MAIlabSoftware Engineering Research Group (UTM SERG) · Training

New course

Colour

Setup check

Is this computer ready for the course? MAIlab checks what this course’s labs need, from Python and your settings to the models you can call and the tools, and says how to fix anything missing. The same checks run in a terminal:

Modules

Copy report gives a short text for the class chat when you ask for help: the checks and your browser ID, never a key.

Model settings
1.0

Inspector

Send a message. The exact HTTP request, the raw response, the streamed chunks and every retry appear here.

3 · Few-shot examples input → the exact JSON you want back; include an ambiguous one
4 · Output contract exact JSON fields, types and allowed values
Business rules your case study's own checks, run in code after the schema

Model used for tests

How the contract becomes an API request

The parts are assembled into one request. The system field carries the instruction, the output contract and the failure policy. Each few-shot example becomes a user/assistant message pair. The enquiry goes last, inside the input variable.

Tools what the agent may ask for. The harness decides what actually runs.
Limits and stop conditions

How to run it

Run the agent

Each step: observe (what is in context) → plan (the tool call the model proposes) → act (the harness checks it, then runs, denies or asks a human) → update (the result goes back). The model proposes; the harness decides.

Cases what the agent must do, not only what it says

Fallback policy what happens when a check fails
Syntax error (not valid JSON)
Schema error (wrong fields or types)
Business-rule error
Tool outage
Temporary API error (timeout, 429, 5xx)up to 3 attempts with backoff, then human review
Wrong API key (401)stop and alert: retrying cannot fix it
Limit reached, or a tool needs approvalhuman review
How to run it

Run the evaluation

Each case runs through the agent harness with the fallback policy on the left. A case passes only if the agent did the right thing: the right route, the right amounts, and no forbidden action. Failure tests switch on a planned failure and check that the fallback catches it.

Build in:

Agentic engineering in eight ideas

Answer each quick check before you build.

1 · Agentic engineering

You build software by directing an AI coding agent that reads files, edits code and runs commands. You set the goal, approve the plan and verify the result.

A freelancer asks Claude Code to add SST to a quote calculator, reviews its plan, then checks the tests and the diff before committing.

2 · A coding agent is the Module 3 loop

Same observe → plan → act → update loop as the agent in Module 3. The tools are now your project: files, the terminal and the tests.

Module 3 harnessClaude Code
System promptCLAUDE.md: standing instructions, every session
Tool permission: allowed / approval / deniedPermission rules: allow / ask / deny
Approval pausePermission prompt, and plan approval in plan mode
Limits (steps, tokens, time)A time box, small steps, /clear between tasks
Module 4 eval casesAcceptance tests, agreed before the change

3 · Agentic engineering versus vibe coding

Vibe coding

Accepts whatever the AI produces. 300 generated lines, unread, because the app seems to run.

Agentic engineering

Keeps engineering discipline: clear requirements, small steps, tests, review and version control.

4 · Context and project memory

The agent only knows what it can read. A CLAUDE.md file in the project root gives standing instructions (commands, conventions, rules) that load in every session. It is committed to Git, so it never holds secrets.

5 · Permissions and safety

Claude Code asks before it edits files or runs commands, unless you allow them. Plan mode is read-only. CLAUDE.md is guidance; permission rules are the hard limits.

Allow pytest to run without asking, but keep approval for git push and for deleting files.

6 · Verification defines “done”

An agent saying “done” is not evidence. Passing tests, a readable diff and a run of the real program are. Agree the tests before you ask for the change: you own the requirement and the acceptance test.

compute_quote([("logo", 2)]) must return subtotal RM600.00, SST RM48.00 and total RM648.00.

7 · The renovation analogy

Everyday ideaTechnical concept
Contractor, fast on siteCoding agent
Agreed drawingsApproved plan
Site rulesCLAUDE.md + permissions
Inspection before payingTests and diff review

Where it stops working: a contractor carries professional liability. The agent carries none, so the reviewer does.

