// Warm-up

Quick show of hands

01

Used an AI tool to write code?

02

Shipped AI code you didn't fully understand?

03

Been confidently lied to by an AI?

// The next 2 hours

Where we're going

01 · 18 min

Foundations

What an LLM is and how agents work

02 · 8 min

The toolbox

Copilot, Claude Code and Codex

03 · 9 min

Prompt engineering

How to ask for what you need

04 · 8 min

Context engineering

What the model sees, and why

05 · 28 min

Building blocks

Prompts, agents, MCP, skills + demo

06 · 15 min

Workflow & specs

Spec-driven dev, tests, review

07 · 6 min

Guardrails

Do's, don'ts and security

08 · 5 + 15 min

Wrap-up & Q&A

30-day plan, then your questions

// 01 · Foundations

What is an LLM, anyway?

L

Large

Billions of learned numbers, called parameters.

L

Language

Trained on text and code: books, docs, public repos.

M

Model

A huge math function: text in, next-token odds out.

01 · PRE-TRAINING

Reads a vast library and learns to predict the next token.

02 · TUNING

Learns to follow instructions and hold a conversation.

03 · FEEDBACK

People and automated checks reward helpful, correct answers.

04 · TOOL USE

Learns to call tools: read files, run commands, search.

// 01 · Foundations

A very well-read autocomplete

// 01 · Foundations

Tokens and the context window

// 01 · Foundations

Brilliant at some things, bad at others

Great at

Weak at

// 01 · Foundations

From autocomplete to teammates

2021

Copilot preview

AI autocomplete arrives in the editor

2022

ChatGPT

Chat becomes the way people ask for code

2023

Chat in the IDE

Ask questions about the code you're looking at

2025

Agents

Claude Code, Codex and Copilot agents edit, run and test

Now

Teams of agents

Parallel and background tasks; you review results

// 01 · Foundations

Three ways AI helps you code

Autocomplete

You type. It suggests.

BEST FOR

Boilerplate, repeated patterns, finishing your thought

YOUR JOB

Accept only what you would have written

Chat

You ask. It answers.

BEST FOR

Explaining code, decoding errors, exploring options

YOUR JOB

Question the answer before you paste it

Agent

You delegate. It acts.

BEST FOR

Multi-file changes, refactors, tasks with tests

YOUR JOB

Scope the task, approve actions, review the diff

// 01 · Foundations

How an agent actually works

It's a loop, not magic. The model reads, plans, acts and checks — and repeats until the job is done or it needs you.

Every step is a tool call you can see — and approve.

// 01 · Foundations

Vibe coding vs. AI-assisted coding

Vibe coding

“just go with the vibes”

AI-assisted coding

“the AI types, you engineer”

Read the code?

Rarely. If it runs, ship it.

Who designs?

The AI picks the approach.

When it breaks

Paste the error back and hope.

Proof it works

“Looks fine when I click around.”

Great for

Prototypes, hackathons, throwaway scripts, personal tools.

// 02 · The toolbox

Three tools, one idea

// Tool 1 of 3

GitHub Copilot

The assistant that lives inside your editor — and on GitHub.

Ghost text as you type. Tab to accept, Esc to ignore.

Ask about selected code: /explain, /fix, /tests.

Multi-file edits and terminal commands, right in VS Code.

Assign it a GitHub issue, get a pull request back.

Request Copilot as a reviewer on your pull requests.

Teach it your team's conventions once, in a file.

Tip: there's a free tier, and verified students can get Copilot Pro free through GitHub Education.

// Tool 2 of 3

Claude Code

An agent that works in your terminal and understands your whole repo.

Also in VS Code, JetBrains, the desktop app and the web.

Searches, opens files and runs commands to get context.

Proposes a plan before touching any code (Shift+Tab).

Project memory: commands, conventions, gotchas.

Delegate side research; package reusable workflows.

Auto-run linters; connect GitHub, Jira, databases.

