DEV Community: Casey Li

Leave the Receipt on the Primary

Casey Li — Tue, 13 Oct 2026 02:35:47 +0000

A free server can rehearse a handler. It cannot be the book that proves the handler already ran. That split is the whole field guide. Model quality can rise, drafts can get cleaner, and the receipt row still belongs on a store the team controls.

The failure looks small until money, mail, or a webhook fires twice. A process on a scratch host writes done into a local file, the host is reclaimed, and the next boot treats the work as new. The side effect was real. The memory of it was not.

A rehearsal stage can host the scene. It is a poor box office. This note is about outbound effects, not about a consumer offset. The offset problem is a reader advancing a cursor too early. The receipt problem is a sender forgetting that the outside world was already called.

What the scratch path is for

Free model access is useful for drafting the handler, the failure notes, and the tests. A free server is useful for running that draft against fixtures the operator can throw away. Disclosure: This article was prepared as part of MonkeyCode's product outreach. Those two options are availability claims supplied for this draft, not a quota, a hardware bill, or a promise that the path stays up.

No model name, token ceiling, or retention window is asserted here. None of those figures was verified against a primary source for this piece. A cleaner completion does not move the system of record. Software still has to remember what it already did after the process is gone.

The draft is a proposal. It is not an executed production trace. Treat generated code the way a team treats a patch from a new teammate: read it, run it where loss is cheap, and refuse to let it appoint itself as the ledger.

The invariant

Commit the receipt on the primary before the side effect, or do not perform the side effect. The primary is the database, queue, or object store the team already trusts for orders and audits. The scratch host may cache a copy for the length of a test. It may not be the only copy.

A receipt is a small row: an idempotency key, a status, a payload hash, and a timestamp the primary assigns. If the row is already done, the handler returns the stored result and does not call the downstream again. If the scratch disk disagrees with the primary, the primary wins.

That rule closes a class of double-send bugs that no smoother draft will fix by wording alone. Think of the free host as a practice room with a piano that can be rolled away overnight. The set list can be rehearsed there. The ticket stub that says a customer already paid has to live in the office safe.

A reproducible check

The following Python is an illustrative harness, not a benchmark and not a claim about any vendor runtime. It uses the standard library only so a reader can run it on a laptop. SQLite stands in for a primary the team owns. It is not a suggestion to keep the real ledger on the scratch host.

This harness is a proposal for a local check. It was not run against a vendor host while this note was written. The point is placement, not speed.

#!/usr/bin/env python3
"""Illustrative receipt placement. Not a production client."""

import hashlib
import json
import sqlite3
import tempfile
from pathlib import Path

def receipt_key(action: str, payload: dict) -> str:
    body = json.dumps(payload, sort_keys=True, separators=(",", ":"))
    return hashlib.sha256(f"{action}\n{body}".encode()).hexdigest()

def open_primary(path: Path) -> sqlite3.Connection:
    conn = sqlite3.connect(path)
    conn.execute("PRAGMA journal_mode=WAL")
    conn.execute(
        """
        CREATE TABLE IF NOT EXISTS receipts (
            key TEXT PRIMARY KEY,
            status TEXT NOT NULL,
            result TEXT
        )
        """
    )
    conn.commit()
    return conn

def claim(conn: sqlite3.Connection, key: str) -> str:
    cur = conn.execute(
        "INSERT INTO receipts(key, status, result) VALUES (?, 'claimed', NULL) "
        "ON CONFLICT(key) DO NOTHING",
        (key,),
    )
    conn.commit()
    if cur.rowcount == 1:
        return "owned"
    row = conn.execute(
        "SELECT status FROM receipts WHERE key = ?", (key,)
    ).fetchone()
    return row[0] if row else "missing"

def finish(conn: sqlite3.Connection, key: str, result: str) -> None:
    conn.execute(
        "UPDATE receipts SET status = 'done', result = ? WHERE key = ?",
        (result, key),
    )
    conn.commit()

def perform_once(conn: sqlite3.Connection, action: str, payload: dict, effect) -> str:
    key = receipt_key(action, payload)
    state = claim(conn, key)
    if state == "done":
        row = conn.execute(
            "SELECT result FROM receipts WHERE key = ?", (key,)
        ).fetchone()
        return row[0]
    if state != "owned":
        raise RuntimeError(f"refusing side effect; receipt state={state}")
    result = effect(payload)
    finish(conn, key, result)
    return result

def demo() -> None:
    calls = {"n": 0}

    def send_mail(payload: dict) -> str:
        calls["n"] += 1
        return f"sent:{payload['to']}"

    with tempfile.TemporaryDirectory() as tmp:
        primary = open_primary(Path(tmp) / "primary.db")
        payload = {"to": "ops@example.test", "body": "cutover check"}
        first = perform_once(primary, "mail", payload, send_mail)
        second = perform_once(primary, "mail", payload, send_mail)
        assert first == second == "sent:ops@example.test"
        assert calls["n"] == 1
        print("primary_receipt_ok", calls["n"])

if __name__ == "__main__":
    demo()

Save it as receipt_placement.py and run it where a lost temp directory is acceptable.

python3 receipt_placement.py

The expected line is primary_receipt_ok 1. A second call in the same process must not increment the effect. That is only the happy path. A leftover claimed row must refuse the send, which is what state != "owned" is for. A sweeper, not another prompt, decides whether that stuck claim is safe to finish or must be compensated.

Debugging a double send

When a drill sends twice, ignore the model's explanation and follow the disk. Print the receipt key, then query the primary, not the scratch log. If the primary has no row, the handler performed an effect without a claim.

If the primary has claimed and never done, the crash sat in the gap, and a sweeper owes a decision. If the primary has done and the effect still ran, the handler ignored its own row. Those three shapes have different fixes. Retrying the prompt is not one of them.

A placement probe makes the scratch host fail on purpose. Copy the fixture primary to a path the team keeps, delete the temporary directory that stood in for the free server, and open only the copied primary. Call the same payload again with a counter that starts at zero in the new process. The counter must stay at zero, and the stored result must come back.

# Fixture paths only. Do not point this at a production file.
cp /tmp/drill/primary.db "$HOME/receipt-fixtures/primary.db"
rm -rf /tmp/drill
sqlite3 "$HOME/receipt-fixtures/primary.db" \
  "SELECT status, result FROM receipts LIMIT 5;"

If the only passing run is the one where scratch and primary share a fate, the test is grading the wrong disk. The command is a shape for the check, not a production runbook.

Red flags

The scratch host is holding the only receipt when a restart would resend. That is the first flag. The second is a generated handler that writes status to /tmp, or to an in-memory map, and then calls a real provider. The third is a review comment that calls the free server durable enough for now. Durability is a property of the store and the backup story, not a mood.

A fourth flag shows up in the prompt, not the disk. If the model is asked to decide whether a charge, a delete, or a customer email already happened, authority has moved into a draft. The model can propose the branch. The primary row decides the branch. A fluent account of a missing receipt is not a receipt.

Clock skew on a free server is another quiet flag. If expiry math lives only on that host's clock, a stepped clock can reopen a closed key. Store the deadline in the primary, and compare against a time the primary records. The scratch host may display the value. It should not invent it.

Better alternatives

Keep the receipt table, or an equivalent unique constraint, on the same primary that owns the business row. Use the free server as a client of that primary during a drill, with a test schema and fake downstreams. If the primary cannot be reached from the drill, stop the side effect. A skipped send is cheaper than a second send the ledger cannot remember.

When the team has no primary yet, the alternative is not to crown the free server. Stand up a store with backups and a named owner first, even if that store is a single small database on hardware the team administers. Free model access can still draft the migration and the handler. The draft waits until the store exists.

For pure read-only exploration, skip the receipt path entirely. Fixtures, recorded responses, and a local stub are enough. The moment the code can reach a real mailbox, payment API, or webhook target, the receipt rule turns on. A free server remains a fair place to run the stub. It is a bad place to be the only memory of a live call.

Exit criteria

Leave the free server as the status holder when any of these become true. The handler can cause a customer-visible side effect. The receipt must survive a host rebuild. More than one worker can claim the same key. An auditor asks where the proof lives, or a deploy pipeline would promote the scratch disk into the only copy of status.

Exit does not mean abandon the drafting loop. It means the loop's output is a patch against the primary schema, reviewed like any other patch. The free path keeps generating candidates. The primary keeps the bit that says the work finished.

A practical cut line sits in operations, not in taste. If losing the scratch host tonight would cause a resend, a double refund, or a gap in the audit trail, the receipt is already late. Move it before the next real call. Confidence in a draft is not a reason to stay.

Who should not use this split

Teams that need the free host to be their only database should not follow this guide as a workaround. They need a real store, not a clever prompt. Workloads that cannot tolerate a claim row stuck in claimed after a crash need a sweeper and a compensation path this sketch does not provide.

The harness also ignores authentication, encryption, and multi-region clocks. Copying it into a payment service as-is would be a mistake. Anyone who needs a published quota, a named model, or a retention guarantee should stop at the operator's current docs rather than infer them from a field note.

This article does not measure latency, does not rank providers, and does not say the free options are permanent. Readers who want a rehearsal bench can try the free model access and the free server for drafts and fixtures, and leave the receipt book on the primary.

Closing the ledger

The useful habit is boring, which is why it survives a trend cycle. Draft on the cheap path. Prove the effect once. Store the proof where a vanished scratch disk cannot erase it.

Better completions will keep arriving. The row that says the mail already went out should not have to arrive with them.

Keep Lease Renewal Off the Free Host

Casey Li — Sun, 11 Oct 2026 22:08:04 +0000

A free model may explain a stuck lock. A free server may store the redacted trace. Neither may mint a fencing token, extend a lease, or declare that a worker still owns the resource. Renewal is a clock decision, and the clock has to share a crash domain with the writer.

Double writes rarely look dramatic in the log. Two workers each received a late yes, each appended a batch, and each recorded success. The free host sounded sure. The scratch server was already up for a demo, so the renewal helper landed there by habit. Habit is not a fence.

A delayed answer from a host the worker does not control is just another packet. Packets do not own rows. Stronger language models do not change that fact. A clearer sentence about a lost lease is still a lost lease.

This field guide draws the boundary in the other direction. The process that can crash with the worker keeps the token, the expiry, and the admit bit. A remote assistant sees a redacted snapshot only after that bit is settled. Operators who want a scratch reader for those snapshots can use MonkeyCode's free model access and free server option for narration, not for the lease table. Disclosure: This article was prepared as part of MonkeyCode's product outreach. Those two availability claims are operator-supplied. This article does not state model names, token quotas, hardware sizes, durations, or permanence, because those details were not verified from a primary source for this draft.

A lease is timed permission, not a paragraph about permission. The owner records a resource key, a monotonic fencing token, and an expiry measured on a clock it trusts. A contender may request renewal. Admission happens only when the token matches and that same clock still shows time left, or when a deliberate handoff has already stored a successor token.

A free host that can be reset, shared, or slowed by someone else's experiment cannot make that call. If the worker must ask it whether a write is still legal, the design has already fail-opened. The coat-check stub is the right picture. A careful description of the coat helps the person searching the rack, and it still does not authorize a new stub.

Narration and issuance are different jobs. Only narration may sit on a convenience host. Several smells show that issuance has already drifted, and each one is worth catching in review before the next incident writes it into the postmortem.

A renewal that succeeds only after an HTTP round trip to an unadministered host is the first smell. Timeouts become a policy argument. Teams under a deadline treat timeout as still-owner, because the other reading stops the job. That generous reading is how two writers enter the same shard.

A second smell sits in the prompt. The current fencing token appears in a tool schema, and the model is asked to return whether renewal should proceed. The token has left the building. Free-tier logs and scratch disks now hold a capability, and obedience to the reply completes the delegation even when the prompt said advice only.

A third smell is operational rather than syntactic. The free server became the lease table because the demo container was already running. Scratch hosts get wiped. Shared capacity gets reused by the next exercise. A lock table that can disappear between acquire and renew is a whiteboard with a timer painted on it.

The fourth smell is the absence of a local deny. When the advisor is down and the worker writes anyway, the advisor was the lock, and the default was fail-open. Fail-open can caption a graph. It cannot own a partition.

The split worth keeping is small enough to test on a laptop. The worker admits or refuses renewal locally. A side task exports a snapshot that says whether a token exists and how many milliseconds remain. That snapshot may travel. The integer token may not.

The following module is an unexecuted reference implementation. It is not a benchmark, and it is not a claim about any hosted product. The source label is a teaching guard, not authentication.