8 · Common mistakes

MistakeDo instead
Accepting changes without reading the diffReview every diff. Ask Claude to explain any line you do not understand.
One huge, vague promptBreak the work into small, testable steps, and plan first.
Secrets or client data in CLAUDE.md or promptsKeep keys in environment variables. CLAUDE.md is committed to Git.

Checking Redis…

Your keys

Only keys with your browser's prefix. Inspecting them is not logged below.

Redis commands

Every command MAIlab sent for you, newest first, as redis-cli shows it.

The read-through cache

Build the key, then GET it. A hit returns the stored, validated result. A miss calls the model, checks the answer, and stores it with SET key value EX ttl.

What goes into the key leave one out and two different requests may share an answer they should not
Guided demos
Hit, expiry, version.
Leave one out.
Side effects.

Today’s job

Studio Reka JB, a small design studio in Johor Bahru, has an AI assistant that answers customer enquiries. You decide what the AI reads before it answers: start with Start here on the right.

The studio’s documents

What the AI’s search can find. Untick a document to hide it from the search (the search index). Two are out of date on purpose, and one is in Bahasa Melayu.

Practice or a real AI model

Import my work

Bring in what you built in Modules 2–7. Each one fills its stage, and goes into the build pack as it is.

From idea to a SaaS you can sell

Fourteen stages in four phases: define the idea and its requirements, decide the stack, the quality and the core modules every SaaS needs, design the AI (only when a feature uses it), then ship. Each stage ends in a file your coding agent will read, with blueprint.json as the source of truth. Click a stage to see what you decide there and why.

One request through your app

Drawn from your own decisions: a step you chose not to have is grey. Change a decision on the Blueprint tab and this changes with it.

Trainer console

The trainer passcode is TRAINER_PASSCODE in this exam server's .env.

The studio is the course case. My own business builds the same agent for your business: your price list, skills and tools.

Skill library

One folder per skill. Until the agent loads one, it sees only the names and descriptions.

Skills and agents

A skill packages the know-how for one kind of task: a name, a description of when to use it, numbered steps and optional files. An agent works toward a goal by choosing which of its permitted skills and tools to use, inside a harness that sets the rules.

One agent, many skills

Prompt, tool or skill?

A prompt is one instruction. A tool is one function the app runs. A skill bundles know-how for a task: instructions plus the tools and files it needs.

Analogy: the clinic receptionist

She keeps a binder of procedures: booking, billing and panel insurance claims. She reads the tab labels and opens only the procedure each patient needs.

Today’s job

Pusat Tuisyen Cemerlang, a tuition centre in Johor Bahru and Kulai, answers parents on WhatsApp. You build the Johor Bahru assistant that finds the right page in its documents and answers only from it: start with 1 · Start here on the right.

The centre’s documents

Each one has labels (metadata): its branch, current or out of date, its language, and where it came from. One was copied from Facebook and never checked.

Numbers for meaning (embeddings)

Practice or a real AI model

Today’s job

Studio Reka JB uses Claude Code, Claude Desktop and a Flowise assistant, and each one needs the same prices. You build one MCP server for all of them, plug MAIlab’s agent into it, then your own AI app: start with 1 · Start here on the right.

Your MCP servers

Each one runs on this computer at its own address (Streamable HTTP). Steps 2, 3 and 5 use the one you choose.

Practice or a real AI model

Today’s job

Kafe Senja wants a logo and a poster, and 200 A3 posters printed by Friday, with the reply in BM and English. Studio Reka JB’s agents share the work, and the printing goes to another company’s agent: start with 1 · Start here on the right.

The team

Practice or a real AI model

Today’s job

Practice or a real AI model

Your versions

Today’s job

Where you are

Practice or a real AI model

Only for “Ask the AI to fix it” in step 4.

Today’s job

Practice or a real AI model

For step 5, Generate from the contract.

Today’s job

Your portal

Opening your portal…

Today’s job

Practice or a real AI model

For step 4, The run, and the agent’s answer to your review.

The repository

Today’s job

Practice or a real AI model

For step 3, Run the team. A real model plays each agent in its own conversation.