Tip: run /init in a project to generate a starter CLAUDE.md — then edit it by hand.

// Tool 3 of 3

OpenAI Codex

A coding agent in your terminal, your IDE — or the cloud.

Open-source agent that runs locally in your terminal.

Works in VS Code and VS Code-based editors.

Many tasks in parallel, each in its own sandbox.

An open, shared format for agent instructions.

Choose read-only, auto, or full access.

Mention @codex on a pull request to get a review.

Tip: Codex is included with paid ChatGPT plans — you can start cloud tasks from the web or your phone.

// 02 · The toolbox

The wider ecosystem

Tools change every month. The habits in this talk work with all of them.

Cursor

AI-first code editor built on VS Code

Windsurf

Agentic IDE with a built-in agent

Gemini CLI

Google's open-source terminal agent

JetBrains AI

Assistant and the Junie agent in IntelliJ IDEs

Cline

Open-source agent extension for VS Code

Aider

Git-native pair programmer in the terminal

Zed

Fast editor with built-in AI agents

Local models

Open models on your own machine, e.g. Ollama

// 03 · Prompt engineering

Anatomy of a good prompt

ONE PROMPT, SIX PARTS

ROLE · You're a senior Node.js dev on this API. TASK · Add rate limiting to POST /login. CONTEXT · Middleware lives in src/middleware/.   Redis is already set up in src/lib/redis.ts. CONSTRAINTS · No new dependencies.   Max 5 attempts per IP per 15 minutes. FORMAT · Plan first, then the diff, then how to test. EXAMPLE · Follow the style of src/middleware/auth.ts.

// 03 · Prompting

Vague prompt, vague code

VAGUE

“fix the bug in the login”

It guesses which bug, which file, and what “fixed” means — then “fixes” something, confidently.

SPECIFIC

Users get a 500 error logging in when their email has uppercase letters. Repro: POST /login {"email":"[email protected]"} Look at: src/auth/login.ts, users table Expected: emails match case-insensitively. Constraints: don't change the DB schema. Verify: add a failing test first, then fix.

Context

+

Goal

+

Constraints

+

How to verify

// 03 · Prompt engineering

Six techniques that work everywhere

“Propose a plan and wait for my OK before editing.”

“Ask me clarifying questions before you start.”

One or two samples of what you want beat long rules.

“List possible causes before changing any code.”

“Answer as a table / a diff / a checklist.”

Refine in small steps. Lost? Start fresh with what you learned.

In every tool: @ or # to attach context · / for saved commands · a plan or ask mode

// 04 · Context engineering

Context engineering

Prompting is what you ask. Context is everything the model sees while it answers.

// 04 · Context engineering

What to feed the machine

Full stack trace and logs — not “it doesn't work”.

Point at them: @-mention, open tabs, or paths.

What does “done” look like? Be concrete.

Versions, libraries, style — and what not to touch.

“Follow the pattern in orders.ts.”

A test, a command, or the expected output.

Switching tasks? Start a fresh chat (or /clear). Stale context confuses the model.

// Common ground

Give your AI a README

# shop-api ## Commands - Install: npm ci - Test: npm test - Lint: npm run lint ## Conventions - TypeScript strict — no `any` - Validate input with zod - Tests live next to code: *.test.ts ## Never - Commit .env files or secrets - Edit /migrations by hand - Add a dependency without asking

// 05 · Building blocks

The vocabulary, in one slide

The LLM itself. Predicts the next token.

What you ask for, in one message.

Standing rules, loaded every session.

One action it can take: read, run, search.

Model + tools + instructions, in a loop.

A helper agent with its own clean context.

A standard plug for adding tools and data.

A folder of know-how, loaded when relevant.

Analogy: the model is a new hire's brain. Instructions are the onboarding doc, tools their laptop, skills the team playbooks, MCP the badge that opens other systems — and the agent is the new hire actually doing the work.

