A Receipt the Model Cannot Forge

The founder slid a chipped mug across the table. Rain hit the kitchen glass in slow even ticks. One usage cap still blocked the evening launch.

The product had to refuse extra API calls. Last month's cloud bill already felt heavy. A fresh model invoice was simply not happening.

A paid copilot could draft the handler quickly. That path would also print a usage charge. The founder needed generation that left no bill.

The evening still demanded real and boring engineering proof. Fast drafts were not the kitchen's true villain. A merge without a local receipt was the risk.

Models now write handlers in a few seconds. Dashboards stay green while a branch stays missing. The founder needed a receipt no model could forge.

Indie shipping still looks like a kitchen table. One person owns the product and the risk.

There is no review queue waiting at dawn. There is also no spare budget for tokens.

The work for tonight is small and painful. An API key may spend a daily call budget. Extra calls must return a clean refusal payload.

No extra call may silently succeed after the cap. That rule is a contract, not a vibe. A model can narrate the rule with confidence.

Narration is not the same as a failing test. The method starts with a red light. The founder writes the test before any handler.

The file lives under tests and nowhere else. The model is told to leave that file.

Here is a compact contract in plain pytest. It encodes the evening cap as three behaviors. Positive spend must pass under the remaining cap.

Overspend must return false without raising extra noise. Non-positive spend must raise a hard ValueError.

# tests/test_usage_cap.py
from usage_cap import UsageCap


def test_allows_spend_under_limit():
    cap = UsageCap(limit=10, used=7)
    assert cap.allow(2) is True
    assert cap.used == 9


def test_rejects_spend_over_limit():
    cap = UsageCap(limit=10, used=7)
    assert cap.allow(4) is False
    assert cap.used == 7


def test_rejects_zero_or_negative_spend():
    cap = UsageCap(limit=10, used=0)
    try:
        cap.allow(0)
    except ValueError:
        return
    raise AssertionError('expected ValueError')

The application file starts as an empty promise. That emptiness is useful tonight and not embarrassing. A missing class keeps the receipt honestly red.

# usage_cap.py
# The model may edit this file only.

Run the suite once before any generation step. The command must fail, and fail in a boring way. Capture the output into a receipts directory immediately.

mkdir -p receipts
python -m pytest -q tests/test_usage_cap.py \
  --junitxml=receipts/red.xml \
  | tee receipts/red.txt

A red file is the evening's first honest artifact. It proves the contract existed before the patch. Later green output without this red file is suspect.

A free generation desk can sit in that gap. The founder still runs pytest on the laptop.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode provides free model access for generation work. It also provides a free server option for runs.

Those two availability claims come from the operator. This article does not name models or numeric quotas. It does not claim hardware, duration, scores, or permanence.

The founder treats the product as one generation desk. The prompt stays narrow and almost impolite tonight. The founder asks the model to edit usage_cap.py only.

The tests and receipts stay frozen during generation. Green comes from receipt.sh, not from chat text.

A local shell wrapper keeps that boundary visible. The wrapper is not magic and not clever. It is a locked door with a short note.

#!/usr/bin/env bash
# receipt.sh — run from the repo root
set -euo pipefail

ROOT="$(cd "$(dirname "$0")" && pwd)"
cd "$ROOT"

mkdir -p receipts
TICK="$(date -u +%Y%m%dT%H%M%SZ)"
OUT="receipts/${TICK}"

if [[ -f usage_cap.py ]]; then
  SRC_HASH="$(openssl dgst -sha256 usage_cap.py | awk '{print $2}')"
else
  SRC_HASH='missing'
fi

set +e
python -m pytest -q tests/test_usage_cap.py \
  --junitxml="${OUT}.xml" > "${OUT}.txt" 2>&1
CODE=$?
set -e

if [[ "$CODE" -eq 0 ]]; then
  COLOR='green'
else
  COLOR='red'
fi

{
  echo "tick=${TICK}"
  echo "color=${COLOR}"
  echo "pytest_exit=${CODE}"
  echo "usage_cap_sha256=${SRC_HASH}"
  echo "tests_sha256=$(openssl dgst -sha256 tests/test_usage_cap.py | awk '{print $2}')"
} > "${OUT}.receipt"

chmod a-w "${OUT}.receipt" "${OUT}.txt" "${OUT}.xml"
printf 'wrote %s.receipt (%s)\n' "$OUT" "$COLOR"
exit "$CODE"

The chmod line is the rude part. After pytest finishes, the receipt becomes read-only. A later model turn cannot quietly rewrite the stub.

The founder can still delete files by hand. Manual deletion stays visible in the git log. Silent forgery of the stub is not easy.

Think of the receipt as a parking stub. The stub comes from the meter, not the driver. A handwritten stub on branded paper still fails.

The city wants the meter's own ink. That ink is the pytest exit code tonight.

The generation step can happen on a free server. That is handy when the laptop is already warm. It is also a limit the founder must accept.

Code leaves the kitchen if the server is remote. Keep the prompt in a file the runner never writes.

Implement UsageCap in usage_cap.py. allow(n) returns True and increases used when used+n is within limit. allow(n) returns False and leaves used unchanged when used+n exceeds limit. allow(n) raises ValueError when n is not a positive integer. Do not edit tests or receipts. Do not create a fake receipt.

Paste that block into the free generation desk. Bring the resulting usage_cap.py back to the laptop. Run ./receipt.sh and read the color line only.

A plausible implementation looks like the sketch below. Treat it as a labeled example, not a benchmark. Nobody timed this file against a public leaderboard.

# usage_cap.py
class UsageCap:
    def __init__(self, limit, used=0):
        if limit < 0 or used < 0:
            raise ValueError('limit and used must be >= 0')
        self.limit = limit
        self.used = used

    def allow(self, n):
        if not isinstance(n, int) or n <= 0:
            raise ValueError('n must be a positive integer')
        if self.used + n > self.limit:
            return False
        self.used += n
        return True

Run the receipt script again after the paste. Green means the contract held on this machine. Red means the evening is not done yet.

Repeat the same narrow prompt without extra scope. Do not widen the cap during a red receipt.

This is where pretend engineering usually starts tonight. A chat window often shows a confident paragraph. The paragraph claims all tests passed in spirit.

Spirit does not write a chmod locked receipt. The receipt also fights a newer failure mode.

Public talk says models outgrow old tests. That may be true for giant benchmarks. It is not true for a ten-line kitchen cap.

A tiny contract does not need to measure intelligence. It needs to block extra calls tonight. If the model outgrows the test, the test was vague.

Tighten the test instead of praising the speech. Solo founders should keep the loop ugly on purpose. Ugly loops are hard to screenshot as theater.

A red xml file is not a launch post. It is a brake for an evening merge.

Limitations sit beside the mug, not in a footnote. Free model access is not a named quota here. A free server is not a private vault either.

Latency, context, and uptime stay unspecified on purpose. The method will fail on large refactors. It will fail when secrets live in the tree.

It will fail when two services must move together. It will fail when the test describes the wrong product.

Regulated teams should skip this kitchen loop tonight. People who cannot send code off-box should skip it.

Medical and payments work should skip it as well. Anyone hunting model leaderboard glory should skip it.

The founder can still merge after tea with this. The bill stays at zero if the free path holds. The limit is the point, not a surprise.

The loop keeps one cap and one red file. It also keeps one read-only stub beside them.

If the office is a kitchen table this week, try the free path once. Keep a throwaway cap and keep the receipt.