Agentic AI, End to End

A hands-on course that builds a production-shaped AI agent from scratch — the loop, the tools, the memory, the evals, the guardrails — with no framework at all. When you later pick up LangGraph or CrewAI, you will already know what it is doing for you, because you will have written it.

Everything runs offline. No API key, no pip install, no virtualenv. The code ships with 116 passing tests and a working demo you can run in the next sixty seconds.

This is the workshop. The map is next door. Twenty-four lessons that build one thing deeply, with code you execute and exercises you check. For the breadth of the role — how LLMs work, prompting, model selection, tokens and cost, chunking, hallucination and grounding, fine-tuning, inference serving, GPU cost, multimodal — read the AI Engineer track. None of those are covered here. Every lesson links back to its concept page, marked Concept at the top. Read the concept if you want the framing; skip it if you want to build.

Start in sixty seconds

Grab just the course folder. It is 184 KB — do not clone the whole site.

npx degit iluzn/HLD-Designs/agentic-course agentic-course
cd agentic-course

No Node? Use a sparse checkout, which skips the site entirely:

git clone --filter=blob:none --sparse https://github.com/iluzn/HLD-Designs.git
cd HLD-Designs
git sparse-checkout set agentic-course
cd agentic-course

Then, either way:

python3 demo.py                                  # full stack, 6 scenarios
python3 -m unittest discover -s tests -t .       # 116 tests

Python 3.10+. Standard library only. That is the whole setup.

Why it runs with no API key. Everything talks to a model through one method, Model.complete. That single seam is the trick: FakeModel is scripted and deterministic, so the agent loop, the traces, and the eval suite behave identically whether a real provider is on the other end or not. You learn the mechanics for free, then swap one class to go live.

What you actually build

from agentic import Agent, FakeModel, Registry, tool, tool_call

@tool(description="Look up an order by id.", order_id="The order id.")
def get_order(order_id: str) -> dict:
    return {"id": order_id, "status": "delivered"}

model = FakeModel([
    tool_call("get_order", {"order_id": "4471"}),
    "Order 4471 was delivered.",
])

run = Agent(model, Registry([get_order])).run("Where is order 4471?")

run.output        # "Order 4471 was delivered."
run.trajectory()  # ["get_order"]  - tools that actually RAN
run.stop          # Stop.ANSWERED

By the end you have added budgets, tracing, an eval suite, a judge, hybrid retrieval, injection containment, and a capstone you can put in front of an interviewer.

Three ideas the whole course turns on

A loop with no budget is not an agent. It is a while loop with a credit card attached. Every run in this course ends with a named stop reason — answered, step budget, cost budget, repeated call, fatal tool error. There is no unnamed terminal state, because “it just stopped” is how you get a surprise invoice.

Requested is not executed. run.trajectory() lists tools that actually ran. run.requested_tools() lists what the model asked for. Conflating them makes a working guardrail look like a breach — a blocked injection would fail a never_used("refund") assertion even though the defence held. Writing the tests for this course is what surfaced that bug in my own code.

Prompt injection is contained, not prevented. Instructions and data share one channel, so no phrasing makes a document’s text non-instruction. The course therefore removes capability rather than trying to detect attacks: a context that has read untrusted text loses its mutating tools. Demo scenario 3 shows a fully compromised model that still cannot issue the refund.

Agentic AI Course — Lesson Tracker

Track your progress through all 24 lessons. Sign in to save across devices.

Part 1 — Build an Agent From Scratch

No frameworks. You write the loop, so you understand every layer above it.

Part 2 — Make It Not Break

The half of agent engineering that separates a demo from something you can deploy.

Part 3 — Give It Knowledge

Part 4 — Scale the Pattern

Part 5 — Run It in Production

Part 6 — Ship Something

The library you build

Eight modules, each short enough to read in one sitting.

Tests as the curriculum

The test names tell you what the course is really about:

test_step_budget_stops_a_runaway_agent
test_repeated_identical_call_is_detected
test_internal_exception_does_not_leak_details_to_the_model
test_unknown_tool_does_not_reveal_hidden_tools
test_missing_confirm_handler_crashes_rather_than_degrading
test_permission_filter_runs_before_ranking
test_rrf_combines_by_rank_not_score
test_always_pass_judge_has_zero_kappa_despite_high_agreement
test_injected_document_cannot_reach_a_mutating_tool
test_protected_keys_cannot_be_written_by_an_agent

Each encodes a failure mode that costs real money. Two of them exist because writing them found genuine design bugs in the library.

Honest limitations

Stated up front, because a course that hides its simplifications teaches you to trust the wrong things.

• HashingEmbedder is a bag-of-words hash, not a semantic model. It cannot tell “cheap” and “inexpensive” are related. It exists so the retrieval mechanics run offline. Swap in a real embedding model for anything real — and note that doing so means re-indexing your whole corpus, never a config flip.
• VectorStore is exact brute-force search, linear in corpus size. Real systems use approximate indexes and treat recall as a tunable SLO. Brute force is the baseline you measure those against.
• guard.scan is a pattern matcher and will always be incomplete — an attacker needs one phrasing you did not think of. Use it for triage, never as the thing standing between an attacker and a tool.
• No async. The library stays synchronous so the control flow is readable.

Prerequisites

Working Python and comfort with HTTP APIs. You do not need a maths background, a PhD, an ML background, or a GPU. If you want the conceptual grounding first, the AI Engineer track covers the vocabulary; this course is the hands-on half.

Related on SystemCraft

• Become an AI Engineer — the 36-topic reference track this course implements
• Design ChatGPT — the system-design view of an AI product
• System Design Concepts — idempotency, queues, caching, observability
• DSA Problemset — the coding round is still an ordinary coding round

Navigation

Start lesson 1 →