Whetstone.
All courses
langchainIntermediate

Deep Agents Foundations

This mirrors foundation-introduction-to-deepagents, the course the LCAE exam guide labels Deep Agents Foundations. It is one of two courses the guide names for the Build section, and the guide's weighting indicates deepagents is roughly half of it. Everything is here: the constructor and its six additions, the fixed middleware stack, models, the system prompt after v0.7 emptied its base, tools and MCP, threads and checkpointers, human-in-the-loop gates, the execution environment where sandboxes are backends and the default shell policy is full host access, the context numbers that make the best quiz questions, skills against always-loaded memory, delegation as a context lever, and a full project derivation at the end. Every default in this library resolves toward capability, and that is the through-line.

Start the course 18 lessons 304 min
DACrash course
Curriculum

18 lessons across 6 modules

01Getting Oriented1 lessons · 15 min
02Building a Deep Agent7 lessons · 117 min
03The Execution Environment3 lessons · 55 min
04Context Management3 lessons · 54 min
05Delegation2 lessons · 33 min
06Putting It All Together2 lessons · 30 min
Capstone

Specify an unattended agent for a system you own, and write its incident report before you build it

You have every part. The exam asks whether you can put them together and defend the parts you left alone.

The task

Pick a system you genuinely own and would genuinely automate. Not a toy. Something where you would feel the consequences of getting it wrong, which means you will make honest decisions rather than tidy ones.

Then produce two documents in a scratch file. No cloud account, no deployment, no provisioned anything.

Document one: the specification

  1. The layer. create_agent or create_deep_agent, and one sentence naming what you would have to hand-assemble if you picked the lower one. If your answer is “nothing, it is only defaults”, you have understood module 1.
  2. The environment. Which backend, whether execute is granted at all, and which shell policy if any. State explicitly what your sandbox does not protect you against.
  3. The permission list, in declaration order, ending in an explicit catch-all. If you cannot say why the catch-all is mandatory, reread module 2 lesson 3.
  4. The gate list. Which tools sit in interrupt_on, with the reversibility judgement that put each one there, and at least one irreversible tool you deliberately left ungated along with the reason.
  5. The context strategy. Which thresholds you kept and which you moved, with the actual numbers, and what evidence moved the ones you changed.
  6. The knowledge split. What goes in always-loaded memory and what goes in a SKILL.md, with the reason expressed as a token-cost argument rather than a taste argument.
  7. The delegation topology. Your subagent roster, each with a description written for the parent and a prompt written for the child, plus an output contract the parent can act on.

Document two: the incident report, written first

This is the half that makes the exercise worth doing.

Write the post-mortem of the failure your design would actually have. Not a hypothetical, the likely one. Give it a date, a trigger, a blast radius and a detection story.

Three questions it must answer:

  • What went wrong, and which default was involved? The odds are heavily on one of the three that resolve toward capability.
  • How long before anyone noticed? Most failures in this library degrade rather than break. Nothing throws when a permission list fails open, an MCP toolset is missing, or a base prompt empties out from under you.
  • What in your specification would have caught it? If the answer is nothing, go back and change the specification, not the report.

The bar

Every number in document one is either a documented default you can name, or a deliberate override with a reason attached. No number appears because it sounded about right.

And document two names a real failure mode rather than a polite one. “The agent might occasionally be less accurate” is not an incident report. “The shell policy defaulted to the host, an injected page told it to read the deploy key, and nothing logged it because reads are not gated” is.

That is the discipline the whole course is aimed at. The exam tests whether you know which layer owns which concern and what happens when a default is left alone. The capstone asks the same question once, about a system you would have to live with.