversity, process, efficiency	The set’s construction
Verifier’s precision	The filter’s quality bound	Proposition 15.9.1
Diversity	Unique tasks / total	The coverage’s measure
Duplicates’ pass^k penalty	Overfitting, generalisation gap	Proposition 15.12.2
Distillation pipeline	Generate, filter, convert, train, evaluate	The five steps
Re-serialization	The student’s format, not the teacher’s	The conversion
Sequence-level loss	SFT on teacher’s samples	Closed teacher
Logit-level loss	KL to teacher’s distribution	Open teacher
Exploit amplification	Student learns teacher’s exploits	Proposition 15.18.1
Contamination	Test tasks in training	The split’s violation
Privacy	PII, secrets	Scrubbing, redaction, retention
Licence provenance	Teacher’s, data’s, derivative’s	The per-checkpoint rule
Datasheet	Eight sections	The reusability’s condition
SWE-RL	RL on software tasks, rule-based reward	arXiv:2502.18449, P
SFT vs RL data	Teacher’s vs rollouts	The bridge
Bridge design	SFT’s model as RL’s initialisation	The warm start

Module 16: Agentic RL

Concept	Rule	Use
RL objective	$\mathbb{E}[R(\tau)]$ over rollouts	The SFT’s successor
Agentic differences	Multi-turn, tool observation, verifier reward, environment cost	The four
Policy gradient	$\mathbb{E}[\sum\nabla\log\pi_\theta\,A^\pi]$	The theorem
Baseline unbiasedness	State-only baseline leaves gradient unbiased	The property
GRPO	$\hat A_i=(r_i-\bar r)/\mathrm{std}(r)$	R
GRPO bias	std normalisation, small- $G$	The small- $G$
Agentic GRPO	Trajectory advantage for all turns	The credit’s problem
RLVR	Verifiable rewards	Reliable but hackable
DeepSeek-R1	Reasoning emergence from RLVR	R
Survey warning	Apparent RL gain masked by format failures	P; format rate first
APPO / PACT	Responses to sparse collapse	P
Reward density	Sparse, dense, intermediate	The spectrum
Dense variance	$O(T)$ vs $O(T^2)$	The benefit
Exposure’s cost	Per-step errors accumulate	The cost
VPR	Outcome + dense oracle	P
VPR condition	Benefit iff $\sigma^2_{\text{sparse}}-\sigma^2_{\text{dense}}>\sigma^2_{\text{oracle}}$	The gate
RLVP	Outcome − penalties	P
Penalties	Validity, safety, efficiency	The design
Per-turn mask	Assistant’s tokens only	The mask
Per-turn validity	Counterfactual correlation	The validation
Four instabilities	Control-token, formatting, entropy, KL	The signatures
Format first	Primary metric before reward	The survey’s warning
Hacking taxonomy	Exploit, specification, shortcut, collapse	The four
Audit	Exploit list, rate, corrected score	The evidence
Four defences	Immutable verifier, held-out, adversarial, KL	The layers
Deployment vs training	Production verifier vs reward	The difference
Reward principles	Precision, immutable, audit, dense condition, corrected	The five
On/off-policy	Fresh vs replay	The spectrum
Async architecture	Workers, trainer, weights server	The throughput
Per-rollout cost	Three-term invariant	The budget
Experiment budget	$N_{\text{updates}}\times B\times G\times C_{\text{rollout}}$	The arithmetic
Environment requirements	Hermetic, resettable, instrumented, non-leaky	The validation

PART V — MULTI-AGENT, SECURITY, GOVERNANCE, PRODUCTION

Module 17a: Environments

Concept	Rule	Use
Environment	$(\mathcal{S},\mathcal{T},\mathcal{O},\mathcal{Z},\text{reset},\text{verifier})$	The substrate
Four properties	Hermetic, resettable, instrumented, non-leaky	The construction
Hermetic test	Rebuild hash equality	Reproducibility
Reset test	State equality	The leakage’s check
Leakage channels	Solution, test, verifier, held-out	The four
Synthetic tasks	Failure mutation, template, compositional	The generation
Curriculum	Easy-to-hard, competence-based, mixed	The scheduling
Formal verifier (Lean 4)	TPR=1, FPR=0	The ideal
Validation checklist	Eight items	The acceptance

Module 17b: Verifier Engineering

Concept	Rule	Use
Oracle kinds	Symbolic, differential, metamorphic, property-based	The construction
Metamorphic relation	$f(x)=f(g(x))$	Oracle-free
Calibration set	Labelled, representative, large (≥500)	The measurement
TPR/FPR	Wilson intervals	The estimation
Precision	Base-rate dependent	The deployment’s
ROC	TPR vs FPR	The operating points
Judge biases	Position, length, confidence, format, self-preference	The V5’s weaknesses
Exploit taxonomy	Test, specification, judge, oracle blind spot	The four
Red-team	Attack, rate, corrected score	The audit
Measurement protocol	Seven steps	The procedure
Precision interval	Delta method	The uncertainty
SPRT	Accept/reject/continue	Wald–Wolfowitz; independence caveat
Composition	Product (measured, not computed)	The precision trade-off

