AI-Native Engineering: Course Index

The promise

AI-native engineering is not prompt-writing. It is engineering the environment around a model so an agent can explore and execute within clear boundaries, while tests, traces, and review decide whether the result is good.

Humans specify intent and boundaries. Agents explore and execute. Evidence decides whether the change ships.

How to use this series

Read one part, implement its lab in the shared shop-agent repository, break one assumption, and leave a test or trace behind. Each post is short enough to teach back in five plain sentences and concrete enough for a fresh agent to implement from a clean checkout.

The sequence

1. AI-Native Engineering 00: Choose the Smallest Agentic Shape
2. AI-Native Engineering 01: Package Procedural Knowledge as Agent Skills
3. AI-Native Engineering 02: Engineer Context, Not Just Prompts
4. AI-Native Engineering 03: Connect Capabilities Through MCP Portals
5. AI-Native Engineering 04: Make the Codebase Agent-Ready
6. AI-Native Engineering 05: Review Agent Work with Intent and Evidence
7. AI-Native Engineering 06: Secure the Agent as an Untrusted Operator
8. AI-Native Engineering 07: Parallelize Background Agents as a Bounded DAG
9. AI-Native Engineering 08: Build the Software Factory

The capstone

The shop-agent capstone grows one safe system across the series: choose the smallest agentic shape; package a refund-review skill; curate context; route typed tools through an MCP-like gateway; make the repository legible; review behavior with evals; enforce security boundaries; parallelize bounded research; and operate the whole loop as a software factory.

The definition of done is behavioral: a clean checkout can run the labs, wrong scopes and injected instructions are refused, a timeout cannot duplicate a write-like effect, and a fresh agent can resume from a verified progress file.

Shared vocabulary

An API is a defined way for programs to talk. JSON is a text format for data. A schema says which fields and types are allowed. Authentication proves who is calling; authorization decides what they may do. A scope is one named permission. A side effect changes the outside world. Idempotent means repeating the same request does not repeat the effect. A sandbox is an isolated computer. A trust boundary is where data or authority changes hands. A trace is a linked record of a run. An eval is a repeatable test of behavior. A DAG is a directed graph with no cycles.

The learner-critic loop

Run a fresh critic after each major revision. Do not give it the answer key first.

You are a rigorous beginner implementer. Start from a clean checkout of the course.
For each module: (1) teach it back in ≤5 plain sentences, (2) draw the diagram from
memory, (3) implement the lab without copying the worked example, (4) break one
assumption, (5) list every undefined term, hidden prerequisite, ambiguous step,
unverifiable claim, and missing failure path, and (6) audit the visual: 10-second gist,
60-second narration, grayscale, phone width/zoom, alt text, semantic labels, and
failure path. Score the rubric below to 0.01. Do not award points for prose that you
cannot turn into a test. Return failing tests and exact edits needed; then rerun only
the failures plus one regression case after the author revises the course.

Scoring rubric (10.00)

Release gates

The score is not enough. Release only after two consecutive fresh critic runs score ≥9.90 and all gates pass:

• no critical factual or security error;
• clean-checkout labs run and acceptance tests pass;
• the critic completes the transfer task without author intervention;
• every visual accurately matches code/runtime behavior and has a text alternative;
• every externally checkable claim has a current primary source;
• no undefined required term, hidden prerequisite, placeholder, or broken link.

Source map and reading order

These are the sources used to shape the syllabus (research checked 2026-09-02). Read the short primary source first, then implement, then use the longer source to deepen the decision. MCP is version-sensitive; the current protocol release is 2026-07-28, while the older 2025-06-18 pages remain useful for historical architecture concepts.

Visual standard for every future revision

Every visual must answer one named question, make one primary claim, show the failure path, and label arrows with verbs. Prefer a sequence diagram for a loop, a trust-boundary diagram for security, a layered map for context/MCP, a timeline for review, and a decision table for pattern choice. Keep the first view to 3–7 objects; reveal detail progressively. Pair each diagram with a short text equivalent. Never make color the only carrier of meaning. Test the 10-second gist, 60-second narration, grayscale, narrow width/zoom, alt text, and semantic consistency.

What “good” looks like

The graduate does not merely say “use agents.” They can answer:

• What is the smallest system that can solve this task?
• What exact context does the next step need, and what can be dropped?
• Which tool is available, with what schema, scope, timeout, and side effect?
• Where is the trust boundary, and what happens when the model is wrong?
• What evidence proves the outcome in the environment?
• Which work can run in parallel, and what must remain serialized?
• How does the next agent resume after failure without guessing?

If the answer is not visible in the repository, tests, traces, or review record, the system is not finished.