Appendix A — Glossary (plain language)

Activation function — a simple non-linear function (like ReLU) applied between layers. Without it, stacking layers is pointless.

Adam / AdamW — an optimizer that gives each parameter its own adaptive step size from running averages of its gradient and squared gradient, plus (in AdamW) weight decay applied separately from that adaptive step. Trains almost every modern neural network, LLMs included. See Chapter 71.

Agent — an LLM in a loop with tools and a goal, deciding its own next action.

Agent framework — a library (LangGraph, CrewAI, an SDK) that packages the agent loop's state management and control flow into reusable abstractions. See Chapter 69 — it doesn't make the model reason better, only easier to wire up.

AI governance — the processes and documentation (risk classification, model cards, audits) that let an organisation and regulators verify an AI system does what it claims. Distinct from runtime guardrails (Chapter 60). See Chapter 70.

Alignment — post-training that makes a model helpful, harmless, and honest.

Attention — the mechanism where each word looks at all other words and pulls in the relevant ones, weighted by learned relevance.

Backpropagation — the algorithm that computes how much each parameter contributed to the error, by applying the chain rule backwards.

Base model — a pretrained LLM before instruction tuning. Continues text; not an assistant.

Batch — a group of examples processed together in one training step.

BPE (Byte-Pair Encoding) — the tokenizer algorithm that repeatedly merges the most frequent adjacent pair of symbols.

Chain of thought — asking (or training) the model to show reasoning steps before answering, which improves multi-step tasks.

Chat template — the specific format of special tokens a chat model expects (roles, turn markers). Model-specific; must be correct.

Chinchilla — the 2022 result that compute-optimal training uses roughly 20 tokens per parameter.

Context window — the maximum tokens (prompt + output) the model can handle at once.

Cross-entropy — the loss function: -log(probability given to the correct answer). Punishes confident wrong answers heavily.

Dark knowledge — the information carried in a teacher model's wrong-answer probabilities (which mistakes are reasonable), not just its top prediction. Knowledge distillation exists to transfer this to a student.

Decode — the generation phase, one token at a time. Memory-bandwidth-bound.

Deep learning — neural networks with many layers, which learn their own features.

Diffusion model — a generative model (mainly for images) that learns to reverse a noising process. Different family from LLMs.

DPO (Direct Preference Optimization) — a simple way to train on preference pairs without a reward model or reinforcement learning.

Embedding — a dense vector of numbers representing a word, sentence, or item, where similar meanings are geometrically close.

Epoch — one full pass through the training data.

Few-shot — putting examples in the prompt so the model infers the task, with no weight updates.

Fine-tuning — further training of a pretrained model on your own data.

FLOPs — floating-point operations; the unit of compute.

GPU — the hardware that makes all of this feasible, because it does huge matrix multiplies in parallel.

GQA (Grouped-Query Attention) — many query heads sharing few key/value heads, to shrink the KV cache. In nearly every modern LLM. See Chapter 72 for the mechanism and the arithmetic.

Gradient — the direction and steepness of the loss surface; tells each parameter which way to move.

Gradient descent — repeatedly stepping parameters downhill on the loss. See Chapter 71 for how AdamW improves on the plain version used in Chapter 10.

Hallucination — fluent, confident output that is false or unsupported.

Head (attention head) — one of several parallel attention computations, each learning different relationships.

Hyperparameter — a setting you choose (learning rate, layers, batch size), as opposed to a parameter the model learns.

Inference — using a trained model to produce output. (Also called prediction.)

Knowledge distillation — training a small "student" model to reproduce a large "teacher" model's outputs (its full distribution, not just its final answer), transferring more of the teacher's learned behaviour than training the student on raw labels alone would.

KV cache — stored keys and values of previous tokens, reused during generation so you don't recompute them. Grows with context and users; usually the memory bottleneck.

Label — the correct answer for a training example.

Latent space / embedding space — the high-dimensional space where embeddings live.

Layer — one stage of a neural network.

Learning rate — the step size in gradient descent. The most important hyperparameter.

LLM (Large Language Model) — a large Transformer trained to predict the next token on huge text corpora, then usually instruction-tuned.

Logits — the raw scores the model outputs before softmax turns them into probabilities.

LoRA — training a small low-rank "patch" beside frozen weights, so fine-tuning is cheap.

Loss — a single number measuring how wrong the model is. Lower is better.

MoE (Mixture of Experts) — an architecture with many "expert" sub-networks where only a few run per token: more parameters, similar cost per token.

Multimodal — handling more than one kind of input (text + images + audio).

Overfitting — memorising the training data instead of learning general patterns; good train scores, bad test scores.

Parameter / weight — one of the numbers inside the model that training adjusts.

Perplexity — exp(average loss); roughly "how many words is the model choosing between?" Lower is better.

Prefill — the phase where the model processes your whole prompt at once. Compute-bound; determines time-to-first-token.

Pretraining — the big, expensive, self-supervised training run on raw text.

Prompt injection — malicious instructions hidden in text the model reads (user input, documents, web pages) that hijack its behaviour.

Quantization — storing weights in fewer bits (8-bit, 4-bit) to save memory and speed up generation, using a scale factor to map floats onto integers. See Chapter 73 for the actual arithmetic, GPTQ, and AWQ.

RAG (Retrieval-Augmented Generation) — fetching relevant documents at query time and putting them in the prompt so the model answers from sources.

Reranker — a model that re-scores retrieved candidates more accurately than the initial search. High value in RAG.

Residual connection — output = input + f(input). Gives gradients a direct path; makes deep networks trainable.

RLHF — Reinforcement Learning from Human Feedback: train a reward model on human comparisons, then optimise the LLM against it.

Safetensors — a weight file format storing a flat buffer plus a JSON header of tensor names/shapes/dtypes; can't execute code on load (unlike pickle-based .bin/.pt) and can be memory-mapped for fast loading.

Scaling laws — the smooth, predictable relationships between loss and model size, data, and compute.

Self-attention — attention where queries, keys, and values all come from the same sequence.

Self-supervised learning — creating labels from the data itself (e.g. "hide the next word"), so no human labelling is needed.

SFT (Supervised Fine-Tuning) — training on (instruction, ideal answer) pairs to make a base model behave like an assistant.

Softmax — turns a list of scores into probabilities that sum to 1.

Teacher model / student model — in knowledge distillation, the large already-trained model (teacher) whose outputs a smaller model (student) is trained to reproduce.

Temperature — a decoding setting controlling randomness. 0 = deterministic. (In knowledge distillation, temperature instead softens a softmax distribution so a student can learn from dark knowledge — see Chapter 67.)

Token — the unit an LLM reads and writes: usually a word-piece. Your bill and context window are measured in these.

