Local AI Agents: Advanced Systems

The advanced continuation of Local AI Agents. Wire multi-agent systems against local endpoints, defend a tool-using agent against prompt injection, instrument runs and gate them on golden-task evals, and take the llama.cpp direct path when Ollama's abstraction stops paying for itself. Local-first throughout: no cloud-primary path.

Register no.

LH-04

Status

3 lessons published · open to enrol

Level

Practitioner

Access

Free

Format

Self-paced, text-first modules with formative checks

Who it is for

Practitioners who have completed Local AI Agents (LH-01) and now need agents that coordinate, resist hostile input, and prove their own quality before anything depends on them.

• Plan-act-observe-reflect loops
• Multi-agent patterns
• Prompt-injection defence
• Observability and evaluation
• llama.cpp direct path
• Operator-agent runtimes

1. M1

   Planning and single-agent orchestration

   Three lessons — the plan, act, observe and reflect loop and the human gate each step can hand control to; bounding that loop with step limits and token budgets that abort safely; and stop rules that log a failure reason and emit a structured handoff artifact. Sourced to Anthropic's agent guidance and the ReAct paper.

   1. The plan, act, observe, reflect loopLesson 1 of 3 · 20–30 minutes
   2. Bounding the loop, step limits and token budgetsLesson 2 of 3 · 20–30 minutes
   3. Stop rules and the structured handoff artifactLesson 3 of 3 · 20–30 minutes
2. M2

   Multi-agent patterns (local)

   Four canonical patterns — sequential pipeline, parallel crew, supervisor-worker and shared-state graph — wired against local OpenAI-compatible endpoints, with the shared-state hazards (race, stale context, loop amplification) and their mitigations. Patterns are the subject; LangGraph and CrewAI appear as examples, not destinations.

3. M3

   Prompt injection and tool-abuse defence

   The six injection surfaces — system prompt, user input, retrieved documents, tool results, agent-to-agent messages and environment variables — and layered defences that harden them without disabling legitimate tool use: input sanitisation, output validation, allowlist dispatch, and a human approval gate on high-risk calls.

4. M4

   Observability and evaluation

   Structured trace logging across span, tool call, result and decision; golden tasks covering happy path, edge case and known failure modes; and an eval harness that scores runs and gates on a pass threshold — plus where automated scoring must give way to manual review.

5. M5

   llama.cpp direct path

   Building llama.cpp from source and running llama-server as an OpenAI-compatible endpoint: KV cache, context length and batch size for agent workloads, GBNF grammars for structured output, and an honest comparison of Ollama's convenience against llama.cpp's control.

6. M6

   Operator-agent runtime concepts

   The five components of an operator-class runtime — skill registry, memory store, approval bus, scheduler and tool surface — with memory externalisation patterns (working, episodic, semantic, procedural), the MCP tool surface mapped onto the model, and what must always require human approval.

7. M7

   Capstone lab — local multi-tool research agent

   Build, evaluate and document a local multi-tool agent end to end: at least two tools, a structured run-evidence packet, an eval harness with golden tasks, a rollback plan, and a written reflection on what the agent cannot safely do.