Module 3: Agentic Coding#

Use agents to write real code and learn how to make them work for you: planning, breaking things down, and verifying as much as possible, in a tight loop.

Questions this module answers#

• What workflow reliably gets good code out of an agent?
• Where does AI-generated code fail on security, and are the failures predictable or preventable?
• How do I steer an agent toward secure code, and how far does that get me?
• What model tiers should I use for what?
• Who is accountable for code an agent wrote?

Slides#

Lab 3.1: Build ShareBox#

Goal#

Ship a working web app to spec using the small model in pi. Practice the plan/decompose/verify workflow from the lecture. Your submission freezes overnight and becomes raw material for Day 2, becoming a codebase your security-evaluation system hunts in Lab 6.1.

Provided#

• The ShareBox spec: ~/labs/03-sharebox/spec.md on your VM
• The grading test suite: ~/labs/03-sharebox/tests/test_sharebox.py in the same directory

The spec#

ShareBox is an HTTP file-sharing API with user registration/login, file upload/download, share links, and an admin endpoint that lists users.

Rules#

• Build to the spec, nothing more.
• Do not security-harden beyond what the spec requires; that tension is the point of Day 2.
• Small model only.

Steps#

1. Read the full spec before touching pi. Build your app in ~/work/sharebox on your VM.

2. Have pi produce a build plan first: endpoints, data model, order of implementation. Review the plan and cut anything that isn’t the spec.

3. Build incrementally, one feature at a time, and ask your agent to run the whole test suite after each feature. This will help both it and you keep track of implementation progress.

4. When the full test suite passes locally, deploy the app on port 8080 and tell the instructor.

5. The instructor verifies your app against the suite and freezes it in its submitted state. Your app source will be copied to a class bucket (at the location $CLASS_BUCKET).

Done when#

You finish and submit your app. If you aren’t able to finish in time, no worries - the instructor will deploy a reference app on your VM instead for Day 2.