Agent State Machine & Sandboxed Code Diagnosis

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R24 — LangGraph durable execution

   R41 — Agentic boundaries

   R21 — MCP security

   R02 — OWASP ASVS

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Audit P3 state machine, step/time/concurrency budgets, cancellation, and retries. Implement `C4` (Automated code diagnosis & PR generation) as a bounded workflow: ingest CI failure logs, reproduce the failure inside an isolated, network-restricted container workspace, generate a patch + test run, and output an unmerged PR proposal for human review (never auto-merge).

   Audit D2 JSON-RPC validation, caller identity, per-tool scopes, shadow-tool pinning, and D3 typed inter-agent message envelopes. Run poisoned tool description and message-spoofing tests.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   No separate task text for this block on day 85 — the sourced work sits in the block above. Keep the time box.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   C4 sandboxed code-diagnosis workflow tests + D2/D3 negative security test suite.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R02OWASP ASVS↗ owasp.org

  Access-control, validation, authentication, file-handling, and logging requirements.

• R21Model Context Protocol (MCP)↗ modelcontextprotocol.io

  Official specification: client/server lifecycle, JSON-RPC messages, tool discovery, authorization, and trust boundaries.

• R24LangGraph Documentation↗ docs.langchain.com

  State graphs, durable checkpointing, human-in-the-loop interrupts, retries, and resumability.

• R41OWASP Agentic AI Resources↗ genai.owasp.org

  Agentic threat taxonomy: tool misuse, excessive agency, memory poisoning, inter-agent trust, and human oversight.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsDocs by LangChain
  Interrupts

  Explains how interrupt() pauses a graph, persists state through the checkpointer, and resumes on human input, which is exactly the bounded-workflow and human-approval primitive C4 needs before emitting an unmerged PR.

  R24checked 2026-11-11
• videoLangChain
  LangGraph: Human-in-the-Loop

  Walks the minimal code change that turns a LangGraph runtime into a checkpointed human-in-the-loop workflow, showing where a graph halts and how it resumes from saved state.

  R24checked 2026-11-11
• videoAli Hamza
  LangGraph #36: Human in the Loop | LangGraph Interrupts Explained

  Demonstrates interrupt-driven approval gates in a state graph so you can audit where cancellation and retry boundaries sit before wiring the C4 patch-proposal step.

  R24checked 2026-11-11
• articleOWASP GenAI Security Project
  Agentic AI - Threats and Mitigations

  Catalogs tool misuse, excessive agency, memory poisoning and inter-agent trust failures, giving you the taxonomy to audit D2 per-tool scopes and D3 typed message envelopes.

  R41unchecked 2026-11-11
• repoGitHub
  SWE-agent/SWE-agent

  Reference implementation of the C4 loop you are building: ingest an issue, run inside a Docker-isolated workspace, apply a patch, validate with tests, and optionally open a PR rather than merging.

  R41checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.