What gets graded tomorrow

Not “what did you build” — “what did you find out”.
The demo is not the star of the show. It is evidence.

Honestly — this is outside our course

• Business models are not part of this course’s official curriculum. You will not be graded on BM theory tomorrow.
• What gets graded instead: how specifically you narrowed the problem, how much you touched reality, and whether you are honest about what you could not do
• So what you learn today is not “startup methodology” — it is how to use AI to raise the quality of your judgment. And that is exactly our course

Four things you make today

These four are the entire day. The urge to build a fifth thing is today’s biggest risk.

The one claim of these two days

When the cost of building approaches zero, all the value moves to “the ability to choose what to build”.

Today’s tool — install it, and paste if it won’t work

You finish the install on your own, Monday or Tuesday — no commands to memorise: paste one paragraph and Codex runs it for you. If it does not work, you go with the workbook prompts. Whichever you use makes zero difference to today’s grade.

What is gstack — 90 seconds

“It turns Claude Code into a virtual engineering team — a CEO who rethinks the product, an eng manager who locks architecture, a designer who catches AI slop, a reviewer who finds production bugs, a QA lead who opens a real browser…”README.md, github.com/garrytan/gstack

Open source, MIT-licensed, released by Garry Tan (CEO of Y Combinator). It does not give the AI new abilities — it is a rulebook that puts roles on it.

The quote says “Claude Code” because that is the author’s default environment. Ours is the OpenAI Codex app (desktop). gstack supports Codex, but recognition inside the app is not guaranteed — which is why the prompt track is our default.

Without it vs with it

All gstack does is pre-write the sentence on the right for 50 different situations. There is no magic. Which is exactly why we can copy that sentence and use it ourselves.

Almost all of it is Markdown

“gstack gives Claude Code a persistent browser and a set of opinionated workflow skills. The browser is the hard part — everything else is Markdown.”ARCHITECTURE.md

In other words, one command = one Markdown file. After install, the prompts sit in plain sight inside .agents/skills/. It is not a black box — which is why “copy and paste” works exactly as well as the original. That is the basis of today’s default track.

ETHOS — the one principle you need today

“AI models recommend. Users decide. This is the one rule that overrides all others.”ETHOS.md

“Two AI models agreeing on a change is a strong signal. It is not a mandate.”

The top principle of gstack’s three. It is today’s tiebreaker for every conflict — “the AI told me to” is not a reason.

AI is not your CTO

If you insist on the CTO label — then you are the CEO. And the CEO’s job is to reject.

Absolutely not this morning

The morning’s two hours succeed or fail on how much you deleted.

Skill catalogue — when to use what

The next 8 slides are reference. In class we only walk through ① and ②. ③–⑥ and the “5 worth knowing” are material you open when you need it — not exam material.

gstack’s skills are laid out in the order you build a product. Don’t memorise them — just take away “ah, this stage has one of these”.

/office-hours — what it does

A YC partner office-hours session, turned into a command. It pressure-tests the idea before a single line of code gets written.

“Push on each one until the answer is specific, evidence-based, and uncomfortable. Comfort means the founder hasn’t gone deep enough.”office-hours/SKILL.md

Two Codex-app cautions: ① No choice buttons — the questions arrive as prose in the body, and you answer in your next message. ② Installed: $office-hours. Not installed: paste workbook P1 as-is. The result is the same.

/office-hours

One riskiest assumption

If the hypothesis collapses, where exactly does it collapse?

This afternoon’s 2 real-world contacts must be an attempt to break this one assumption. Ask random questions and you only burn time.

Today’s hard limits

If it can’t be built in 40 minutes, it is not what you build today. Cutting scope is skill, not surrender.

The ladder of evidence — today’s target is ③

④ and ⑤ are impossible in one day. Today’s target: two pieces of ③. And tomorrow, saying “we only got as far as ③” scores higher than pretending you reached ⑤.

Friend bias — write it down, don’t hide it

The 2 people you contact today will almost certainly be people you know. That is not the problem. Pretending otherwise is.

What lunch is for

11:50–12:50 is not just for eating — it is when the replies come in.

• Sending finished inside Block B. The replies arrive over lunch
• No reply? Send to 1 more person at the start of the afternoon
• Reply arrives? Fill the last column of the evidence log immediately

This design is the only channel through which reality intervenes in these two days.

