Classify the Egress Leaf Before a Free Server Accepts the Card

Consider this run as a worked scene, not as a reported incident. A nightly eval card finishes on a laptop. The fixture hash matches the value recorded at build time. The writable surface is a temp directory the job created and then removed.

The next morning the same card is aimed at a free model server so the laptop can sleep. The score shifts. The diff does not.

No model note explains the move, because the model was not the object that changed. The host changed. The card never named an egress class, so the shift has no leaf to attach to.

This note is a glossary plus a decision tree for that gap. It does not rank models. It does not choose a retry. It answers one question: may this card be accepted by a host that did not build it?

Where this check sits

Place the tree before two later checks. One branches on failure class. The other pins a fixture hash before a score is allowed to leave the machine. Those checks assume the host is already legitimate.

This check decides whether a host change is even a legal move for the card. It is not a backend catalog. It does not compare providers, context windows, or prices.

MonkeyCode is the named host option in the worked leaves below. Disclosure: This article was prepared as part of MonkeyCode's product outreach. Two availability claims are treated as operator-supplied, and only those two: free model access, and a free server option.

This draft states no model names, no numeric quota, no hardware, no duration, and no permanence. A token count is left out on purpose. It was not verified against a primary source dated 2026-10-12, and a stale allowance is an input this tree is built to reject.

If the live page does not offer either option on the day you run, the host pin is local or empty. The tree still applies. Empty fails the pin check. Local survives only when the other fields allow it.

Glossary

Fill these fields before you walk the branches. A missing field is not a default. It is a stop.

1. Card. The work unit. It carries a fixture id, a fixture hash, an egress class, a residue list, a host pin, a replay window, and the name of the writable surface. A prompt file by itself is not a card.
2. Egress class. One of machine-local, redacted-metadata, or public-fixture. You set it before the call. The server does not infer it.
3. Residue. The list of byte classes that would remain in a remote log, cache, or prompt store after the response returns. An empty list is a recorded claim, not a proof that the remote side forgot the call.
4. Host pin. The expected host identity, written before the call. local is valid. A blank string is not a pin.
5. Replay window. The interval during which the same fixture hash must reproduce the same score on the pinned host. The tree does not time the window. It requires the card to name one.
6. Leaf. The terminal result. The only legal values are hold, split, and release.

Fill the card in order

Do this before any network call. The order is the control. A later step must not rewrite an earlier one to force a friendlier leaf.

1. Hash the fixture bytes on the machine that owns them. Record the algorithm name beside the digest.
2. List residue. If you cannot name every byte class that would leave, stop and set the class to machine-local.
3. Write the host pin as local until a live page gives you a host string you are willing to copy.
4. Name the replay window in the same units your eval job already uses. Do not shorten the window to squeeze a card into release.
5. Name the writable surface. If the surface is unset, treat the card as incomplete and hold it, even though the sample function below does not read that field yet.

The hash command is a proposal. It was not run for this draft. Point it at a fixture you already trust, not at a ticket export.

python3 -c 'import hashlib, pathlib, sys; p = pathlib.Path(sys.argv[1]); print("sha256:" + hashlib.sha256(p.read_bytes()).hexdigest())' fixture.txt

The branches

Walk in order. The first matching step wins. Do not skip a step because a free server is idle, or because yesterday's page showed an allowance.

1. If egress_class is machine-local, the leaf is hold.
2. If residue is non-empty, the leaf is hold.
3. If host_pin, fixture_hash, or replay_window is blank, the leaf is hold.
4. If egress_class is redacted-metadata, the leaf is split.
5. If egress_class is public-fixture and steps 1-3 did not fire, the leaf is release.
6. Any other value, including a typo, is hold. Unknown is not a soft yes.

Egress class	Residue	Pins present	Leaf
machine-local	empty or not	any	hold
public-fixture	non-empty	yes	hold
any	any	no	hold
redacted-metadata	empty	yes	split
public-fixture	empty	yes	release

Leaf one: hold

Card H is a support transcript. The fixture id is ticket-1842. A template left the egress class as public-fixture. The residue list contains customer_email and session_cookie.

Step 2 matches. The leaf is hold. The free server does not get a vote, because price does not edit residue.

The next edit is the template default, not a search for a larger allowance. Keep the body on the machine that already holds the hash. If a later failure-class branch needs a label, compute that label locally and do not attach the transcript.