The team’s repository

Today’s job

Your pipeline

Today’s job

Your staging

Today’s job

The situation

Practice or a real AI model

For steps 3 and 4: who writes the answers.

Today’s job

Practice or a real AI model

For steps 2 to 5: who answers. Step 6 is practice only.

Made up for teaching

Every enquiry, student, meeting and figure in this lab is invented. Use real ones only in your own assistant, with names removed.

Today’s job

The lab change

Practice or a real AI model

For every step: who writes the answers.

Today’s job

Practice or a real AI model

For every step: who answers.

Made up for teaching

Every claim, staff member, student, survey answer and number in this lab is invented. Real forms and data go only into tools your university approves for them.

Today’s job

The review

Practice or a real AI model

Who answers; OpenAlex is real either way.

Today’s job

The codebook

For codebook and coding-reliability approaches; reflexive thematic analysis codes differently and does not measure agreement.

Practice or a real AI model

Who answers; MAIlab’s checks are the same either way.

Today’s job

The five topics

Practice or a real AI model

Who answers. A plan records which, and its runs keep to it.

Today’s job

Practice or a real AI model

Who answers; the checks are the same either way.

Today’s job

Practice or real models

Who answers. The model here is the one you try a task on, add on step 4, and ask to read the results.

Calls and money

Calls made at the same time can slow each other down: 1 at a time gives the cleanest latency, 4 finishes sooner.

Prices are in US dollars, as in models.json. Enter today’s rate to see RM as well; MAIlab does not guess it.

Today’s job

Your settings

Carried from step to step, and into the notebook on step 9.

Practice or a real AI model

Used only by the teacher on step 7 and the AI’s reading on step 10. The rest of the lab needs no model.

Today’s job

Practice or a real AI model

Who answers, reranks, extracts and summarises. Practice uses MAIlab’s free stand-ins, with made-up names and estimated costs.

Meaning search

The embeddings behind meaning search: MAIlab’s free stand-in, or real ones from OpenAI or Ollama, as in the RAG Lab.

Money

Prices are in US dollars, as in models.json. Enter today’s rate to see RM as well; MAIlab does not guess it.

Today’s job

Practice or a real AI model

Who reads the requests, checks them and writes the emails. Practice uses MAIlab’s free stand-ins, with made-up names and estimated costs; a person always decides the edge cases.

The checker’s search

Money

Prices are in US dollars, as in models.json. Enter today’s rate to see RM as well; MAIlab does not guess it.

Today’s job

The traces

Practice reads a simulated week of the agent team’s traffic, free. Live reads your own calls from MAIlab’s call log and makes no model calls.

Today’s job

Practice or a real AI model

Who checks the requests and writes the lessons. Practice uses MAIlab’s free stand-ins, with planted behaviour and estimated costs; a live run is counted, costed and confirmed first.

A results file

Today’s job

Practice or a real AI model

Who runs the pilot’s two conditions. Practice uses MAIlab’s free stand-ins from E01, E03 and E06, with planted behaviour and estimated costs; a live pilot is counted, costed and confirmed first.

Today’s job

The locked plan

Practice or a real AI model

Who runs step 3’s two conditions. Practice uses MAIlab’s free stand-ins from E01, E03 and E06, with planted behaviour and estimated costs; a live run is counted, costed and confirmed first.

Today’s job

The case

Today’s job

The case

Today’s job

The case

Today’s job

The case

Today’s job

The case

Practice or a real AI model

For step 6: who writes the drafts.

Today’s job

The case

Practice or a real AI model

For step 6: who writes the tests.

Today’s job

The case

Today’s job

The case

Today’s job

The case

Today’s job

The case

Today’s job

The case

Today’s job

The case

API keys

MAIlab uses the keys in the server's .env file by default: the instructor's on a class server, your own when MAIlab runs on your laptop. To use your own account, paste your key here. It stays in this browser tab (sessionStorage, cleared when the tab closes) and goes to the MAIlab server only to be forwarded to the provider. The server never saves or logs it.