// 05 · Building blocks

Instructions vs. reusable prompts

ALWAYS ON

Instructions file

Standing rules the agent reads at the start of every session.

Copilot  .github/copilot-instructions.md Claude   CLAUDE.md Codex    AGENTS.md

ON DEMAND

Prompt file / slash command

A saved prompt you run by name when you need it: /write-tests

Copilot  .github/prompts/*.prompt.md Claude   .claude/commands/*.md Codex    ~/.codex/prompts/*.md

EXAMPLE · write-tests.prompt.md

--- description: Write unit tests for a file --- Write tests for the given file: happy path, edge cases, errors. Don't change the code.

// 05 · Building blocks

Agents, custom agents, subagents

Agent

=

Model

+

Tools

+

Instructions

+

Loop

Agent mode: reads, edits, runs and tests.

A named role with its own rules and tools.

A helper with a fresh context; returns a summary.

Works in a sandbox, then opens a PR for you.

EXAMPLE · a custom “reviewer” agent

--- name: reviewer description: Reviews diffs for bugs   and security issues tools: [read, search]  # no edit, no shell --- You are a strict reviewer. Never edit files. List issues by severity, with file and line.

// 05 · Building blocks

MCP: a USB-C port for AI

// 05 · Building blocks

Skills: know-how, loaded on demand

A SKILL IS A FOLDER

.github/skills/release-notes/ ├── SKILL.md ├── template.md └── scripts/collect_commits.sh

SKILL.md

--- name: release-notes description: Drafts release notes from merged PRs.   Use when asked for a changelog or release notes. --- 1. Run scripts/collect_commits.sh <last-tag> 2. Group changes: Features, Fixes, Breaking 3. Fill template.md; one user-facing line each

1 · AT START

Only the name and description sit in context.

2 · WHEN RELEVANT

The task matches, so the agent reads SKILL.md.

3 · IF NEEDED

It opens extra files or runs the scripts.

// 05 · Building blocks

Prompt vs. skill vs. tool vs. MCP

PROMPT

What you want

TRIGGERED BY

You, every time you ask

EXAMPLE

“Fix SHOP-142 and add a test.”

SKILL

How we do it here

TRIGGERED BY

The agent, when the task matches

EXAMPLE

bugfix-playbook: repro → test → fix

TOOL

What it can do

TRIGGERED BY

The agent, step by step in its loop

EXAMPLE

read_file · grep · run_tests

MCP

Where it can reach

TRIGGERED BY

The agent, via a server you install

EXAMPLE

jira.get_issue · github.create_pr

// 05 · Building blocks

One request, all four at work

// 05 · Cheat sheet

Which building block do I need?

// Live demo · ~8 min

Let's build something.

From a GitHub issue to a reviewed pull request — with an AI agent doing the typing.

01

Explore — “explain this repo”

02

Plan — agree on the approach

03

Build — code plus tests

04

Verify — run it, read the diff

05

Ship — small commit, clear message

// 06 · The workflow

The workflow that works

01

Explore

Have it read and explain the code. No edits yet.

02

Plan

Agree on the approach. Challenge it. Edit the plan.

03

Code

Small steps, one task at a time. Let it run the tests.

04

Verify

Read the diff. Run it. Try to break it.

05

Commit

Small commits, clear messages. You own it.

// 06 · Spec-driven development

Write the spec. Then let it build.

VIBE CODING

prompt → code → “hmm, not quite” → prompt → code → …

SPEC-DRIVEN

spec → plan → tasks → code + tests → review

1 · spec.md

What & why

Users, goals, acceptance criteria. No tech yet.

2 · plan.md

How

Architecture, data model, stack, risks.

3 · tasks.md

Steps

Small, ordered, each one testable.

4 · implement

Build

Agent works task by task; you review.