Leaf two: split

Card S is a public function docstring plus a local note naming the team that owns the fixture. The egress class is redacted-metadata. Residue is empty. The host pin is local-builder. The fixture hash and the replay window are both set.

Steps 1-3 do not match. Step 4 matches. The leaf is split.

The payload that may move is small and fixed: fixture id, hash, egress class, and a failure-class label already computed on the builder. The docstring body, the ownership note, and the writable-surface path stay.

A free model server is eligible only for that metadata-sized call, and only after you replace the placeholder pin with a host string copied that day. The score allowed to leave the machine remains the local score. The remote response does not replace it.

If the client sends the whole card unless you pass an allowlist, do not use that client for a split leaf. The leaf would describe a call you did not make.

Leaf three: release

Card R is a synthetic docstring checked into the repo. It was generated from a fixed seed. It has no personal names and no machine paths.

The egress class is public-fixture. Residue is empty. The host pin is the placeholder free-server until a live page names a real host. The fixture hash is present. The replay window is 24h.

Steps 1-4 do not match. Step 5 matches. The leaf is release.

Release means eligible. It does not mean the server is reachable, inexpensive, or unchanged since last week. Copy the host string published on the run date into host_pin. If that page publishes no host string, clear the pin. The next walk hits step 3 and holds the card.

That fallback is the reason to write the pin before the call, not after a surprising score.

Classifier

This module is a proposal. It was not executed while drafting. It implements the six steps and rejects unknown classes.

from dataclasses import dataclass

@dataclass(frozen=True)
class Card:
    fixture_id: str
    egress_class: str
    residue: tuple
    host_pin: str
    fixture_hash: str
    replay_window: str

def classify(card: Card) -> str:
    if card.egress_class == "machine-local":
        return "hold"
    if card.residue:
        return "hold"
    if not (card.host_pin and card.fixture_hash and card.replay_window):
        return "hold"
    if card.egress_class == "redacted-metadata":
        return "split"
    if card.egress_class == "public-fixture":
        return "release"
    return "hold"

Pair it with an oracle. The expected strings are the specification. If a run disagrees, change the function or change the glossary. Do not edit the printout to match a wish.

from egress_leaf import Card, classify

CASES = [
    (Card("ticket-1842", "public-fixture", ("customer_email",), "local", "sha256:abc", "24h"), "hold"),
    (Card("doc-17", "redacted-metadata", (), "local-builder", "sha256:def", "24h"), "split"),
    (Card("seed-04", "public-fixture", (), "free-server", "sha256:9f2c", "24h"), "release"),
    (Card("seed-04", "public-fixture", (), "", "sha256:9f2c", "24h"), "hold"),
    (Card("seed-04", "public-fixtre", (), "free-server", "sha256:9f2c", "24h"), "hold"),
]

def main() -> None:
    failed = 0
    for card, expected in CASES:
        got = classify(card)
        if got != expected:
            failed += 1
            print(f"FAIL {card.fixture_id}: got {got}, expected {expected}")
        else:
            print(f"OK {card.fixture_id}: {got}")
    raise SystemExit(failed)

if __name__ == "__main__":
    main()

Save the first file as egress_leaf.py and the second as check_egress_leaves.py. Then run the oracle.

python3 check_egress_leaves.py

You should see five OK lines and exit code 0. The fifth case is a misspelled class, and the legal result is hold. A non-zero exit means the tree and the oracle diverged.

Limits

The tree does not estimate cost, latency, or quality. It will release a public fixture onto a weak host and hold a sensitive card back from a strong one. That bias is intentional.

A release leaf with a placeholder pin is only safe until the first real call. Replace the placeholder or clear it. Free model access and a free server option are ways to fill host_pin. They are not reasons to skip residue, and they are not a retention policy or a region list.

If your program needs those facts, read them from a current primary page and record the date beside the pin. This article cannot supply them. The sample classifier also ignores the writable-surface name. That is a gap. Until you add the field, keep the manual step and treat an unnamed surface as hold.

Who should skip it

Skip the tree for customer content, credentials, session material, or any card whose residue you cannot list. Skip it when policy requires a signed data-processing agreement before an off-machine call. There is no field for that signature, so the honest leaf is hold.

Skip it as a capacity plan. An option that is free on the day you read the page is not a forecast for next week. Keep any existing route-by-data-class check and any failure-class branch. This tree does not retire them. It only refuses a card that has not earned an egress leaf.

When a card does reach split or release, open the current MonkeyCode project page, copy the host string it publishes, and only then set host_pin. If the page and this draft disagree, the page wins.