The 200 Came From a Rental

A pull request arrived after midnight with a README that claimed the API was already healthy. The coding agent had started a process, requested its own localhost, and treated a 200 as proof the service would run for everyone. That response was genuine inside a short-lived workspace, yet it said nothing about the laptop waiting on Monday. The reviewer stared at a green sentence printed on a host that nobody on the team could reopen.

This pattern appears whenever a coding agent can execute commands, not merely suggest them, and reviewers misread the transcript. Developers treat the agent's shell as a preview of their laptop because both sessions speak bash and render similar fonts. The analogy fails like a hotel gym standing in for a home garage, familiar until one bolt size changes. Claims in the next sections are the ones that keep returning during review, then a fingerprint workflow that makes the rental visible.

Myth: a bound port means the service is portable

Agents love a bound port because it is a crisp success token that copies cleanly into a README. A process that answers on the sandbox does not encode libc, extra packages, file layout, or the user's group permissions. Health checks measure a moment on a host you do not retain, not a contract with the checkout that will survive merge. Treat a remote 200 as proof that some files ran once, then demand a second run on CI or a laptop.

A useful correction is to refuse README claims that cannot be replayed from a clean clone of the branch. Ask the agent for the exact command sequence, the working directory, and the non-secret environment keys it exported during the run. Then execute that sequence locally with undocumented keys unset, unless they already exist in the team's dotenv template. If the local run dies on a missing header or a path the sandbox invented, the original green check was a rental.

Myth: a free remote box is unofficial CI

Teams under schedule pressure will point at agent logs the way they once pointed at a personal developer laptop after a demo. Continuous integration is a pinned image, a known network policy, and an artifact that later jobs can download without guessing. A disposable coding workspace is usually none of those properties, even when the vendor does not charge for the minutes of compute. Billing and reproducibility sit on different axes, so a zero-dollar session can remain an unpinned host that vanishes.

Free model access plus a free server option makes retries look cheap, which confuses a rental with a pipeline. Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode can host an agent session with free model access and a free server option without turning that session into merge infrastructure. Use the remote box to draft changes and capture fingerprints, then keep gates on runners the team can name and retain.

Myth: matching the language runtime is enough

Python 3.12 on both sides is a comforting sentence that hides compilers, locales, and case sensitivity in the rest of the stack. Operating system package names and default filesystems drift independently of the language version string that agents paste into summaries. Agents also invent paths like /home/sandbox/work and then hard-code them into scripts that look abstract in the pull request. The corrected model treats a runtime version as one row in a matrix, never as the entire matrix itself.

Capture rows you can observe without leaking secrets, including kernel name, architecture, package managers, and the lockfile hash the agent actually used. Do not paste environment values; paste only sorted key names so reviewers can see DATABASE_URL was assumed without copying its contents. The scripts below are unexecuted proposals you should read, then run locally and again inside the agent workspace. Commit the script on the branch so both hosts hash identical bytes rather than improvising two inventories by hand.

A fingerprint instead of a vibe

The bash script prints inventory lines and avoids credential values, which matters when the remote transcript might be retained by a vendor. Redirect stdout to a file named after the host role, such as fingerprint.local.txt or fingerprint.agent.txt, before you compare. Keep raw files out of public gists when they reveal internal hostnames, and prefer committing only a short diff summary.

#!/usr/bin/env bash
# Proposed example: secret-free host fingerprint for agent-versus-laptop diffs.
set -euo pipefail

role="${1:-unspecified}"
echo "role=${role}"
echo "date_utc=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
echo "pwd=${PWD}"
echo "user=$(id -un 2>/dev/null || echo unknown)"
echo "uid=$(id -u 2>/dev/null || echo unknown)"

echo "uname=$(uname -s 2>/dev/null || echo unknown)"
echo "arch=$(uname -m 2>/dev/null || echo unknown)"
echo "kernel=$(uname -r 2>/dev/null || echo unknown)"

if command -v python3 >/dev/null 2>&1; then
  python3 - <<'PY'
import sys, platform
print(f"python={sys.version.split()[0]}")
print(f"python_impl={platform.python_implementation()}")
print(f"platform={platform.platform()}")
PY
else
  echo "python=missing"
fi

if command -v node >/dev/null 2>&1; then
  echo "node=$(node -v)"
else
  echo "node=missing"
fi

if command -v go >/dev/null 2>&1; then
  echo "go=$(go env GOVERSION 2>/dev/null || echo present)"
else
  echo "go=missing"
fi

echo "env_keys=$(env | cut -d= -f1 | sort | tr '\n' ',' | sed 's/,$//')"

for lock in package-lock.json yarn.lock pnpm-lock.yaml poetry.lock uv.lock Cargo.lock go.sum Gemfile.lock; do
  if [[ -f "$lock" ]]; then
    if command -v sha256sum >/dev/null 2>&1; then
      echo "lock_${lock}=$(sha256sum "$lock" | awk '{print $1}')"
    else
      echo "lock_${lock}=$(shasum -a 256 "$lock" | awk '{print $1}')"
    fi
  fi
done

Pair the capture with a comparer that fails review when sandbox and laptop disagree on fields your team marked required. The Python that follows is also a proposal, so change the required keys rather than treating them as universal. Exit status is the review signal; printed DRIFT lines are the conversation starter in the pull request thread.