Module 17c: Verification Economics

Concept	Rule	Use
Cost per correct	$(C_g+C_v+C_f\mathrm{FPR}(1-\pi))/(\mathrm{TPR}\pi)$	The optimisation
Optimum	Enumerate over ROC	The operating point
Sensitivity	FPR most sensitive	The calibration priority
Autonomy threshold	$(1-\mathrm{TPR})\pi C_f<C_h$	The release decision
Threshold vs optimum	Different; feasible set	The disagreement
Allocation	Pre, post, release; marginal costs	The budget’s order
Robustness	Decision across intervals	The fragile’s input
Memo	Seven fields	The deliverable

Module 18: Multi-Agent Systems

Concept	Rule	Use
Five patterns	Orchestrator-worker, debate, blackboard, market, hierarchical	The topology
Default bias	Single agent; multi is the exception	The burden of proof
Null hypothesis	Single well-harnessed ≥ multi	The test
Three metrics	Reliability, cost, diagnosability	The comparison
MAST	14 modes, 3 categories	arXiv:2503.13657, P
Category 2	Inter-agent misalignment	The multi’s unique
Cohen’s kappa	$(p_o-p_e)/(1-p_e)$ ; ≥0.6 acceptable	The coding’s reliability
A2A	Agent cards, v1.0	B
Card-rewriting risk	Redirect, injection, auth downgrade	The attack
Four defences	Integrity, untrusted treatment, permission independence, pinning	The layers
Cross-agent identity	Agent’s, user’s, composite	The delegation’s chain
Inter-agent contract	Task, result, permissions, SLAs, security	The interface
Coordination cost	$\sum C_{A_i}+\sum C_{\text{msg}}+C_{\text{coord}}$	The model
Reliability	$\prod p_i$ ; verifier-gated recovers	The compounding
Justification	$\Delta p\cdot V>C_{\text{multi}}-C_{\text{single}}$	The decision
Consistency	Strong vs eventual	The shared state
Stale read	Read before write, act on old	The failure
Deadlock	Circular wait	The failure
Delegation chain	User → A → B	The audit’s basis
Confused deputy	A’s permission used on user’s behalf	The attack

Module 19: Agent Security

Concept	Rule	Use
Indirect injection	Adversary’s instruction in agent’s content	The core threat
Instruction-only insufficiency	No prompt rule guarantees resistance	Proposition 19.1.2
Five adversary capabilities	Content, format, timing, multi-step, composition	The threat model
Injection forms	Direct, role-play, format mimicry, encoded, incremental	The five
ASR	Attack success rate	The security metric
Tool poisoning	Malicious tool description/output	The schema-position vector
Malicious skills	Skill document as injection	The supply-chain vector
Confused deputy	Privileged agent used on adversary’s behalf	The permission’s attack
Exfiltration	Private data reaching adversary	The goal
Lethal trifecta	Private data + untrusted content + external comms	The design gate
Trifecta check	Eliminate a leg	Procedure 19.8.1
Residual risk	ASR after × compromise cost	The acceptance input
IFC	Labels + flow policies	The provable defence
Confidentiality policy	High data cannot flow to low sinks	The exfiltration defence
Integrity policy	Low-integrity content cannot influence high-integrity action	The injection defence
Declassification	Explicit trusted rule	The policy’s critical point
IFC guarantee	Policy-compliant flows, conditional on labels	Theorem 19.13.2
CaMeL	P-LLM plans, Q-LLM extracts	P
CaMeL guarantee	Untrusted content never reaches the plan	The structural defence
CaMeL cost	Two models, plan rigidity	The adaptivity loss
Capability	Unforgeable, scoped, expiring, attenuable	The confused-deputy defence
Privilege separation	Privileged planner, unprivileged processor	The narrow interface
Model-based defences	Instruction, fine-tune, screening	The layers
AgentDojo	Benchmark: utility and security	R
Red-team suite	The deployment’s own attacks	The lab
OWASP Top 10	Agentic applications 2026	B
Supply chain	Skills, MCP servers, weights, dependencies	The audit surface
Safetensors	No-code-execution checkpoint	The weights’ control
Security dossier	Eight sections	The governance artefact

