Plan to 26 October¶
Built on the findings in the Premise review. Roughly eight weeks from 2026-09-02.
For the two of us
This page is the what. The Development plan is the how: the hypotheses we need to prove, the eval harness that proves them, how the work splits between us, and the decision gates.
Decisions to make first¶
These block everything else. Take them in week 1.
| # | Decision | Recommendation | Cost of delay |
|---|---|---|---|
| B1 | Cluster: which environments do we support? | All three — Codespaces (default), local k3d, BYO — on one namespace-scoped contract | Makefile and all docs need rewriting |
| B2 | Agent runtime: custom code or Claude Code + MCP? | Claude Code + K8s MCP | We build a framework we can't test in time |
| B3 | Model access for participants | Workshop keys with a spend cap | The room stalls at minute 30 |
| B4 | Lab 3: hands-on or demo? | Demo | We overrun and lose the wrap-up |
| B5 | Website: one or two? | Astro at root, MkDocs at /docs |
Two designs, two domains, confused participants |
| B6 | Do we run a quest board? | Yes, by forking the MCP workshop's quest-server — built last, cuttable | We build a scoreboard from scratch, or bore the fast third of the room |
Revised schedule¶
Adjusted for buffer, and for Lab 3 becoming a demo. Still 120 minutes, but with slack.
| Time | Duration | Block | Change from proposal |
|---|---|---|---|
| 00:00 | 12 min | Intro: What is Agentic Cloud Ops? | −3, tightened |
| 00:12 | 8 min | Bootstrap + verification | −7, assumes pre-pull at home |
| 00:20 | 5 min | Buffer / help stragglers | New |
| 00:25 | 30 min | Lab 1 — Your first agent | unchanged |
| 00:55 | 35 min | Lab 2 — Security and hardening | unchanged, protected |
| 01:30 | 10 min | Lab 3 — Chaos, as a demo | −5, format changed |
| 01:40 | 5 min | Buffer | New |
| 01:45 | 15 min | Q&A and wrap-up | +5 |
Why bootstrap shrinks rather than grows
Because the work moves home. Block 2 should be "run one command, see two green nodes" — not "download Kubernetes". See P1.
Phases¶
Phase 1 · Decisions and skeleton (weeks 1–2, September)¶
- Take B1–B6
- Build
bootstrap/base+make verify— the environment contract — and get it green on arm64 and amd64 -
devcontainer.json+ prebuilt image, so the Codespaces path is proven early -
make preflightthat also pre-pulls images and fails clearly - Wire the MCP server to the cluster; verify the agent can see nodes
- Ask the organisers about the P9 items
Phase 2 · Labs 1 and 2 (weeks 3–5, Sept–Oct)¶
-
manifests/insecure/— the deliberately bad deployments - System prompts:
deploy.md,harden.md,incident.md - Lab 1: the planted
ImagePullBackOff, and verify the agent actually finds it - Lab 2:
make healthas a deterministic, external health check - Write down expected agent behaviour per lab, for the facilitators
- Checkpoint branches:
checkpoint/lab1,checkpoint/lab2
Phase 3 · Lab 3, evals and content (week 6, October)¶
-
manifests/chaos/— pick one deterministic scenario for the demo - Re-scope
dns-messandnode-pressureto namespace level (capability matrix) - Fork the quest server; six quests sealed under a private pepper
- Evals: run Labs 1 and 2 ten times each, measure success rate. Below 80% → simplify
- Slides for blocks 1 and 6 — including CVE-2026-46519 (P5)
- Landing page in Astro (spec)
Phase 4 · Dress rehearsal (week 7, ~19 October)¶
- Full timed run-through, both speakers, from a cold machine
- Test on a machine that isn't the development machine — ideally a work laptop behind a proxy
- Freeze the prompts. No changes after this point
- Write the facilitator runbook: common failures and what to say
Phase 5 · Final week (week 8)¶
- Send participant instructions with pre-pull at the top, at least 5 days ahead
- Generate workshop API keys with a spend cap; print them on cards
- Test on the conference network the evening before, if possible
- Upload slides to the CFP portal (still outstanding)
Still missing from the repo¶
bootstrap/ base kustomization + the three env scripts
evals/ the harness, scenarios, checkers and results
quests/ forked quest-server, quests.yaml, answers.yaml
agents/prompts/ deploy.md, harden.md, incident.md
agents/tools/ MCP config, RBAC for the agent's service account
manifests/insecure/ root containers, no limits, no NetworkPolicy
manifests/chaos/ at least one deterministic scenario
Makefile agent, agent-check, lab1-break, health, chaos (all TODO)
web/ the Astro landing page
Risk register¶
| Risk | Likelihood | Impact | Mitigation |
|---|---|---|---|
| Conference network can't carry the room | High | Critical | Pre-pull at home; images as a hard prerequisite |
| Participants without model access | High | Critical | Workshop keys on cards |
| The agent behaves differently across the room | Certain | Medium | Checkpoints, evals, make it the curriculum |
| We run out of time before block 6 | Medium | High | Two buffer blocks; Lab 3 as a demo |
| Lab 2 breaks the app for everyone | Medium | Medium | make health + rollout undo in the prompt |
| Work laptop blocks Docker or the API | Medium | Medium | Codespaces as the default path |
| Quest board eats time the labs needed | Medium | High | Built last, after Gate B; cuttable to six quests |
| BYO participant points the agent at something real | Low | Severe | byo.sh guard + namespace-scoped RBAC (Environments §5) |