Tokenizer — the reversible mapping between text and token IDs. Frozen for a model's lifetime.

Top-p (nucleus sampling) — keep the smallest set of tokens whose probabilities sum to p, then sample from those.

Training — adjusting parameters to reduce the loss.

Transformer — the 2017 architecture built on attention that underlies all LLMs.

TTFT / TPOT — Time To First Token / Time Per Output Token. The two latency metrics.

Vector database — a store optimised for finding the nearest embeddings to a query vector.

Weight tying — reusing the input embedding matrix as the output layer, to save parameters.

Zero-shot — asking the model to do a task with no examples, just instructions.

Agents, MCP, and safety (Parts 12–15)

Action guardrail — a deterministic check in your code that runs before a tool executes. The most important guardrail layer, because it works regardless of what the model was persuaded to want.

Agent — an LLM in a loop that chooses its own next action using tools, until a goal is reached. Contrast with a workflow.

Agent loop — think (ask the model) → act (your code runs the requested tool) → observe (append the result) → repeat, until the model answers or a limit is hit.

Allowlist — the explicit set of tools/domains/actions permitted. Never dispatch on a model-supplied string without one.

Confused deputy — an agent with legitimate broad privileges is manipulated into using them for something the user never intended.

Elicitation (MCP) — a server-initiated request for more information from the user, mid-operation.

Guardrail — any check outside the model: on input, on the action, or on the output.

Host (MCP) — the AI application that owns the LLM conversation and creates a client per server.

Human in the loop — requiring explicit human approval before a consequential action executes. The single most effective safety control.

Indirect prompt injection — malicious instructions hidden in content the agent reads (a document, email, web page, or tool description), rather than typed by the user. The dangerous variant.

JSON-RPC 2.0 — the message format MCP uses.

Kill switch — one flag that instantly disables all tool execution.

Least privilege — give the agent the minimum tools and permissions for its job. Read-only by default.

MCP (Model Context Protocol) — an open standard letting any AI application connect to any tool or data source, so integrations are written once rather than once per application. Introduced November 2024; specification versioned by date.

Orchestrator-workers — a pattern where a planner dynamically decides the subtasks and dispatches workers.

Prompt (MCP primitive) — a user-invoked template or workflow offered by a server. User-controlled.

Prompt injection — content that changes the model's behaviour by being interpreted as instructions. Unsolved; design for limited blast radius.

ReAct — reasoning + acting; the alternating think/act pattern at the heart of the agent loop.

Resource (MCP primitive) — data a server exposes that the host can read into context. Application-controlled.

Sandbox — an isolated environment (container/microVM) with no secrets, no network, and an ephemeral filesystem, for running model-generated code.

Server (MCP) — a process exposing tools, resources, and prompts. It never talks to the LLM.

stdio / HTTP transport — MCP's two transports: a local subprocess over standard input/output, or a remote HTTP endpoint with optional SSE streaming.

Tool (MCP primitive) — a function the model can choose to call. Model-controlled.

Tool poisoning — a malicious server embedding hidden instructions in a tool's description, which then enters the model's context.

Trajectory test — a test asserting on the sequence of tools called rather than the exact output text. Negative assertions ("did not call X") are the valuable ones.

Workflow — an LLM orchestrated through predefined code paths that you wrote. Prefer this over an agent whenever the steps are predictable.

Harnesses, production agents, decision models, and world models (Parts 20–21)

A2A (Agent2Agent) — an open protocol, now under the Linux Foundation, for one agent to discover another (via its Agent Card), send it a task, and track that task to completion. MCP is for tools; A2A is for peer agents. See Chapter 78.

AGENTS.md — a Markdown file in a repository giving coding agents the project's build/test commands, conventions, and no-go areas. The "project rules" layer of a harness. See Chapter 78.

Agent Card — the JSON document an A2A agent publishes describing its skills, endpoint, and authentication.

Agent Skill — a folder with a SKILL.md (name, description, instructions) plus optional scripts and files, loaded by the agent only when relevant. See Chapter 78.

Calibration — how well a model's stated probabilities match reality: of everything it calls "90% likely", about 90% should be true. Measured with a reliability table and ECE. See Chapter 80.

Compaction — replacing the older part of an agent's conversation with a model-written summary when the context window fills. Lossy. See Chapter 74.

Context rot — the decline in model quality as the context window fills with more, and staler, material.

Durable execution — journaling every step of a long-running process so that after a crash it resumes by replaying finished steps from the journal instead of redoing them. Temporal, Restate, DBOS, and framework checkpointers provide it. See Chapter 77.

ECE (Expected Calibration Error) — the average gap between stated probability and actual frequency across probability buckets, weighted by bucket size. 0 means perfectly calibrated.

Harness — all the code around the model in an agent: context assembly, tools, permissions, hooks, result shaping, context management, verification, sandbox, and limits. "Agent = model + harness." See Chapter 74.

Hook — your own code that runs at a fixed point in the agent loop (before a tool, after a tool, at stop) and can block, modify, or add to what happens.

Idempotency key — a deterministic ID sent with a side-effecting request so a retry is recognised and not executed twice. Essential for agent tools.

JEPA (Joint-Embedding Predictive Architecture) — a self-supervised architecture that predicts the embedding of a hidden or future part of the input rather than its raw pixels or tokens. I-JEPA, V-JEPA, V-JEPA 2. See Chapter 81.

Jev — TypeSafe AI's decision-only "System One" model (2026): it returns typed answers (Noul, Choice, Score) with probabilities instead of text. See Chapter 80.

Model-predictive control (MPC) — planning by imagining many action sequences with a model, executing only the first action of the best one, then re-planning from the new real state.

Outer loop — a loop that runs many fresh agent sessions, one task each, with state kept in files and git; the Ralph loop is the simplest form. See Chapter 75.

pass^k (pass-hat-k) — the probability that all k attempts at a task succeed; the reliability metric for agents. Contrast pass@k, the probability that at least one succeeds. See Chapter 76.

Progressive disclosure — showing the model only a short index (names and one-line descriptions) and loading full instructions on demand; how harnesses offer many skills cheaply.

Rainbow deployment — running old and new versions side by side so in-flight long-running tasks finish on the version they started on.

Ralph loop — running the same prompt through a headless coding agent again and again, each time with a fresh context, so the codebase converges on a spec; named after Ralph Wiggum. See Chapter 75.

Representation collapse — the failure in which a self-supervised encoder maps every input to (nearly) the same vector, making the prediction loss zero while learning nothing.

Sub-agent — an agent started by another agent with its own fresh context for a self-contained job; only its short result returns, keeping the parent's context clean.

System One model — a fast, non-generative decision model that returns probabilities over predefined options (after Kahneman's fast "System 1" thinking). "The LLM writes, the decision model decides, code acts."

