Draw the Trust Line Before You Borrow a Seat

You should name the trust line before any secret, raw log, or working tree leaves your laptop. A free model seat does not shrink that line, and a friendly page does not make a remote process local. Treat the model endpoint and the server workspace as different rooms, because each room leaks a different kind of trace. If you cannot say which room receives which class of data, you are not ready to send the bundle.

Models have become more capable, so the temptation is to attach more context, and that temptation is exactly how a private trace leaves home. A stronger answer does not earn a wider door, and a free seat does not earn a looser rule. You still decide the room before you decide the wording, the attachment, or the command you hope to run. Capability may change the quality of the reply, but it does not move the trust line that sits under your feet.

The useful picture is a small office that has three rooms and one hallway you still control. Your laptop is the room you already trust, while the model room reads whatever text you choose to hand it. The free server is a third room that can hold files, run commands, and keep traces you do not administer. The hallway is your staging step, and that is the only place where a boundary check should live.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. Here, MonkeyCode is only the borrowed seat, and operator materials describe free model access plus a free server option. You should confirm the live allowance, retention, and region on the project page before you plan any real workload. This draft does not treat any quota, hardware shape, or duration as a stable fact, because those figures move.

The same hallway still works if you later swap the seat for another hosted model or another remote workspace. Start by writing a boundary ledger in plain files, rather than trusting a rule that lives only in your head. You give every artifact a class, a source path, and a destination room, then you refuse a bad pairing. Secrets stay on the laptop, raw logs stay out of remote rooms, and a prompt moves only after the ledger agrees.

A prompt that is safe for the model room can still be the wrong object to drop on the server. Files persist there, and commands run there, so a question file is a poor tenant for that room. A scrubbed source file that fits the server is still the wrong paste for the model room. The ledger exists so those two permissions do not collapse into one careless upload across both rooms.

A stack trace often carries tokens, hostnames, and customer identifiers that the prompt author never meant to include. Source may enter the server room only as a scrubbed copy, not as the checkout you are still editing. A missing file is not a safe file, so the check fails closed when a listed path cannot be read. The script below is a local proposal you can run today, and it does not call a model or upload bytes.

#!/usr/bin/env python3
'''Fail closed before a bundle crosses a trust line.

Proposal only: run this on your machine, against a manifest you wrote.
It does not call a model and it does not upload anything.
'''

from __future__ import annotations

import json
import re
import sys
from pathlib import Path

ROOMS = {'laptop', 'model', 'server'}
CLASSES = {'secret', 'raw_log', 'source', 'prompt', 'config'}

# Remote rooms never receive secrets or raw logs.
ALLOW = {
    'model': {'prompt'},
    'server': {'source', 'config', 'prompt'},
}

SECRET_RE = re.compile(
    r'(?i)(api[_-]?key|secret|token|password|BEGIN (RSA |OPENSSH )?PRIVATE KEY)'
)

def load_manifest(path: Path) -> list[dict]:
    data = json.loads(path.read_text(encoding='utf-8'))
    if not isinstance(data, list):
        raise SystemExit('manifest must be a list of records')
    return data

def check_record(rec: dict) -> str | None:
    kind = rec.get('class')
    room = rec.get('room')
    src = rec.get('path')
    if kind not in CLASSES or room not in ROOMS or not src:
        return 'record missing class, room, or path'
    if room == 'laptop':
        return None
    if kind not in ALLOW[room]:
        return f'{kind} may not enter {room}'
    file_path = Path(src)
    if not file_path.is_file():
        return f'missing file: {src}'
    text = file_path.read_text(encoding='utf-8', errors='replace')
    if SECRET_RE.search(text):
        return f'secret-like text in {src}'
    if kind == 'prompt' and 'raw_log' in text:
        return f'prompt still names a raw log: {src}'
    return None

def main() -> int:
    if len(sys.argv) != 2:
        print('usage: boundary_gate.py manifest.json', file=sys.stderr)
        return 2
    failed = False
    for rec in load_manifest(Path(sys.argv[1])):
        reason = check_record(rec)
        label = rec.get('path', '<unknown>')
        if reason:
            failed = True
            print(f'BLOCK {label}: {reason}')
        else:
            dest = rec.get('room')
            print(f'ALLOW {label} -> {dest}')
    return 1 if failed else 0

if __name__ == '__main__':
    raise SystemExit(main())

A matching manifest should stay boring, because excitement in a staging file is often a secret you forgot to remove. You list the prompt that may reach the model room and the scrubbed source that may reach the server room. You keep the secret record pointed at the laptop, and you never paste a production log into the question file. If the gate prints BLOCK, you fix the file or you change the room, and you do not override the exit code.

[
  {"class": "prompt", "room": "model", "path": "staging/question.md"},
  {"class": "source", "room": "server", "path": "staging/scrubbed_app.py"},
  {"class": "secret", "room": "laptop", "path": "local/dev.env"}
]

mkdir -p staging local
printf 'How does the scrubbed parser fail on an empty list?\n' > staging/question.md
printf 'def parse(items):\n    return items or []\n' > staging/scrubbed_app.py
printf 'APP_TOKEN=local-only\n' > local/dev.env
python3 boundary_gate.py manifest.json

printf '\napi_key=fake-value\n' >> staging/question.md
python3 boundary_gate.py manifest.json
echo exit:$?
# Restore staging/question.md before you consider any remote send.

Walk one deliberate failure through the hallway before you trust the habit on a real task. Put a fake key string inside the prompt file, run the gate, and confirm that the pattern blocks the model room. Then point a raw log at the server room, and confirm that the class alone is enough to block the send. Those two failures are the whole test plan, and they do not prove that a vendor deletes data after a permitted send.

What you should withhold is broader than the passwords that people already know they should hide. Connection strings, session cookies, signing keys, customer rows, and unredacted shell history all belong in the laptop room. Do not send another person's private messages just to make a bug report sound more vivid than it is. A dashboard image still carries an account identifier in the corner, even though this text gate cannot see pixels.

The free server deserves the same suspicion you would give any workspace you do not patch or back up yourself. That room can keep files, command output, and editor state after you close the tab and forget the session. A coat check keeps the rule honest, because you may hand over the coat without handing over the keys in the pocket. The gate does not make the remote room safe, and it only stops obvious pocket contents from leaving with the coat.

A free model can still be the right place to ask how a redacted function fails under a stated constraint. A free server can still be the right place to run that scrubbed copy when your laptop is too small or too dirty. You should skip this approach for regulated data, for a company DLP path, or when policy forbids external models. A regex misses secrets that look like ordinary words, and a manifest misses the file you forgot to list at all.

This script does not encrypt files, does not redact them for you, and does not audit what a provider stores later. If your employer forbids external models, the correct exit is to stop, not to rephrase the prompt until the checker is quiet. People who need a formal assessment, a legal review, or a guarantee of deletion should not treat this note as that work. The checker is a hallway habit, not a control that replaces your team's existing security review.

When the gate is green, you can try the borrowed seat with that same bundle and with nothing extra attached. Read the current MonkeyCode project docs for how free model access and the free server are offered on the day you start. Send only files the ledger allowed, keep secrets on your own disk, and believe the docs if they disagree with this draft. An outreach article can show a method, but it cannot act as a live status page for allowances or retention.