What this gives you

Choose a platform path and record a reversible installation pre-flight
Verify the CLI, Gateway, provider, and a controlled test task without exposing credentials
Define an approval boundary and remove the first-agent environment safely

Preflight

Before you start

Foundations and Architecture

Syllabus

Work through the map

Choose a safe installation path20 min
Install deliberately on macOS, Linux, Windows, WSL, or a VPS20 min
Onboard a provider without leaking its credential20 min
Verify the CLI and Gateway before connecting anything real20 min
Define a first agent that can only propose20 min
Capstone: run, inspect, stop, and remove the first safe agent20 min
Final assessmentAfter coursework

Course details and supporting evidence

What you will build

An intentionally small, local-first agent environment: one trusted operator, one test-only workspace, a provider credential kept out of the workspace, and a task that proposes rather than performs an external action. You will keep a short evidence record and finish by stopping and removing the environment.

Course map

Choose a path and set the stop conditions.
Install without giving the installer more scope than necessary.
Use onboarding to configure a provider without copying a key into notes or source control.
Verify the CLI and Gateway before connecting a real channel.
Define a single-purpose first agent and an explicit approval boundary.
Run, inspect, stop, remove, and document the result.

Before you begin

Use a disposable local account, VM, or VPS test user. Do not point this course at a work mailbox, a production channel, a production repository, or a credential that grants access beyond a throwaway test. If you cannot name the owner, workspace path, approved recipient, and deletion plan, pause before installing.

Safe first-agent boundary

trusted operator -> Gateway + test workspace -> model provider -> proposal for review
                                                          |
                                             approval required before any side effect

Keep the test credential outside the workspace, leave real channels disconnected, and verify that teardown returns the host to its prior state.

Completion evidence

Keep a redacted record containing platform path, installed version, Gateway status result, provider live-check result, one bounded proposal, the approval decision, and teardown result. Do not paste keys, tokens, logs containing secrets, or private endpoints into the record.

Review course maintenance history →