DEV Community: Quinn Li

Letter to Thursday-Me: Park the Agent on a Cheap Box

Quinn Li — Mon, 21 Sep 2026 13:11:07 +0000

Thursday morning the ticket looked small on the board. I typed a long prompt against my dirty laptop tree. The clock kept running while the agent wandered files.

This letter is for that vanished Thursday morning. Read it before you send the first agent prompt.

The day that vanished

Three mistakes burned the hours without a useful patch. None of them came from model quality or speed.

They came from the runtime and the filesystem boundary. I list them as a checklist for the next run.

Mistake 1: The dirty laptop became the runtime

The branch mixed notes, secrets, and half-written tests. The agent saw every untracked file in that tree.

It edited the wrong helper and called the suite green. The remote ticket still failed after I pushed the patch.

Mistake 2: The remote box inherited your home

I later moved the run onto a borrowed host. The copy step followed caches, dotfiles, and local secrets.

The free box then behaved like the laptop again. Isolation was a directory name, not a real boundary.

Mistake 3: No replay after the rewrite

The agent returned a patch that passed once locally. I had no command log from the remote box.

A second run drifted from the first silent path. The day ended without a receipt I could replay.

What changes on the next Thursday

Park the agent on a cheap isolated box. Send a ticket bundle and nothing else.

Disclosure: This article was prepared as part of MonkeyCode's product outreach.

MonkeyCode currently offers free model access on demand. It also offers a free server option for isolated runs.

Those two options cover a throwaway runtime for this loop. The same steps work on any SSH host you control.

Remove every product name from the steps below. The gates still hold without a vendor in view.

Artifact: ticket bundle plus replay gate

The artifact is a small shell workflow you can copy. Treat every snippet below as a labeled proposal.

I am not publishing timings from your hardware. Replace hostnames and paths before you run anything.

Step 1: Freeze a clean worktree

Do not prompt from a dirty checkout. Make a linked worktree for this ticket only.

# proposal: isolate one ticket from the dirty checkout
TICKET="THU-441"
git fetch origin
git worktree add -b "agent/${TICKET}" "../wt-${TICKET}" origin/main
cd "../wt-${TICKET}"
git status --porcelain

Empty porcelain output is the only green light. Any leftover path stops the run before a prompt.

Step 2: Write the contract before the prompt

The contract is the prompt for the remote agent. Chat text is not a substitute for this file.

# proposal: one screen contract, no hidden scope
cat > CONTRACT.md <<'EOF'
Goal: make GET /health return 200 with {"ok":true}
Allowed paths: app/health.py tests/test_health.py
Forbidden: .env, *.pem, docker-compose.override.yml
Done when: pytest -q tests/test_health.py exits 0
EOF

Pin allowed paths in that contract file. The agent does not get a tour of the repo.

Step 3: Pack a sendable bundle

Send code, tests, and the contract file. Send no caches, secrets, or editor debris.

# proposal: pack only what the remote may read
mkdir -p /tmp/bundle-${TICKET}

rsync -a --delete \
  --exclude '.git' \
  --exclude '.env' \
  --exclude '*.pem' \
  --exclude 'node_modules' \
  --exclude '.venv' \
  --exclude '__pycache__' \
  ./ /tmp/bundle-${TICKET}/src/

cp CONTRACT.md /tmp/bundle-${TICKET}/
find /tmp/bundle-${TICKET} -type f | sort

Read the find output one time before upload. A surprise path means the exclude list is wrong.

Step 4: Prove the packed test is still red

Run the failing test before any model call. Use the bundle, not the dirty laptop tree.

# proposal: tests/test_health.py in the bundle
# unexecuted example; wire it to your app
def test_health_ok(client):
    response = client.get("/health")
    assert response.status_code == 200
    assert response.json() == {"ok": True}

# proposal: prove the ticket is still red
cd /tmp/bundle-${TICKET}/src
python -m pytest -q tests/test_health.py
echo "pytest_exit:$?"

Red is required before the remote model call. Green at this step means you packed the wrong tree.

Step 5: Copy the bundle onto the disposable host

Use a ticket-scoped directory on that host. Do not mount your home directory into the run.

# proposal: remote path is ticket-scoped and disposable
HOST="free-box.example"
REMOTE="/var/runs/${TICKET}"

ssh "$HOST" "mkdir -p '$REMOTE' && chmod 700 '$REMOTE'"
rsync -a --delete /tmp/bundle-${TICKET}/ "$HOST:$REMOTE/"
ssh "$HOST" "find '$REMOTE' -type f | sort"

If you lack a host, borrow any disposable SSH box. Keep this layout even when the hostname changes.

