program design

The lead-level capstone: not 'which metrics' but 'what's your operating program.' SLOs per model, a drift policy with teeth, retraining as routine rather than rescue, and the inventory discipline that separates teams who run models from teams who babysit them.

The grown-up version of 'how would you red-team a chatbot', Microsoft-style loops ask for a program, not a pen test. Team composition, harm taxonomy, iteration cadence, and which attack classes you script on day one.

One backdoored MCP server can BCC every email an agent drafts, and a clean server can rug-pull its tool definitions a week after approval. This is a software supply-chain program for dependencies that talk, not a one-time review.