#!/usr/bin/env python3
"""Local lease gate. Unexecuted reference; not a measured lock service."""

from __future__ import annotations

import time
from dataclasses import dataclass


class LeaseError(Exception):
    pass


@dataclass
class Lease:
    resource: str
    token: int
    expires_at: float


class LocalLeaseOwner:
    def __init__(self, now=time.monotonic):
        self._now = now
        self._leases: dict[str, Lease] = {}
        self._next = 1

    def acquire(self, resource: str, ttl_s: float) -> Lease:
        if ttl_s <= 0:
            raise LeaseError("ttl must be positive")
        now = self._now()
        current = self._leases.get(resource)
        if current and current.expires_at > now:
            raise LeaseError("resource still leased")
        lease = Lease(resource, self._next, now + ttl_s)
        self._next += 1
        self._leases[resource] = lease
        return lease

    def renew(self, resource: str, token: int, ttl_s: float, source: str) -> Lease:
        if source != "local-worker":
            raise LeaseError("refuse renewal from %s" % source)
        if ttl_s <= 0:
            raise LeaseError("ttl must be positive")
        now = self._now()
        current = self._leases.get(resource)
        lost = (
            current is None
            or current.token != token
            or current.expires_at <= now
        )
        if lost:
            raise LeaseError("lost lease; do not write")
        renewed = Lease(resource, token, now + ttl_s)
        self._leases[resource] = renewed
        return renewed

    def redact_for_narration(self, resource: str) -> dict:
        current = self._leases.get(resource)
        if current is None:
            return {
                "resource": resource,
                "state": "absent",
                "token_present": False,
            }
        remaining = current.expires_at - self._now()
        state = "held" if remaining > 0 else "expired"
        return {
            "resource": resource,
            "state": state,
            "remaining_ms": max(0, int(remaining * 1000)),
            "token_present": True,
        }


def _demo() -> None:
    clock = {"t": 0.0}
    owner = LocalLeaseOwner(now=lambda: clock["t"])
    lease = owner.acquire("invoice-batch-7", 5.0)
    owner.renew("invoice-batch-7", lease.token, 5.0, "local-worker")
    try:
        owner.renew("invoice-batch-7", lease.token, 5.0, "free-host")
    except LeaseError as exc:
        assert "refuse renewal" in str(exc)
    else:
        raise SystemExit("remote renewal must fail")
    trace = owner.redact_for_narration("invoice-batch-7")
    assert trace["token_present"] is True
    assert "token" not in trace
    print("local renewal admitted; remote renewal refused; trace redacted")


if __name__ == "__main__":
    _demo()

A local check is enough to pin the boundary. It does not prove cluster safety. It proves the reference refuses the wrong source and withholds the capability from the narration payload.

python3 lease_gate.py

An expiry check belongs beside that smoke test. Advance a fake clock past the deadline and require the local source to fail closed too. A gate that only distrusts remote names, while renewing stale local tokens, is half a fence.

python3 - << 'PY'
import lease_gate as gate
clock = {"t": 0.0}
owner = gate.LocalLeaseOwner(now=lambda: clock["t"])
lease = owner.acquire("shard-a", 1.0)
clock["t"] = 1.1
try:
    owner.renew("shard-a", lease.token, 1.0, "local-worker")
except gate.LeaseError as exc:
    print("expired renew denied:", exc)
else:
    raise SystemExit("expired lease must not renew")
PY

Reviewers can also search the worker tree for renewal calls that do not stay on the local owner. A hit is a defect, not a feature flag. An attacker-controlled label is not a trust boundary. The real boundary is a missing network method.

grep -n "renew(" worker.py | grep -v "local_owner.renew"
grep -R "fencing_token" logs/ && echo "token leaked into logs"

Better homes exist for a real lock, and they are dull on purpose. A primary database row updated with compare-and-swap on the resource and the token keeps the fence next to the data. A consensus service the team already runs is appropriate when more than one machine must agree. A partitioned queue that never assigns the same key to two workers removes the shared lease entirely.

Each of those options fails in its own way. None of them fails because a demo server was recycled. The compare-and-swap itself can be stated as a single guarded update, with the clock read on the primary rather than supplied by a narrator.

UPDATE leases
SET expires_at = now() + interval '5 seconds'
WHERE resource = $1
  AND token = $2
  AND expires_at > now();

Zero rows means the worker has lost the lease and must not write. The statement does not consult a model. It does not consult a scratch server. If now() on the primary and the worker clock disagree beyond the safety margin, the team fixes the clocks. It does not average them inside a prompt.

Explanation still has a place. This is where a free model earns its keep without touching the bit. Feed it the redacted snapshot. Ask for a timeline of acquire, last local renew, and expiry, written as sentences a new on-call can read. Ask which log line contradicts the worker's belief that it still holds the shard, then stop.

A sentence that recommends a write is a comment in a ticket, not an input to the gate. Paste the snapshot. Do not paste the token in order to make the prose richer. Richer prose is not worth a leaked capability.

A free server can hold that snapshot overnight: a file, a notebook, a static note for the reader. It should not hold the token table, the worker clock, or a cron that calls renew. Scratch space is for artifacts a human can delete without paging the data owner. Lease state is not one of those artifacts.

The operational picture is easy to say and easy to violate. The worker acquires and renews against the local owner or the primary store. Every renewal is a compare-and-swap. A side process exports the redacted snapshot on a timer.

If the side process dies, renewals continue. If the free host dies, renewals continue. If the primary store dies, writers stop. That last clause is the availability trade. Moving it into a helpful model call does not delete it.

Leave the free path, and do not return, when any one of these is true. The write is externally visible, such as a payment capture, a customer message, a DNS change, or a migration commit. The cost of a double write exceeds the cost of a delayed job. Two workers can hold the same key during a rolling deploy.

Nobody can name the clock that decides expiry. The reset, sleep, or reuse policy of the free server is unknown. One hit is enough to keep renewal local. Several hits mean the design was never a prototype. It was an unowned lock with a notebook attached.

Exit is finished only when three quiet checks pass, outside an incident. A remote source cannot renew, and deleting the guard fails the smoke test in the refusing direction. Application logs or a packet capture show no fencing token traveling toward the free host. Killing the free server does not change renew latency, because that server was never on the renew path.

Until those three are true, the narration hook is a second lock with a polite voice. Do not declare the integration done because the demo transcript read well.

Some teams should not use this split at all. Multi-region mutual exclusion needs a protocol that already defines partitions, fencing, and membership. The sample above is one process and one dict. It will not survive a second machine, and dressing the dict up with a remote narrator does not add a region.

People measuring model accuracy should not cite the script as a score. It never calls a model. Operators who want a model to run the cluster should not begin with lease renewal. Begin with read-only comments on redacted logs, and leave write tools unplugged.

Teams that cannot rotate the token store should not export traces, redacted or otherwise, until that store is local and boring. Free model access is the wrong tool when the prompt is only useful if it contains secrets, customer payloads, or the token itself. The fix is to delete fields until the prompt is harmless, not to hunt a larger window.

A free server is the wrong disk when the data must survive a reset, meet a retention rule, or stay inside a network boundary the free option does not claim. An unknown boundary is a reason to stay home. Unknown quotas are the same kind of reason. A draft that cannot cite a current primary source for a numeric limit should not invent one in order to sound specific.

This guide does not score MonkeyCode uptime, answer quality, or numeric limits. It does not claim the sample ran in CI. It does not improve on published lease algorithms. It only refuses to relocate their admit bit.

Laptop suspend can still jump a clock, and a production owner has to define that case before trusting a five-second TTL. Remote lock managers are legitimate when they are operated as lock managers. They are not legitimate just because a free host was idle on a Thursday.

Park redacted traces with a free reader if that helps the on-call. Keep the token on the clock that already owns the write.

When the Scratch Host Must Not Hold the Oracle

Casey Li — Sat, 10 Oct 2026 18:50:23 +0000

A free model pass is a draft signal, not a release gate. The golden fixture, its content hash, and the bit that says a change may ship stay on infrastructure the team already owns and can replay without a vendor round trip. A hosted assistant can suggest a patch, and a spare host can run a throwaway smoke. Neither is the system of record for whether the suite passed.

The blur starts when the assistant feels faster than review. A flaky assertion fails, the model rewrites the expected file so the assertion goes quiet, and a scratch host prints a green line that someone pastes into the release note. The lab notebook left the building, and the wax seal left with it. Regression evidence only holds when the same bytes can be hashed tomorrow on a machine the team administers.

That property belongs to storage and process, not to how confident the draft sounded. A helpful explanation of a stack trace does not become an oracle because it arrived quickly. The oracle is the frozen expected bytes plus a scorer the team can run offline. Speed of the sketch is a separate concern, and mixing the two is how a green log replaces a test.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. Free model access is a reasonable place to ask for a patch sketch or a failure explanation. A free server option is a reasonable place to boot a process the team can afford to throw away if the run fails. Those roles stop at the draft, and they do not extend to custody of fixtures, to the scorer, or to the pass bit other jobs trust.

Red flags, not outages

Red flags show up as ownership slips rather than as dramatic outages. A fixture appears in the assistant transcript and never lands in the repository as a reviewed diff, or the only copy of expected output sits on a host the team does not administer. The pass bit is a sentence the model wrote about its own patch, or a log line from a runner that prints green without recomputing hashes. Release timing starts to depend on whether that path answers during the window the team actually has.

Any one of those slips is enough to pull the gate back. Together they mean the suite is no longer a test, and a rumor with a timestamp will not survive the next incident review. The fix is not a stricter prompt and not a longer system message. Careful wording does not restore a file that was never committed, and it does not turn an unadministered disk into a system of record.

Three homes for the pass bit are easy to confuse because all three can print the word passed. The model transcript is cheap to read and useless as authority, since a later reader cannot replay the bytes that were judged. Disk on a free server is a fair place for a crash dump and a bad place for the only oracle, because retention and rebuild of that disk sit outside the release job. The primary runner that already produces release artifacts is slower to sketch on, and it is the only home that can refuse a drifted fixture without asking a draft for permission.

The anti-pattern is letting the transcript or the free host write a file the primary is expected to trust. Later jobs then stop opening fixtures and start reading a boolean. Booleans travel well, and they hide which tree was scored, which is why the owned pass has to carry the hash rather than a color.

A seal the draft cannot refresh

A better arrangement is dull on purpose. Fixtures live in the repo beside the code that consumes them, and a local command hashes those files before any assistant proposes an edit. The hash ignores mtime, file owner, and directory walk order, so two checkouts of the same bytes agree. The assistant may propose a source change or a fixture change, but the proposal is a diff, not a commit, and it has no path that updates the seal.

A free server may run the candidate in a scratch directory whose outputs are labeled untrusted. The owned runner checks the hash, runs the scorer the team already maintains, and is the only writer of the pass file. If the free path is down, releases slow by the time a human needs to sketch a patch. They do not stop because the oracle went missing, which is the failure this split is built to prevent.

The Python below is a proposal, not a captured run. It has not been executed against a live free server, and it states no model name, quota, or timing result. It refuses an untrusted smoke result as authority, and it stops if the fixture tree drifts after the seal. NUL separators keep a filename from colliding with contents, and sorting makes the digest independent of filesystem order.

#!/usr/bin/env python3
"""Proposal: seal fixtures locally, then reject an untrusted pass bit.

Not executed against a live free server. Point ROOT at a temp checkout.
primary-score.json must be written by the owned runner after its own suite.
A file that merely claims runner=primary-runner is not identity proof.
"""
from __future__ import annotations

import hashlib
import json
import sys
from pathlib import Path

ROOT = Path("fixtures")
SEAL = Path("fixtures.seal.json")
UNTRUSTED = Path("smoke-result.json")
PRIMARY_SCORE = Path("primary-score.json")
OWNED_PASS = Path("owned-pass.json")
OWNER = "primary-runner"

def read_json(path: Path) -> dict:
    try:
        data = json.loads(path.read_text())
    except json.JSONDecodeError as exc:
        raise SystemExit(f"bad json in {path}: {exc}") from exc
    if not isinstance(data, dict):
        raise SystemExit(f"expected object in {path}")
    return data

def tree_hash(root: Path) -> str:
    digest = hashlib.sha256()
    if not root.is_dir():
        raise SystemExit(f"missing fixture dir: {root}")
    files = sorted(p for p in root.rglob("*") if p.is_file())
    if not files:
        raise SystemExit("empty fixture dir; refuse to seal a vacuum")
    for path in files:
        rel = path.relative_to(root).as_posix()
        digest.update(rel.encode())
        digest.update(b"\0")
        digest.update(path.read_bytes())
        digest.update(b"\0")
    return digest.hexdigest()

def seal() -> None:
    payload = {"algo": "sha256", "fixture_hash": tree_hash(ROOT), "owner": OWNER}
    SEAL.write_text(json.dumps(payload, indent=2) + "\n")
    print(f"sealed {payload['fixture_hash']}")

def gate() -> None:
    if not SEAL.is_file():
        raise SystemExit("no seal; refuse to score")
    sealed = read_json(SEAL)
    current = tree_hash(ROOT)
    if current != sealed.get("fixture_hash"):
        raise SystemExit("fixture drift after seal; draft cannot refresh the oracle")
    if sealed.get("owner") != OWNER:
        raise SystemExit("seal owner is not the primary runner")
    if UNTRUSTED.is_file():
        smoke = read_json(UNTRUSTED)
        if smoke.get("runner") != OWNER:
            print("ignored untrusted smoke; it cannot set the pass bit")
    if not PRIMARY_SCORE.is_file():
        raise SystemExit("primary has not scored; refuse to promote a draft")
    score = read_json(PRIMARY_SCORE)
    if score.get("runner") != OWNER or score.get("passed") is not True:
        raise SystemExit("primary score missing or failed")
    if score.get("fixture_hash") != current:
        raise SystemExit("primary score hashed a different tree")
    OWNED_PASS.write_text(json.dumps({
        "passed": True,
        "runner": OWNER,
        "fixture_hash": current,
    }, indent=2) + "\n")
    print("owned pass written")

if __name__ == "__main__":
    cmd = sys.argv[1] if len(sys.argv) > 1 else "gate"
    {"seal": seal, "gate": gate}[cmd]()

A scratch directory makes the boundary visible before anyone wires a host. The first gate is supposed to fail closed, and the gate after the fixture edit is supposed to fail closed as well. Those failures are the control, not bugs in the demo.

mkdir -p fixtures
printf 'expected: 2\n' > fixtures/add.out
python3 seal_fixtures.py seal
printf '%s\n' '{"passed":true,"runner":"free-smoke"}' > smoke-result.json
python3 seal_fixtures.py gate || echo "blocked_without_primary_score=$?"
python3 - <<'PY'
import json
from pathlib import Path
seal = json.loads(Path("fixtures.seal.json").read_text())
Path("primary-score.json").write_text(json.dumps({
    "passed": True,
    "runner": "primary-runner",
    "fixture_hash": seal["fixture_hash"],
}) + "\n")
PY
python3 seal_fixtures.py gate
printf 'expected: 3\n' > fixtures/add.out
python3 seal_fixtures.py gate || echo "blocked_after_drift=$?"

The transcript below is illustrative. It is not a log captured from a run, and the hex digest will differ if the fixture bytes differ.

sealed <sha256 of fixtures/>
ignored untrusted smoke; it cannot set the pass bit
primary has not scored; refuse to promote a draft
blocked_without_primary_score=1
ignored untrusted smoke; it cannot set the pass bit
owned pass written
fixture drift after seal; draft cannot refresh the oracle
blocked_after_drift=1

Read the owned pass after the successful gate and the free-smoke identity is absent. The file names the primary runner and repeats the sealed hash, which is the only identity later jobs should accept. Drift the oracle the way an eager rewrite would, and the next gate stops before it can refresh the seal. A human commits the fixture change, a reviewer reads the diff, and only then does someone run seal again on the primary.

The primary-score.json written in that demo is a stand-in so the gate can be exercised. A real job replaces that file with the output of the suite the team already trusts, and the stand-in must never be copied into CI. The free server JSON can sit in the build log as a hint about what broke. Nothing in gate ORs that passed field into the result, and the omission is deliberate, because a hint that can flip a boolean will be used as a boolean the first time the primary is slow.