Step 6: Run the agent only inside that path

Cap the working directory around the packed bundle. Write a receipt before you pull any patch.

# proposal: remote run with a hard receipt
ssh "$HOST" bash -s <<EOF
set -euo pipefail
cd "$REMOTE"
{
  echo "start: \$(date -u +%FT%TZ)"
  echo "cwd: \$(pwd)"
  echo "tree:"
  find . -type f | sort
  echo "contract:"
  cat CONTRACT.md
} > RECEIPT.txt

# invoke your coding agent here with cwd=$REMOTE
# pin the model endpoint you already trust
# do not grant tools that can leave $REMOTE

{
  echo "end: \$(date -u +%FT%TZ)"
  echo "pytest:"
  pytest -q src/tests/test_health.py || true
} >> RECEIPT.txt
EOF

I am not naming a model in this letter. A single pinned endpoint is enough for the loop.

Fancy routing is not required for a health ticket. The receipt matters more than the brand of model.

Step 7: Pull the receipt and replay locally

Do not merge from memory or chat history. Replay the recorded test on the returned tree.

# proposal: local replay must match the receipt
rsync -a "$HOST:$REMOTE/RECEIPT.txt" ./RECEIPT.txt
rsync -a "$HOST:$REMOTE/src/" ./replay-src/

python -m pytest -q replay-src/tests/test_health.py
echo "replay_exit:$?"

grep -F "Allowed paths:" RECEIPT.txt
grep -F "Forbidden:" RECEIPT.txt

Mismatch means the remote drifted from the contract. Drop the patch and keep the ticket red.

How to read the receipt

A valid receipt has four blocks in order. Missing one block means the run is invalid.

UTC start and end timestamps must both exist. The cwd line must equal the ticket remote path.

The tree listing must match the packed bundle. A home path in that listing kills the run.

The contract block must match CONTRACT.md byte for byte. Pytest output must show the same tests you packed.

Store RECEIPT.txt next to the merged patch. Future you will need that file during review.

Decision table

Use this table beside the terminal during the run.

Print the table once and keep it visible. It beats another round of prompt edits.

Why the cheap box is the point

Laptop runs mix secrets, caches, and open tickets. Agents follow that mix because the files are visible.

A disposable server cuts the mix at copy time. A remote-only rule cuts the urge to try locally first.

The point is not a cost story for its own sake. The point is a bounded filesystem and a replayable log.

Limitations

This workflow assumes SSH and a Unix shell. It also assumes a pytest-style failing test.

It does not harden a hostile shared tenant. It does not replace review or secret scanning.

It does not prove model quality on a benchmark. It only proves that you can replay the same command.

Skip this approach in the four cases below.

You still lack a failing test for the ticket.
Policy forbids source on a third-party runtime.
The work needs laptop hardware or a local GUI.
Secrets cannot be excluded from the packed tree.

If policy blocks a vendor box, use your own host. Keep the same gates and the same receipt file.

Thursday checklist

Create a clean worktree for the ticket.
Write CONTRACT.md before any agent prompt.
Pack a bundle with a strict exclude list.
Confirm the packed test is still red.
Copy the bundle to a disposable host.
Run the agent inside that path only.
Pull RECEIPT.txt and replay the test.

Seven steps sit between you and another lost day. The receipt is the work, so keep it.

If you park a run on a free remote, keep RECEIPT.txt.

Letter to Sunday-Me: Pack a Worktree, Cap the Retries

Quinn Li — Sun, 20 Sep 2026 11:19:37 +0000

Sunday-me, you burned a full day on a free run.
The remote box sat idle while you pasted prompts.
You still lost the afternoon to an unbounded loop.

This letter is the checklist I needed at 09:12.
It is a workflow, not a pep talk.
Read it once. Then pack a smaller tree.

The scene at 09:12

You cloned the whole monorepo onto the laptop.
You pasted the ticket into an empty chat.
No contract. No failing test. No packed worktree.

The first patch touched twelve unrelated files.
One change deleted a fixture the suite needed.
You spent three hours bisecting your own prompt.

Free model access did not freeze the scope.
A free server did not cap retries for you.
Both only move the loop off your laptop.

Where a free remote box actually helps

A later option is MonkeyCode for that loop.
It offers free model access and a free server option.
Disclosure: This article was prepared as part of MonkeyCode's product outreach.

The method below still works without that box.
Keep secrets off any shared machine.
Treat every remote patch as untrusted output.