Test-time compute — spending more computation at inference (longer reasoning, more samples) to get better answers; the scaling axis behind reasoning models.

World model — a model that predicts how the world will change, often given an action, so that an agent can plan by imagining outcomes. JEPA-style (predicts embeddings) or generative (predicts video).

Appendix B — Math corner (only what you need)

Everything here appeared in the guide. This is the reference version.

Vectors and similarity

vector          a list of numbers, e.g. [0.2, -0.5, 0.9]; a point in space
dot product     a . b = a1*b1 + a2*b2 + ...     (big when they point the same way)
norm            ||a|| = sqrt(a . a)              (the length of the vector)
cosine sim      (a . b) / (||a|| * ||b||)        in [-1, 1]; the standard
                                                 similarity measure for embeddings

Matrix multiply

Multiplying a vector by a matrix mixes the inputs in a learned way.
This IS a neural network layer.

cost of [m x n] @ [n x p]  ~  2 * m * n * p  floating-point operations

Softmax

softmax(z)_i = exp(z_i) / sum_j exp(z_j)

  - turns any scores into probabilities summing to 1
  - always subtract max(z) first for numerical stability
  - dividing z by a "temperature" T before softmax controls sharpness

Cross-entropy loss

loss = -log( p_model(correct answer) )

  p = 0.99  ->  loss 0.01     confident and right
  p = 0.50  ->  loss 0.69
  p = 0.10  ->  loss 2.30
  p = 0.01  ->  loss 4.61     confidently wrong: heavily punished

perplexity = exp(average loss)

Gradient descent

parameter  <-  parameter  -  learning_rate * gradient

chain rule:  if a affects b affects c, then
             (effect of a on c) = (effect of a on b) x (effect of b on c)
             ... which is all backpropagation is.

Attention

Attention(Q, K, V) = softmax( Q K^T / sqrt(d_k) ) V

  Q  queries  "what am I looking for"
  K  keys     "what do I offer"
  V  values   "what I contribute if attended to"
  d_k         dimension per head; the sqrt keeps scores in a sane range
  + a causal mask (-infinity above the diagonal) for text generation

Useful scale formulas

forward compute per token   ~  2 x (number of parameters)  FLOPs
training compute             ~  6 x parameters x tokens     FLOPs
memory for weights           =  parameters x bytes-per-parameter
                                (bf16 = 2 bytes -> ~2 GB per billion parameters)
KV cache bytes = 2 x layers x kv_heads x head_dim x tokens x batch x bytes
decode speed (1 stream)      ~  memory_bandwidth / model_size_in_bytes
Chinchilla optimum           ~  20 training tokens per parameter

Appendix C — Setup and troubleshooting

The environment (repeat of §0.4)

python3 -m venv .venv
source .venv/bin/activate           # Windows: .venv\Scripts\activate
pip install numpy scikit-learn matplotlib jupyter
pip install torch transformers tokenizers datasets
pip install gensim tiktoken sentence-transformers faiss-cpu
pip install peft trl accelerate      # for fine-tuning

Free GPUs

Common errors and fixes

Model size vs your hardware

Rough memory needed just to LOAD a model:

  bf16/fp16:  ~2 GB per billion parameters
  8-bit:      ~1 GB per billion parameters
  4-bit:      ~0.5 GB per billion parameters

So on an 8 GB GPU:   a 7B model needs 4-bit; a 1.5B model is comfortable in 16-bit.
Fine-tuning needs several times more than inference -- use LoRA/QLoRA.

Appendix D — Cheat sheets

Decoding settings by task

classification / extraction / routing   temperature 0
code: fix a bug                          temperature 0
code: write a function                   temperature 0.1-0.3
factual Q&A, RAG                         temperature 0-0.3
general chat                             temperature 0.7, top_p 0.9
brainstorming, fiction                   temperature 0.9-1.1, top_p 0.95
self-consistency (sample N and vote)     temperature 0.7-1.0, n = 5-20
ALWAYS                                   set max_tokens

Prompt skeleton

[ROLE]            who the model is being (if it helps)
[TASK]            precisely what to do
[CONTEXT]         the data, clearly delimited (### CONTEXT ... ###)
[EXAMPLES]        2-5, perfectly consistent format
[CONSTRAINTS]     length, tone, escape hatch ("if not in context, say ...")
[OUTPUT FORMAT]   exact structure or schema
[INPUT]           the actual thing to process        <-- LAST (caching + recency)

RAG checklist

[ ] chunks are self-contained (title/section prefixed)
[ ] chunk size suits the task (200-800 tokens) with 10-20% overlap
[ ] hybrid search: embeddings + keyword (BM25)
[ ] reranker on the top ~20-50 candidates
[ ] best chunks placed at the START and END of the context block
[ ] prompt says "use only the context" and requires citations
[ ] an escape hatch for "not in the documents"
[ ] retrieval measured SEPARATELY from generation (recall@k)
[ ] an eval set of 50+ real questions, run on every change
[ ] metadata filtering for permissions/tenancy BEFORE the search

Training a model: sanity checks

[ ] initial loss ~= ln(vocab_size)
[ ] can overfit a single batch to ~0 loss
[ ] gradient clipping is on (norm 1.0)
[ ] learning rate has warmup then decay
[ ] validation loss is tracked and plotted
[ ] checkpoints save model + optimizer + step
[ ] a fixed set of generation prompts is checked by eye every N steps

inference compute   ~ 2 x parameters, per token
training compute    ~ 6 x parameters x tokens
memory for weights  ~ 2 GB per billion parameters (bf16)
Chinchilla          ~ 20 tokens per parameter (compute-optimal)
English tokens      ~ 0.75 tokens per word, ~4 characters per token

Appendix E — Master reading list

If you only do five things

1. Watch: 3Blue1Brown, Neural Networks series (4 videos, ~1.5 h)
2. Watch: Karpathy, Neural Networks: Zero to Hero (8 videos) — especially "micrograd", "Let's build GPT", and "Let's build the GPT Tokenizer"
3. Read: Jay Alammar's Illustrated Transformer and Illustrated Word2vec
4. Read: Jurafsky & Martin, Speech and Language Processing (3rd ed. draft, free) — chapters 3, 6, 9, 10
5. Build: the three projects in this guide (tiny LLM, LoRA fine-tune, RAG app)

Books

Courses (free)

• Karpathy, "Neural Networks: Zero to Hero" — YouTube. The single best hands-on course.
• Google Machine Learning Crash Course — for Part 3.
• fast.ai, "Practical Deep Learning for Coders" — top-down, project-first.
• Hugging Face NLP Course and LLM Course — the practical modern pipeline.
• Stanford CS224N (NLP with Deep Learning) — lectures on YouTube.
• Stanford CS336 (Language Modeling from Scratch) — the deep version of Part 10.
• Stanford CS25 (Transformers United) — guest lectures from frontier labs.
• DeepLearning.AI short courses — 1-hour practical courses on RAG, agents, evaluation, fine-tuning.