# Proposed example: compare two fingerprint files and exit nonzero on drift.
from pathlib import Path
import sys

REQUIRED = ("uname", "arch", "python", "node")


def parse(path: Path) -> dict[str, str]:
    data = {}
    for line in path.read_text(encoding="utf-8").splitlines():
        if "=" not in line:
            continue
        key, value = line.split("=", 1)
        data[key] = value
    return data


def main() -> int:
    if len(sys.argv) != 3:
        print("usage: compare_fingerprints.py local.txt agent.txt", file=sys.stderr)
        return 2
    local = parse(Path(sys.argv[1]))
    agent = parse(Path(sys.argv[2]))
    failed = False
    for key in REQUIRED:
        lv, av = local.get(key, "absent"), agent.get(key, "absent")
        if lv != av:
            print(f"DRIFT {key}: local={lv} agent={av}")
            failed = True
        else:
            print(f"OK {key}={lv}")
    local_keys = set((local.get("env_keys") or "").split(","))
    agent_keys = set((agent.get("env_keys") or "").split(","))
    invented = sorted(k for k in (agent_keys - local_keys) if k)
    missing = sorted(k for k in (local_keys - agent_keys) if k)
    if invented:
        print("AGENT_ONLY_ENV_KEYS " + ",".join(invented[:40]))
    if missing:
        print("LOCAL_ONLY_ENV_KEYS " + ",".join(missing[:40]))
    return 1 if failed else 0


if __name__ == "__main__":
    raise SystemExit(main())

A prompt you paste into the agent is part of the same proposal and is not a guarantee that the agent will comply. Ask it to run the committed script, write fingerprint.agent.txt, and stop without starting long-lived servers as proof of success. If it starts a server anyway, treat that as data about the agent rather than a reason to skip the fingerprint file. If it rewrites the script to omit inconvenient fields, that rewrite is itself a finding you should quote in review.

Myth: small tasks do not need the second run

Short diffs are where silent path assumptions hide, because nobody wants a pipeline ceremony for a twelve-line helper. The helper that imports orjson because the sandbox already had it will fail on a laptop that only shipped the standard library. The helper that writes /tmp/agent-out may later collide with a shared runner that treats that directory as a crowded hallway. Diff size is a poor prior for environment drift, while novelty of commands and native dependencies is a better one.

If the agent touched package manifests, native modules, container files, or anything that binds a port, run the fingerprint pair. If it only rewrote comments and string copy, you can skip the ceremony without pretending the environments were proven equal. Write that split into the review guide so agents are not negotiating freshness of the rule during every late session.

The rental is not the hall

Think of the agent's workspace as a rental instrument, tuned before you arrived and reset after you leave the room. Your repository is the score, and your CI image is the hall where the performance is actually graded for merge. A free-tier session can still play the piece clearly and still be the wrong room for the exam that counts. The useful question is which host produced each claim, and whether that host will still exist tomorrow morning.

Merge only when the local or CI fingerprint satisfies the required keys and the lockfile hashes match across both captures. Agent-only environment keys must be documented in the template or removed from the code before the branch is eligible. Fail the review when the agent started a server as proof, sandbox paths leaked into scripts, or the fingerprint file is missing. Pass with comments when the drift is limited to tools the change never invokes, and record that exception in the thread.

Limitations and who should skip this

This workflow does not prove functional correctness, security, or performance, and it only reduces a class of worked-over-there mistakes. It will not help if the agent refuses to run your script, or if the remote filesystem vanishes before the fingerprint can be written. It can create false safety when required keys are too few, because two similar Linux boxes can still disagree on libpq. Expand the required set when your change touches databases, browsers, or compilers, rather than celebrating an OK python line.

Do not use a remote coding server as the system of record for regulated data, production secrets, or customer traffic. Do not treat free compute as permission to disable CI in order to save a handful of wall-clock minutes on a branch. People on air-gapped product lines should keep remote agents off the critical path, even when the models themselves are appealing. People shipping mobile or embedded artifacts need device coverage that a host fingerprint does not pretend to replace at merge time.

The approach is a poor fit for exploratory chats that never touch the repository, because there is no merge gate to protect. In that setting a fingerprint comparison adds ceremony without changing what will run on anyone else's machine later. Once files move toward a pull request, the ceremony is cheaper than a Monday failure caused by a port that existed only on their box.

If you already draft on a free-tier agent with a remote workspace, capture both fingerprints before trusting a health check. Reproduce the commands from a clean clone, and treat any remote 200 as a rental receipt rather than a production certificate. The receipt can still be useful notes for debugging, as long as nobody files it under continuous integration by accident.