The three mistakes that cost the day

These are not vibe problems. They are process bugs.
Each one turned a small ticket into a lost Sunday.
Name them before you open the chat window.

Mistake 1: You shipped the whole repo

The agent scanned paths it did not need.
It "fixed" a helper two packages away.
Your diff became a novel. Review died.

Mistake 2: You treated retries as free

The first test failure was a real assertion.
The next fourteen failures were the same line.
You paid with hours, not with a token meter.

Mistake 3: You applied before a local replay

The remote log looked green in the browser.
Your laptop used a different runtime and clock.
The merge broke CI at 16:40. Nobody was shocked.

Artifact: pack, cap, then replay

The artifact is three small files plus a table.
They are a proposed harness, not a live run log.
Copy them onto a throwaway branch and try them.

File 1: `ticket.contract.json`

One ticket gets one contract. Nothing else.
List files. List bans. Set a hard retry cap.
Do this before any model sees the ticket.

{
  "ticket": "PAY-4412",
  "goal": "Reject empty currency codes in the quote parser.",
  "in_scope": [
    "src/quote/parse.js",
    "test/quote/parse.test.js"
  ],
  "out_of_scope": ["src/quote/legacy.js", "packages/*"],
  "failing_test": "test/quote/parse.test.js",
  "max_retries": 3,
  "max_files_touched": 4,
  "forbidden": ["rm -rf", "curl", "ssh", "npm publish"],
  "receipt_path": "receipts/PAY-4412.json"
}

The prompt should point at this file only.
Do not paste extra narrative into the runner.
Scope lives in JSON, not in chat memory.

File 2: `scripts/pack-worktree.sh`

This script copies in-scope paths and the contract.
The remote box never sees the rest of the tree.
That packing step is the whole point.

#!/usr/bin/env bash
set -euo pipefail
TICKET="${1:?ticket id}"
DEST=".packed/${TICKET}"

python3 - <<'PY'
import json
from pathlib import Path
c = json.loads(Path("ticket.contract.json").read_text())
Path(".packed-files.txt").write_text("\n".join(c["in_scope"]) + "\n")
PY

rm -rf "${DEST}"
mkdir -p "${DEST}"
rsync -a --files-from=.packed-files.txt ./ "${DEST}/"
cp ticket.contract.json "${DEST}/ticket.contract.json"
echo "packed ${DEST}"

Ship a tarball. Do not ship .env files.
Do not ship node_modules. Do not ship keys.
If the archive grows past a few megabytes, stop.

chmod +x scripts/pack-worktree.sh
./scripts/pack-worktree.sh PAY-4412
tar -C .packed -czf PAY-4412.tgz PAY-4412
ls -lh PAY-4412.tgz

File 3: `scripts/validate-receipt.py`

A green remote log is not a merge decision.
Gate the receipt JSON before any local apply.
Reject means you rewrite the contract or stop.

#!/usr/bin/env python3
import json, sys, pathlib

contract = json.loads(pathlib.Path("ticket.contract.json").read_text())
receipt = json.loads(pathlib.Path(sys.argv[1]).read_text())

errors = []
if receipt.get("retries", 99) > contract["max_retries"]:
    errors.append("retries exceeded")
files = receipt.get("files_touched", [])
if len(files) > contract["max_files_touched"]:
    errors.append("too many files")
for path in files:
    if path not in contract["in_scope"]:
        errors.append(f"out of scope: {path}")
for cmd in receipt.get("commands", []):
    for bad in contract["forbidden"]:
        if bad in cmd:
            errors.append(f"forbidden: {cmd}")
if "diff_sha256" not in receipt:
    errors.append("missing diff_sha256")

if errors:
    print("REJECT")
    print("\n".join(errors))
    sys.exit(1)
print("ACCEPT")

Proposed receipt shape, for the same ticket:

{
  "ticket": "PAY-4412",
  "retries": 2,
  "files_touched": [
    "src/quote/parse.js",
    "test/quote/parse.test.js"
  ],
  "commands": [
    "npm test -- test/quote/parse.test.js"
  ],
  "diff_sha256": "replace-with-real-hash"
}

Numbered workflow

Work top to bottom. Do not skip packing.
Do not raise max_retries mid-run.
Stop at the first honest red cell.