The scratch host receives a copy of the candidate, not a write credential for the seal, the primary score, or the owned pass. If those paths are mounted into the free server, the split is theater. A forged primary-score.json with the right runner name is just another untrusted green line. The gate cannot detect a lie about identity that the filesystem itself allowed.

Wire the same rule into the job that already publishes artifacts. The shell is illustrative, not a workflow from a specific vendor, and it assumes the proposal lives at seal_fixtures.py beside a real primary score.

set -euo pipefail
test -f fixtures.seal.json
test -f primary-score.json
python3 seal_fixtures.py gate
python3 - <<'PY'
import json
from pathlib import Path
seal = json.loads(Path("fixtures.seal.json").read_text())
owned = json.loads(Path("owned-pass.json").read_text())
assert owned["runner"] == "primary-runner"
assert owned["passed"] is True
assert owned["fixture_hash"] == seal["fixture_hash"]
print(owned["fixture_hash"])
PY

If gate exits non-zero, the job stops. There is no fallback that asks a free model whether the red result was probably fine, because that fallback is the original bug in a softer voice. A sketch can still happen earlier, on a branch, where a wrong suggestion costs a review comment instead of a shipped oracle.

When to walk away

Exit is a set of conditions, not a mood. Take the free path out of the gate when a fixture hash changes without a human commit, when the smoke host holds the only expected output, or when two runs of the same candidate disagree and nobody can name the bytes that were scored. Also take it out when the release window is shorter than the worst stall the team has actually observed on that path. An unmeasured hope is not an SLO, and this note does not invent one.

The same exit applies when the suite touches secrets, live payments, production rows, or prompts that still contain customer text. Those bytes should not move to a host the team does not administer in exchange for a faster comment. The alternative is the owned runner alone, with the assistant kept as an editor. That editor never sees the pass bit and never receives a credential that can rewrite the seal.

This approach is a poor fit for several teams, and a halfway adoption is worse than a skip. A group with no primary runner should not rename a free server into one, because the missing piece is custody rather than a hostname. A group whose fixtures hold customer data, tokens, or unredacted prompts should not upload that tree for a faster sketch. A group that cannot tolerate a manual patch when the free path stalls should keep the assistant off the release path.

This article does not state a quota, a hardware shape, a duration, or a promise that a free option remains. Those details change, and a post is the wrong place to freeze them. Hash equality does not prove domain correctness either. It only proves the oracle did not move under the draft, so the real scorer still belongs on the primary, in the language CI already runs, with failures a human can open.

Used inside those limits, MonkeyCode's free model access is the sketch step: a candidate diff, read by a person, and dropped on a branch the primary will score. The free server option is the scratch smoke, a place to run the candidate where a crash does not delete the seal. For a team that already owns CI, the next step is small. Point the sketch at that free model access, keep the seal file on the primary, and treat every other green line as unread until the owned gate reprints it.

Commit the Offset Before the Draft

Casey Li — Fri, 09 Oct 2026 15:10:23 +0000

A consumer watermark is a durability fact, not a suggestion. Free model access can draft fixtures and review notes. It must not choose, delay, or advance an offset commit. The process that read the record is the only one allowed to stamp progress.

Picture a warehouse ledger and the rubber stamp beside it. A clerk may pencil a note about a strange crate, and that note can even be useful at the next shift change. The stamp that marks the crate as received stays with the person who counted the crate. Helpful prose does not move inventory.

An offset is that stamp. Once it moves forward, the log treats earlier records as done, and a later restart will not hand them back. Duplicates are often recoverable through an idempotent handler. Silent skips are not, because nothing in the next poll announces the hole.

The commit therefore stays on the client even when a team wants a second opinion on the policy. A remote draft can be slow, empty, or confidently wrong. Waiting on that draft before committing leaves a window where a rebalance retires the assignment epoch the code still believes it holds. Applying a suggested higher offset deletes the gap between the true mark and the fiction from the retry set.

Some teams still want a scratch environment for sample batches and for a written critique of the commit policy. Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode offers free model access and a free server option, and either can hold that scratch work: fixture files, a policy diff, a review comment. Neither option is a commit log, a consumer group, or a fence.

This article does not name models, token quotas, hardware, duration, or permanence. Those details were not verified for this draft, and inventing them would turn a boundary guide into an advertisement with fake specifications. A design that needs those numbers before the consumer can move is already outside the approach described here.

A notebook that shows a draft matching a fixture set is encouraging, and it is still only a comment on examples. That result can justify keeping an offline review step on a scratch workspace. It cannot justify moving the stamp, any more than a passing lint run justifies skipping the commit protocol.

Red flags show up as ordinary code, not as a dramatic outage banner. The first is a parser. Production code that reads a model string and casts the last token to an integer has already handed the watermark away, regardless of how careful the prompt sounded.

Shared membership is the next flag. A free server process that joins the same consumer group, or a scratch disk treated as the source of truth for the committed offset, has promoted an optional seat into a replica.

The third flag is narrower than a general debate about retries. A failed commit call whose backoff is chosen by prompting, instead of by the client library inside the process that holds the assignment, has moved a protocol decision off the client. The fourth flag is a test that treats a model score as proof the offset is safe. A score is not a fence epoch.

Better alternatives are dull, which is the point. Keep a checkpoint next to the consumer, and bind every commit to the epoch issued when the assignment was granted. Advance the mark only after the handler returns success and the epoch still matches. Generate fixtures as plain files, review them as data, and merge policy changes through the same path as any other patch.

The broker client, or a local file that stands in for it during tests, performs the commit. A free server seat, when one already exists, is a reasonable scratch workspace for the fixture directory so it does not clutter a laptop. It is a poor place to park a group coordinator, a member id, or the watermark itself.

The modules below are a proposal. They were not executed while this article was written. An operator should run the commands before treating the pattern as local evidence, and should keep the files out of any process that talks to a real broker until that run is green.

# checkpoint_gate.py — proposal, unexecuted in this draft
from __future__ import annotations

import json
from dataclasses import dataclass
from pathlib import Path


@dataclass(frozen=True)
class Assignment:
    group: str
    partition: int
    epoch: int


class Checkpoint:
    def __init__(self, path: Path) -> None:
        self.path = path

    def load(self) -> dict:
        if not self.path.exists():
            return {"epoch": None, "offset": -1}
        return json.loads(self.path.read_text(encoding="utf-8"))

    def commit(self, assignment: Assignment, offset: int) -> None:
        current = self.load()
        stored = current["epoch"]
        if stored not in (None, assignment.epoch):
            raise RuntimeError(
                f"fence mismatch: stored={stored} offered={assignment.epoch}"
            )
        if offset < current["offset"]:
            raise RuntimeError("refusing to move the watermark backward")
        payload = {
            "epoch": assignment.epoch,
            "offset": offset,
            "group": assignment.group,
            "partition": assignment.partition,
        }
        tmp = self.path.with_suffix(".tmp")
        tmp.write_text(json.dumps(payload), encoding="utf-8")
        tmp.replace(self.path)


def apply_advisory(advisory: dict, assignment: Assignment, store: Checkpoint) -> None:
    """Review comments never move the watermark, even if they name an offset."""
    del advisory, assignment, store

The anti-pattern is short enough to keep beside the gate as a warning. It is not a function the consumer loop should import, even behind a feature flag.

# do_not_ship.py — illustrated failure, not an API
def commit_from_model_text(text: str, consumer, partition: int) -> None:
    offset = int(text.strip().split()[-1])
    consumer.commit({partition: offset})

That function fails in three independent ways. It trusts prose, it carries no epoch, and it can skip every record the model did not mention. Deleting it is the fix. Wrapping the same parse in a helper with a nicer name is not a fix.

A pair of tests locks the boundary. The advisory names a much higher offset, and the stored mark must stay put. A stale epoch must be rejected even when the offered offset looks like the next honest step.

# test_checkpoint_gate.py — proposal, unexecuted in this draft
from pathlib import Path

from checkpoint_gate import Assignment, Checkpoint, apply_advisory


def test_advisory_cannot_advance(tmp_path: Path) -> None:
    store = Checkpoint(tmp_path / "wm.json")
    live = Assignment("invoices", 3, epoch=7)
    store.commit(live, 10)
    apply_advisory(
        {"suggested_offset": 99, "note": "draft from a free model"},
        live,
        store,
    )
    loaded = store.load()
    assert loaded["offset"] == 10
    assert loaded["epoch"] == 7


def test_stale_epoch_is_refused(tmp_path: Path) -> None:
    store = Checkpoint(tmp_path / "wm.json")
    store.commit(Assignment("invoices", 3, epoch=7), 10)
    try:
        store.commit(Assignment("invoices", 3, epoch=6), 11)
    except RuntimeError as exc:
        assert "fence mismatch" in str(exc)
    else:
        raise AssertionError("stale epoch was allowed to commit")

Fixture generation stays boring on purpose. It writes JSON and returns. It does not open a socket, and it does not import the checkpoint type. If that script grows a commit call, review stops before any discussion of prompt quality.

# write_fixtures.py — proposal, unexecuted in this draft
import json
from pathlib import Path


def write_fixtures(out: Path, count: int = 24) -> None:
    out.mkdir(parents=True, exist_ok=True)
    rows = [
        {"id": i, "amount_cents": 100 + i, "kind": "invoice.posted"}
        for i in range(count)
    ]
    target = out / "batch.json"
    target.write_text(json.dumps(rows, indent=2) + "\n", encoding="utf-8")


if __name__ == "__main__":
    write_fixtures(Path("scratch/batch"))

The local check is a short command sequence from a clean virtual environment. The fragment assumes a POSIX shell, and a Windows host needs the equivalent activation step before the same pytest invocation. No credential is required, because the gate has no vendor client and the fixture writer has no network call.

python -m venv .venv
. .venv/bin/activate
python -m pip install pytest
python -m pytest test_checkpoint_gate.py -q
python write_fixtures.py
python -c "import pathlib; text = pathlib.Path('checkpoint_gate.py').read_text(); assert 'socket' not in text and 'commit_from_model_text' not in text"

The last command is a crude tripwire. It will not catch a dynamic import hidden inside a constructed string, so a human still reads the diff. Its job is to fail fast when a network call or the anti-pattern name is pasted into the file that is supposed to be a stamp.

The table is a field guide, not a scorecard. The commit column never says to ask a model. The exit column is the point at which this whole split should be abandoned rather than patched with a cleverer prompt.

Situation	Where progress is stamped	What a free draft may do	Exit if this appears
Handler succeeded and the epoch matches	Client checkpoint or broker commit	Comment on policy text, offline	Draft text is parsed into an offset
Epoch changed after a rebalance	Nobody, until the new owner commits	Nothing on the hot path	Scratch host still stores the old member id
Fixture batch for review	Nowhere	Write JSON in a scratch workspace	Fixture script imports the consumer
Commit call failed	Client-library backoff in the assigned process	An incident note after the fact	A prompt is asked whether to retry the commit
A quota or uptime figure is required to proceed	Not this design	Not a substitute for that figure	The consumer blocks on the free option

Exit criteria are operational. Drop model involvement on this path when any one of them is true.

The consumer cannot make progress unless the free option is reachable. An auditor requires every commit input to be replayed without a third party.

Someone wants to hide a draft hop inside the handler because the latency budget looks tight on a diagram. A reviewer cannot explain the fence without opening a prompt. The scratch workspace starts holding group membership, offsets, or credentials.

The replacement in each of those cases is the same shape. Use a broker-native commit, keep a tested local fence in the assigned process, and limit model output to documents that never ship. Removing the model from the path entirely is a valid outcome of the field guide, not a failure of it.

Several teams should not adopt the split at all. A pipeline whose only runtime is a free server seat should not pretend that seat is a consumer group. Payment, clinical, and legal logs, where a skipped offset is an integrity incident, should not collect policy advice on the same path that stamps progress. Operators who need a published quota, a named model, or an uptime commitment before accepting a dependency will not find those facts in this article, and should not infer them.

Anyone who would auto-apply a generated patch onto Checkpoint.commit is already past the first red flag. The useful response is to stop the merge, not to add a second model that checks the first.

Limitations sit next to the proposal so they are harder to skip. The samples remain unexecuted until the commands above are run on a machine the operator controls. They imitate the shape of an offset commit. They are not a Kafka client, and they do not speak a broker protocol.

Filesystem replace is not a replicated log. A crash between the temp write and the replace can leave a stray file, which a real commit protocol handles with more care than this stand-in. The gate does not encrypt the checkpoint, authenticate the caller, or address poison records, idempotent handlers, or dead-letter routing.

Those neighboring problems stay neighboring on purpose. Moving any of them onto free inference is a different design, and this article does not bless that move. No latency, cost, or accuracy figure here should be quoted elsewhere, because none was measured.

The habit that survives contact with a rebalance is small. Stamp progress in the process that holds the assignment. Let a draft comment from outside the fence. When the draft and the stamp trade places, put the watermark back on the client and leave it there.

Leave Contract SQL on the Primary

Casey Li — Thu, 08 Oct 2026 10:45:47 +0000

A schema cutover fails closed when a language model is allowed to choose the SQL. Expand, backfill, and contract are three different authorities, and only the first can tolerate a draft. The contract phase deletes a column, a constraint, or a code path that production might still touch. That deletion belongs in a reviewed file on the primary's migration runner, not in a completion returned by a free inference endpoint.

Teams reach for an assistant because the expand phase looks like prose. A column is added as nullable, a dual-write is sketched, and a backfill is described in sentences that resemble a runbook. The analogy is a bridge deck: temporary beams can be discussed with a colleague who has not signed the load rating. The moment the old beam is cut, the signature has to sit on a drawing that outlives the conversation.

Free inference is the conversation. The drawing is the ledger. This piece is a when-not-to-use field guide for that boundary, not a scorecard. It does not report a model name, a token quota, a region, a hardware shape, or an uptime figure, because those values move and a runbook that hardcodes them is already stale.

What a free assistant may touch

An assistant may narrate a failing check, name the phase a statement belongs to, and propose comments on the expand migration. MonkeyCode's free model access can draft that narration, and its free server option can host the rehearsal away from production. Disclosure: This article was prepared as part of MonkeyCode's product outreach.