Blogs and sites worth following

• jalammar.github.io — the Illustrated series.
• colah.github.io — Chris Olah; especially "Understanding LSTM Networks".
• karpathy.github.io — including "The Unreasonable Effectiveness of RNNs".
• huggingface.co/blog — practical, current, code-first.
• distill.pub — visual explanations (archived but timeless).
• transformer-circuits.pub — interpretability research.
• simonwillison.net — pragmatic LLM engineering and prompt-injection coverage.
• lilianweng.github.io — deep technical surveys.
• blog.vllm.ai — serving and inference.
• magazine.sebastianraschka.com — clear technical writeups.

Interactive tools

• playground.tensorflow.org — watch a network learn.
• bbycroft.net/llm — 3D walkthrough of a GPT forward pass.
• projector.tensorflow.org — explore embeddings in 3D.
• platform.openai.com/tokenizer and tiktokenizer.vercel.app — see tokens.
• huggingface.co/spaces — thousands of runnable demos.

Papers, in reading order

Once you finish this guide you can read these directly.

How the facts in this guide were checked

Historical dates, paper attributions, and the specific numbers used as examples were verified against primary sources (the arXiv papers listed above and official model documentation). Specifically confirmed:

• Chinchilla: ~20 tokens per parameter; 70B model trained on 1.4T tokens, outperforming the 280B Gopher at equal compute (Hoffmann et al., 2022).
• GPT-3: 175B parameters, ~300B training tokens, 96 layers, 12,288 hidden size (Brown et al., 2020).
• Llama-2-7B: 4,096 hidden size, 32 layers, 32 heads, 11,008 FFN intermediate size, 32,000 vocabulary, RMSNorm + SwiGLU + RoPE (official model config).
• word2vec: CBOW/skip-gram from arXiv:1301.3781; negative sampling, subsampling, and the 0.75-power noise distribution from arXiv:1310.4546.
• Lost in the Middle: U-shaped positional accuracy, Liu et al., arXiv:2307.03172 (2023), later published in TACL.
• τ-bench: pass^k metric and the finding that consistency across repeated trials was far below single-trial success (Yao et al., arXiv:2406.12045).
• V-JEPA 2: pretrained on 1M+ hours of video; V-JEPA 2-AC post-trained on 62 hours of DROID robot video for zero-shot planning (arXiv:2506.09985).
• Parallel-agent C compiler: 16 agents, ~2,000 sessions, ~$20,000 in API costs, a ~100,000-line Rust compiler that builds Linux 6.9 (Anthropic Engineering, 2026).
• Agentic AI Foundation: formed under the Linux Foundation (Dec 2025) with MCP, goose, and AGENTS.md as founding projects (Linux Foundation press release).
• Jev (Chapter 80): launch facts from InfoQ's and MarkTechPost's coverage (Sept–Oct 2026). Pricing, latency, and accuracy figures are vendor or early-adopter claims, not independently verified here, and the most likely to change.

Things that change and should be re-checked before you rely on them: model names and capabilities, API prices, context-window sizes, benchmark scores, and library APIs. Anything in this guide about current models is a snapshot; the fundamentals in Parts 1–9 are stable.

Appendix F — Answers to "Check yourself"

Ch 1 (1) A program's rules are written by a human; a model's numbers are found by the computer from examples. (2) A number inside the model that training adjusts. (3) The average size of the prediction errors. (4) The steps overshot the minimum and bounced further away each time.

Ch 2 (1) Labelled: emails tagged spam/not-spam. Unlabelled: a billion web pages. (2) Because labelled data is scarce and expensive, but raw text is nearly infinite — hiding the next word creates labels for free. (3) A feature is part of the input data; a parameter is a knob inside the model.

Ch 3 (1) No — a chess engine using minimax search is AI but learns nothing. (2) Having many layers, so it learns a hierarchy of features itself. (3) LLM ⊂ Transformer ⊂ deep learning ⊂ machine learning ⊂ AI.

Ch 5 (1) Working memory (facts about this case), rule base (general IF-THEN knowledge), inference engine (applies rules). (2) Backward when you have a specific question to prove; forward when you want everything that follows from the facts. (3) The rule required the literal words "holiday" and "how many", which weren't present.

Ch 6 (1) Experts can't fully articulate what they know, so extracting rules is slow, incomplete, and never finished. (2) Explain its reasoning by citing the exact rule chain; guarantee correctness by construction. (3) Anywhere the logic is legally defined and must be auditable — tax, payroll, access control.

Ch 7 (1) Can't articulate knowledge; brittleness; endless exceptions; combinatorial explosion; symbols aren't grounded. (2) Because each new rule adds interactions with all existing rules, and the space of unanticipated inputs is infinite. (3) Answers went from certain to probabilistic, and knowledge went from written to learned.

Ch 8 (1) The examples and (in classical ML) the features. (2) Because the model degrades gracefully on unfamiliar input instead of failing outright, and gives you a confidence level to act on.

Ch 9 (1) Counting how often each vocabulary word appears; it throws away word order. (2) Squashes any score into 0–1 so it can be read as a probability. (3) For — a positive weight pushes toward the spam class.

Ch 10 (1) Loss = how wrong the model is (one number). Gradient = which way to nudge each parameter to reduce it. (2) So the model is pushed hard away from confident errors, which are the costly ones. (3) Too high: overshoots and diverges. Too low: learns impractically slowly.

Ch 11 (1) It appears in every document, so its inverse-document-frequency is log(1) = 0. (2) The angle between their TF-IDF vectors — how much vocabulary they share, weighted by informativeness. (3) "Annual leave" and "holiday" share no words, and TF-IDF only matches identical strings.

Ch 12 (1) A model that gives a probability for the next word given the previous ones. (2) Because the count is zero and probability = count/total; fixed by smoothing (add-k, backoff, interpolation, Kneser–Ney). (3) Every word is an independent symbol, so statistics learned for one never transfer to a similar one — no generalisation. (4) The effective number of words the model is choosing between; lower means better prediction.

Ch 13 (1) Because always predicting the majority class scores well while being useless. (2) Precision: of the emails I called spam, how many were? Recall: of all spam, how much did I catch? (3) Information in training that won't exist at prediction time — e.g. using account_closed_date to predict churn. (4) Recall — missing a real cancer is far costlier than a false alarm.

Ch 14 (1) XOR isn't linearly separable — no single straight line puts both positives on one side. (2) Stacked linear layers collapse into a single linear layer, so depth buys nothing. (3) The hidden layer invents intermediate concepts useful for the task, without being told what they should be.