Module 20: Oversight and Governance

Concept	Rule	Use
Oversight problem	Checking when reviewer’s capability is insufficient	Definition 20.1.1
Three regimes	Reviewer more, comparable, less capable	The design’s branch
Two failure directions	Over-trust, under-trust	The measurement’s target
Scalable oversight	Debate, amplification, recursive reward modelling, market making	The four
Techniques’ assumptions	Judge’s discernment, decomposition’s verifiability, preference’s consistency, market’s incentives	The failure modes
Monitoring	Trace’s analysis against baseline	The detection layer
Monitor’s targets	Policy violations, verifier disagreements, behavioural, content	The order
Base rate’s effect	Precision collapse	The alert fatigue
CoT monitorability	Trace reveals intention	The claim
Fragility	Unfaithfulness, optimisation pressure, steganography, capability growth	The four reasons
Design implication	Defence in depth, not trace alone	The posture
Sandbagging	Strategic underperformance	The alignment’s failure
Sabotage	Deliberate degradation	The alignment’s failure
Four evaluations	Capability elicitation, honeypot, sabotage detection, red-team	The designs
Interpretation	Can vs will	The monitoring’s role
Control agenda	Trusted monitoring, untrusted monitoring, editing, protocol design	The security framing
Control’s guarantee	Containment, not alignment	The achievable
Oversight’s components	Verifier, policy engine, monitor, human gate, audit	The system
Five principles	Prevention, fail-closed, measurement, audit sample, layering	The design
Deployment’s reward hacking	Production verifier’s optimisation	The distinction
Deployment’s additional risks	Persistent, reputation, multi-agent, regulatory	The four
Specification gaming	Letter over intent	The under-specification
Goal misgeneralisation	Competent pursuit of wrong goal	The generalisation’s failure
EU AI Act	Prohibited, high-risk, GPAI, limited, minimal	The tiers
Act’s timeline	Force, prohibited, GPAI, high-risk, full	The dates
Act’s penalties	€35M/7%, €15M/3%, €7.5M/1%	The maxima
Agentic reading	Use’s classification, deployer’s obligations, Article 14	The application
Sectoral rules	Health, finance, employment, education	The stricter’s
Compliance mapping	Obligations to controls	The table
Compliance posture	Highest standard, not minimum	The efficiency’s
Accountability chain	Delegation + decision	The traceability’s
Audit log	Append-only, tamper-evident, complete, attributable, retained, accessible	The evidence’s
Audit log schema	Trace + principal, authorisation, decision, outcome, chain	The fields
Sample audit	Periodic review, human’s TPR, monitor’s precision	The measurement
Oversight design	Scope, interface, authority, competence, time, record, feedback	The elements
Oversight failures	Rubber-stamping, fatigue, bottleneck, automation bias	The modes
Privacy controls	Pseudonymisation, encryption, access, retention, deletion	The tension’s resolution
Risk register	ID, description, likelihood, impact, mitigation, residual, owner, review, acceptance	The structure
Roles	Owner, security, evaluation, operations, compliance, board	The RACI
Cadence	Weekly, monthly, quarterly, annual	The rhythm
Governance dossier	Ten sections	The lab’s deliverable

Module 21: Domain Agents

Concept	Rule	Use
GUI agent	Action is screen interaction, observation is screen	Definition 21.1.1
Action forms	Pixels, element reference, keyboard	The abstraction’s levels
Observation forms	Screenshot, accessibility tree, DOM	The modality’s choice
Grounding function	$g:\mathcal{O}\times\mathcal{T}\to\mathcal{A}$	The mapping
Three error sources	Observation ambiguity, state ambiguity, action precision	The failure’s modes
Grounding accuracy	Product of element, action, state	The compounding
OSWorld	369 tasks, OS apps, final-state verifier	The GUI benchmark
WebArena	812 tasks, 4 web apps, app-state verifier	The web benchmark
Persistence bound	$1-(1-p)^n$	The browsing reward
Persistence optimum	$n^*=\log(c_q/(pV))/\log(1-p)$	The arithmetic
Persistence risk	No convergence	The deployment’s needs
GUI four failure modes	Grounding, state, plan, loop	The distribution
Research anatomy	Literature, hypothesis, experiment design, execution, analysis, write-up	The pipeline
Verifier per stage	Citation, plausibility, pre-registration, reproduction, statistical, expert	The chain
Verification gap	$r_{\text{out}}-r_{\text{ver}}$	The bottleneck
Survey findings	38% release traces, no externally validated in-loop oracle, gap is limiting	arXiv:2608.05179, P
Four verification options	Reproduction, citation, expert, internal consistency	The ranking
In-loop vs post-hoc	Per-step vs end	The VPR’s connection
Research evaluation	Correctness, novelty, significance	The metrics
Research risks	Fabrication, misquotation, p-hacking, reproducibility, gaming	The risks
Research defences	Reproduction, citation, pre-registration, expert, trace	The controls
Transfer dimensions	Task, verifier, data, regulation, expert	The five
High-stakes profile	Unstructured, weak verifier, sensitive, high regulation, expert	The hardest
Expert’s three roles	Verifier, collaborator, overseer	The integration
Expert’s bottleneck	Time is the scarce resource	The allocation
Medical verifier	Outcome, guideline, expert, formal	The vertical
Legal verifier	Statute, precedent, expert, consistency	The vertical
Financial verifier	Audit, regulatory, expert, model risk	The vertical
Article 14 oversight	Human intervention and stop	The compliance
High-stakes evaluation	Base rate, cost, expert, ground truth	The difficulty
Verification-first principle	Verifier before agent	The module’s synthesis
Capability-first failure	Benchmark not deployment, verifier afterthought	The contrast
Verifier specification checklist	Eight steps	The design’s gate
Autonomy decision	Domain $\pi$ , $C_f$ , $C_h$ , TPR/FPR	The decision
Radiology worked example	Expert verifier, assistive value, no autonomy	The worked