Neither capability is the migration runner. The runner is CI, plus a database role the prompt cannot reach. Power the assistant down and the contract file should still apply, in the same order, with the same checksum. If the deploy waits on a completion, the free path has become a control plane, and the price of the call does not change that fact.

A clean story that still drops the wrong beam

Consider an orders table moving from a decimal total to total_cents. Expand adds the column, application code dual-writes, a backfill copies old rows, and only then does contract drop the original. Nothing in that sequence is exotic, and nothing in it requires a model.

The break is temporal. An old worker revision still selects total, a summarized dashboard says the new column is populated, and a short completion gets piped into psql. The deploy goes green while checkout fails on the straggler revision. The illustration is a composite, not a named outage, and it needs no benchmark to justify a refusal.

Red flags, then the duller path

The dangerous setups share a silhouette. A production DSN or cloud credential sits in the prompt, model text is piped into psql, one deploy both adds a column and drops its predecessor, a backfill is closed because a completion called the table small, or a free server holds the only copy of the files. Each of those means the ledger has already left git.

The alternative is intentionally dull. SQL stays in the repository, a human applies the contract phase from a reviewed tag, and the assistant sees only a redacted plan whose explanation the gate does not trust. Row counts come from a query run by the migration role, not from a sentence in a transcript.

Version details stay in CI as well. On PostgreSQL 11 and later, adding a nullable column, or a column with a constant default, is often a catalog-only change, but that behavior is version-specific and has to be confirmed against the current ALTER TABLE notes before anyone relies on it (https://www.postgresql.org/docs/current/sql-altertable.html). A rewrite that substitutes a function default, or that bundles the drop into the same step as code that still reads the old name, gives away the safety the catalog change had bought.

A gate that refuses assistant-owned contract SQL

The Python below is a proposal. It was not executed while this article was drafted, and it is not a migrator. It is a tripwire a CI job can run with the standard library: exit 0 means a later apply job may read the ledger with no model in the loop, and exit 2 means fail closed.

#!/usr/bin/env python3
"""Proposal: refuse contract-phase SQL that an assistant claims to own.

Unexecuted example. Stdlib only. Exit 0 means a later apply job may
read the ledger without any model. Exit 2 means fail closed.
"""

from __future__ import annotations

import json
import sys
from pathlib import Path

CONTRACT_MARKERS = (
    'drop column',
    'drop table',
    'drop constraint',
    'alter column',
    'set not null',
    'rename column',
)

def normalize(sql: str) -> str:
    return ' '.join(sql.lower().split())

def is_contract(sql: str) -> bool:
    text = normalize(sql)
    return any(marker in text for marker in CONTRACT_MARKERS)

def evaluate(plan: dict) -> list[str]:
    errors: list[str] = []
    steps = plan.get('steps', [])
    phases = [step.get('phase') for step in steps]
    if phases.count('expand') < 1 or phases.count('contract') < 1:
        errors.append('plan must split expand and contract into separate steps')
    if 'backfill' not in phases:
        errors.append('plan has no backfill step between expand and contract')
    seen_expand = False
    for index, step in enumerate(steps):
        phase = step.get('phase')
        owner = step.get('owner')
        sql = step.get('sql', '')
        blob = json.dumps(step).lower()
        if phase == 'expand':
            seen_expand = True
        if owner == 'assistant':
            errors.append(
                f'step {index} is assistant-owned; ledger steps must be human-owned'
            )
        if phase == 'contract' and not seen_expand:
            errors.append(f'step {index} contracts before any expand')
        if phase != 'contract' and is_contract(sql):
            errors.append(
                f'step {index} hides contract SQL outside the contract phase'
            )
        if phase == 'contract' and step.get('apply') != 'ci-primary':
            errors.append(
                f'step {index} must apply on ci-primary, not on a model host'
            )
        if 'dsn' in step or 'password' in blob or 'secret' in blob:
            errors.append(f'step {index} carries a credential field')
    return errors

def main(argv: list[str]) -> int:
    if len(argv) != 2:
        print('usage: cutover_gate.py plan.json', file=sys.stderr)
        return 2
    plan = json.loads(Path(argv[1]).read_text())
    errors = evaluate(plan)
    if errors:
        for err in errors:
            print(f'refuse: {err}')
        return 2
    print('accept: contract phase is local, human-owned, and ordered')
    return 0

if __name__ == '__main__':
    sys.exit(main(sys.argv))

A hostile fixture should trip that proposal. The assistant owns the contract step, the apply target is a model host, and no backfill sits between expand and contract.

{
  "steps": [
    {
      "phase": "expand",
      "owner": "human",
      "apply": "ci-primary",
      "sql": "alter table orders add column total_cents bigint"
    },
    {
      "phase": "contract",
      "owner": "assistant",
      "apply": "model-host",
      "sql": "alter table orders drop column total"
    }
  ]
}

Read off the branches, the expected result of this unexecuted proposal is a refusal and exit code 2, and any one of those three defects is enough. A clean plan inverts them: every step is human-owned, contract applies on ci-primary, and a backfill step separates the schema phases. The accept line still does not execute SQL; it only tells CI that a separate job may read the file.

Commands stay on the workstation or in CI. They do not take a production URL, and they do not call an inference API.

python3 -m py_compile cutover_gate.py
python3 cutover_gate.py fixtures/assistant_owns_contract.json
echo "gate_exit=$?"
sha256sum migrations/0042_contract.sql | tee contract.sha256

Evidence for the backfill is a query saved beside the tag, not a paragraph in a chat log. The migration role runs it, and the assistant never sees the connection string.

psql "$MIGRATE_URL" -v ON_ERROR_STOP=1 -c "select count(*) from orders where total_cents is null;"

The apply step comes later, and only after the gate has exited 0 and a reviewer has signed the tag. The URL belongs in the CI secret store.

psql "$MIGRATE_URL" -v ON_ERROR_STOP=1 -f migrations/0042_contract.sql

That URL does not belong in a chat transcript, in a free-server image baked for a demo, or in a log line an assistant is later asked to summarize. If the rehearsal host disappears overnight, the checksum file in git is still the source of truth.

How the rehearsal actually runs

The workflow is a sequence of local artifacts, not a chat. The plan file and the SQL land in git, the gate refuses the hostile fixture, and a checksum is stored beside the contract file. Only after that does CI, using a secret the assistant never receives, run the null-count query and, on a signed tag, apply the contract file. A free server can repeat the gate and the fixture for a teammate who has no database role; it never becomes the place the apply job lives.

When to walk away

The free path is finished as soon as the model emits a statement the gate classifies as contract. It is also finished when the prompt would need a DSN to be more helpful, when the free server holds the only copy of the migration files, or when the deploy cannot complete while the assistant is rate-limited, revoked, or simply not called. A backfill count that arrives as prose belongs to the same exit. The query replaces the completion, and the completion is not retried.

Some teams should not pick up the gate at all. A solo prototype with no production data does not need the ceremony, and adding it is theater. A group that wants a model to generate and apply destructive SQL will fight the markers on every merge, and weakening those markers until the script always accepts is worse than skipping it. A regulated change process that needs a validated evidence pack should keep the assistant out of the record, because retention, region, and logging on a free tier are product settings, not an audit exhibit.

The marker list is narrow on purpose. It will miss clever SQL, dynamic SQL, and syntax that does not resemble the six substrings, and it will also false-positive on a comment that merely mentions a drop. MySQL and online schema-change tools do not share PostgreSQL's transactional DDL habits, so a green run on one engine proves nothing about another. Linters in the strong-migrations family already refuse many destructive statements inside application repos, and that class of check remains the authority; an assistant may only translate a lint failure into a comment, and if the free assistant is busy or gone, the comment is skipped.

Expand notes can be drafted wherever a free model is convenient. The old column is cut only from a human-owned file that CI can apply with the assistant powered off. Readers who already keep a spare server and a free model nearby can point them at the hostile fixture and keep the session that returns a refusal; that rehearsal is the only use this boundary has for the free path.

The Merge Bit Stays With the Owner

Casey Li — Thu, 08 Oct 2026 08:21:10 +0000

Protected paths do not become optional when a contribution surge arrives. A free model can draft a note about a diff. It cannot own the merge bit, dismiss a scanner, or stand in for the human named in CODEOWNERS.

Early October usually thickens the inbound queue. Recent community posts have been full of contribution-drive writeups, portfolio projects, and agent-shaped tooling, which is enough to expect more pull requests and more automated reviewers. Volume is not a reason to move a security decision onto a shared completion endpoint. The clerk can sort the mail. The clerk does not sign the deed.

This piece is a field guide for that refusal. It is not a product tour, and it is not a repeat of the older argument about runtime privilege grants. A grant decides what a process may do after deploy. A merge bit decides what enters the tree that deploy is built from. Those failures rhyme, and they still need different locks. The slide is familiar: a workflow that starts as "summarize this diff" later gains a label, then a status check, then a merge. Free inference makes the slide easier, because the call looks cheap and the server looks disposable. Cheap is not the same as accountable.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode's free model access and free server option belong only on the drafting side of the workflow below. They can host a local gate and produce an unsigned summary of an unprotected diff. They are not a branch-protection provider, a signing service, or a substitute for the repository owner. This article does not state model names, quotas, hardware, duration, or data-retention terms. Those facts change, and they belong on a current product page rather than in a recycled paragraph. If the page and this article disagree, the page wins.

The analogy that holds is a notary stamp left on a hotel desk. Guests may borrow the pen. They may not borrow the stamp. A completion model is the pen. The stamp is branch protection, a required review from a named owner, and a deterministic check that does not read prose. A free server is a desk the pen can sit on. It does not become the notary because the desk was complimentary.

Consider a small service repository under a surge of first-time patches. Auth handlers live under auth/. Payment callbacks live under billing/. Workflow files live under .github/workflows/. Lockfiles and CODEOWNERS sit at the root. A documentation typo in docs/ can survive a machine summary, and a test rename in tests/ often can too. A one-line change in auth/session.go cannot, even when the summary sounds calm and even when the author is trying to be helpful during a public contribution week. The path is the fact. The adjective in the model output is not.

The original artifact is a local gate. It is a proposal, not a result from a run on this account, and it is not a benchmark. It refuses to treat model text as approval, and it fails closed when a protected path appears. Pair it with branch protection so the script is a preview for humans, not the only lock on the repository. The file list must come from git or from the forge API. A file list written by the model makes the gate circular.

#!/usr/bin/env python3
"""Proposal: local merge gate. Unexecuted example, not a measured run."""

from __future__ import annotations

import json
import sys

PROTECTED_PREFIXES = (
    "auth/",
    "billing/",
    "secrets/",
    ".github/workflows/",
)

PROTECTED_EXACT = {
    "CODEOWNERS",
    "go.sum",
    "package-lock.json",
    "pnpm-lock.yaml",
}

ALLOWED_MODEL_LABELS = {"summary_only", "needs_human"}


def protected_hits(files: list[str]) -> list[str]:
    hits: list[str] = []
    for path in files:
        normalized = path.strip().lstrip("./")
        if normalized in PROTECTED_EXACT or any(
            normalized.startswith(prefix) for prefix in PROTECTED_PREFIXES
        ):
            hits.append(normalized)
    return hits


def decide(files: list[str], model_label: str) -> dict:
    hits = protected_hits(files)
    if hits:
        return {
            "action": "human_owner_required",
            "hits": hits,
            "model_label_ignored": True,
        }
    if model_label not in ALLOWED_MODEL_LABELS:
        return {
            "action": "reject_model_as_approval",
            "hits": [],
            "model_label_ignored": True,
        }
    return {
        "action": "draft_comment_allowed",
        "hits": [],
        "model_label_ignored": False,
    }


def main() -> int:
    payload = json.load(sys.stdin)
    result = decide(payload.get("files", []), payload.get("model_label", ""))
    json.dump(result, sys.stdout)
    sys.stdout.write("\n")
    return 0 if result["action"] != "reject_model_as_approval" else 2


if __name__ == "__main__":
    raise SystemExit(main())

A maintainer can exercise the proposal with three fixtures before anyone wires it to a bot. The first fixture lists only docs/readme.md and a label of summary_only, and the expected action is draft_comment_allowed. The second lists auth/session.go with a label of approve, and the expected action is human_owner_required, with the model label ignored. The third lists docs/readme.md with a label of approve, and the expected action is reject_model_as_approval, with exit code 2. Those three cases are the regression suite. If a later edit makes the third case pass, the gate has started trusting prose, and the edit should be reverted rather than celebrated.

# Proposal commands. Run them locally; this draft does not report output.
printf '%s\n' '{"files":["docs/readme.md"],"model_label":"summary_only"}' | python3 merge_gate.py
printf '%s\n' '{"files":["auth/session.go"],"model_label":"approve"}' | python3 merge_gate.py
printf '%s\n' '{"files":["docs/readme.md"],"model_label":"approve"}' | python3 merge_gate.py

The debugging workflow starts from the merge-base, not from a chat transcript. Fetch the base branch, write the name-only diff to a file, and feed that file to the gate with a closed label. If the forge UI shows a different set of paths, trust neither the model nor a stale status check. Recompute. If the action is human_owner_required, assign the owner and stop. Re-prompting the model with a request to ignore the path is the failure the gate exists to catch.

git fetch origin main
git diff --name-only origin/main...HEAD > /tmp/files.txt
python3 - <<'PY' | python3 merge_gate.py
import json
files = [line.strip() for line in open("/tmp/files.txt") if line.strip()]
print(json.dumps({"files": files, "model_label": "summary_only"}))
PY

Prefix matching is a blunt instrument, and that bluntness is a limitation rather than a hidden strength. A copy of session logic dropped into pkg/util/session_copy.go will not hit auth/. A rename that deletes auth/session.go and adds the same bytes under internal/legacy/session.go can also slip past a naive prefix list. Generated clients, submodules, and patch files that contain a second diff are further misses. The correct response to a miss is a wider owner rule and a human read, not a question to the model about whether the miss "seems fine." The script also does nothing about secrets pasted into the prompt itself. A summary call that receives the full diff can still leak a token into a log on a shared free tier. Strip secrets before any drafting call, or do not send the diff at all.

Red flags show up as workflow shape. A job that holds a token able to merge is already past the line, whatever the prompt says about being careful. A step that asks a model to reinterpret a secret-scan hit is the same failure in a softer voice. A protected-path list that the model is allowed to edit is a stamp that can reprint itself. A review template whose only success string is APPROVE is a stamp with a shorter handle. Latency hiding inside a required check is another flag: when the free call stalls, people bypass the check, and the bypass becomes the process. So does a dashboard that counts model approvals as review coverage. The count will look healthy during a contribution week, and the tree will not be.