Ch 15 (1) The final error is passed backwards, and each station's share of the blame is (blame from downstream) × (its own sensitivity). (2) The backward pass needs those values to compute gradients. (3) Gradients shrink toward zero through many layers so early layers don't learn; fixed by ReLU, normalisation, careful init, and residual connections. (4) It provides a direct path so the gradient can flow past a layer unchanged.

Ch 16 (1) Edges → textures → parts → objects (vision). (2) You build reusable components once and combine them, instead of enumerating every combination. (3) GPUs, large datasets, and training tricks (ReLU, better init, normalisation, residuals).

Ch 17 (1) A vector carrying a summary of everything read so far. (2) Vanishing gradients; the cell state uses addition rather than repeated multiplication, so gradients survive many steps. (3) The whole input had to fit in one fixed vector; attention let the decoder look at all encoder states and weight them. (4) Full parallelism during training, and direct connections between any two positions.

Ch 18 (1) It means the representation says two distinct words are completely unrelated, so nothing learned about one transfers to the other. (2) Words used in similar contexts tend to have similar meanings. (3) A dense vector representing an item, where geometric closeness means semantic similarity.

Ch 19 (1) Predicting a word's neighbours; we keep the learned word vectors and discard the prediction machinery. (2) The full version needs a score for every word in the vocabulary per training pair — computationally impossible; negative sampling replaces it with a handful of yes/no comparisons. (3) The offset between "king" and "man" is roughly the same vector as between "queen" and "woman", so relations become consistent directions. (4) Embeddings place "annual leave" near "holiday" by meaning, while TF-IDF requires literal word overlap.

Ch 21 (1) Multiple senses of a word, word order, and negation. (2) A vector computed from the whole sentence, so the same word gets different vectors in different contexts. (3) It first showed that pretraining a language model and reusing its internals beats training each task from scratch.

Ch 22 (1) Resolving it requires combining information from words several positions away in both directions. (2) Training parallelism — all positions processed at once instead of sequentially.

Ch 23 (1) Query = what this word is looking for; key = what each word offers; value = what it contributes if selected. (2) It returns a weighted blend rather than one item, which makes it differentiable and therefore learnable. (3) Three learned matrices project each word's embedding into the three roles.

Ch 24 (1) Score (dot products) → scale by √d_k → mask the future → softmax → weighted sum of values. (2) To keep scores in a range where softmax isn't saturated, which preserves useful gradients. (3) Sets future positions to −∞ so they get zero weight; without it the model would see the answer it's meant to predict. (4) It's two large matrix multiplies over the whole sequence, which GPUs do extremely well; an RNN must wait for each step.

Ch 25 (1) So different heads can specialise in different relationships simultaneously. (2) Attention is a weighted sum, which ignores order — but language depends on order. (3) Attention moves information between positions; the feed-forward network processes information within each position (and stores much of the factual knowledge). (4) Gradients wouldn't reach early layers, and deep models wouldn't train. (5) The attention score matrix is n × n, so cost grows with the square of the length.

Ch 26 (1) At the start the model is uniform over the vocabulary, and -log(1/V) = ln(V). (2) Loss dropped fast but generation broke — the model could see the token it was supposed to predict. (3) Scale (parameters and data), tokens instead of characters, modern components (RoPE/RMSNorm/GQA/SwiGLU), and post-training.

Ch 27 (1) Unknown words (typos, names, new terms) can't be represented, and the vocabulary becomes enormous. (2) Sequences become far longer, and attention cost grows quadratically with length. (3) Every token ID maps to a specific row of the embedding table; changing the tokenizer invalidates all of them.

Ch 28 (1) Start from characters; repeatedly count adjacent pairs and merge the most frequent; stop after the desired number of merges, saving the ordered merge list. (2) The order encodes the vocabulary that was built; a different order gives a different (incorrect) segmentation. (3) Because "low" and "est" were both learned as merged units, while "newest" contains pieces that never merged.

Ch 29 (1) About 1,000 tokens. (2) Digit groupings are inconsistent between numbers, so the model sees fragments that don't align to place value; and long numbers split unpredictably. (3) Tokenizers are trained mostly on English, so other scripts need more tokens for the same content.

Ch 30 (1) Formats messages into the exact string of special tokens the model was trained on. (2) Quality degrades silently — the model doesn't recognise the structure it expects. (3) A user can inject text that looks like a role marker and attempt to impersonate the system prompt.

Ch 31 (1) A probability for every token in the vocabulary being next. (2) Your application re-sends the conversation history in every request. (3) Because predicting the next token across all human text requires learning grammar, facts, arithmetic, code, and reasoning patterns.

Ch 32 (1) [tokens × d_model] in both cases — the shape is unchanged; the numbers accumulate context. (2) Only the last position has seen the entire prompt (due to the causal mask), so it's the one that predicts what follows. (3) Logits are raw, unbounded scores; probabilities are logits after softmax, summing to 1.

Ch 33 (1) From the text itself — the true next word is the label (self-supervised). (2) For compute-optimal training, scale parameters and data together, at roughly 20 tokens per parameter. (3) Because a model is trained once but served billions of times; a smaller, over-trained model is far cheaper to run. (4) It was trained to continue documents, not to answer — so it continues in the style of the surrounding text.

Ch 34 (1) SFT teaches the format and behaviour of an assistant; preference tuning teaches taste — which of two valid answers people prefer. (2) Comparative judgements are faster and far more consistent between annotators than writing ideal text. (3) Without it, the model drifts into degenerate text that scores well on the reward model but is useless ("reward hacking"). (4) The model agreeing with the user regardless of correctness, because agreeable answers were rated higher.

Ch 35 (1) The loss rewards plausible-looking text, not truth; and the softmax always produces an answer — there's no built-in "I don't know". (2) The model has learned the format of citations far better than any specific citation, so it pattern-completes a well-formed fake. (3) Give it the source material and require it to answer only from that (RAG), plus tools for exact facts. (4) Because abstaining is just another string it must be explicitly trained to produce in the right circumstances.

Ch 36 (1) Prefill processes the whole prompt in one pass and is compute-bound; decode generates one token at a time and is memory-bandwidth-bound. (2) The weights are read from memory once and reused for every request in the batch. (3) Time to first token — mainly prompt length plus queueing.

Ch 37 (1) It divides the logits, which flattens or sharpens the distribution after softmax. (2) Top-p adapts to the model's confidence: narrow when it's sure, wide when it isn't. (3) Temperature 0 for extraction; ~0.9–1.0 with top-p 0.95 for a poem.

Ch 38 (1) Because of the causal mask, a token's key and value depend only on itself and earlier tokens, so they never change. (2) Memory — it grows linearly with context length and the number of concurrent users. (3) To shrink the KV cache by sharing key/value heads across many query heads. (4) The KV cache keeps growing, so each new token requires reading more memory.

