Name Failure Domains Before Apply

You do not start an architecture review inside the diff. You start by naming the failure domain that can hurt you. A clean patch can still cross a boundary you never drew.

Think of the change as water in a set of pipes. The pipes matter more than the color of the water. If a pipe leaks, the patch quality will not save you.

Your first constraint is the scope of files. You name the files the change may touch. You also name the files it must not touch.

A suggestion that wanders past that fence fails review. That remains true even when the code compiles. Scope is a wall, not a hopeful wish.

Your second constraint is the path data takes. Prompts, file snippets, and test logs either stay on your machine or they leave. You write that choice down before you ask any model for help.

Your third constraint is where the patch lands. Apply stays on a branch that you control. Or it lands on a machine you do not administer.

Those two targets are different failure domains entirely. Do not blur them because the suggestion looks small. A small diff can still open the wrong door.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode offers free model access and a free server option. This review uses only those two supplied facts.

It does not assume a model name or a quota. It also skips hardware shape and any duration. You read the live plan yourself before you rely on either offer.

Treat the free server as a rented workbench, not as your archive. You can try a patch there when your laptop is the wrong place. You still keep the source of truth on a host you can inspect.

Here is the data flow you should draw before you paste anything. Your intent stays written in your own notes. The context you select then moves to the model.

The suggestion comes back to you as text. That text then sits in a review file. Apply happens only after the domain map says yes.

That flow has four hops, and each hop can fail alone. A failure in hop two does not excuse a failure in hop four. You review them as separate rooms in one building.

Hop one is the intent you already wrote. You write the constraint in a short file, not in a chat scroll. If the constraint is fuzzy, the model will invent a goal.

You cannot review an invented goal after the fact. A fuzzy intent is how drift enters the building. Write the goal in one sentence you can test.

Hop two is the egress of selected context. You choose snippets, not the whole tree, unless the tree is already public. Secrets, tokens, and customer paths do not ride along.

If you cannot redact, you do not send. Egress is a door you choose to open. Once the snippet leaves, you cannot pull the meaning back.

Hop three is the proposal text you received. The model returns a suggestion you can store. You store it as a patch file with a timestamp.

You do not apply it from the chat window. The chat is a transcript, not a release. A transcript can vanish, while a patch file can be diffed.

Hop four is where you apply the patch. You apply on a branch, or you apply inside the free server sandbox. You run the tests that belong to the touched files.

A green test on the wrong host is not evidence. Evidence is a file you can still open tomorrow. If that file is missing tomorrow, the hop already failed.

Failure domains are the rooms where a hop can burn you. Name each one before you admire the diff. You can use five names and keep them stable.

The egress domain fails when private data leaves. The drift domain fails when the patch solves a different problem. The apply domain fails when the patch lands on the wrong ref.

The custody domain fails when you cannot retrieve remote files. The evidence domain fails when no file can prove what ran. Five rooms share one building and no excuse.

The custody domain is about getting files back. It is not about how much room you were given. A free server may hold a workspace for a while.

That hold is not a backup you can trust. It is also not a promise you should invent. Read the current plan, then assume the workspace can vanish.

You can encode this review as a small gate. The gate reads a manifest you write by hand. It refuses apply when the map is incomplete or unsafe.

The script below is a proposal you can run locally. This proposal claims no benchmark and no vendor API. It only checks the map you already wrote.

Use hold when the map is fine but you are not ready. Hold stores the decision without landing any patch. Apply stays closed until you change that target on purpose.

#!/usr/bin/env python3
# Local domain gate. Proposal only. It makes no network calls.

import json
import sys

REQUIRED = (
    "intent",
    "touched",
    "forbidden",
    "egress",
    "apply_target",
    "evidence",
)
TARGETS = {"local-branch", "free-server-sandbox", "hold"}
EVIDENCE = {"patch-file", "patch-file+tests"}

def load(path):
    with open(path, encoding="utf-8") as handle:
        return json.load(handle)

def domain_failures(spec):
    failures = []
    missing = [key for key in REQUIRED if not spec.get(key)]
    if missing:
        failures.append("map-incomplete:" + ",".join(missing))
        return failures
    if spec.get("egress") == "external" and spec.get("secrets") is True:
        failures.append("egress-domain:secrets-would-leave")
    overlap = set(spec.get("touched") or []) & set(spec.get("forbidden") or [])
    if overlap:
        failures.append("drift-domain:forbidden-overlap")
    target = spec.get("apply_target")
    if target not in TARGETS:
        failures.append("apply-domain:unknown-target")
    if target == "free-server-sandbox" and not spec.get("source_of_truth"):
        failures.append("custody-domain:no-local-source-of-truth")
    if spec.get("evidence") not in EVIDENCE:
        failures.append("evidence-domain:no-local-artifact")
    if target != "hold" and spec.get("waiver") != "reviewed":
        failures.append("gate:apply-without-waiver")
    return failures