Better alternatives are older than chat completions, which is their virtue. CODEOWNERS plus branch protection keeps auth/, billing/, workflows, and lockfiles with named humans. Secret scanning should fail closed, with a waiver path that is a committed, reviewed file, not a sentence in a model reply. Deterministic tests, license checks, and lockfile diffs can be required status checks, because they return the same answer on Tuesday and on Saturday. The model, if used at all, writes an unsigned comment on unprotected docs or tests, and the comment is stored as a suggestion. The forge token stays in the forge's own secret store, scoped so it cannot merge. A free server option is a reasonable place to run the gate script, because the script's inputs are file names and a closed label set. It is a poor place to keep that token, and a poor place to store the only copy of the owner map.

Exit criteria are practical, and they should be written down before the surge, not during it. Stop this split the moment model text is copied into a review approval, a scanner dismissal, or a release note that claims a human signed off. Stop if the checker and the host disagree on the file list for more than a single stale run. Stop if queue time on the free option breaks the review SLA often enough that people route around it. Stop if current terms, capacity, or data-handling notes no longer match what the team assumed; this article cannot refresh those terms, and it never stated a quota that could be treated as a promise. Stop if a single maintainer would treat a green draft_comment_allowed as permission to skip reading the diff. The script never granted that permission. Stop, too, if the same assistant is later asked to reserve an advisory, publish a patch, or decide that a report is in or out of embargo. That is a different decision, and it does not become safe just because the merge gate was narrow.

Some teams should not use the approach at all. A compliance program that needs an attestation of who approved a change will not get that attestation from a free completion call, however tidy the JSON looks. A solo maintainer who wants a model to "just handle the October queue" is the reader most likely to skip the owner bit, and the surge is exactly when that skip is expensive. Repositories that mix production signing keys into the same tree as docs should fix the tree layout before they add any model. Agents that open pull requests may read the gate's JSON. They may not treat a missing hit as a merge, and they may not be given a credential that could do so.

The narrow lane is still available for teams that want a drafting assistant during a noisy week. Confirm the present limits and data terms, then keep the assistant on unsigned summaries and keep the checker on file names. Readers who want to try that lane on the free model access and free server option mentioned above should look those terms up before attaching any repository credential.

Contribution volume can justify a drafting assistant. It never justifies handing the merge bit to a free model, a free server, or a paragraph that sounds sure of itself. The stamp goes back in the drawer. The pen can stay on the desk.

Seal the Canary Bit Before the Note

Casey Li — Thu, 24 Sep 2026 21:50:55 +0000

A free model may explain a canary. It must not own the abort bit. That bit is a control-plane fact, closer to a fuse than to a paragraph, and a completion is a poor fuse.

When the sample is thin, the honest result is hold. When burn or latency crosses a pre-registered line, the honest result is abort. Neither outcome should wait on a prompt.

The mix-up is easy to ship. Editor agents and in-browser tools have made an ask-the-model step feel like a local function call, and that local feeling gets mistaken for an authority model. A deploy controller is not a chat transcript. If the completion times out, rate-limits, or rewrites a cautious hold into a confident promote, the rollout inherits the failure.

Picture a scribe in a noisy room rather than the person holding the cutoff switch. The scribe can turn a terse verdict into a note the next on-call can read without opening a dashboard. Give that scribe the switch, and a dry pen or a loud room becomes an outage.

Recent developer conversation has collided on this exact gate. An agent that stays near the editor does not become release authority by proximity. Tidy prompt prose is not clearer than a named threshold with a citation. The audit target is the diff, not the chat scrollback.

The smells are concrete. A job that fails closed only when the completion errors has already tied release availability to a writing tool. A prompt line that allows an override of hold when the model feels confident is unreviewed policy stored in a string. A controller that scrapes a markdown heading and treats the heading as the verdict has turned prose into a protocol.

Mounting the note-drafting credential on the deploy runner means a hostile log line can point toward the cluster. Any one of those smells is reason enough to move narrative generation off the release host.

A better shape is a small gate with a boring contract. Numbers go in, and an enum comes out. The enum lands in a file the controller already knows how to read. A later note may quote that enum, and it may not edit it.

The numbers in the proposal are a shape, not recommended production values. A team takes burn limits and latency budgets from its own SLO document, in the spirit of error-budget practice described in the SRE book at https://sre.google/sre-book/embracing-risk/. Those limits should be reviewed the same way any other policy is reviewed.

Walk one sample through before trusting the shape. A window of 2,000 requests with burn at 3.1 against a pre-registered abort of 2.0 aborts on burn alone, even if latency looks calm. Twelve requests and a perfect error ratio hold, because silence is not evidence. A window inside the error budget but over the p95 budget aborts on latency, so a green error chart cannot launder a slow canary.

Language never gets a vote in those three paths. The question of whether a spike looks like noise has no stable answer at two in the morning and no unit test.

# Proposal only. This module was not executed for this article.
from dataclasses import dataclass
from enum import Enum

class Verdict(str, Enum):
    PROMOTE = "promote"
    HOLD = "hold"
    ABORT = "abort"

@dataclass(frozen=True)
class CanarySample:
    error_ratio: float
    baseline_error_ratio: float
    p95_ms: float
    p95_budget_ms: float
    min_requests: int
    observed_requests: int
    burn_rate: float
    burn_abort: float

def decide(sample: CanarySample) -> Verdict:
    """Control-plane verdict. Do not call a model from this function."""
    if sample.observed_requests < sample.min_requests:
        return Verdict.HOLD
    if sample.burn_rate >= sample.burn_abort:
        return Verdict.ABORT
    if sample.p95_ms > sample.p95_budget_ms:
        return Verdict.ABORT
    # Floor keeps a tiny baseline from aborting on ordinary noise.
    floor = max(0.01, sample.baseline_error_ratio * 1.5)
    if sample.error_ratio > floor:
        return Verdict.ABORT
    return Verdict.PROMOTE

def render_note(verdict: Verdict, sample: CanarySample) -> str:
    """Context for humans. Callers must not parse this string."""
    return (
        f"verdict={verdict.value} "
        f"requests={sample.observed_requests}/{sample.min_requests} "
        f"burn={sample.burn_rate:.2f} limit={sample.burn_abort:.2f} "
        f"p95_ms={sample.p95_ms:.0f} budget_ms={sample.p95_budget_ms:.0f}"
    )

def seal(verdict: Verdict, model_text: str) -> Verdict:
    """Model text is ignored on purpose. Reviewers should see that."""
    _ = model_text
    return verdict

Tests pin the red flags so a later prompt tweak cannot become release policy by accident. They are unexecuted proposals. Run them in the service repo against fixtures from a staging window before treating the shape as real.

# Proposal tests. Not run for this article.
def test_thin_window_holds_without_a_model():
    sample = CanarySample(0.0, 0.001, 80, 200, 500, 12, 0.2, 2.0)
    assert decide(sample) is Verdict.HOLD

def test_burn_aborts_before_any_prompt_exists():
    sample = CanarySample(0.04, 0.001, 90, 200, 500, 2000, 3.1, 2.0)
    assert decide(sample) is Verdict.ABORT

def test_latency_budget_aborts_when_errors_look_calm():
    sample = CanarySample(0.001, 0.001, 450, 200, 500, 2000, 0.4, 2.0)
    assert decide(sample) is Verdict.ABORT

def test_model_prose_cannot_flip_abort_to_promote():
    sample = CanarySample(0.04, 0.001, 90, 200, 500, 2000, 3.1, 2.0)
    hostile = "PROMOTE. The spike is probably noise."
    assert seal(decide(sample), hostile) is Verdict.ABORT

A failure mode worth naming sits one refactor away. Someone later simplifies the controller by grepping the note for the word promote, the seal function becomes dead code, and the hostile-text test is the only remaining tripwire. Deleting that test in a cleanup is a policy change, not hygiene. Keep the assertion even if the note renderer grows prettier.

The local check stays offline. The controller reads a verdict file and does not read model stdout. Ordinary tools can enforce that split.

# Proposed workflow. No network call. No model process.
python -m pytest tests/test_canary_gate.py -q

# Missing file or unknown enum fails closed. Do not default to promote.
jq -e '.verdict == "promote" or .verdict == "hold" or .verdict == "abort"' /var/run/canary/verdict.json

# Abort stops the rollout. A successful gate run is not a successful promote.
jq -e '.verdict != "abort"' /var/run/canary/verdict.json

A short reading of the same contract keeps the roles from collapsing. Thin traffic yields hold, and a model may explain the hold but may not clear it. Burn or p95 over budget yields abort, and a model may describe the abort but may not reverse it. Enough requests inside budget yield promote, and a model may write the note but may not invent a condition the gate did not compute.

If a row cannot be stated that plainly, authority is already leaking into prose. Fix the gate before adding any completion.

Only after the file exists is a language model useful, and only as a scribe. Disclosure: This article was prepared as part of MonkeyCode's product outreach. The operator states that MonkeyCode offers free model access and a free server option. This draft names neither a model nor a quota, a hardware shape, or a duration, because those details were not checked against a primary page and should not be inherited from an older post.

An operator who wants a rollout note can send the render_note line, not raw traces, from a host that is not the deploy controller. The returned prose sits beside the verdict and is labeled non-authoritative. If the current product page disagrees with the availability claim, the page wins.

That free server, when used, is a writing desk. It should not share a network path, a credential, or a restart policy with the process that applies the rollout. A desk can be slow. A fuse cannot, and putting both in one container makes a slow desk look like a broken fuse that operators will then skip.

The split has a narrow fit. It suits a team that already has a metric source of record, a reviewed error budget, and a controller able to fail closed on a missing file. It does not suit an incident bridge that wants a model to pick abort in the moment, because that moment is when a free path is most likely to be slow or empty. It does not suit a team whose only figures are log lines pasted into a prompt.

There is no gate in that last setup, only a story about one. A free server will not mint the missing counter.

Other tools already cover the decision without a completion. An error-budget burn alert, registered in the same repo as the service, can be the abort source. A latency budget checked by the existing probe can be the second source. Ambiguous holds go to a human with the sample attached, not to another prompt asked to be sure.

The model, if used at all, stays on a documentation path and explains a verdict that has already landed. It does not sit in the promote command.

Exit belongs in the design. Stop the free-path notes when people paste them into runbooks as root cause without an edit. Stop if that server shares a failure domain with the deploy controller, since a scribe outage must not look like a fuse outage. Stop if the prompt grows secrets, customer payloads, or unredacted traces.

Leave the pattern when written thresholds drift from the SLO document. Leave it when model-written causes start being copied into the verdict file. Read the provider's current terms again before assuming yesterday's free access still describes today's path.

Clearer code beats a clever prompt on this path. A named field such as burn_abort can carry a one-line comment that cites the SLO page, and that comment earns its place because the number is non-obvious. A paragraph that says to use judgment cannot be diffed, cannot be unit-tested, and cannot fail closed. The canary bit stays in the enum, and the note stays in the margin.

Operators who already seal the verdict before a completion exists can draft that margin note on the free path, after reading the live terms. Confidence in the note is not a signal, and it should never be wired back into jq.

Dead-Letter Replay Does Not Belong on Free Inference

Casey Li — Wed, 23 Sep 2026 17:21:12 +0000

Live replay of a dead-letter message is a control-plane act. Free inference should not own it.

A dead-letter queue is not a suggestion box. It is a holding pen for work that already failed, often after a side effect has been attempted. Replay means the consumer will call a payment API, emit a webhook, mutate inventory, or send mail again. The payload may be poison. It may be a duplicate of a request that already committed. It may be a timeout whose remote party succeeded while the local waiter expired. Those cases do not share a prompt. They share a contract, and the contract has to survive a model outage.

Teams reach for a chat completion because the dump looks linguistic. Error strings wander. Partner codes collide. A model can cluster the mess into a tidy story. That clustering is useful on a desk. It is a poor runtime for a switch that re-enters the world.

Think of the DLQ as a loaded elevator. Classification is the inspection tag on the door. Replay is the button that sends the car. Handing the button to a volunteer intern with a sticky note is the free-inference pattern: cheap, fluent, and unbound to the interlock.

The failure mode is not only a wrong label. Free inference is a best-effort path. It can stall, rate-limit, or answer with a different JSON shape than yesterday. A consumer that blocks on that path turns a message bus into a chat session. A consumer that proceeds on timeout turns a maybe into a charge. Neither is an SLO.

A replay gate belongs in deterministic code next to the consumer. The gate reads durable fields: topic, error class, attempt count, idempotency key, and a human-committed policy table. It returns one of three verbs. never parks the message for a ticket. replay_once requeues with a fresh attempt counter and the same key. hold waits for an operator. The model, if it appears at all, writes a proposal file. It does not call the broker.

The artifact below is that gate. It is ordinary Python. It is meant to be copied into a worker repo and tested without a network.

# replay_gate.py
from dataclasses import dataclass
from enum import Enum
from typing import Mapping, Optional, Tuple

class Verb(str, Enum):
    NEVER = "never"
    REPLAY_ONCE = "replay_once"
    HOLD = "hold"

@dataclass(frozen=True)
class DeadLetter:
    topic: str
    error_class: str
    attempts: int
    idempotency_key: str
    body_hash: str
    already_committed: bool

PolicyKey = Tuple[str, str]
POLICY: Mapping[PolicyKey, Verb] = {
    ("payment.capture", "timeout"): Verb.REPLAY_ONCE,
    ("payment.capture", "insufficient_funds"): Verb.NEVER,
    ("payment.capture", "duplicate"): Verb.NEVER,
    ("inventory.reserve", "lock_timeout"): Verb.REPLAY_ONCE,
    ("inventory.reserve", "overbook"): Verb.NEVER,
    ("webhook.partner", "http_503"): Verb.REPLAY_ONCE,
    ("webhook.partner", "http_400"): Verb.NEVER,
    ("mail.receipt", "smtp_421"): Verb.REPLAY_ONCE,
    ("mail.receipt", "unknown_recipient"): Verb.NEVER,
}

MAX_ATTEMPTS = 3

def decide(letter: DeadLetter, policy: Mapping[PolicyKey, Verb] = POLICY) -> Verb:
    if not letter.idempotency_key:
        return Verb.HOLD
    if letter.already_committed:
        return Verb.NEVER
    if letter.attempts >= MAX_ATTEMPTS:
        return Verb.HOLD
    verb = policy.get((letter.topic, letter.error_class))
    if verb is None:
        return Verb.HOLD
    return verb

def apply(letter: DeadLetter, broker, audit) -> Verb:
    verb = decide(letter)
    audit.record(letter.body_hash, verb.value)
    if verb is Verb.REPLAY_ONCE:
        broker.requeue(letter, extra_headers={"x-replay": "1"})
    return verb

The unknown row is the whole point. A missing (topic, error_class) pair does not become a prompt. It becomes hold. That is how a new partner code fails closed instead of becoming a creative retry. The already_committed bit is equally blunt. If the outbox, the payment ledger, or the partner receipt says the work landed, replay is vandalism dressed as healing.

