Add tool timeouts

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R01 — Async timeouts & exception handling

   R10 — OWASP Error Handling & Logging Cheat Sheets

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Add per-tool timeouts, bounded exponential-backoff retries, and safe error contracts to P1.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   Run D1 injection cases combined with simulated tool timeouts and malformed tool outputs.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Combined tool-security regression suite and residual-risk notes.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R01Python, FastAPI & Pydantic↗ fastapi.tiangolo.com

  FastAPI tutorial, request bodies, dependencies, async, and Pydantic model validation.

• R10OWASP Cheat Sheet Series↗ cheatsheetseries.owasp.org

  Authorization, SQL Injection Prevention, File Upload, SSRF, Secrets Management, and Logging Cheat Sheets.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsOWASP Cheat Sheet Series
  Logging

  Specifies what belongs in a log event and what must never appear (credentials, tokens, sensitive payloads), which is the constraint your safe error contract has to satisfy while staying debuggable.

  R10checked 2026-11-11
• videoArjanCodes · 24:02
  Retry Pattern: The Secret to Resilient Python Code

  Covers the retry decorator, backoff, and which exceptions are safe to retry, including the idempotency question that decides whether a failed tool call may be repeated at all.

  S7checked 2026-11-11
• videoYash Jain · 16:14
  Retry LLM API Calls Automatically with Python Tenacity

  Applies bounded retries with exponential backoff to LLM provider calls, showing how to cap attempts so a slow model cannot turn into unbounded spend.

  R03M5checked 2026-11-11
• articleAWS Architecture Blog
  Exponential Backoff and Jitter

  Gives the full-jitter formula and the measured reason plain exponential backoff still synchronizes clients into retry storms, which is the difference between bounded and unbounded retries.

  M5S7checked 2026-11-11
• repoGitHub
  jd/tenacity

  Retrying library with stop, wait, and retry conditions you can compose into per-tool attempt and deadline budgets rather than one global retry policy.

  S7checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.