def paths_in_diff(diff_text):
    paths = []
    for line in diff_text.splitlines():
        if line.startswith("+++ b/"):
            paths.append(line[6:])
    return paths

def extra_paths(diff_text, touched):
    allowed = set(touched)
    return [path for path in paths_in_diff(diff_text) if path not in allowed]

def main():
    spec = load(sys.argv[1])
    failures = domain_failures(spec)
    if len(sys.argv) > 2:
        with open(sys.argv[2], encoding="utf-8") as handle:
            extra = extra_paths(handle.read(), spec.get("touched") or [])
        if extra:
            failures.append("drift-domain:patch-outside-touched")
    if failures:
        print("REFUSE")
        for item in failures:
            print(item)
        return 2
    print("ALLOW")
    print("target=" + spec["apply_target"])
    return 0

if __name__ == "__main__":
    sys.exit(main())

Save that checker as domain_gate.py on your machine. Then write a manifest that matches a real change. Do not let a model fill the forbidden list.

That list is your constraint, not a suggestion. A model that edits the fence is already inside drift. You keep the pen when you write that list.

{
  "intent": "Rename the retry helper without changing its public signature.",
  "touched": ["src/retry.py", "tests/test_retry.py"],
  "forbidden": ["src/secrets.py", ".env", "deploy/"],
  "egress": "external",
  "secrets": false,
  "apply_target": "local-branch",
  "source_of_truth": "git@origin/main",
  "evidence": "patch-file+tests",
  "waiver": "reviewed"
}

Run the domain gate before you apply anything. A refuse result is the review, not a nuisance. Read the exit code before you read the diff.

python3 domain_gate.py review.json suggestion.patch
status=$?
echo "exit=${status}"
test "${status}" -eq 0 || exit "${status}"
git switch -c review/retry-helper
git apply --check suggestion.patch
git apply suggestion.patch
python3 -m pytest tests/test_retry.py -q

If the gate prints an egress failure, stop and redact. If it prints a custody failure, keep the patch file local. Do not treat the free server as the archive.

Walk a concrete miss so the rooms feel real. You asked for a rename of a retry helper. The suggestion also edits the config loader to be helpful.

The touched paths and forbidden paths now overlap. The gate refuses, and that refuse is the architecture talking. You do not negotiate with the patch to stay green.

REFUSE
drift-domain:forbidden-overlap

You shrink the request and then ask again. You keep the same forbidden list in place. Helpful extra edits are drift, even when they look kind.

Walk a second miss on the free server. Tests pass in the sandbox during the afternoon. Next morning the workspace is gone, and so is your only copy.

The evidence domain failed when the patch never came home. The free server did not betray a quota you invented. It simply was never meant to be your archive.

You change the order of hops, not the slogan. Write the patch file locally before any remote run. Copy out logs you care about before you close the session.

A second manifest shows the safer sandbox path. You still name a source of truth you control. The free server is where you try the hop.

{
  "intent": "Try the same rename where the local machine is busy.",
  "touched": ["src/retry.py", "tests/test_retry.py"],
  "forbidden": [".env", "secrets/"],
  "egress": "external",
  "secrets": false,
  "apply_target": "free-server-sandbox",
  "source_of_truth": "/work/repo",
  "evidence": "patch-file+tests",
  "waiver": "reviewed"
}

python3 domain_gate.py sandbox.json suggestion.patch
# copy only touched files, run the tests, bring the patch file back

You should change the gate next, not the model. Turn the waiver into a commit message line, not a loose flag. Add a check that the patch edits only touched paths.

Expire sandbox copies on a clock you choose. A vendor clock is not your own constraint. Bring the patch home before you call the hop done.

Do not change the model as your first move. A sharper model does not shrink an unnamed failure domain. It only writes a more confident patch in the same pipes.

Here is the analogy to keep on the wall. A building inspector does not start by praising the paint. The inspector walks the load path, the exits, and the fire spread.

Your domain map is the inspection walk itself. The diff is only the paint on the wall. Fresh paint on a cracked beam is still a cracked beam.

Limits sit in plain sight for this gate. This gate cannot see secrets you forgot to mark. It cannot prove the free server isolated your work.

It cannot tell you a quota or a region. It cannot tell you how long a workspace lives. Those facts change, so you read them at use time.

This article will not freeze those live facts for you. Do not use this approach for regulated data that must stay local. Do not use it when you need a durable build farm.

Do not use it if a tool should merge to the default branch. The gate is a review aid, not a release system. If the manifest and the patch disagree, believe the manifest.

Throw the patch away and ask for a smaller suggestion. You should not widen touched paths just to make the gate go green. That move hides drift instead of naming it.

A green gate on a lying map is worse than a red gate. Free model access helps when the hop is small and the map is complete. A free server helps when you need a disposable place to run that hop.

Neither offer replaces the walk through failure domains. If you try that walk with MonkeyCode, confirm the live plan first. Then run this gate on a scratch branch before you trust a suggestion.