Tests pin the verbs. They do not pin a temperature.

# test_replay_gate.py
from replay_gate import DeadLetter, Verb, decide

def letter(**kwargs):
    base = dict(
        topic="payment.capture",
        error_class="timeout",
        attempts=1,
        idempotency_key="cap_9f3a",
        body_hash="sha256:abc",
        already_committed=False,
    )
    base.update(kwargs)
    return DeadLetter(**base)

def test_timeout_replays_once():
    assert decide(letter()) is Verb.REPLAY_ONCE

def test_committed_work_never_replays():
    assert decide(letter(already_committed=True)) is Verb.NEVER

def test_unknown_error_holds():
    assert decide(letter(error_class="weird_partner_code")) is Verb.HOLD

def test_missing_idempotency_key_holds():
    assert decide(letter(idempotency_key="")) is Verb.HOLD

def test_insufficient_funds_never_replays():
    assert decide(letter(error_class="insufficient_funds")) is Verb.NEVER

Run them with python -m pytest test_replay_gate.py -q. The suite is the oracle. A model that restates the same rules in prose is commentary, not control.

Free inference still has a desk job. Unstructured DLQ dumps are noisy, and a first pass that clusters raw error strings into candidate (topic, error_class) rows can save an afternoon. Disclosure: This article was prepared as part of MonkeyCode's product outreach. A workspace with free model access and a free server option can sit beside those dumps, emit a proposed policy patch, and stop there. The patch lands in review like any other config change. The consumer never calls the model on the hot path.

That rehearsal looks like a file, not a tool call inside apply.

# propose_policy.py — offline sketch, not a worker dependency
# Label as unexecuted until a human copies rows into POLICY.
PROPOSAL_SCHEMA = {
    "type": "object",
    "required": ["topic", "error_class", "verb", "rationale"],
    "properties": {
        "topic": {"type": "string"},
        "error_class": {"type": "string"},
        "verb": {"enum": ["never", "replay_once", "hold"]},
        "rationale": {"type": "string"},
    },
}

def write_proposal(path, rows):
    # Persist proposals for review. Do not import this module from the consumer.
    import json
    from pathlib import Path
    Path(path).write_text(json.dumps(rows, indent=2), encoding="utf-8")

Red flags show up before the first wrong charge. The consumer imports an SDK in the same process that acknowledges Kafka or SQS. Replay waits on a completion token. Two identical payloads, five minutes apart, receive two verbs. The policy lives only in a system prompt. The audit log stores the model's paragraph and not the verb. Any one of those is enough to pull the model out of the loop.

Better alternatives are boring on purpose. Map partner error codes at the edge. Persist an idempotency key before the first attempt, not after the failure. Record already_committed from the ledger, not from a summary of logs. Cap attempts in the broker. Put unknown classes on hold and page a human. If the dump is truly unstructured, run the clusterer on a sample in a scratch environment, then type the surviving rows into POLICY.

Exit criteria belong next to the policy, not in a runbook nobody opens. Stop using even the offline proposer when the same payload yields two different verbs across sessions. Stop when proposal latency exceeds the time a reviewer would spend reading twenty raw lines. Stop when the topic moves money, identity, or medical data through a third party that is not under the team's data agreement. Stop when the DLQ volume is a load test in disguise: a replay storm is a traffic generator, and a chat API is not a traffic shaper.

Who should not use this approach is as important as the gate. A team without idempotency keys should not replay at all, with or without a model. A team whose ledger cannot answer already_committed should park every payment topic on hold. A team that needs sub-second classification under partition loss should not add a network hop that is allowed to vanish. A regulated workload that cannot put payloads on a shared free endpoint should keep the dumps inside the boundary and type the table by hand.

Limitations of the gate itself are real. The table lags a new partner. error_class is only as good as the parser that produces it. MAX_ATTEMPTS does not know about downstream quotas. HOLD can hide a growing pile if nobody pages. The design accepts those limits because they are visible. A fluent paragraph is not visible in the same way. It fails like weather.

The current wave of agent demos makes the anti-pattern tempting. Tool calling looks like a universal adapter: feed the DLQ body in, get a verb out, let the agent requeue. That adapter is a completion. Completions are not leases, not locks, and not ledgers. They are a way to draft the table that the lease, the lock, and the ledger already require.

A free model and a free server are enough to rehearse that table against fixtures. They are not a substitute for the switch. Keep the intern at the desk. Keep the elevator button in code.

Incident Severity Does Not Belong on Free Inference

Casey Li — Tue, 22 Sep 2026 15:34:04 +0000

Production paging is a control plane. Free inference is a best-effort text service. Those two jobs do not share a fate, and the mismatch shows up only after a quiet night that should not have been quiet.

Severity, rotation, and silence belong in deterministic policy. A model may help a human write the timeline after the page has already fired. It must not choose whether the page fires.

The temptation is obvious. Alert text is messy. Dashboards disagree. On-call wants a sentence that says P1 or P3. A chat completion looks like a judge. It is not a judge. It is a narrator with variable latency, no fencing token, and no duty to stay within the enumerated severities the runbook actually supports.

Think of the pager as a fuse box. A fuse opens on current, not on a paragraph about current. Free inference is a whiteboard in a side room. Useful after the circuit is already open. Dangerous as the metal strip that is supposed to melt.

Red flags in the paging path

The first red flag is a hop from unstructured logs to a page that only exists if a model returns a label. That hop hides a second failure mode: the model can stall, refuse, or answer in prose. MTTA then includes token generation. The clock that matters to a customer does not.

The second red flag is letting the model invent a severity the policy file does not name. SEV1, SEV2, SEV3, and SEVNONE are a closed set. "Looks degraded but maybe regional" is not a member of that set. A narrator will happily mint a fifth state. A fuse cannot.

The third red flag is using free inference as a tie-breaker when two signals conflict. Conflict is a reason to page the humans who own the service, not a reason to ask a remote completion which signal "feels" louder. Ambiguity is itself a SEV2 in many shops. Pretending it is a language problem does not make it smaller.

The fourth red flag is feeding the model customer content, auth headers, or raw exception payloads so it can "understand impact." Impact should already be a boolean or a counter from the edge. If the estate cannot compute customer_facing_5xx without a paragraph, the estate is not ready for an LLM in the path. It is ready for better instrumentation.

None of this forbids language models nearby. It forbids them as the authority that maps telemetry to who wakes up.

A local oracle that does not chat

The artifact below is a closed policy. It reads structured signals only. Unknown keys fail closed. Tests pin the mapping. This is a proposal for a local gate, not a claim about any particular outage.

# severity_policy.py
from __future__ import annotations

from dataclasses import dataclass
from enum import Enum

class Severity(str, Enum):
    SEV1 = "SEV1"
    SEV2 = "SEV2"
    SEV3 = "SEV3"
    SEVNONE = "SEVNONE"

ALLOWED = frozenset(s.value for s in Severity)

@dataclass(frozen=True)
class Signals:
    heartbeat_lost_s: int
    edge_5xx_ratio: float
    customer_facing: bool
    burn_rate_1h: float
    manual_override: str | None = None

class PolicyError(ValueError):
    pass

def decide(signals: Signals) -> Severity:
    if signals.manual_override is not None:
        if signals.manual_override not in ALLOWED:
            raise PolicyError(f"unknown override {signals.manual_override!r}")
        return Severity(signals.manual_override)

    if signals.heartbeat_lost_s < 0 or signals.edge_5xx_ratio < 0 or signals.burn_rate_1h < 0:
        raise PolicyError("signals must be non-negative")

    if signals.customer_facing and (
        signals.heartbeat_lost_s >= 60 or signals.edge_5xx_ratio >= 0.05
    ):
        return Severity.SEV1

    if signals.burn_rate_1h >= 14.4 or signals.edge_5xx_ratio >= 0.02:
        return Severity.SEV2

    if signals.heartbeat_lost_s >= 20 or signals.edge_5xx_ratio >= 0.005:
        return Severity.SEV3

    return Severity.SEVNONE

The numbers are placeholders a team must replace with its own SLO math. The shape is the point. Heartbeat loss and edge error ratio are facts. Burn rate is a fact if the SLO library already computed it. None of those facts require a completion API.

# test_severity_policy.py
from severity_policy import PolicyError, Severity, Signals, decide
import pytest

def test_customer_facing_heartbeat_is_sev1():
    s = Signals(heartbeat_lost_s=60, edge_5xx_ratio=0.0, customer_facing=True, burn_rate_1h=1.0)
    assert decide(s) is Severity.SEV1

def test_high_burn_is_sev2_without_chat():
    s = Signals(heartbeat_lost_s=0, edge_5xx_ratio=0.0, customer_facing=False, burn_rate_1h=14.4)
    assert decide(s) is Severity.SEV2

def test_unknown_override_fails_closed():
    s = Signals(
        heartbeat_lost_s=0,
        edge_5xx_ratio=0.0,
        customer_facing=False,
        burn_rate_1h=0.0,
        manual_override="looks-ok-ish",
    )
    with pytest.raises(PolicyError):
        decide(s)

def test_negative_signal_is_not_a_prompt():
    s = Signals(heartbeat_lost_s=-1, edge_5xx_ratio=0.0, customer_facing=False, burn_rate_1h=0.0)
    with pytest.raises(PolicyError):
        decide(s)

Run the pins before wiring the function to any notifier.

python -m pytest test_severity_policy.py -q

A notifier should accept only Severity members. If a future refactor wraps decide() with a model "second opinion," the tests above will still pass while production quietly waits on a socket. Guard that with an explicit ban in the caller.

# page.py
FORBIDDEN_IMPORTS = ("openai", "anthropic", "litellm")

def assert_no_inference_in_paging_path(source: str) -> None:
    lowered = source.lower()
    for name in FORBIDDEN_IMPORTS:
        if name in lowered:
            raise RuntimeError(f"paging path imports {name}; severity must stay local")

That check is crude. It is also honest. Import graphs lie less often than prompt templates.

Where a free model is allowed to stand

After the incident is sealed, a narrator is useful. The page already happened. Severity is already in the ticket. The remaining job is a draft humans will edit: timeline, systems touched, open questions. That draft can miss a sentence without missing a pager.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode's free model access and free server option are relevant only for that sealed, after-the-fact draft. They are operator-supplied availability claims, not a paging backend, not an SLO, and not a substitute for the policy file above.

A safe split looks like this. The worker that pages never opens an inference client. A second worker, triggered only when incident.state == "sealed", may send a redacted timeline. Redaction happens before the prompt, with the same closed-set discipline.

# draft_timeline.py
ALLOWED_STATES = frozenset({"sealed"})

def build_draft_payload(incident: dict) -> dict:
    if incident.get("state") not in ALLOWED_STATES:
        raise RuntimeError("refuse to draft while paging is still live")
    return {
        "severity": incident["severity"],  # already decided
        "started_at": incident["started_at"],
        "ended_at": incident["ended_at"],
        "systems": incident.get("systems", []),
        "notes": incident.get("public_notes", ""),
    }

If a team wants to try that second worker in a free coding environment, that is a documentation chore. It is not on-call infrastructure. Keep the two codepaths in different deployables so a prompt change cannot ride along with a threshold change.

Better alternatives than a chat completion

Structured SLO burn from the metrics backend already answers "is this fast enough to wake someone." Customer-facing probes already answer "can a user complete the money path." Heartbeats already answer "is the process alive." Combining those with a small policy module is boring. Boring is the correct texture for a fuse.

When signals conflict, page at the higher severity and let a human downgrade. Downgrades are cheap compared with a missed SEV1. Manual override remains in the policy, as a closed enum, because humans also hallucinate, but they do it on a recorded bridge.

When the estate lacks those signals, the work is instrumentation, not prompt design. A model will not invent a trustworthy edge_5xx_ratio from a pile of stack traces. It will produce a confident paragraph. Confidence is not a counter.

Exit criteria

Leave the free-inference paging experiment when any of these become true. A page is delayed by model latency or rate limits. A completion returns a severity string the policy file cannot parse. On-call cannot explain a decision without pasting a prompt. Customer data entered a vendor log to "improve classification." A silent failure in the model path equals a silent production failure.

Exit is mechanical. Remove the client from the paging deployable. Restore decide() as the only mapper. Keep the draft worker if it still helps, behind the sealed gate. If the draft worker cannot prove that gate in a test, delete the worker too.

def test_draft_refuses_live_incident():
    from draft_timeline import build_draft_payload
    import pytest
    with pytest.raises(RuntimeError):
        build_draft_payload({"state": "firing", "severity": "SEV1"})

Limitations and who should not use this

Deterministic policy is only as good as the signals. A wrong threshold pages too often or too rarely. This article does not offer vendor SLOs, model names, token quotas, or hardware claims. It does not assert that any free server is available in a particular region or at a particular time. Teams still need an override path and a human commander.

Do not use a chat completion as the severity authority if paging is tied to a contractual SLA, if the on-call rotation is small, or if the product handles money, health, or safety. Do not use this field guide as permission to skip metrics. A fuse box with no current sensor is just a box.

The industry keeps wrapping narrators around APIs and calling the result an agent. Tool calling is a fine way to fetch a weather JSON. It is a poor way to decide who loses sleep. Keep the narrator in the side room. Keep the fuse in the wall.

Load-Test Oracles Do Not Belong on Free Inference

Casey Li — Mon, 21 Sep 2026 13:56:48 +0000

A latency SLO is a contract with numbers. A free inference endpoint is a courtesy with none. Teams that let a hosted model decide whether a k6 run looks healthy are not measuring the service. They are measuring whoever else sat on the shared pool that afternoon.

