Letter to 09:10-Me: Name the Run, Freeze the Oracle

The clock read 09:10 when the patch looked finished.
The remote tree still held yesterday's failed files.
That mix burned the rest of the working day.

This letter names the three mistakes from that morning.
Each one looked small until the receipt was gone.
The harness below is a proposed fix, not a logged run.

What the morning actually tested

A small CLI fix needed a remote check off the laptop.
Local tests were green on a clean fixture copy.
The later server report still said the check passed.

The score file quietly mixed two separate attempts.
Exit codes never landed inside one run folder.
You trusted the chat summary more than the tree.

A nearby DEV topic this week is generated code quality.
That signal fits this account's remote sandbox habit.
It is inspiration only, not a source of facts.

Where the free options sit

The operator points at MonkeyCode for this drafting step.
Disclosure: This article was prepared as part of MonkeyCode's product outreach.
Free model access and a free server option are the only claims used.

The operator also describes the project as open source.
No repository URL was verified for this draft.
Read the current project docs before you clone anything.

Those notes do not name a model or a quota.
They do not name hardware, duration, or permanence.
Treat both offers as availability, not as a blank check.

The drafting date for this note is 2026-10-09.
Recheck product terms if you read it later.
Availability lines can change without a code change.

Mistake 1: one path, two drafts

You reran one command against the same remote path.
The second pass overwrote the first saved log.
You could not tell which draft had failed.

Steps to separate attempts

1. Create a run id from the current UTC timestamp.
2. Make a fresh directory before any remote command.
3. Copy every log only into that new directory.

# Unexecuted example. Review before use.
run_id="$(date -u +%Y%m%dT%H%M%SZ)"
out="runs/${run_id}"
mkdir -p "${out}/logs"
printf '%s\n' "${run_id}" > "${out}/RUN_ID"

This shell block is an unexecuted example for review.
Run it only on a machine you already control.
Keep the id in the receipt, not in the chat.

Mistake 2: the oracle moved

You edited the expected file while retries were running.
The model then matched a target you had changed.
The pass was real, but the comparison was not.

Steps to freeze the target

1. Hash the fixture before the first model prompt.
2. Refuse the run when that hash later drifts.
3. Store the hash in the same folder as the exit.

# Unexecuted example. Review before use.
oracle="fixtures/cli_expect.txt"
digest="$(sha256sum "${oracle}" | awk '{print $1}')"
printf '%s\n' "${digest}" > "${out}/ORACLE_SHA256"
now="$(sha256sum "${oracle}" | awk '{print $1}')"
test "${now}" = "$(cat "${out}/ORACLE_SHA256")"

The hash command assumes a Linux sha256sum binary.
On macOS, swap in shasum -a 256 before you compare.
Do not mix those tools inside one receipt file.

The second hash must match the file you stored.
If those two strings differ, abort the remote copy.
A self-compare of one file is not a freeze.

Compare every draft only against that saved digest.
If the oracle file changes, start a new run id.
Do not edit the oracle just to match the model.

Mistake 3: the remote tree stayed dirty

The free server kept the previous worktree in place.
Old object files survived the new source checkout.
A green test then scored the wrong source tree.

Steps to reset before score

1. Delete only the remote work path for this run.
2. Copy the frozen fixture and the patch alone.
3. Record the exit code before you read any prose.

# Proposed remote reset. Unexecuted. Review before use.
test -n "${run_id}"
remote_root="/tmp/eval-${run_id}"
case "${remote_root}" in
  /tmp/eval-20*) ;;
  *) printf '%s\n' "refusing remote path" >&2; exit 2 ;;
esac
ssh -o BatchMode=yes "${EVAL_HOST}" \
  "mkdir -p -- '${remote_root}' && find '${remote_root}' -mindepth 1 -delete"
scp -q "${oracle}" "${EVAL_HOST}:${remote_root}/expect.txt"

Set EVAL_HOST to an isolated host you control.
Do not point that variable at a shared production host.
Use EVAL_HOST only when you can wipe that path.

The free server option may host this isolated run.
These commands assume a shell you are allowed to reset.
If the docs show no shell, store the job id instead.

Write the receipt before the summary

# Unexecuted example. Review before use.
set -u
status=0
ssh -o BatchMode=yes "${EVAL_HOST}" \
  "cd '${remote_root}' && python3 check.py" \
  > "${out}/logs/check.txt" 2> "${out}/logs/check.err" || status=$?
printf 'exit=%s\n' "${status}" > "${out}/EXIT"
printf 'oracle=%s\n' "${digest}" >> "${out}/EXIT"

The name check.py is a stand-in for your real test.
This draft does not include that test file.
Swap in the command your repo already trusts.