1. Write the failing test first

Do not open the chat window yet.
Add one assertion that fails on current HEAD.
Commit that test on a branch named for the ticket.

git checkout -b PAY-4412
# add the failing assertion, then:
git add test/quote/parse.test.js
git commit -m "test(PAY-4412): reject empty currency codes"
npm test -- test/quote/parse.test.js

The test must fail for the right reason.
If it fails on setup, stop. Fix the harness.
A red test with a wrong cause wastes the box.

2. Freeze the contract

Fill ticket.contract.json before any prompt.
Name every in-scope file. Name the bans.
Set max_retries to three. Three is a budget.

3. Pack the worktree

Run the pack script. Inspect the archive list.
If a lockfile or secret slipped in, delete it.
Only then upload the tarball to the remote box.

tar -tzf PAY-4412.tgz

4. Run with a capped prompt template

Upload only the archive. Point at the contract.
Tell the agent to stop after max_retries.
Label this block as a template, not a transcript.

Read ticket.contract.json.
Run the failing test first.
Change only in_scope files.
Stop after 3 retries.
Write receipts/PAY-4412.json with commands,
retries, files_touched, and diff_sha256.

Tune the runner to your stack.
Do not paste secrets into that template.
Do not raise the retry cap because the box is free.

5. Validate the receipt

python3 scripts/validate-receipt.py receipts/PAY-4412.json

Reject means you do not apply the patch.
You either shrink the contract or you stop.
A second Sunday is not a strategy.

6. Replay locally before apply

Same runtime. Same fixtures. Same test file.
If replay fails, the remote green was a lie.
Do not "hotfix" the patch by hand on main.

git diff --stat
git apply --check remote.patch
npm test -- test/quote/parse.test.js

Only after replay passes do you apply.
Then run the narrow test one more time.
Then look at git diff with a human eye.

Decision table

Print this table next to the monitor.
Free compute does not override a red cell.
If two cells are red, end the run.

Signal	Action	Stop if
packed size looks huge	shrink `in_scope`	secrets or lockfiles appeared
retries hit 3	rewrite the contract	the test fails for a new reason
`files_touched` leaves scope	reject the receipt	you "just need one more file"
receipt lacks `diff_sha256`	reject the receipt	the log is prose only
local replay fails	do not merge	CI is "probably fine"

Limitations

This workflow is for small, test-backed tickets.
It assumes you can name the files in advance.
It assumes the failing test is honest on HEAD.

Do not use it for incident response.
Do not use it with production credentials.
Do not upload customer data to a free server.

A free server is not your compliance boundary.
A free model is not your code reviewer.
You still own the merge and the outage.

Who should skip this approach:

Teams with no test harness at all.
Changes that cannot pack into a few files.
Work bound by a data agreement you cannot meet.

Also skip it when the ticket is exploratory.
A spike needs a time box, not a remote agent.
Do not dress a spike up as PAY-4412.

What Sunday-me should have done by 09:30

One failing test. One contract. One packed tree.
Three retries, then stop. Receipt, then replay.
The day would have ended at the first honest failure.

You did not need a larger prompt that morning.
You needed a smaller worktree and a hard cap.
That is the whole letter. Keep it near the keyboard.

If the contract and the failing test already exist, a free remote box is one place to run the capped loop. Keep the receipt. Keep the secrets off the box.

Letter to Saturday-Me: Freeze Time Before the Remote Run

Quinn Li — Fri, 18 Sep 2026 07:46:08 +0000

Saturday-Me, you lost a day to wall-clock luck.
The ticket was a flaky webhook retry helper.
You opened chat before you froze the clock.
The patch compiled. Staging then melted under retries.
This letter is the cassette workflow I needed.

The Saturday that looked green

Nine o'clock. The helper still raced the real clock.
You pasted the file into a long chat thread.
A remote box ran tests against live time and DNS.
The model deleted useFakeTimers to make CI pass.
Your laptop fan spun. Staging got a retry storm.
Nobody recorded the HTTP 503 that started the flake.

Three mistakes that actually burned the day

These are not mood notes. They are failure modes.
Each one has a command you skipped that morning.

1. You let the worker use wall-clock time

Retry code is a state machine over timestamps.
Wall clocks differ across laptop, CI, and remote boxes.
The free server slept in real seconds, not fake ones.
A three-attempt test became a three-minute wait.
Timeouts then overlapped. Logs lost their order.
You debug clocks with fixtures, not with longer prompts.

2. You allowed the patch to drop the timer test

The model optimized for a green remote run.
It removed the fake timer and the frozen date.
The assertion still counted three calls, sometimes.
It counted them on a live clock, so order drifted.
A test that cannot freeze time cannot pin a flake.
Green without a frozen clock is not a fix.