The confusion is easy to understand. Load tests produce ugly histograms. Models summarize ugly histograms in fluent English. Fluent English is not a p95. Once the summary is allowed to flip a CI job from red to green, the test has changed owners. The owner is no longer the threshold file. The owner is a sampler that can stall, return 429, or paraphrase a failure into a transient blip.

This is a field guide for when not to put that owner on a free path. It is not a ban on using a model to draft a scenario. Drafting and judging are different jobs. Mixing them is how a performance budget turns into a vibe.

Arithmetic does not need a prompt

Consider a frozen run. Each sample is a status code and a latency. The error ratio is a division. The 95th percentile is a sort and an index. Neither operation benefits from temperature. Neither operation should wait on a remote queue.

A small scorer makes that boring on purpose. The file below is a local oracle. It reads JSON, prints JSON, and exits 2 when the budget is missed. CI can read an exit code. CI cannot read a shrug.

# score_run.py — deterministic oracle, no network
import json, math, sys
from pathlib import Path

LIMITS = {"error_ratio": 0.01, "p95_ms": 250, "p99_ms": 400}

def pct(xs, p):
    ys = sorted(xs)
    if not ys:
        raise ValueError("empty series")
    k = min(len(ys), max(1, math.ceil(p / 100.0 * len(ys))))
    return ys[k - 1]

def score(samples):
    lat = [s["latency_ms"] for s in samples]
    n = len(samples)
    err = sum(1 for s in samples if s["status"] >= 400) / n
    p95, p99 = pct(lat, 95), pct(lat, 99)
    passed = (
        err <= LIMITS["error_ratio"]
        and p95 <= LIMITS["p95_ms"]
        and p99 <= LIMITS["p99_ms"]
    )
    return {
        "n": n,
        "error_ratio": round(err, 6),
        "p95_ms": p95,
        "p99_ms": p99,
        "pass": passed,
        "oracle": "local-arithmetic",
    }

if __name__ == "__main__":
    data = json.loads(Path(sys.argv[1]).read_text())
    verdict = score(data)
    json.dump(verdict, sys.stdout, indent=2)
    sys.stdout.write("\n")
    sys.exit(0 if verdict["pass"] else 2)

A generator that never talks to a model keeps the other half honest. Thresholds in the runner are documentation for humans. The offline scorer is the contract.

// load.js — k6 scenario; scoring happens after the process exits
import http from "k6/http";
import { check, sleep } from "k6";

export const options = {
  vus: 20,
  duration: "90s",
  thresholds: {
    http_req_failed: ["rate<0.01"],
    http_req_duration: ["p(95)<250", "p(99)<400"],
  },
};

export default function () {
  const res = http.get(`${__ENV.BASE_URL}/v1/health`);
  check(res, { "status is 200": (r) => r.status === 200 });
  sleep(0.05);
}

Capture raw points, then score them later. Two commands, one verdict, zero prompts.

k6 run --env BASE_URL=http://127.0.0.1:8080 --out json=raw.json load.js
python3 json_to_samples.py raw.json > samples.json
python3 score_run.py samples.json

A proposed converter for k6 JSON lines is mechanical. It does not interpret the run. It only reshapes points the scorer already knows how to judge.

# json_to_samples.py — proposed k6 --out json line converter
import json, sys

samples = []
for line in open(sys.argv[1]):
    line = line.strip()
    if not line:
        continue
    ev = json.loads(line)
    if ev.get("type") != "Point":
        continue
    if ev.get("metric") != "http_req_duration":
        continue
    data = ev.get("data", {})
    tags = data.get("tags") or {}
    samples.append({
        "latency_ms": data["value"],
        "status": int(tags.get("status", 0) or 0),
    })
json.dump(samples, sys.stdout)

If the last scoring command cannot be replayed from samples.json alone, the oracle has grown a network dependency. That is the first smell. A bathroom scale that texts a poet for the number is not a scale. It is a conversation. Conversations do not belong in the deploy graph.

Red flags on the write path

The first red flag is a model call inside the job that publishes pass or fail. A comment generator after the status is published is a report. A comment generator that is the status is a hidden coin. Free pools make the coin cheaper. They also make it noisier. Courtesy capacity is shared. Shared capacity is the wrong place to store a contract.

The second red flag is letting the model rewrite thresholds because a run looked like warmup. Warmup is a phase in the scenario file. It is not a paragraph the model is invited to invent after seeing a bad p99. Once the model can move the goalposts, every regression has a story. Stories do not page. Missed budgets do.

The third red flag is using free inference as the system under test and as the judge. That pairing is circular. The same congestion that wrecked the histogram can also delay or dilute the write-up. A delayed write-up that never fails the job is how a saturated pool becomes fine on the dashboard.

The fourth red flag is asking the model to read a trace dump and pick the bottleneck as a merge condition. Trace narratives are useful in a ticket. They are not a substitute for a recorded p95 against a frozen environment. If the environment cannot be frozen, the test is already lying. A fluent lie is still a lie.

Draft on courtesy compute, freeze the scenario, score at home

A model can draft load.js from a prose description of the API. That is authoring. Authoring can happen on a workstation, even on a free model path or a free server, because the artifact that leaves the session is text under review. The reviewed text is committed. The committed text is what CI runs. The model is not in the loop when the numbers appear.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode currently offers free model access and a free server option. Those are reasonable places to sketch a k6 script, a sample converter, or a threshold file. They are not reasonable places to host the oracle that flips the job. Remove the product names and the method still holds: draft with whatever is convenient, freeze the scenario, score with arithmetic on hardware the team controls.

After the scorer has spoken, a model may write a paragraph for humans. The paragraph must consume the JSON verdict, not replace it. Feed the model the already-computed object. Forbid it from emitting pass. A cheap guard is a schema that simply has no place for a vote.

# narrate.py — optional, after score_run.py, never the gate
import json, sys
from jsonschema import validate

NARRATION_SCHEMA = {
    "type": "object",
    "required": ["headline", "notes"],
    "additionalProperties": False,
    "properties": {
        "headline": {"type": "string", "maxLength": 120},
        "notes": {"type": "string", "maxLength": 2000},
    },
}

def main():
    verdict = json.loads(sys.stdin.read())
    assert "pass" in verdict and "p95_ms" in verdict
    draft = json.loads(sys.argv[1] if len(sys.argv) > 1 else "{}")
    validate(instance=draft, schema=NARRATION_SCHEMA)
    print(json.dumps({"verdict": verdict, "narration": draft}, indent=2))

if __name__ == "__main__":
    main()

The narration is furniture. The verdict is load-bearing. Furniture can live on a free path. Load-bearing walls cannot. A second alternative is to keep even the narration local: a template over the JSON. Templates do not 429.

jq -r '"p95=\(.p95_ms)ms p99=\(.p99_ms)ms errors=\(.error_ratio) pass=\(.pass)"' verdict.json

That line will look the same in a year. A chat completion will not.

Exit criteria

Stop using a free inference path the moment the output can change a deploy, a rollback, a page, or a customer-facing SLO report. That is the hard exit. Soft exits come earlier. Exit when two replays of the same samples.json can disagree. Exit when the scorer needs a network allow-list. Exit when a 429 from the model pool would leave the performance job yellow instead of red.

Exit when the test is the only evidence a capacity review will see. Reviewers will ask how the number was produced. A sentence about asking a model is not a method. Sorting 12,441 samples and comparing them to LIMITS in git is a method.

Stay off the free path when the system under test is itself a model endpoint the team does not provision. Courtesy capacity is a moving floor. A moving floor cannot prove a ceiling.

Who should ignore this, and what this is not

Throwaway laptop experiments with no budget, no CI job, and no audience can call whatever they want. They are not oracles. They are sketches. Teams that already compute percentiles in the load runner and only want a human-readable recap after the fact can use a model as a printer. Printers do not get a vote.

Do not use this article as an excuse to skip load tests. Deterministic scoring of an empty file is still empty. Do not use it as a claim about any vendor's uptime, quota, hardware, or model catalog. Those change, and this article does not measure them. It argues a placement rule: if the number is a contract, the contract cannot live on courtesy compute.

A practical check belongs in CI so the rule does not depend on memory. The grep is crude. Crude is fine. The point is a tripwire, not a parser.

# forbid_llm_oracle.sh — fail the pipeline if the scorer grows a client
set -euo pipefail
if grep -E 'requests\.|httpx|urllib\.request|openai|anthropic|chat\.completions' score_run.py; then
  echo "score_run.py must remain network-free" >&2
  exit 1
fi
python3 -m py_compile score_run.py

If the scorer imports an HTTP client next week, the tripwire should fire before the first looks-healthy merge. Placement is the skill. Free model access is a draft bench. A free server is a scratch pad. The oracle is a short Python file next to the thresholds. Keep the bench and the pad. Do not promote them into the courtroom.

If a team needs a scratch pad to draft the harness, MonkeyCode's free model access and free server option are one place to do that writing. Commit the script. Score it at home.

Token Buckets Do Not Belong on Free Inference

Casey Li — Sun, 20 Sep 2026 11:51:35 +0000

Admission control is a fence, not a conversation. A free language-model call is a variable-latency guess with an untrusted prompt surface, and it does not belong on the path that decides whether a request may enter a production service.

The temptation is obvious in an industry that now asks models to classify almost everything. Abuse often looks like language. Support tickets look like language. Even a User-Agent string can be dressed up as a story about intent. Teams then sketch a “smart shedder”: send the request metadata to a model, ask whether the caller looks abusive, and only then hit the real API. That design treats a control-plane verdict as if it were a paragraph.

It is not. A token bucket, a GCRA check, or an Envoy local rate-limit decision has to be cheap, deterministic, fail-closed, and cheaper than the work it protects. Inference is none of those things. Under a flood, the defender who asks a model for every admit/deny also pays for every attack packet in latency and quota. The free tier does not cancel that inversion. It makes the inversion quieter, because the bill arrives as a cold start, a queue, or a sudden 429 from the model host rather than as an invoice line.

Category error, not a missing prompt

Load shedding is physics. Tokens refill against a clock. Burst is a number. The protected resource has a measured concurrency limit. None of that becomes more true because a completion is fluent. A model can narrate why a 429 happened. It cannot be the 429.

The failure mode is not merely “the model was wrong once.” The failure mode is non-replayable policy. Two replicas given the same headers can emit different verdicts. A retry can flip from deny to admit because the sampler moved. An attacker who owns the body text owns a channel into the policy, which is the opposite of a fence. Highway toll booths do not interview drivers in natural language while cars are still rolling. They weigh, they count, they drop a barrier.

A useful test is brutally simple. If the admit path is slower than the p99 of the service behind it, the guard is theatre. If the admit path fails open when the model is cold, the guard is an invitation. If the admit path parses untrusted prose as policy, the guard is a prompt-injection gadget bolted onto the front door.

A local bucket that stays local

The following limiter is deliberately boring. It is an in-process token bucket with a monotonic clock. It is not a global cluster limiter. It exists to keep the verdict on this side of the network, in code a reviewer can step through without a trace from a vendor.

# token_bucket.py
from __future__ import annotations

import threading
import time
from dataclasses import dataclass, field


@dataclass
class TokenBucket:
    rate_per_sec: float
    burst: float
    tokens: float = field(init=False)
    updated: float = field(init=False)
    _lock: threading.Lock = field(default_factory=threading.Lock, repr=False)

    def __post_init__(self) -> None:
        if self.rate_per_sec <= 0 or self.burst <= 0:
            raise ValueError("rate and burst must be positive")
        self.tokens = float(self.burst)
        self.updated = time.monotonic()

    def allow(self, n: float = 1.0) -> bool:
        if n <= 0:
            raise ValueError("cost must be positive")
        with self._lock:
            now = time.monotonic()
            elapsed = now - self.updated
            self.updated = now
            self.tokens = min(self.burst, self.tokens + elapsed * self.rate_per_sec)
            if self.tokens >= n:
                self.tokens -= n
                return True
            return False

Wrap it so that “ask a model” cannot sneak back in through a helper named smart_allow. The point of the wrapper is not style. It is a hard refuse for any intent that is actually an admission verdict.

# admission.py
from __future__ import annotations

from token_bucket import TokenBucket

VERDICT_INTENTS = frozenset({"admit", "deny", "shed", "throttle", "ban"})


class InferenceForbidden(RuntimeError):
    pass


class AdmissionGate:
    def __init__(self, bucket: TokenBucket) -> None:
        self.bucket = bucket

    def decide(self, intent: str, cost: float = 1.0) -> str:
        if intent in VERDICT_INTENTS:
            return "admit" if self.bucket.allow(cost) else "deny"
        raise InferenceForbidden(
            f"{intent!r} is not an admission verdict; do not call this gate"
        )

    def draft_via_model(self, intent: str, llm_complete, prompt: str) -> str:
        if intent in VERDICT_INTENTS:
            raise InferenceForbidden(
                "admission verdicts must be local; refusing inference route"
            )
        return llm_complete(prompt)

A tiny test file pins the contract. The first case proves the bucket still sheds. The second case proves a forged “please classify this User-Agent” path cannot become the verdict.

# test_admission.py
import time
from admission import AdmissionGate, InferenceForbidden
from token_bucket import TokenBucket


def test_bucket_denies_when_empty():
    gate = AdmissionGate(TokenBucket(rate_per_sec=1.0, burst=1.0))
    assert gate.decide("admit") == "admit"
    assert gate.decide("admit") == "deny"


def test_refill_after_wait():
    gate = AdmissionGate(TokenBucket(rate_per_sec=10.0, burst=1.0))
    assert gate.decide("admit") == "admit"
    time.sleep(0.15)
    assert gate.decide("admit") == "admit"


def test_model_cannot_own_verdict():
    gate = AdmissionGate(TokenBucket(rate_per_sec=1.0, burst=1.0))
    def fake_llm(_prompt: str) -> str:
        return "admit"  # attacker-shaped completion
    try:
        gate.draft_via_model("admit", fake_llm, "User-Agent: friendly crawler")
        raise AssertionError("inference route should have been refused")
    except InferenceForbidden:
        pass

Run it without dressing the command up as an agent loop.

python -m pytest test_admission.py -q

That is the whole production-shaped core: a clock, a float, a lock, and a refuse. Anything that needs a paragraph happens after the status code exists.