Ch 39 (1) Each output token requires a separate full pass through the model, while input tokens are processed together in one efficient pass. (2) Keeping the beginning of your prompt stable and putting variable content at the end. (3) Use a smaller model, retrieve instead of stuffing context, and cap/shape the output.

Ch 42 (1) It freezes the original weights and trains a small low-rank matrix pair added alongside them. (2) Facts are stored diffusely and fine-tuning on a few examples doesn't reliably overwrite them; and facts change, requiring retraining. (3) It reproduces training examples verbatim, and it gets worse at anything outside the fine-tuning data.

Ch 44 (1) Each generated token is another forward pass, so reasoning tokens give the model computation space it cannot get in a single step. (2) Models attend strongly to the end of the context, and it keeps everything before it stable for caching. (3) An explicit permitted answer for "I can't tell from this" — without it the model invents something.

Ch 45 (1) Quadratic attention cost, linear KV-cache memory, and positional generalisation beyond the trained length. (2) Accuracy is highest at the start and end of long contexts; put the most important material there and restate the question at the end. (3) Because if you fill the window with input, there's no room left for the model to answer.

Ch 46 (1) Keep the beginning of the prompt byte-identical across requests. (2) They cost more per token and dominate latency, since each requires a full forward pass. (3) A too-loose similarity threshold returns a cached answer to a question that was actually different.

Ch 47 (1) Embed the question → search for similar chunks → rerank → build a prompt with the top chunks → generate a grounded answer. (2) RAG for knowledge that changes or is too large to memorise; fine-tuning for behaviour, style, and format. (3) A cross-encoder that scores the question and chunk together, which is far more accurate than comparing independent embeddings. (4) Otherwise a retrieved chunk may be uninterpretable out of context ("he resigned in 2019" — who?).

Ch 48 (1) For supported schemas, it prevents invalid output at decoding time by restricting which tokens can be sampled, assuming the schema and implementation are correct. (2) Arithmetic, current information, and access to your private data. (3) Least privilege, human approval for consequential actions, and hard limits on iterations/spend.

Ch 49 (1) Output is non-deterministic and there are many valid phrasings, so exact-match assertions don't work. (2) Malicious instructions hidden in content the model reads — documents, web pages, emails — rather than typed by the user. (3) In your code: permissions, allowlists, and approval gates, not in the prompt. (4) The prompt template, the model ID and parameters, and the retrieval index snapshot.

Ch 50 (1) In a workflow you write the steps in code and the LLM fills in the blanks; in an agent the model decides which steps to take. (2) Retrieval, tools, and memory. (3) Prompt chaining (fixed sequential subtasks); routing (distinct input categories); parallelisation (independent subtasks or multiple opinions); orchestrator-workers (subtasks unknown in advance); evaluator-optimiser (clear quality criteria, iteration helps). (4) Workflows are predictable, testable, cheaper, and debuggable — autonomy is a cost you should only pay when the task genuinely requires it.

Ch 50 Practice 1 = single prompt · 2 = workflow, evaluator-optimiser · 3 = workflow (RAG + one prompt) · 4 = agent (it must decide whether to look up, check policy, and act) · 5 = agent, orchestrator-workers (you can't know how many files) · 6 = workflow, parallelised (identical fixed steps per invoice) · 7 = workflow, routing/classification.

Ch 51 (1) Think (ask the model), Act (your code runs the tool), Observe (append the result), Repeat. (2) Your code. The model only requests a call. (3) So it can see what went wrong and correct itself — error recovery is a large part of why agents work. (4) Maximum steps, maximum cost, and a tool allowlist (plus result truncation and a timeout). (5) In the messages list — there is no hidden state.

Ch 52 (1) Only the name, the description, and the JSON schema of the arguments. (2) Because it's natural language that the model reads to decide whether and how to use the tool — the same care applies as to any prompt. (3) It gives the model unbounded capability, including destructive queries; a narrow tool is safer, easier to use correctly, and testable. (4) Because anything the model produces can be influenced by injected content — identity must come from your authenticated session.

Ch 53 (1) The model is stateless; every call is independent, so "memory" is whatever your code puts back into the context. (2) Working context, rolling summary, retrieved memory, structured state — an order ID belongs in structured state, because it must be exact. (3) Summarising costs an extra LLM call; doing it every turn is wasteful and adds latency. (4) So one user's data can never appear in another user's context — a serious and common bug class.

Ch 54 (1) Genuinely parallel subtasks; very different tool sets; safety separation (read-only researcher, separate actor); different models per role; adversarial review. (2) Because each hand-off has its own failure probability and they multiply — 0.9^5 ≈ 0.59. (3) Any context not explicitly included in the hand-off. (4) To limit blast radius: the agents that read untrusted content cannot act on it.

Ch 55 (1) Infinite loops, cost explosions, wrong tool choice, hallucinated arguments, giving up early, context overflow, silent wrong answers, prompt injection. (2) Output is non-deterministic — the same input can produce different valid paths and wordings. (3) A test asserting on the sequence of tools called rather than the text; a negative assertion ("did not call issue_refund") catches dangerous behaviour that a quality check would miss. (4) Trace ID, step number, tool name and arguments, result summary, duration, tokens, and cumulative cost.

Ch 56 (1) N applications each needing M integrations means N×M bespoke connectors; a standard makes it N+M. (2) The Language Server Protocol, which standardised editor↔language integration. (3) When the tool should be reused across applications, when someone else has already written the server, when you want process isolation, or when you're building a product others connect tools to. (4) MCP is evolving quickly — headers, session handling, and options have changed between revisions, so your SDK and server must agree.

Ch 57 (1) Host (the AI application), client (a connector inside the host, one per server), server (the capability provider). Only the host talks to the LLM. (2) Tools (model-controlled), resources (application-controlled), prompts (user-controlled). (3) JSON-RPC 2.0. (4) The protocol core became stateless — sessions and the session header were removed, and identity/version/capabilities travel in a _meta parameter per request — so any instance behind a load balancer can serve any request.

Ch 58 (1) stdio runs the server as a local subprocess over standard input/output — best for local tools; HTTP is for remote/shared servers. (2) Because issuing a refund is irreversible, so it creates a pending request for a human to approve instead. (3) Because rules that must always hold belong in code — a tool description is a prompt, and prompts can be talked around. (4) It discovers what the server offers, e.g. with tools/list or the current SDK's discovery helper; older SDK flows may still expose initialize for compatibility.

