Agents track

Start here: what turns a model into an agent

Six sites, one engine. Harnesses takes apart the loop around one model; Protocols follows its tool calls onto the wire; Context decides what goes into the window; Orchestration runs many steps and many agents as a graph; Evals asks how good the result is, and how sure you can be; Security makes the dangerous flows impossible by design. Read them in order, or start anywhere and follow the links back.

Reading order for the Agents track

Each site's chapters build on each other; start at chapter 1 of Harnesses. Every number is computed by the same tested simulator, Agent_Loop_Sim, or replayed from a recording.

1Harnesses (this site): the loop, tools, context budget, prompt cache and permissions around one model; assumes nothing.
2Protocols: how tools and other agents are reached on the wire (MCP, A2A); assumes the loop.
3Context: what goes into the window: retrieval, packing, compaction, memory; assumes the context budget.
4Orchestration: many steps and many agents as a graph: state, checkpoints, durable runs, fan-out.
5Evals: is the agent good, and how sure are you: pass@k, intervals, graders, the harness effect.
6Security: defences by design: trust labels, least privilege, sandboxes, approvals; reads best last.

What you need first

What a language model call is. Text in, tokens out, one token at a time, priced per million tokens. The Foundations track (Decoder and Training) shows what happens inside; the Agents sites treat the model as a box.
Tokens and the context window. That a prompt is counted in tokens, that it has a maximum length, and that the model reads all of it on every call. LLM Inference Explained covers what that costs on the server.
A little probability. Rates, independent events and an average; Evals and Orchestration build the rest (intervals, percentiles, Little’s law) as they go.
Reading code is optional. The Code layer shows the engine’s TypeScript, cut from the tested source, and where it helps a snippet for a real SDK; hide it with the layer switch.

How a chapter works

A chapter opens with an animation of its mechanism, run by the engine (a simulated agent, or a recorded one replayed token for token), then explains it in three layers you can switch on and off: Concept (words and pictures), Maths (the formulas) and Code (the code that runs). It ends with Check yourself, three questions to commit to before you reveal the answers (the numbers come from the same engine), and What to remember, the chapter in a few lines.

Some terms mean different things on different sites (goodput, ρ, the pipeline bubble). The shared definitions give each one definition and one formula, and say where a site differs. The Agents slide series goes deeper on every chapter.

Glossary

Each term links to the section that defines it, on the site that defines it.

Harness, agent loop: the program around a model that sends the conversation, parses the reply, runs any tool and calls the model again
Tool call, malformed call: text in a format the harness described; valid JSON, an offered tool and arguments that fit the schema, or an error back to the model
Context budget, compaction: everything shares one window; truncate, clip or summarise when the next prompt would pass a fraction of it
Prompt caching (ρ, w, L_min): a provider re-uses a prompt's processed prefix; reads cost ρ of the input price, writes w times it, above a minimum length
Permission rules and modes: allow, ask or deny per tool and argument pattern, checked deny first, so an allow never overrides a deny
Sub-agent: a second loop with a fresh context; only its final report crosses back to the parent
Hooks and sandbox: the user's code at fixed points of the loop, and an operating-system boundary around the commands the agent runs
Retry budget, back-off, loop detection: with r retries a call fails with probability p to the r + 1; waits double; three identical calls are not progress
Policy imitation: the simulator's settings closest to a public harness's documented defaults, with the same scripted model in every row
Cost and latency of a call: fresh prompt tokens, cached ones at ρ of the price, output and thinking tokens; overhead, prefill and decode time
MCP: host, client, server: one client per agent application and one server per tool turn N × M adapters into N + M
JSON-RPC, handshake, stateless revision: requests, results, errors and notifications; 2026-07-28 drops the handshake and carries an envelope on every request
Version negotiation: the newest revision both sides speak
Tools, resources, prompts: chosen by the model, the application and the user respectively
stdio, Streamable HTTP: a child process with one JSON message per line, or one HTTP POST per message answered with JSON or an SSE stream
Elicitation, sampling, input_required: a server needs the user or the client's model mid-call; in 2026-07-28 the call ends and is retried with the answers
PKCE: only a hash of the verifier leaves with the user; the verifier redeems the code
Token audience: a server accepts only tokens issued for it, and never passes them on
Gateway, name collisions: one server in front of many; prefix tool names with an alias so none is shadowed
A2A task: work handed to another agent, with an ID and a life cycle; results as artifacts
Tool poisoning (rug pull): a changed tool description with hidden instructions; pin a hash of the approved definition
The window as working memory: everything the model can use is in the prompt, and every call pays for it again
BM25: lexical scoring: rare terms weigh most, repeats saturate (k1), long chunks are discounted (b)
Dense retrieval: texts as vectors whose cosine reflects meaning; int8 vectors lose nothing measurable
Reciprocal rank fusion, reranking: merge retrievers by rank, then let a cross-encoder reorder the top n
Chunking: where documents are cut decides whether an answer sits in one chunk
Packing, lost in the middle: which chunks go in and where; models use the start and end of a long input best
Lossy compaction: a fact summarised n times survives with probability (1 − ℓ)ⁿ, so the oldest go first
Agent memory: written and read back across sessions: transcript, scratchpad, episodes or facts
Long context or retrieval: the whole set in every prompt, cached, or the top k chunks
Super-step, barrier: every triggered node reads the same snapshot; writes are applied when the last one finishes
Channel, reducer: the rule that merges a key's writes; without one, a key takes one write per step
Checkpoint, interrupt: state, next tasks and pending writes after every step; an interrupted node restarts from its first line
Durable execution, idempotency key: replay against a recorded history; exactly-once effects need at-least-once execution plus idempotent effects
Multi-agent patterns: single agent, supervisor, hierarchy, swarm, debate, map-reduce: who reads what
Fan-out, Amdahl's law, token bucket: a fan-out is capped by its serial part and by the rate the endpoint admits tokens
Visible and silent failures, verifier: retries fix errors that signal themselves; only a verifier catches a plausible wrong answer
Capacity, Little's law: the smallest rate any limit allows; L = λW for any stable system
Cluster-robust error, design effect: count tasks, not runs, as the unit; runs on one task are alike
FAIL_TO_PASS, PASS_TO_PASS: hidden tests that check the fix, and that nothing else broke
pass@k, pass^k: does some one of k tries pass, or do all k
Wilson interval, coverage: a 95% interval that stays near 95% coverage, unlike Wald's near 0% and 100%
Paired comparison, McNemar's test: both agents on the same tasks; only discordant tasks carry evidence
LLM judge biases, swap test, κ: position, verbosity and self-preference; swapping removes only position
Trajectory grading: the outcome, verification and no unsafe action, read from the whole trace
Harness effect: the same model's score moves with tools, call format and turn budget
Contamination: tasks seen in training; n-grams, canaries and time splits each see part of it
Pareto front, cost per solved task: configurations nothing beats on both cost and success; mean cost over success rate
Labels, trust boundaries: where a value came from and how secret it is; a derived value carries the join
Untrusted control, indirect prompt injection: once a model reads untrusted text, its next decisions may be that text's
Lethal trifecta: private data, untrusted input and a way out, all held at once
Least privilege: grant each task exactly the tools, scopes and destinations its plan uses
Sandbox layers, egress allow-list: file scope, container and network allow-list limit what a process can do
Detection in depth, shared blind spot: stacked detectors multiply their misses, down to a floor they all share
Dual model, CaMeL: plan from the request; untrusted data never chooses what the agent does
Approval fatigue: each extra prompt makes a mistaken approval likelier
Security–utility frontier: tasks finished against risk, for fixed and adaptive attackers