AI slop — what erodes trust tomorrow

Slop is not an aesthetics problem — it is a trust problem. The moment it reads as “an AI made this”, nobody hears your content.

Already built — what /review catches

1. SQL · data safety string interpolation, writes that bypass validation
2. Race conditions duplicate submissions, unsafe HTML rendering
3. LLM output trust boundaries model-generated values flowing into the DB, mail, fetch — with no validation
4. Shell injection executing string-interpolated commands
5. Constant completeness tracing a new value to consumers outside the diff

In student projects the real catches are 3 and 5. Number 5 is a defect humans structurally cannot catch — it never appears in the diff.

/review

/qa — it opens a real browser

“Repro is everything. Every issue needs at least one screenshot. No exceptions.”qa/SKILL.md

• Unit tests check “is my thinking right”; /qa checks “what the user experiences”
• It demands a clean working tree — commit first, then run it
• Never run it on a deployed live service. It is a real browser with real cookies and sessions

Short on time? Track B is enough — hand your laptop to your neighbour and let them click with zero explanation. 3 minutes surfaces most of the problems.

/qa

“Where this demo is lying, right now”

Write down everything fake on your current screen. Tomorrow you present this list, as-is.

Hide it and get caught in Q&A, and that talk is over. Say it first, and it becomes honesty points.

Lock the one demo path

• You must be able to show these 4 steps in 90 seconds, without speaking
• If it needs explanation midway, it is not a path — it is an excuse
• Practise 3 times and delete any click that fails
• Check laptop brightness, resolution and notifications-off — today

Tonight’s checklist · the last word

• One-sentence hypothesis (final)
• 2 evidence log entries — including the last column (where it differs from my assumption)
• 90-second demo path + the fake list
• 5-slot script + 2 rehearsal runs
• Laptop · adapter · backup file (or the recording)
• Notifications off — a popup mid-talk costs you trust

Presenting “this turned out to be wrong” tomorrow is not a penalty. Finding that out in one day is an achievement.
The penalty is for inventing results that do not exist.

Why polish earns zero points

As the cost of building falls toward zero, all the value moves into “the value of choosing what to build”.

The audience’s job — three kinds of questions

1. The falsifying question “How would you know if that was wrong?”
2. The evidence question “Of the people you asked, had anyone already spent money or time on this?”
3. The honesty question “Which part of this demo is fake?”

Of the 5 Q&A minutes, at least 2 questions come from you. If the instructor asks everything, you become spectators.

Speakers — the 30-seconds-before check

• Kill notifications (Slack · WhatsApp · email)
• Prefer plugging in directly over screen sharing — no lag
• Have your backup file or recording path already open
• Say your first sentence out loud once — it opens up your voice

Your first sentence is not a greeting — it is the problem sentence. Do not burn 15 seconds on “Good morning, my name is…”.

Session A — go

8 people from here. 15 minutes each.

• No questions during a talk. Write them on your card
• The next speaker plugs their laptop in ahead of time
• Keep the 7-minute timer visible on screen

Right after lunch — morning-patterns briefing (3 min)

We stop for just 3 minutes here and name what kept repeating across the morning’s 8 talks.

The whole point of these 3 minutes: the afternoon 6 do not repeat the morning’s mistakes.

Session B — go

6 people left. You are allowed to apply the morning’s feedback immediately.

• Fixing your script is not cheating — it is learning
• But if you changed something, say so: “I watched the morning talks and changed this part” — that earns bonus points

What the good talks had in common

• A specific person shows up in the first 30 seconds — “a 300-level Business Admin student who commutes”
• The quote comes out verbatim — “He said, ‘I’d just go to the campus kiosk’”
• The demo is one path. Not a tour
• They say what they could not build first
• “What to check next” is measurable

verify vs falsify

This distinction is the longest-lasting thing you learn today — because it is training in judgement, not in entrepreneurship.

Now it’s the tools’ turn to be doubted

For two days you used Codex and gstack. The last 20 minutes go to how to doubt these tools.

The tools will be different in 2 years. The method of doubting will not.

Bonus — the tool doesn’t match its own docs either

A tool that promises to stop documentation drift is drifting in its own README. We hit it ourselves — the README lists --host cursor, but the install script rejects that value as an error.

The code is the truth, not the docs.

So the real metrics are

Time to your first user is the metric. Not lines of code.

Today’s rubric and this sentence are saying the same thing.