Ch 59 (1) Because everything — system prompt, user message, retrieved documents, tool results — arrives as one undifferentiated text stream that the model interprets together; natural language has no formal grammar separating code from data. (2) Direct: the user tries to override your instructions. Indirect: malicious instructions hidden in content the agent reads (a document, an email, a web page, a tool description) — far more dangerous because the victim isn't the attacker. (3) A malicious server ships a tool whose description contains hidden instructions; the MCP specification states that tool descriptions and annotations should be treated as untrusted unless the server is trusted. (4) An agent with legitimate broad privileges is manipulated into using them for something the user never intended. (5) Because it means you must design so that a successful injection has limited blast radius, rather than hoping to prevent it.

Ch 60 (1) Input, action, and output. Action matters most, because it is deterministic code that runs regardless of what the model was persuaded to want; input and output filters are probabilistic. (2) Because the prompt can be talked around by injected content, while code cannot. (3) Human approval for consequential actions. (4) Because a common exfiltration technique is putting secrets into a URL the agent then fetches; restricting outbound destinations breaks that channel. (5) Buy layers 1 and 3 (safety classifiers, PII detection, schema validators); build layer 2, because your business rules are yours.

Ch 61 (1) Users can generally extract it, and no mechanism hides it from the model that must read it. (2) Strip special tokens, strip invisible Unicode, delimit and label it as data, and cap its size. (3) Because post-filtering still leaks existence, counts, ranking, and sometimes snippets. (4) It ensures you only accept tokens that were minted for your server, preventing a token issued for another service being replayed against you. (5) A single flag that instantly disables all tool execution — it turns a five-day incident into a five-minute one.

Ch 62 (1) Because the prompt can be overridden by injected instructions, but execute_tool runs regardless of what the model believes. (2) It returns "Order not found", because the guardrail compares the order's owner to the session's customer ID — and it deliberately doesn't reveal that the order exists. (3) So that an injection telling the model to list another customer's orders cannot succeed — the argument is replaced with the authenticated identity. (4) Because "you don't have access" confirms the order exists, which is itself an information leak. (5) Removing the human-approval gate on request_refund — it turns a request into an irreversible payment.

Ch 66 (1) A weight matrix W and a bias vector b, combined as y = W @ x + b. (2) Both use 16 bits, but bf16 spends more of them on the exponent (matching fp32's dynamic range) and fewer on the mantissa, so it resists overflow during training at the cost of some precision. (3) Because the file's header just describes where each named tensor sits, and a runtime can memory-map that region directly rather than executing anything.

Ch 67 (1) The relative sizes of its probabilities on the wrong answers — which mistakes are "reasonable" — not just which answer is most likely. (2) Because the KL term's gradient naturally shrinks by roughly 1/T^2 as temperature rises, so the correction keeps the distillation signal from weakening as T increases. (3) Because a continuous output isn't squashed by a softmax, so there's no small-probability information to expose — the teacher's raw output already is the full signal. (4) Quantization reduces the number of bits per weight in an existing architecture; distillation trains a different (smaller) architecture from scratch on the teacher's outputs.

Ch 68 (1) Because the student is trained purely by regression distillation — its only label, ever, is teacher.forward(x), so neither the synthetic curve nor the live feed is ever referenced in that loop. (2) Because the teacher now has to fit two sources at once (the smooth hand-typed curve and noisier real observations that don't sit exactly on it) instead of just one — a model that compromises between two targets necessarily fits either one alone a little worse than a model that only ever saw that one target; this is expected, not a sign anything broke. (3) Because both models had already seen the synthetic curve and (for training days) the live feed during training — evaluating only against those would risk measuring memorisation, not generalisation; the 60 held-out real days were never used in either model's training, so accuracy on them is the first genuinely honest number in the chapter. (4) Hand-rolling the forward pass would still work in principle, but at that size you'd reach for a real runtime (TensorFlow.js or ONNX Runtime Web) rather than inline array.reduce calls, and you'd likely load the weights asynchronously rather than inline them in a <script> tag. (5) Because an external API can be slow, rate-limited, or simply offline, and none of that should be a reason a local training script crashes — catching the exception and falling back to the illustrative curve keeps the pipeline usable with or without network access.

Ch 69 (1) Persistence/checkpointing, resumability, human-approval interrupts, and visualisation/tracing of the control flow — not better reasoning. (2) A function that inspects the current state and returns the name of the next node; it replaces the if check inside Chapter 51's while loop that decides whether to execute a tool call or return the final answer. (3) Because a framework manages state and control flow, not the model's judgement — action guardrails, least privilege, and human approval still have to be designed and added explicitly, regardless of framework. (4) When the task needs explicit branching, cycles, or checkpointing rather than a mostly linear/hierarchical handoff between fixed roles.

Ch 70 (1) Part 14's guardrails guarantee runtime behaviour for one system (what it will and won't do); governance requires documentation, risk classification, and audit evidence that exist independently of whether the runtime guardrails are good. (2) Unacceptable (e.g. social scoring, banned outright); high (e.g. hiring/credit decisions, requires conformity assessment); limited (e.g. chatbots, requires disclosure); minimal (e.g. spam filters, no obligation). (3) Govern, Map, Measure, Manage — Measure maps most directly to Chapter 49's eval sets and adversarial testing. (4) Because EU AI Act risk tier depends on what the system is used for and what it's allowed to decide, not on its code — the same refund agent is limited-risk as built, but would become high-risk if it also decided credit limits.

Ch 71 (1) m (an exponential moving average of the gradient — momentum) and v (an exponential moving average of the squared gradient — used to scale the step per parameter). (2) Because m and v start at zero, so early updates are biased toward zero until enough history accumulates; dividing by (1 - beta^t) cancels that bias exactly. (3) It applies weight decay as a separate, direct shrink of the parameter instead of mixing it into the gradient before computing m and v, so the adaptive scaling doesn't distort the decay amount. (4) Because the update uses m_hat / sqrt(v_hat), which self-normalises — once the running averages have spun up, the ratio stays roughly stable even as the raw gradient's magnitude changes.

Ch 72 (1) Queries (Q) stay full-sized — every head keeps its own projection; only keys and values (K, V) shrink to a smaller number of shared projections. (2) Using the chapter's per-token-per-user figure with 8 KV heads (0.16 MB) times 4,000 tokens times 4 users ≈ 2.56 GB (versus ~12.8 GB at plain MHA's 40 KV heads for the same conversation length and user count). (3) Because queries are never shared — each head still asks its own question — only what it's allowed to look at is pooled across a group, which loses far less than pooling everything the way MQA does. (4) Because the number and grouping of K/V projections is fixed by the weight matrices learned during pretraining; changing it changes the architecture itself, which requires retraining (or a dedicated uptraining procedure), unlike quantization which only changes numeric precision after training.

