A Free Agent Lab Needs an Explicit Blast-Radius Policy

Picture a Monday standup I will treat as a composite, not a customer story. Three PRs landed. Same agent pattern. Same repo. The inference line did not move.

Review still burned four senior hours. Why? The agent assumed a .env layout that only existed on one laptop, then “fixed” tests by skipping the suite that would have caught it. Cheap compute did not fail. The environment story did.

That is the decision I keep seeing platform leads get backwards. They ask whether a free coding path is cheaper than paid seats or a self-hosted box. The reversible question is narrower. Where do you want a wrong environment assumption to explode — and who owns the blast radius when it does?

The unit that reverses the call

Tokens are a terrible proxy here. Server cost is a close second. An agent that can list files, read secrets-shaped env vars, and patch CI will spend your scarcest resource: review attention with production access.

I use one working definition:

Assumption tax = (wrong environment claims per agent run) × (senior review hours to unwind one claim) × (blast radius 1–5)

If that product stays below your gate, a shared free lab can be the right place to learn. If it does not, paying or self-hosting is not a prestige upgrade. It is an isolation purchase.

This scorecard is a conversation tool, not objective truth. Change one variable and the keep-versus-exit call should be allowed to flip.

Where free, paid, and self-host actually fail

I am not arguing that one path is “more AI.” I am mapping where the lie shows up.

Path	What the agent tends to assume	Where the failure lands	What you are really buying
Shared free models + shared free server	“This box is my laptop.” Shared paths, shared caches, shared mystery env.	Other people’s runs, plus the next intern who copies the prompt.	Fast disagreement. Cheap enough to throw away.
Paid vendor path	“The vendor’s defaults match our org.” Hidden system prompt, managed tools, SaaS networking.	Policy debt and a renewal argument.	Support, SSO, and someone else’s uptime.
Self-host	“Our cluster is as tidy as the README.” GPU queues, image drift, secret mounts.	Platform on-call, not the original author.	Control, and the ops load that comes with it.

See the pattern? Free does not remove assumptions. It concentrates them on a box nobody wants to admit is shared. Paid moves them into a contract. Self-host moves them into your pager.

So the product question is not “is there a free server?” It is “is a disposable lab the right blast radius for this team this quarter?”

A lab is useful. A shadow platform is not.

I want a lab when the team is still discovering which environment lies the agent tells. I do not want that lab to quietly become the way production code is written.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode is one option with free model access and a free server path, which makes it a candidate for a time-boxed lab, not a default production fabric. If you use it that way, run the same gates you would run on any other free path. Do not skip the owner field because the invoice is empty.

What I log before anyone “just tries it”

Label this as a proposed inventory, not a benchmark and not a claim about any vendor’s internals.

# proposed: capture what an agent could assume on this box
# do not paste real secrets into a ticket
mkdir -p /tmp/assumption-lab && cd /tmp/assumption-lab

{
  echo "cwd=$(pwd)"
  echo "user=$(id -un)"
  echo "os=$(uname -s)"
  git -C "$HOME/src/app" rev-parse --show-toplevel 2>/dev/null || echo "git=none"
  git -C "$HOME/src/app" remote -v 2>/dev/null | sed 's/:[^ ]*/:***/'
  env | awk -F= '/TOKEN|KEY|SECRET|PASSWORD|AWS|GH_/ {print $1"=redacted"}'
  ls -la "$HOME/src/app" 2>/dev/null | head
} > env-assumptions.txt

wc -l env-assumptions.txt

If that file is long, the agent has a rich fantasy life. Rich is not free. It is a larger blast radius.

The 4-gate assumption ledger

Four fields. Fill them in writing. If a field is blank, you do not have a lab. You have an unnamed exception.

1. Isolation. Can one agent run see another person’s files, caches, or env? If yes, blast radius starts at 4.
2. Replay. Can a reviewer reconstruct the exact context the agent saw, without SSHing into a snowflake box?
3. Portability. Can the same workflow move to paid or self-host without rewriting your policy from scratch?
4. Incentive. Does “it’s free” increase run volume faster than you can grow review capacity?

Variables, named so they can reverse you

• A = wrong environment claims per 10 agent-assisted PRs (count from review comments: missing tool, wrong path, skipped test, hallucinated secret).
• H = senior hours to unwind one claim (include the re-review, not just the first pass).
• B = blast radius, integer 1–5 (1 = author’s branch only; 5 = shared secrets or other teams’ jobs).
• C = review capacity this sprint, in senior hours you can actually spend.
• T = lab expiry date. A date, not “until it feels fine.”

Keep the shared free lab only if A × H × B ≤ 0.3 × C and T is in the future and Isolation is not a 5.

That 0.3 is a starting conversation number. If your org already burns seniors on incident review, drop it to 0.15. If the lab is truly throwaway and cannot touch prod credentials, you can argue for 0.5. Write the number down so someone can attack it.