// 06 · Spec-driven development

What a good spec contains

specs/password-reset/spec.md

# Feature: Password reset ## Why Locked-out users contact support (~40/week). ## Acceptance criteria - GIVEN a registered email, WHEN I request   a reset, THEN I get a link valid 30 min - Links work once; old links are rejected - Unknown emails get the same message ## Constraints - Max 3 requests per hour per account ## Out of scope - SMS reset, security questions ## Open questions - [NEEDS CLARIFICATION] Log users out   of other devices after a reset?

// 06 · Spec-driven development · example

From spec to plan to tasks

specs/password-reset/plan.md

# Plan: Password reset - Stack: existing Express API + Postgres - New table password_reset_tokens   (token_hash, user_id, expires_at, used_at) - Store only a SHA-256 hash of the token - Email via the existing mailer service - Rate limit: reuse middleware/rateLimit.ts - Risk: email enumeration → same reply

specs/password-reset/tasks.md

# Tasks - [x] T1 Migration: password_reset_tokens - [x] T2 POST /auth/reset-request + tests - [ ] T3 POST /auth/reset-confirm + tests - [ ] T4 Expiry + single-use checks + tests - [ ] T5 Rate limit 3/hour + test - [ ] T6 Email template + docs Each task: one PR, tests first.

DRIVING IT WITH ANY AGENT

1 › “Read specs/password-reset/spec.md. Draft plan.md. Don't write code.” 2 › “Split plan.md into small tasks, each with its tests. Save as tasks.md.” 3 › “Implement T3 only. Run the tests. Tick it off in tasks.md.”

// 06 · Spec-driven development

SDD in practice

Open source. Works with Copilot, Claude Code, Codex and more.

/speckit.specify /speckit.plan /speckit.tasks /speckit.implement

e.g. Kiro: generates requirements, design and tasks files.

requirements.md design.md tasks.md

Any agent + plan mode + a few markdown files in the repo.

specs/<feature>/spec.md specs/<feature>/plan.md specs/<feature>/tasks.md

USE IT FOR

Multi-file features, unclear requirements, team work, anything that takes more than a day.

SKIP IT FOR

One-line fixes, quick spikes, throwaway prototypes. Watch for spec drift.

// 06 · Tests

Tests keep the AI honest

// 06 · Review

Review it like a stranger's PR

// 07 · Guardrails

The do's

Start small

One function, one bug, one test at a time.

Give context

Files, errors, goals, constraints, examples.

Ask “why?”

Make it explain its choices and alternatives.

Keep tests green

Run them after every change, not at the end.

Commit often

Easy to roll back when it goes sideways.

Write it down

Keep your instructions file up to date.

// 07 · Guardrails

The don'ts

Don't paste secrets

API keys, passwords, customer data.

Don't merge the unknown

Can't explain it? You'll debug it at 2 a.m.

Don't “yes to all”

Read what it wants to run before approving.

Don't argue for an hour

Reset, re-scope — or write it yourself.

Don't skip review

AI code needs more scrutiny, not less.

Don't skip learning

Struggle first, then compare with the AI.

// 07 · Security

Security: the non-negotiables

// 08 · For juniors

Learn with it, not instead of it

The 15-minute rule

// 08 · For experienced devs

Multiply, don't abdicate

Delegate the tedious

Boilerplate, test scaffolding, migrations, docs, one-off scripts.

Run agents in parallel

Separate, well-scoped tasks in git worktrees or cloud sandboxes.

Use it as a reviewer

A tireless first pass on every PR catches the boring bugs.

Codify team knowledge

Shared instruction files, prompts and skills lift the whole team.

Measure honestly

Track rework and bugs, not just speed. Feeling faster isn't being faster.

// 08 · Wrap-up

Your 30-day starter plan

WEEK 1

Autocomplete

Turn on inline suggestions. Accept only what you'd have written.

WEEK 2

Chat to learn

Have it explain unfamiliar code and errors. Hints, not answers.

WEEK 3

First agent tasks

Small bug fixes with a test. Plan, code, then review every line.

WEEK 4

Make it yours

Write your instructions file. Save the prompts that worked.

Keep learning