Module 22: Production Operations

Concept	Rule	Use
SLO	(metric, threshold, window)	Definition 22.1.1
Stochastic SLO	Distribution’s statistic, not point	The agent’s specificity
Four SLO metrics	Availability, success, latency, cost	The set
User’s SLO	Derived from user tolerance	The principle
Technical SLO anti-pattern	Benchmark’s, not user’s	The failure
Error budget	(1−threshold) × volume	Definition 22.3.1
Budget’s uses	Release gate, prioritisation, acceptance	The operations
Burn-rate alerting	Multi-window, multi-burn-rate	The SRE practice
SLO failures	Technical, short window, tight, loose	The four
Canary	Small traffic, comparison	Definition 22.8.1
Canary statistics	Power, sequential	The design
Peeking’s problem	Repeated checks inflate false positives	The sequential’s fix
Canary design	Fraction, duration, metrics, guardrails, rule	The elements
Guardrails	Security, safety, fairness, cost	The block’s
Canary failures	Underpowered, peeking, guardrail ignored, shift	The four
Rollback	Reversal, previous version	The mechanism
Rollback’s risk	The rollback’s own change	The risk
Rollback drill	Periodic exercise	The rehearsal
Model pinning	Exact checkpoint, exact serving	The reproducibility
Deprecation risk	Provider’s forced upgrade	The migration
Regression suite	Tasks, scenarios, checks	Definition 22.16.1
Suite layers	Smoke, regression, full	The layering
Suite maintenance	Review, incidents, coverage	The rot’s
Upgrade procedure	Offline, canary, staged, audit, rollback	The five steps
Compatibilities	Format, context, verifier, harness	The four
Cost per success	Three-term / success rate	The economics
Forecast	Volume × cost, with range	The model
Pareto frontier	Non-dominated (model, harness)	The choice
Optimisation levers	Success rate, routing, context, tools, verifier	The order
FinOps practices	Allocation, anomaly, unit review, showback	The practices
Success rate’s leverage	Highest, quality and cost	The concept
Team topologies	Stream-aligned, platform, enabling, complicated-subsystem	The framework
Harness platform	Modules 1–17 as the platform	The agent’s topology
Review’s difference	Volume, trust, rationale	The agent’s
Review’s design	Risk-based, verification-first, signature, feedback	The design
Productivity Goodhart	Metric’s target	The risk
Measurement design	DORA, outcome, audit, no individual	The design
Operational loop	Deploy → canary → promote/rollback	The loop
Stability condition	$\eta<2/(L(1+2d))$	The Part 0’s
Oscillation	Adopt, rollback, repeat	The failure
Margin worked	$\eta=1,d=3,L=0.5$ → bound 0.571, unstable	The arithmetic
Adoption phases	Pilot, expansion, scaling, maturity	The phases
Adoption risks	Pilot misleading, scaling break, resistance, governance lag	The risks

THE FIVE MASTERY CRITERIA (The Curriculum’s Close)

Every claimed improvement carries uncertainty estimates and harness controls.
Every autonomy increase is paired with a named verifier, its ROC, and the autonomy threshold.
Every external input is treated as untrusted, and every architecture is checked against the lethal trifecta before it is built.
Every citation carries its evidence tier and reproduction status; every vendor claim is either reproduced or explicitly marked unreproduced.
Every factorial comparison reports the model × harness interaction term.

THE THREE QUESTIONS THAT CUT THROUGH EVERYTHING

What is the verifier? — Its TPR, its FPR, its precision at the deployment’s base rate, its cost. (Modules 5, 7, 17b.)
What is the autonomy? — $(1-\mathrm{TPR})\pi C_f < C_h$ ? The feasible set. The value proposition. (Modules 17c, 20, 21.)
What is the harness-controlled comparison? — The factorial, the interaction term, the held-out family. (Modules 5, 14, 22.)

End of the cheat sheet. The curriculum is complete.