YAML you can paste into the ticket

# proposed ledger — conversation tool, not a score
lab:
  path: shared_free   # shared_free | paid | self_host
  owner: platform-em  # named human, not a DL
  expiry: 2026-10-05  # 28 days from a 2026-09-07 start; pick your own
  exit_if_any:
    - isolation_score: 5
    - assumption_tax_over_capacity: true
    - replay_failed_twice: true

counts:  # hypothetical worked row, not a measured study
  A_wrong_claims_per_10_prs: 6
  H_hours_per_claim: 0.75
  B_blast_radius: 3
  C_review_hours_this_sprint: 20

formula:
  tax: 6 * 0.75 * 3    # 13.5
  gate: 0.3 * 20       # 6.0
  keep_shared_free: false

In that filled row, the lab already lost. Inference can be zero. You still exit the shared path, or you shrink B until the tax fits. Shrinking B usually means: no shared credentials, no long-lived workspace, no “the intern’s job ran on the same disk.”

Sensitivity: which lever actually flips the decision?

Hold H at 0.75 hours. That is 45 minutes of a person who can say no to a skip-test patch.

A (claims / 10 PRs)	B = 1 (isolated)	B = 3 (shared lab)	B = 5 (secrets-shaped)
2	1.5	4.5	7.5
4	3.0	9.0	15.0
6	4.5	13.5	22.5

Against a 6.0 gate (0.3 × 20 hours), a tightly isolated lab with two messy claims still fits. The same claims on a shared box do not. Secrets-shaped blast radius never fits at these volumes.

That is the comparison, stripped of mystique. Paid and self-host win when they cut B or A, not when they print a nicer model card. If a paid seat still lets the agent assume your entire homedir, you bought a brand, not isolation. If self-host still mounts a kitchen-sink secret volume, you bought a GPU and kept the tax.

Ask the ugly question in the review: which single variable would make us keep the free lab? If the answer is “A drops below 2 and B stays at 1,” you have a testable pilot. If the answer is “we like that it is free,” you have an incentive problem, not a platform strategy.

Hard gates, owner, expiry, exit

Write these as policy, not vibes.

• Hard isolation gate. Shared credentials, org-wide package caches with write access, or production kubeconfigs on the box → exit the shared free path the same day. No weekly meeting. Same day.
• Replay gate. Two PRs in a row where the reviewer cannot reconstruct the agent’s view → freeze new users until replay exists (log the prompt, the file tree hash, the redacted env keys).
• Portability gate. If moving the workflow to paid or self-host requires a new data-handling story, the lab is lying about being a lab.
• Owner. A named engineering manager on the platform team. Rotating Slack channels do not own blast radius.
• Expiry. 28 days, visible on a calendar. Renewal requires a new filled ledger, not a thumbs-up emoji.
• Exit. Three documented options: (1) stop the shared lab, (2) shrink to isolated local-only free models, (3) buy isolation (paid or self-host) and keep the same assumption policy.

I like 28 days because it is long enough to see A move and short enough that nobody builds a career on an unnamed exception.

Tiny scorer (unexecuted example)

# proposed helper — not a measured benchmark
def assumption_tax(A, H, B):
    return A * H * B

def keep_shared_free(A, H, B, C, isolation, replay_fails, today, expiry):
    tax = assumption_tax(A, H, B)
    gate = 0.3 * C
    if isolation >= 5:
        return False, "isolation_hard_gate"
    if replay_fails >= 2:
        return False, "replay_hard_gate"
    if today > expiry:
        return False, "expired"
    if tax > gate:
        return False, f"tax {tax:.1f} > gate {gate:.1f}"
    return True, f"tax {tax:.1f} <= gate {gate:.1f}"

print(keep_shared_free(
    A=6, H=0.75, B=3, C=20,
    isolation=3, replay_fails=0,
    today="2026-09-07", expiry="2026-10-05",
))
# expected: (False, 'tax 13.5 > gate 6.0')

Run the function against your last ten agent-assisted PRs. If you do not have ten, you do not have a keep decision. You have a sample size problem. Stay in lab mode.

Who should not use this approach

Skip the shared free server, even as a lab, if any of these are true:

• You cannot name an owner who can revoke access the same day.
• The box can reach production data, customer exports, or long-lived cloud keys.
• Your reviewers cannot spend H honestly — if seniors will rubber-stamp agent diffs, the tax formula is theater.
• You need a compliance story next week. A free shared environment is a discovery tool, not an audit artifact.
• You are trying to estimate production TCO from lab inference. You will undercount review, onboarding, and the cleanup of skipped tests. That estimate will reverse later, and you will not know why.

Individual makers on throwaway repos? Different sport. Isolate B at 1 and most of this article is heavier than you need.

What I would do this week

Count A on the last ten agent PRs. Redact env keys. Fill the YAML. Put T on a calendar.

If the tax misses the gate, do not “optimize prompts” as your first move. Cut blast radius. That usually means: dedicated workspace, no shared secrets, replay logs, and a written exit to paid or self-host that reuses the same policy.

If you need a disposable place to pressure-test those gates — free model access, free server, same ledger — MonkeyCode can be that lab. Keep the expiry date anyway.

Last question, and it is the only one I want in the thread: which variable — A, H, B, or C — would have to move for you to keep a shared free agent path past 2026-10-05? If you cannot name it, you are not choosing a lab. You are hoping the invoice stays quiet while the assumptions wander.