Ch 73 (1) scale = max(|w|) / 127; q = round(w / scale) clipped to [-127, 127]; dequantize with w_approx = q * scale — the scale stretches the integer range to cover the group's actual magnitude. (2) Because one scale is shared across the whole group, and the scale must stretch to fit the largest value — an outlier forces a scale so large that every smaller weight rounds toward zero; per-group quantization computes a separate scale for a small block of weights, so the outlier only damages its own block. (3) It's run through the layer to measure which weight directions actually affect the layer's output most, so GPTQ can adjust not-yet-quantized columns to compensate for error already introduced in quantized ones. (4) It protects the small fraction of weight channels that get multiplied by large-magnitude activations, because those contribute disproportionately to output error; weight magnitude alone doesn't tell you that, since a modest weight multiplied by a huge activation can matter more than a large weight multiplied by a tiny one. (5) Because scales (and zero-points) are stored per group at higher precision (often fp16), adding overhead on top of the nominal 4 bits per weight.

Ch 74 (1) Any five of: context assembly, tools, permissions, hooks, result shaping, context management (compaction, sub-agents, external memory), verification, sandbox, and limits. (2) Because the model can be talked out of (or simply ignore) a prompt instruction, whereas code runs regardless of what the model outputs; the Replit incident is the example. (3) It runs your code after a tool call and appends the output to the result. Running tests after every edit means a mistake is caught, and shown to the model as evidence, one step after it's made instead of many steps later. (4) Prompt caching reuses a prefix only if it's byte-for-byte identical; a changing timestamp at the top invalidates the cache on every call, so you pay full price for the whole prefix each step. (5) Context isolation: the sub-agent reads lots of material in its own fresh context and returns only a short result, so the parent's context doesn't fill with it.

Ch 75 (1) Reasoning (inside the model), agent loop (one context window), outer loop (fresh session per task, state in files), and schedule/event (what starts the outer loop). (2) So no session inherits context rot or a previous session's confusion; the only memory is the code, notes, and git history, which are precise and inspectable. (3) Because the agent is an optimistic narrator and could mark its own homework; the harness measures "done" objectively and protects the task list from being edited. (4) 0.98^200 ≈ 2%, so a long single session almost always hits an error somewhere. The outer loop breaks the work into short, independently verified tasks with retries and checkpoints, so one failure costs one attempt at one task rather than the whole run. (5) Any two of: no automatic verifier; irreversible actions (payments, customer emails, production changes); a task that can't be decomposed into a task list.

Ch 76 (1) pass@k: probability that at least one of k attempts succeeds; pass^k: probability that all k succeed. A customer-facing agent needs pass^k, because every customer gets a run, not the best of several. (2) The message can claim success while the world disagrees (no refund, or two); the environment state is the ground truth. (3) Agents find valid alternative paths; asserting an exact sequence fails good runs. Rules such as "never X" and "Y before Z" capture what actually matters. (4) A second model playing a user with a hidden goal and persona; it lets you test multi-turn conversations, clarifying questions, and edge cases at scale and repeatably. (5) Any two of: escalations to humans, refund reversals, reopened tickets, users repeating themselves, thumbs-down rate, tool error rate.

Ch 77 (1) It re-runs the same code; each step looks up its deterministic key in the journal and returns the recorded result if present, so completed steps are replayed instantly rather than executed, and execution continues from the first unfinished step. (2) A crash can happen after the side effect but before the journal write; on resume the step runs again, and only an idempotency key lets the downstream system recognise and ignore the duplicate. (3) Any three of: version pinning, fallbacks, routing, prompt caching, budgets, rate limiting. (4) A long-running task may be mid-flight when a deploy happens and would resume on a different prompt/tool version. A rainbow deployment keeps old versions running for in-flight tasks while new tasks start on the new version. (5) Any three of: kill switch, blast-radius limits, replay from traces, customer remediation owner, post-incident eval task.

Ch 78 (1) AGENTS.md: always-true project facts ("tests: pnpm test"). Skill: a procedure used sometimes ("how we write release notes"). MCP server: a live, authenticated connection ("create a Jira ticket"). (2) Only names and one-line descriptions sit in context; the full instructions and files load only when relevant, so each installed skill costs a few dozen tokens until it's used. (3) A JSON document an A2A agent publishes describing its skills, endpoint, and auth; it solves discovery (how one agent finds out what another can do and how to call it). (4) MCP when your agent needs to use a tool or data source; A2A when it needs to delegate a task to another, independent agent. (5) APIs are faster, cheaper, more reliable, and far less exposed to prompt injection than operating a UI from screenshots.

Ch 79 (1) Least privilege: the agent's permissions deny git push; only a small deterministic script holds the token and pushes only branches the harness verified. (2) It stops the agent from passing by deleting tests or adding skips; in verify, it's enforced by code on every attempt, whereas a prompt instruction can be ignored. (3) Past upgrades have a known correct outcome; the tests the human added in the real upgrade are hidden from the agent and check that it truly handled the change, not just that the existing suite passes. (4) PR merge rate (with low revert rate), because opening a PR costs nothing; the value is in PRs that humans accept.

Ch 80 (1) The LLM writes (plans, code, text, and handles escalations); the decision model decides (probabilities over predefined options); code acts (thresholds, policy, escalation). (2) Noul: one probability of yes. Choice: chosen option, per-option probabilities, confidence. Score: a probability-weighted score on an ordered rubric, the distribution over levels, and confidence. (3) If the safety check is unavailable and you default to allow, an outage silently removes your protection; failing closed (deny or ask a human) keeps the system safe. (4) The model is overconfident in that range: only 30% of the things it rates around 0.70 are actually positive. The picker therefore places that region inside the escalation band rather than auto-blocking it. (5) Because a wrongly "small" choice causes a failed task, which is expensive, while a wrongly "frontier" choice only costs a little extra money.

Ch 81 (1) The embedding (abstract representation) of the hidden or future part of the input. Pixels contain lots of unpredictable, irrelevant detail; predicting embeddings lets the model ignore it and focus on predictable structure. (2) The encoder outputs the same vector for every input, so the predictor can always predict it exactly; the loss is zero but nothing has been learned. (3) An EMA target encoder with stop-gradient; a regulariser that keeps embeddings spread out (VICReg, SIGReg). (4) Encode the current state and the goal, imagine many action sequences with the predictor, score their imagined end states against the goal, execute the first action of the best one, observe, and re-plan. (5) The EMA run's target moves as the encoder learns, so its loss measures something different; the two losses aren't on the same scale. Use the probe and the spread instead.

End of guide.

What to do right now: pick your route from §0.3, open notes.md, and start Chapter 1. Read one chapter, explain it out loud, run the practice code, and answer the check-yourself questions from memory. Then do it again tomorrow.

The field will keep moving. The fundamentals in Parts 1–9 will not.