Quiz: can you spot the three agents that would leak?

1. Where should the permission check for a tool call live?#

The model requests writeFile in PLAN mode. Where does the refusal happen?

1. In the system prompt, phrased firmly.
2. In the tool handler, before dispatch.
3. After the write, by rolling it back.
4. In the provider layer, by filtering the response.

B. The loop checks the mode before calling the tool. A prompt is advice that competes for attention with the task; a rollback is a write that already happened. See part 8.

2. A user approves `git commit` for the session. Later the agent runs `git push --force`. What should happen?#

1. It runs. Bash is allowed.
2. It asks, force-push is a different command shape.
3. It runs, the session grant covers all git.
4. It is denied permanently. Git is dangerous.

B. A session grant covers a shape. This only works if git commit and git push reduce to different shapes, which takes deliberate work. See part 9.

3. Which SSE detail, if missed, silently breaks your cost accounting?#

1. Using TextDecoder without the streaming flag.
2. Flushing the buffer after the stream ends.
3. Skipping `[DONE]` frames.
4. Not setting `signal` on the fetch.

B. Servers routinely close without a trailing blank line, so the final frame (carrying finish_reason and usage) is still in your accumulator. (A is a real bug too: you get replacement characters mid-word. It breaks output rather than billing.) See part 5.

4. Your agent CLI writes a spinner. CI runs it and the build log fills with spinner frames. What is the correct fix?#

1. Detect CI and slow the spinner down.
2. Send the spinner to stderr and leave stdout clean.
3. Gate the spinner on `process.stdout.isTTY`.
4. Disable animation whenever `--json` is passed.

C. B is necessary but not sufficient, CI captures both streams, so stderr frames land in the log too. D handles one code path and misses the twenty other ways CI runs your tool. See part 3.

5. The risk ledger file is corrupted by a merge conflict. What happens?#

1. It falls back to prompting on everything, correct.
2. It falls back to allowing everything for the session.
3. It refuses all shell commands until fixed.
4. It regenerates an empty ledger and logs a warning.

A. The module fails closed: unreadable is treated as empty, and empty means every novel command is asked. B is the trap, a truncated write silently disables the whole mechanism, and disables it quietly. See part 9.

6. Why record tool-call arguments in history when trimming for a request budget?#

1. For debugging, so a trace is complete.
2. They count toward request size, one big writeFile can blow the limit.
3. Because the provider requires them alongside tool results.
4. To let the model see what it already wrote.

B. A 40,000-character file body stays in the request forever after, so trimming only tool results is not enough. Keep the call id when truncating, or the result stops linking back and the provider rejects the ordering. See part 5.

7. The user presses Ctrl-C mid-turn. Which cleanup happens automatically?#

1. Nothing, you need an explicit handler per resource.
2. The generator's `finally` blocks run.
3. The HTTP request is aborted.
4. All three, automatically.

B. Breaking a for await loop calls the generator’s .return(), which runs finally. C still needs an AbortSignal threaded into the provider call, the socket does not know about your loop. See part 7.

8. The blast-radius gate blocks the first write to a migration. Why not every write?#

1. Subsequent writes to the same path are provably part of the same change.
2. It would be too slow for large migrations.
3. The gate has a per-turn cap of one block.
4. Because migrations should only ever be written once.

A, with the reason being adoption rather than logic. A gate that fires repeatedly trains people to disable it, and a disabled gate is worse than none because you stop looking for it. C is not true. The state is per path, not per turn. See part 10.

9. Which mode lets an agent edit files but not execute commands?#

1. PLAN
2. FIX
3. REVIEW
4. SCAN

B. This is the most useful mode most permission designs skip. It is the difference between “let it help” and “let it help and verify”, and the reason teams end up either refusing writes entirely or granting shell access. See part 8.

10. Your pre-flight reports `warn` on Windows because of the PATH separator. What should `doctor` do?#

1. Exit 1, so the problem is visible in CI.
2. Exit 0 and print the warning.
3. Suppress warnings on Windows.
4. Exit 0 but suppress the warning too.

B. Only a genuine failure should be non-zero. If warnings fail the run on any platform, people wrap it in || true and then it never runs at all — which is worse than not shipping the check. (This one is a real bug I shipped and fixed in this repo.) See part 4.

11. You want to store an API key. Where?#

1. In .sentinel.yaml, committed.
2. In the environment, with the config file holding only non-secret settings.
3. In the config file at 0600, gitignored.
4. In a prompt template, so it is easy to copy.

B. The reason is not just git hygiene: it is that a pre-flight, a diagnostic and a bug report can all mention the variable name safely. Sentinel’s doctor prints groq (GROQ_API_KEY) and never the value, and there is a test that fails if a canary key appears anywhere in the output. See part 4.

12. The agent loop needs to serve a TUI, a `--json` pipeline, and MCP. What is the right shape?#

1. Three loops, one per output format, sharing the tool layer.
2. One loop that prints, plus a mode flag.
3. One loop that yields typed events; three consumers.
4. An HTTP server with three routes.

C. B cannot produce JSON without a parallel code path, which is how the two paths drift. D adds an auth story and a port for something running on your machine. See part 7.

How did you do?#

What part 12 adds#

The last part is not code. It is the conversation you will actually have: what you say when a cautious tech lead asks whether the team should run an agent with shell access on the production repository, and what you can honestly offer instead of a demo.

Frequently asked questions#

Prefer to go back? The full curriculum lists all twelve in order.