Flash Review

What you need fresh. In order of weight, not of syllabus.

If you only read one thing

The mold of almost every itemSymptom → which technique is missing. The option "rewrite the prompt with more detail" is almost always the distractor. And between two valid options, the winner is the one that removes the capability or verifies against the source, not the one that audits afterwards.

For any model or architecture doubtThe smallest, simplest thing that passes the eval. Never "use the most capable". Never "adopt the framework". Never "add an agent" if a workflow does it.

Diagnosis: symptom → what's missing

Wrong shape	Output constraint
Drift across turns	Underspecified system prompt
Hallucinated structure	Few-shot examples
The parser keeps breaking	Structured outputs in the API
Wrong tool from turn 1	The description (exclusion condition)
Wrong tool after N turns	The context window
Tool error when retrying after a cutoff	Half-built block
Units pass, e2e fails	The seam → integration test
Inconsistent across runs	Hallucination
Reproducible failure	Prompt or model capability

Agentic loop

Loop controlstop_reason: keep going on tool_use, stop on end_turn. Never parse natural language or use an iteration cap as the criterion.

Returning resultsrole: user message with tool_result + tool_use_id blocks. There is no tool role. They go first in content, text after, or 400.

Tool failureis_error: true. Never an exception, never an empty result (the model reads it as data).

SubagentsFresh context: only the prompt string crosses. Only the final message comes back. They don't preload skills. Parallelizing = several spawn calls in a single response.

CostAgent ~4× a chat · multi-agent ~15×. Only pays off on tasks that split into independent parallel parts.

Workflow or agent

The lineWorkflow if you can write the exact steps in code. Agent if you can give goal and tools but not the path.

Parallelization vs orchestrator-workersThe only difference: whether the subtasks were predefined. In orchestrator the model decides them at runtime.

Human-in-the-loopIf a tool does something irreversible, the checkpoint goes in before wiring the loop. A log is forensic, not preventive.

Numbers

Pass mark	720 / 1000
Batch	50% discount · 100,000 req or 256 MB · expires 24 h · results 29 days · no streaming
Batch states	Only `in_progress` and `ended`
Cache TTL	5 min · 1 h extended
Cache price	write 1.25× / 2× · read 0.1× → pays off at the 1st read (5 min), 2nd (1 h)
Breakpoints	Maximum 4
Invalidates everything	Changing `tools` · also the effort (it renders in the prompt)
Tools	Degrades above 30-50 · description min. 3-4 sentences
MCP connected	5 servers ≈ 55,000 tokens before doing any work
Strict outputs	20 tools · 24 optional · 16 unions · 180 s compilation
Image	`⌈w/28⌉ × ⌈h/28⌉` · high res 2576px/4784 · standard 1568px/1568
Non-streaming timeout	10 minutes
SDK retries	2 by default, exponential backoff
RAG without RAG	Fits under 200k tokens → all into the prompt with caching
Contextual retrieval	−35% · −49% with BM25 · −67% with reranking · top-20 from top-150
Tool outputs in production	3-5× bigger than the fixtures

Errors

429 vs 529429 = your quota. 529 = global API overload, not yours. Both with backoff.

StreamingErrors as event: error after HTTP 200. Block closed at content_block_stop, turn at message_stop. Tool use and thinking don't recover partially.

Classifying failuresWould waiting fix it? Yes → backoff with a cap and a budget, never a loop. No → named fallback, or the exception becomes the default behavior.

Context windowDoesn't fit → error before generating. Runs out midway → truncated with model_context_window_exceeded. Managing the history is the app's job.

Security — the answer pattern

CorrectRemove the capability. Untrusted content only in tool_result. JSON-encode it. PreToolUse hook that blocks and logs before.

DistractorsLogging to audit afterwards · asking for confirmation · instructing in the system prompt · "our users are trusted" (the injection arrives through the content it reads) · a more capable model (may be more susceptible).

Regulated clientIdentity → OAuth · credentials → environment variables · audit → PostToolUse hook · configuration → managed settings. And raise it in scoping, not after failing the review.

Claude Code and MCP

PermissionsOrder deny → ask → allow, first match decides, specificity doesn't change the order. The mode is a risk decision; the deny rule covers what the mode doesn't.

CLAUDE.mdConcatenated, not overwritten. Re-injected on every request (that's why it survives compaction).

4 mechanisms, 4 problemsCLAUDE.md = memory (dilutes) · rules = scope · hooks = determinism · subagents = separate context. Putting everything in CLAUDE.md is the anti-pattern.