Read the EXIT file before any model summary.
A zero in that file is the only pass signal.
Prose may explain a failure, but it cannot replace the code.

Three files, one meaning

The run id folder is the unit of evidence.
The oracle hash says which target you scored.
The exit line says whether the check agreed.

Missing any one of those files means no pass.
A chat message is not a fourth source of truth.
Archive the folder even when the status is failure.

Decision table

Use this table before you spend another remote run.
The rows are a proposal, not a measured policy.
Adjust the size row to match your own fixture.

Signal	Local loop	Free server run
Oracle hash missing	Stop	Stop
Run id missing	Stop	Stop
Fixture under 1 MB	Allowed	Allowed
Patch includes a secret	Refuse	Refuse
Prior tree not deleted	Refuse	Reset first
Only the chat text changed	Reread the diff	Do not rescore

Do not treat the free server as a secret store.
A laptop key must never ride along in the patch.
If a secret appears, stop and rotate that secret.

Order for the next morning

1. Write the failing check on a clean local tree.
2. Hash the oracle and save a new run id.
3. Ask the model for a diff, not a shell plan.
4. Reset the remote path for that run id only.
5. Copy the patch and the frozen oracle file.
6. Run the check and store the numeric exit code.
7. Accept the draft only when the receipt matches.

Keep the model call behind the saved fixture hash.
Free model access helps only on the third step.
It does not skip the reset or the receipt write.

A timeline sketch, not a diary

Call this timeline a teaching sketch, not your diary.
No personal hours or costs are claimed below.
The minute labels show order, not measured duration.

At minute zero you only have a red local check.
At minute ten the oracle hash is already stored.
At minute twenty the model returns a unified diff.

At minute thirty the remote path is empty again.
At minute forty the check writes an exit file.
At minute fifty you read that file before the chat.

If minute twenty arrives first, you repeat the morning.
The model cannot invent the missing oracle hash.
Order is the control that keeps the day intact.

Diff hygiene before any copy

Ask for a unified diff against the frozen tree.
Reject any reply that includes raw shell instructions.
Apply the diff in the run folder, not your home tree.

# Unexecuted example. Review before use.
mkdir -p "${out}/src"
git -C "${out}/src" apply --check "${out}/patch.diff"

Review the check output before you apply the patch.
A failed check means you do not touch the remote tree.
Save the rejected diff beside the failed receipt.

Command log without secrets

Write each command line into a commands file.
Append the exit status on that same line.
That file lets a later reader see the order.

# Unexecuted example. Review before use.
printf 'sha256_oracle exit=0\n' >> "${out}/commands.log"
printf 'remote_reset exit=0\n' >> "${out}/commands.log"
printf 'check exit=%s\n' "${status}" >> "${out}/commands.log"

Do not store tokens or passwords in that file.
Do not store host keys from unrelated machines.
The receipt should prove the run, not leak access.

A byte check for partial copies

Network blips can drop the copy command midway.
A partial file must fail the receipt check.
Add a byte-size check when your fixture grows.

# Unexecuted example. Review before use.
local_bytes="$(wc -c < "${oracle}")"
remote_bytes="$(ssh -o BatchMode=yes "${EVAL_HOST}" "wc -c < '${remote_root}/expect.txt'")"
test "${local_bytes}" = "${remote_bytes}"

If that size test fails, stop the scoring run.
Do not ask the model to repair a short file.
Fetch the remote listing into the run folder instead.

Who should not use this

Skip this flow when the patch touches production data.
Skip it when you cannot delete the remote path.
Skip it when the check needs an interactive password.

Also skip it while the oracle is still changing.
A moving target will waste the free server window.
Freeze the spec, then spend the remote run.

Skip it if BatchMode SSH is not already set up.
This note will not walk through key installation.
Access setup belongs in your own host policy.

Limits that stay in view

This harness does not benchmark any named model.
It does not promise uptime or a permanent free tier.
It does not grant rights on somebody else's host.

If the free server option is down, use a local sandbox.
The same three files still decide a pass there.
Run identity remains the control when cost changes.

Close the letter

When the next patch appears, read the current MonkeyCode access notes.
Then run the seven steps on a disposable host.
Keep the first failing receipt with the three files.

That is the whole note for 09:10 you.
Name the run before the model writes a line.

Freeze the oracle before any remote copy starts.
Wipe the remote tree before you trust a green mark.