# Agentic workstation checklist — <the workstation you are building>

<!--
Purpose: the deliverable of Capstone 5. Two agents driven by local models, the tools they
         reach through MCP servers, a sandbox whose test passes by failing, a setup script
         that rebuilds the whole thing, and the evaluation suite's numbers over enough
         repeats to mean something.
Platform: all
Minimum memory: 16 GB; the agent-driving models in this course start around there and the
         workstation runs at least two models at once
Assumes: the gateway from Part 9's project, the agent loop and MCP work of Part 24, the
         coding-agent configurations and the sandbox lab of Part 25, the multi-agent
         patterns and evaluation suite of Part 26, and the improved model from Capstone 4
         if it is good enough for one of the roles.

The rule: nothing here is a plan. Every row names what you ran and what it printed, and
the sandbox section is only complete when every boundary attempt was refused and the
control check still succeeded. Delete every comment block, including this one.
No key, address or hostname belongs in this file.
-->

**Author:** <you> · **Date:** <YYYY-MM-DD> · **Track:** <S/X/M/N> ·
**Machines:** <which machine hosts the agents, which serves the models>

---

## 1. Agents and models per role

| Role | Agent | Model | Served by | Context configured | Why this pairing | Evidence |
| --- | --- | --- | --- | --- | --- | --- |
| <e.g. the one you supervise closely> | <agent> | <id or your improved model> | <gateway alias> | <n tokens> | <one sentence> | <a measurement or an observed failure> |
| <e.g. the one that runs a small task unattended> | | | | | | |
| <router or classifier, if you have one> | | | | | | |

**Two agents at minimum, and they must be different in kind:** <say what the difference is
in one sentence: a terminal agent and an editor agent, an interactive one and a batch one,
one you watch and one you do not.>

**Memory while both are running:** <GB observed, against <GB> available, at <the moment
you measured it: both idle, one working, both working>.>

**What happens when both want a model at once:** <the gateway queues, the swap unloads one,
or they use different models. Say which, and how you found out.>

## 2. MCP servers and tools

| Server | Transport | What it can read | What it can change | Reaches the network? | Why the agent needs it |
| --- | --- | --- | --- | --- | --- |
| <name> | <stdio or HTTP> | <paths, data> | <nothing, these paths, these commands> | <no / these hosts> | <one sentence> |

**Tool descriptions are untrusted input.** <Name where each server came from, and say what
you did about the ones you did not write: read the source, pinned a version, ran it inside
the sandbox, or all three.>

**The lethal combination, checked:** <does any single agent hold private data, read
untrusted content and have a way to send data out? If yes, say which of the three you
removed and how. If the answer is no by construction, say what the construction is.>

**What would happen if a tool's output were hostile:** <one paragraph, naming the agent
that would act on it and what would stop it.>

## 3. The sandbox and its test

| Field | Value |
| --- | --- |
| Mechanism | <container runtime, dedicated user, virtual machine> |
| Runs as | <a non-root user id> |
| Root filesystem | <read-only or not, and why> |
| What is writable | <the project directory only, or the list> |
| Network | <what it can reach; the gateway should be on the list and little else> |
| Credentials visible inside | <none; and how you confirmed it> |
| Rebuilt from | <the file that defines it> |

| Boundary check | What was attempted | Result | Pass condition |
| --- | --- | --- | --- |
| Home directory not mounted | <read something outside the project> | | refused |
| Container control socket absent | <list containers from inside> | | refused |
| Runs as a non-root user | <print the user id> | | not root |
| Root filesystem read-only | <write outside the project> | | refused |
| Project directory writable | <write a file in the project> | | succeeds |
| Planted secret unreadable | <read a file you planted outside> | | refused |
| Environment clean | <print the environment> | | no credential in it |
| Outbound network blocked | <fetch something on the internet> | | refused |
| **Control: the gateway is reachable** | <one completion through the gateway> | | **succeeds** |

<The control row is what stops you celebrating a box so isolated that no agent can work in
it. Part 25's boundary test is built the same way, and a run where every boundary was
refused and the control failed is a failed test, not a strict one.>

**Date the whole test last passed:** <YYYY-MM-DD> · **Anything that did not pass:**
<what, and what you changed.>

## 4. The setup script

| Field | Value |
| --- | --- |
| Script | <name> |
| What it builds | <the sandbox image, the agent configuration files, the gateway aliases, the MCP server list> |
| What it deliberately does not do | <download models, write secrets, start anything destructive> |
| Where secrets come from | <the environment, an untracked file, a prompt; never the script> |
| Run from clean on | <YYYY-MM-DD, on which machine> |
| What it did not cover, found by running it | <the manual steps that remained> |
| Time it took | <minutes> |

<The test of the script is a fresh run, not a reading. The list of things it did not cover
is the most useful output of that run and it belongs above rather than in your memory.>

## 5. Evaluation suite results

| Configuration | Agent | Model | Repeats | Success rate | Mean steps | Mean tokens | Mean seconds | Spread across repeats |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| <baseline: the stock model> | | | <3> | | | | | |
| <the improved model from Capstone 4> | | | <3> | | | | | |
| <a second agent or a smaller model> | | | <3> | | | | | |

**Task set and version:** <file and version> · **Tasks:** <n> · **Date:** <YYYY-MM-DD>

**Comparisons you are prepared to defend:** <name them, with the spread. Part 26's rule is
three repeats as the minimum for comparing two configurations, and with a suite of this
size a difference of one or two tasks is inside the noise.>

**One failing trajectory, read:** <which task, at which step it went wrong, and what the
agent did instead. One paragraph, and it teaches more than the whole table.>

**Cost, if you computed it:** <tokens per task and the cost per million tokens from the
Part 23 model, or "not computed".>

## 6. What is not done, and what you would not trust it with

<Every gap above, one line each. Then the sentence that matters: what would you not let
this workstation do unattended, and what would have to be true before you would?>