Transport and scopestdio = local · HTTP = remote or multi-developer. A stdio in .mcp.json looks shareable and isn't. Team = HTTP and project scope.

MCP primitivesTools → the model · Resources → the application · Prompts → the user.

Evals

WhenBefore building. Define success while the design can still change.

Grader by output typeOne correct form → exact match · structured → code · open-ended → judge calibrated beforehand against human cases. Order: code → LLM → human ("avoid it if you can").

Volume over qualityMore cases with automatic grading > few graded by hand. Counterintuitive and literal.

LevelsUnit = inside · integration = the seam · e2e = says it fails, not where. The trace says which step.

Deployment and packaging

Pin, not aliasPin the specific model version and keep the previous one available. An alias is "the current edition of the book": the text can change. With a pin, you adopt the change deliberately and have a way back.

Choosing a platformBy the client's cloud and compliance posture. Defended by measuring: latency from the client's region, compliance against their certification, and total cost per call, not price per token.

ComplianceWith a regulated client it's pass or fail. Raised in scoping, or it kills the build at contract review.

Data processorBedrock → AWS (that's why Anthropic's ZDR doesn't apply) · Claude Platform on AWS → Anthropic · Vertex → Google · Foundry → Anthropic. FedRAMP/IL4/IL5 or "AWS sole processor" → Bedrock.

Packaging while hotAn accelerator keeps the reusable logic, exposes the client-specific parts as documented parameters, and brings the eval and the audit log. Knowing what was client-specific is the most expensive thing to reconstruct later.

ContributingA maintainer accepts what they can verify: scoped code, a runnable example, a test and the assumptions written down. License rights confirmed before the technical review.

SeamsAn application is only as contained as its most privileged seam. Trust is not inherited from the component that sends the data. A seam that can't be secured → human owner, not deployed.

Version traps

No longer validPrefill with { to force JSON · extended thinking budget_tokens · sampling and roots in MCP · "discard the partial turn" (the docs say resume).

CarefulThe guide calls the subagent tool Task; the current docs call it Agent. On the exam, anchor to the guide.

Output that doesn't match the schemaOnly two cases: refusal (200 and billed) and max_tokens. enum doesn't guarantee capitalization.

On the exam: 120 minutes. Flag and move on: don't get stuck. Read how many answers each item asks for. If code appears, read it as shape (what happens and what fails), not as syntax. And on a tie, pick the option that's still correct six months from now and at ten times the volume.

Outside the scope of the CCDV-F · 2

The CCDV-F does not test this. It stays reachable because knowing what is not examinable saves time too, but don't study it for this exam.

The nine recurring patterns

1 · Root cause over symptomPreventing at generation beats filtering afterwards. If one option fixes the origin and another cleans the result, the first wins.

2 · Three mechanisms, three problemsProject conventions → persistent context. Judgment and generalization → few-shot examples. Structural guarantees → contracts (tool use, JSON Schema, tools by purpose).

3 · The right platform mechanismAppending to the default prompt instead of replacing it · forcing the tool and leaving enrichment for later turns · iteration and spend caps · batch only when latency allows.

4 · Targeted retrieval over bulk loadingSearch to locate, read only the hits, follow references. Never dump the whole repository "so it has context".

5 · Preserve information, don't flatten itMetadata separate from content · each data type in its own format · uncertainty explicit · an index of sources instead of the whole sources.

6 · Never fabricate data to pass validationRecomputing a total from the line items is the clearest trap: it generates a false value that now does validate. Worse than manual review.

7 · Fixed schemas ageIf the distribution evolves, prefer the model's judgment or an escape hatch ("other" plus detail) over a closed list or a trained classifier.

8 · Isolated context in subagentsNo automatic inheritance, no shared memory. Everything travels in the prompt.

9 · Parallelism and observabilityParallelizing is emitting several calls in one message, and the coordinator is still the one that launches and aggregates. If execution escapes it, you lose the trace.

Recurring errors in the distractors

Confusing input with outputmax_tokens limits the output. It doesn't fix a document that doesn't fit or a context-exceeded error.

False technical premisesConcurrency doesn't lower the price per token · the order of the tools array gives no priority · there are CLI flags that simply don't exist.

Hiding the failure instead of fixing itMaking the fields that aren't extracted optional · documenting the limitation · accepting the behavior as normal.

Retrying with the same promptWithout feedback on the specific error, the same failure reproduces deterministically.

Keywords or regex where judgment is neededFiltering by words also suppresses the cases where the pattern is a real problem.

Adding infrastructure when asked to avoid itIf the stem says "before adding complexity", the answer isn't a classifier.