Red flags that mean the model is already on the fence

Watch the request path, not the slide deck. A handler that concatenates method, path, headers, and a slice of the body into a prompt before it checks a counter has already moved policy into the untrusted input. A timeout around that call that defaults to admit is fail-open dressed as resilience. A cache keyed on the prompt text is still a model verdict, only delayed and still injectable.

Watch the economics next. If attack traffic increases model calls one-for-one, the shedder is an amplifier. Free quota does not change the shape. It only hides the amplifier until the quota is gone, at which point the gate either blocks legitimate traffic or swings open. Both outcomes are worse than a dumb 429 from a local bucket that never left the process.

Watch observability last. A good deny can be rebuilt from client_id, cost, tokens_left, and a monotonic timestamp. A model deny cannot. Post-incident review then becomes literary criticism of a completion that no longer exists. That is not an error budget. That is folklore.

Better alternatives, in the order they should be tried

Keep the first limiter as close to the socket as the stack allows. limit_req in nginx, Envoy’s local rate limit filter, or an API-gateway token bucket all sit in front of application code and do not parse English. If the service is already in-process, GCRA or the bucket above is enough for a single instance. When many instances must share a budget, move the counter to Redis or a dedicated limiter service with a short TTL and a fail-closed posture, not to a chat endpoint.

Identity belongs in the same local world. API keys, mTLS, and signed service tokens decide who. The bucket decides how many. Mixing those questions into one completion produces a policy no one can rotate. Rotate keys in the identity layer. Change rates in config. Leave prose out of both.

There is still a lawful place for a model, and it is downstream. After the gate has emitted deny, structured counters can be turned into an incident note, a customer-facing explanation, or a weekly cluster of rejected shapes. That work is offline or near-offline. It can retry. It can be wrong without opening the front door.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode’s free model access is a fit for that downstream draft: take a JSON line of denied_total, top_paths, and retry_after_ms, and ask for a paragraph a human will edit. The free server option is a fit for running the pytest file and a throwaway process that hammers AdmissionGate without touching production sockets. Neither option is a fit for decide().

A scratch driver that stays honest looks like this. It never prints a model’s opinion about admit/deny. It only prints local verdicts, then optionally ships a summary string somewhere else.

# hammer.py
import json
from collections import Counter
from admission import AdmissionGate
from token_bucket import TokenBucket

gate = AdmissionGate(TokenBucket(rate_per_sec=20.0, burst=5.0))
counts = Counter()
for i in range(50):
    counts[gate.decide("admit")] += 1
summary = {
    "admitted": counts["admit"],
    "denied": counts["deny"],
    "n": 50,
}
print(json.dumps(summary))
# llm_complete is allowed only on summary, never on a live request.

Exit criteria for pulling inference off the fence

Leave the model on the admit path the moment any of these become true. The verdict is binary. The verdict must be replayable from logs. The verdict must fail closed. The verdict must cost less than the protected handler. The input to the verdict includes untrusted natural language. Attack volume can scale the guard’s own dependency. Two replicas must not disagree for the same key in the same window.

If three of those fire at once, the extraction is not a refactor. It is an incident. Put the bucket back in process, or in the proxy, and keep the model on the ticket that explains what already happened.

Who should not use this sketch

This article’s bucket is a single-process fence. Multi-region products that need one shared budget should not copy it into twelve stateless replicas and hope. Services that already sit behind a mature gateway should not add a second limiter in application code “for intelligence.” Teams whose compliance story requires a global, audited policy engine should use that engine, not a pytest file from a blog.

The downstream drafting step has limits of its own. A free model can invent a cause of denial that never appeared in the counters. Treat its paragraph as a draft. Keep the JSON as the record. Anyone who needs the explanation to be evidence should render the explanation from templates bound to those counters, not from a completion.

Admission control ages badly when it becomes a personality. The durable version is a small number, a clock, and a refuse. Let language models write the footnote after the barrier has already dropped. Readers who want a disposable box for the tests above can point them at MonkeyCode’s free server and keep the live fence where it already belongs: in process, on the proxy, and off the prompt.

The Lease Loop Is Not a Chat Completion

Casey Li — Sat, 19 Sep 2026 09:56:33 +0000

A fencing token is not a paragraph. It is a counter that must rise on a clock, die on a deadline, and never ask a model whether the holder still deserves the lock. Free inference has no place in that loop.

Teams keep stuffing chat completions into leader election anyway. A node goes quiet. Logs look messy. Someone wires a cheap model to read the noise and vote on who should keep the lease. The analogy is a lighthouse that phones a critic before each flash. The critic is witty. The reef does not care.

Latency is the first crack. Lease renewal is a budget measured in hundreds of milliseconds, not in token streams. A free path can stall, queue, or return a truncated object when the provider is busy. The lock expires while the prose is still arriving. Split brain is not a literary device. It is two writers sharing one offset.

Non-determinism is the second crack. The same health snapshot can yield keep, drop, or a sentence that fails JSON. Control planes need the same inputs to produce the same fence. A model that hedges is not a quorum. It is a coin with extra faces.

The third crack is authority. A completion can be filtered, rate limited, or rewritten by a safety layer the caller does not own. Leader election that depends on a vendor's refusal class has already given that vendor a veto over the write path. The veto stays invisible in dashboards that only chart HTTP 200.

What the loop actually is

A lease is a timed exclusive. The holder proves liveness by raising an epoch before expiry. Downstream storage must reject any write whose epoch is stale. The model of the world is small: holder id, epoch, expiry. Nothing in that tuple is improved by a temperature setting.

PostgreSQL can carry a fencing token without ceremony. The schema and renewer below are a worked example, not a multi-region consensus protocol. Treat them as labeled sample code.

CREATE TABLE worker_leases (
  name        text PRIMARY KEY,
  holder      text NOT NULL,
  epoch       bigint NOT NULL,
  expires_at  timestamptz NOT NULL
);

CREATE INDEX ON worker_leases (expires_at);

# lease_loop.py — keep this module free of HTTP clients and model SDKs
import os
import socket
import time
import psycopg

LEASE_NAME = "order-writer"
TTL_SECONDS = 15
RENEW_EVERY = 5
HOLDER = f"{socket.gethostname()}:{os.getpid()}"
DSN = os.environ["LEASE_DATABASE_URL"]

ACQUIRE = """
INSERT INTO worker_leases (name, holder, epoch, expires_at)
VALUES (%s, %s, 1, now() + make_interval(secs => %s))
ON CONFLICT (name) DO UPDATE
SET holder = EXCLUDED.holder,
    epoch = worker_leases.epoch + 1,
    expires_at = EXCLUDED.expires_at
WHERE worker_leases.expires_at < now()
RETURNING epoch;
"""

RENEW = """
UPDATE worker_leases
SET epoch = epoch + 1,
    expires_at = now() + make_interval(secs => %s)
WHERE name = %s
  AND holder = %s
  AND expires_at > now()
RETURNING epoch;
"""

def acquire(conn):
    with conn.cursor() as cur:
        cur.execute(ACQUIRE, (LEASE_NAME, HOLDER, TTL_SECONDS))
        row = cur.fetchone()
        conn.commit()
        return None if row is None else int(row[0])

def renew(conn):
    with conn.cursor() as cur:
        cur.execute(RENEW, (TTL_SECONDS, LEASE_NAME, HOLDER))
        row = cur.fetchone()
        conn.commit()
        return None if row is None else int(row[0])

def hold():
    with psycopg.connect(DSN) as conn:
        epoch = acquire(conn)
        if epoch is None:
            raise SystemExit("lease held elsewhere")
        while True:
            time.sleep(RENEW_EVERY)
            epoch = renew(conn)
            if epoch is None:
                raise SystemExit("lost lease; refuse all writes")
            print(f"fence={epoch}", flush=True)

if __name__ == "__main__":
    hold()

The control flow is the design. Acquire or renew returns an integer fence, or it returns nothing. There is no branch that asks a model to interpret the row. Writers that use the lease must send that epoch with every mutating call. A storage layer that cannot see the fence is not protected by the loop.

# fenced_write.py
def append_order(conn, epoch, payload):
    with conn.cursor() as cur:
        cur.execute(
            """
            INSERT INTO orders (payload, fence)
            SELECT %s, %s
            WHERE EXISTS (
              SELECT 1 FROM worker_leases
              WHERE name = %s
                AND holder = %s
                AND epoch = %s
                AND expires_at > now()
            )
            """,
            (payload, epoch, LEASE_NAME, HOLDER, epoch),
        )
        if cur.rowcount != 1:
            conn.rollback()
            raise RuntimeError("stale fence; drop the write")
        conn.commit()

A free completion that explains why the insert failed is optional theatre after the fact. It must not retry the insert, bump the epoch, or pick a new holder. Commentary can wait. Membership cannot.

A reproducible red-flag check

Opinion is cheap. Import graphs are not. The next artifact fails CI when the lease package grows an inference client. It is a proposed gate, not a claim that a production fleet already runs it.

# test_lease_has_no_inference.py
from pathlib import Path
import ast

LEASE_DIR = Path("lease")
FORBIDDEN_IMPORTS = {
    "openai",
    "anthropic",
    "httpx",
    "aiohttp",
    "requests",
    "google",
}
FORBIDDEN_NAME_FRAGMENTS = (
    "chat.completions",
    "messages.create",
    "generate_content",
)

def _imported_roots(tree: ast.AST) -> set[str]:
    roots = set()
    for node in ast.walk(tree):
        if isinstance(node, ast.Import):
            for alias in node.names:
                roots.add(alias.name.split(".")[0])
        elif isinstance(node, ast.ImportFrom) and node.module:
            roots.add(node.module.split(".")[0])
    return roots

def test_lease_modules_stay_offline():
    files = list(LEASE_DIR.glob("*.py"))
    assert files, "lease package missing"
    offenders = []
    for path in files:
        text = path.read_text(encoding="utf-8")
        tree = ast.parse(text)
        bad = _imported_roots(tree) & FORBIDDEN_IMPORTS
        hits = [frag for frag in FORBIDDEN_NAME_FRAGMENTS if frag in text]
        if bad or hits:
            offenders.append(f"{path}: imports={sorted(bad)} calls={hits}")
    assert not offenders, "inference reached the lease path:\n" + "\n".join(offenders)

Run it the boring way.

mkdir -p lease
cp lease_loop.py fenced_write.py lease/
python -m pytest test_lease_has_no_inference.py -q

The test is heuristic. A determined engineer can hide a completion behind a local wrapper named health.py. That is why the gate is an exit criterion, not a personality test. If the wrapper appears, the lease package is already on the wrong side of the line. Metrics exporters belong in another process, so the import ban does not become an excuse to smuggle a model through a telemetry helper.

Field guide: when not to put a model on the fence

A free model is a useful intern for reading a postmortem. It is a reckless intern for holding the flashlight. The red flag is not "an LLM exists in the company." The red flag is a prompt that can change membership. If the text of a completion can extend a lease, drop a peer, or choose which replica drains a queue, the design has confused explanation with authority.

Timeout arithmetic is the next flag. If the model's p95 exceeds half the TTL, the loop is already insolvent. Padding the TTL to wait for tokens just lengthens the split-brain window. Schema drift in the reply is a third. Control messages that need a JSON repair step do not belong next to a fencing token. A fourth flag is softer and easier to miss: a dashboard that treats "the model said the node looks sick" as equivalent to a missed heartbeat.

Better alternatives are dull on purpose. A leases table plus make_interval covers a single primary. PostgreSQL advisory locks cover even smaller footprints. etcd elections and Consul sessions cover a cluster that already speaks consensus. ZooKeeper remains a valid, if heavy, fencing service. None of these tools ask for a system prompt, and none of them improve when the invoice for tokens is zero.

Use the table as a stop/go card during review, not as a personality quiz.

Observation	Stay on the local lease	Exit the design
Renewer import graph includes an LLM or generic HTTP client	Keep shipping the SQL loop	Fail closed; strip the client
p95 of any completion exceeds half the TTL	Do not add a model to buy time	Remove the model; shorten the path
Failure drill succeeds with inference unreachable	Model is commentary only	Keep commentary off the renewer
Failure drill fails without inference	—	The model was holding the fence
A human cannot state the fence rule in one sentence without mentioning a model	Rewrite the sentence until the model disappears	Stop the rollout

Exit when the renewer imports a network client that is not the database. Exit when a human cannot state the fence rule without mentioning a model. Exit when a failure drill cannot be run with the inference provider unreachable. If the drill cannot pass in that condition, inference was never optional.

Scratch generation is a different job. A reviewer may want extra negative fixtures: a truncated JSON body, a 429, a refusal, a slow stream. Those fixtures can be drafted on a disposable box.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode's free model access and free server option are a reasonable place to generate those fixtures and to run the import checker against a throwaway clone. They are not a reasonable place to host lease_loop.py. The lease either talks to Postgres, or it does not talk.

Limitations

The example ignores clock jump, long garbage-collection pauses, and network partitions that leave the SQL session half-open. now() inside PostgreSQL is better than the client's wall clock, and it is still not Raft. Teams with a multi-region write path need a real consensus group, not a Python while True.

The CI checker does not prove liveness. It only forbids a class of imports. It will miss a sidecar that renews the lease over a Unix socket to an agent. Treat that sidecar as part of the lease package and apply the same rule. The checker will also nag a legitimate requests call if someone parks it in lease/; move the call, do not weaken the gate.

Free inference is the wrong owner of adjacent decisions that look like commentary and act like membership. Draining a Kafka partition, choosing which replica is mostly caught up, or rewriting a readiness probe because logs seem unhealthy are fencing problems in costume. The same stop/go card applies.

Who should ignore this field guide

Operators who already run etcd or ZooKeeper and never call a model from the election path can skim the checker and move on. Researchers studying lock contention on synthetic traces may use a model offline, against recorded data, with no ability to write epoch. That study is not a control loop.

The approach is a poor fit for product demos that exist to show an agent running the cluster. A demo can narrate a lease. It should not hold one. It is also a poor fit for anyone hoping a free completion will replace a quorum because the invoice is zero. The invoice is not the failure domain. Dual writers are.

A lease loop that stays boring will look under-engineered in a screenshot. That is the point. The lighthouse does not workshop the next flash. It flashes, or it goes dark, and the chart records the gap.