Letter to 07:45-Me: Three Checks Before the Agent Touches the Repo

At 07:45 I opened the repo and typed a prompt. At 19:10 I had three diffs and no idea which one passed. The day was not lost to a hard bug.

It was lost to three small omissions. I write these letters to my past self because the pattern repeats. This one is also runnable: a preflight script, a receipt ledger, and a clean-checkout verify step.

Disclosure: This article was prepared as part of MonkeyCode's product outreach.

The three mistakes, ranked by cost

1. No pinned starting point. I let the agent edit a dirty worktree. Hours later I could not diff a run against a known commit.
2. The runner could see my credentials. The loop ran in the same shell that held my tokens and SSH agent. One careless line in generated code would have used them.
3. I trusted the agent's summary. The model wrote "all tests pass". I never reran them in a clean checkout. That was output, not evidence.

None of these is exotic. Each costs about an hour alone. Together they eat the whole day.

Step 0: Pick the runner before you write the prompt

The runner choice comes first. Everything else follows from it.

Workload	Local laptop	Free remote server
Public repo, short unit tests	Fine	Fine, and lighter on your battery
Private registry or package tokens	Only in a disposable container	No
Long loops with unknown wall time	No, unless hard capped	Preferred, if the cap is documented
GPU-bound training or inference	Depends on your own hardware	Do not assume free GPU capacity
Live incident with production secrets	Never	Never

I send the middle rows of that table to MonkeyCode's free model access and free server option. It keeps long agent loops off my laptop and away from my local credentials.

Those two availability claims are supplied by the operator here, and free tiers change without notice. Read the current limits on the project's own pages before you budget a day around them.

Step 1: Preflight the repository

Run this before the first prompt. It fails fast and prints the starting commit.

#!/usr/bin/env bash
# preflight.sh — run before the first agent prompt of the day
set -euo pipefail

die() { printf 'FAIL: %s\n' "$1" >&2; exit 1; }

# 1. Known starting point
[ -z "$(git status --porcelain)" ] || die "dirty worktree: commit or stash first"
base=$(git rev-parse --short HEAD)

# 2. Pinned dependencies
[ -f package-lock.json ] || [ -f uv.lock ] || [ -f go.sum ] || die "no lockfile committed"

# 3. No ambient credentials for the runner
if env | grep -qE '^(AWS_|GITHUB_TOKEN|SSH_AUTH_SOCK|OPENAI_API_KEY)'; then
  die "credentials visible to the runner"
fi

# 4. Declared budget, printed so the log shows it
printf 'base=%s wall_cap=%ss disk_cap=%s\n' "$base" "${WALL_CAP:-900}" "${DISK_CAP:-2G}"

Three checks matter here. The worktree must be clean. The lockfile must be committed. The environment must not leak secrets into a process you do not control.

If check three fails, do not "fix" it by exporting less carefully. Move the loop to a runner that has nothing to steal, or strip the environment on purpose before you start.

Step 2: Write a receipt for every run

A run without a receipt is a rumor. Append one line per run, and never edit the file by hand.

# receipt <run-id> <model-label> <verdict> <wall-seconds>
receipt() {
  local run_id=$1 model=$2 verdict=$3 wall=$4
  printf '%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n' \
    "$run_id" \
    "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
    "$model" \
    "$(sha256sum prompt.md | cut -c1-12)" \
    "$(git rev-parse --short HEAD)" \
    "${RUNNER:-local}" \
    "$wall" \
    "$verdict" >> runs.tsv
}

receipt run-001 "${MODEL_LABEL:?set a model label}" fail 412

The columns are deliberate. Timestamp, model label, prompt hash, base commit, runner, wall time, verdict. When two diffs disagree, the ledger tells you whether the prompt changed or the model did.

Record the failure too. A ledger of only successes hides the reruns that cost the afternoon.

Step 3: Verify on a clean checkout, not in your editor

The agent's word is not the oracle. Rebuild the change from patch plus base commit.

# verify.sh <base-commit> <patch-file>
set -euo pipefail
base=$1; patch=$2
dir=$(mktemp -d)
git worktree add --detach "$dir" "$base"
cd "$dir"
git apply --check "$patch" && git apply "$patch"
npm ci --ignore-scripts
npm test --silent
cd - >/dev/null
git worktree remove "$dir" --force

npm ci --ignore-scripts matters. Install scripts are code. You want dependencies, not a second unreviewed program.

If the tests pass here and fail on your machine, your machine is the anomaly. Fix that difference before you debug the patch.

Step 4: The debugging loop when it still breaks

1. Reproduce on the pinned base commit with the same lockfile.
2. Bisect the patch into the smallest hunk that still fails.
3. Re-prompt with that hunk and the failing test as the only context.
4. Append a receipt line for the new run before you read the diff.

Step 4 is the one I skip when I am tired. Skipping it is how the same bug gets three different explanations.

Limitations and who should skip this

This workflow assumes you can rebuild the project from a lockfile. If your build needs a private registry, keep the loop inside your own network.

Do not send regulated, customer, or unreleased code to any third-party runner without an explicit review. Free tiers are convenient, not audited for your compliance needs.

Skip the remote branch if you need an SLA, long-lived machines, or guaranteed GPU capacity. Check the project's own documentation for current limits instead of trusting a blog post, including this one.

Local-only is a valid answer. The preflight script and the ledger work with zero external services.

What I would tell 07:45-me

Run preflight first. Pick the runner second. Write the receipt third, before you read the diff.

Three checks, four minutes, no lost day. If you want the remote branch without a bill, start with MonkeyCode's free model access and free server option, confirm the current limits yourself, then run preflight before the first prompt.