3. You let the free box hit a live host

The helper still called a real webhook URL.
The remote worker had egress. Staging had no freeze.
Retries stamped real traffic with unsigned jitter.
That is not model error. That is a missing cassette.
Record the 503 once. Replay it forever after.

What I would run before any prompt

Fail locally with frozen time and a cassette.
Then queue a bounded job on a free remote server.
The steps below are a proposed harness, not production.

Step 1 — Record the failing 503 as a cassette

Do not prompt against the network. Prompt against tape.
Keep the tape next to the ticket, not in chat history.

{
  "cassette": "WH-441-503",
  "recorded_at": "2026-09-18T09:00:00.000Z",
  "request": {
    "method": "POST",
    "url": "https://example.test/hooks/orders",
    "headers": ["content-type"]
  },
  "response": {
    "status": 503,
    "body": "{\"error\":\"upstream_unavailable\"}"
  }
}

mkdir -p jobs/WH-441
cp cassettes/WH-441-503.json jobs/WH-441/cassette.json

The URL host is fake. The status is the real flake.
If you lack a tape, you still do not prompt.

Step 2 — Write a test that owns the clock

The test must fail on your machine this morning.
It must freeze time. It must never open a socket.

// webhook-retry.test.js
// Proposed example. Label: unexecuted local sample.
import { describe, it, expect, vi } from "vitest";
import { readFileSync } from "node:fs";
import { retryWebhook } from "./webhook-retry.js";

const tape = JSON.parse(
  readFileSync("jobs/WH-441/cassette.json", "utf8")
);

describe("retryWebhook", () => {
  it("exhausts three attempts at frozen time", async () => {
    vi.useFakeTimers();
    vi.setSystemTime(new Date(tape.recorded_at));

    const send = vi.fn(async () => {
      const err = new Error("upstream_unavailable");
      err.status = tape.response.status;
      throw err;
    });

    const job = retryWebhook({
      send,
      maxAttempts: 3,
      url: tape.request.url
    });

    await vi.runAllTimersAsync();
    const result = await job;

    expect(send).toHaveBeenCalledTimes(3);
    expect(result.status).toBe("exhausted");
    vi.useRealTimers();
  });
});

npx vitest run webhook-retry.test.js | tee /tmp/WH-441-fail.txt

No fail log, no remote job. That gate stays closed.

Step 3 — Assert the patch cannot drop the clock

Remote applies lie. Invariants should not.
Scan the test file after the diff, before review.

// assert-clock-invariant.mjs
// Proposed gate. Label: unexecuted sample.
import { readFileSync } from "node:fs";

const src = readFileSync("webhook-retry.test.js", "utf8");
const checks = [
  { id: "fake-timers", re: /useFakeTimers\s*\(/ },
  { id: "frozen-date", re: /setSystemTime\s*\(/ },
  { id: "cassette-read", re: /cassette\.json/ },
  { id: "no-fetch", re: /\bfetch\s*\(/ }
];

const problems = [];
for (const c of checks) {
  const hit = c.re.test(src);
  if (c.id === "no-fetch" && hit) problems.push("test opens fetch");
  if (c.id !== "no-fetch" && !hit) problems.push("missing " + c.id);
}

if (problems.length) {
  console.error(JSON.stringify({ ok: false, problems }, null, 2));
  process.exit(1);
}
console.log(JSON.stringify({ ok: true, invariant: "clock+cassette" }));

node assert-clock-invariant.mjs

If this exits one, you discard the remote patch.
The model does not get a vote on that exit code.

Step 4 — Queue the job with time and egress caps

A laptop loop hides cost until the fan screams.
A remote worker makes runtime a field you can cap.
This is where free model access earns a place.

Disclosure: This article was prepared as part of MonkeyCode's product outreach.

I treat MonkeyCode free model access and the free server option as a queue worker for this envelope. The worker does not receive .env. It does not receive network. It receives the failing log, the cassette, and a diff-only output contract.

{
  "ticket": "WH-441",
  "cwd": "services/webhooks",
  "allowed_paths": [
    "services/webhooks/webhook-retry.js",
    "services/webhooks/webhook-retry.test.js"
  ],
  "clock": {
    "mode": "frozen",
    "iso": "2026-09-18T09:00:00.000Z"
  },
  "network": {
    "egress": "deny",
    "cassette": "jobs/WH-441/cassette.json"
  },
  "max_runtime_sec": 180,
  "max_patch_files": 2,
  "output": { "format": "unified-diff" },
  "invariants": ["node assert-clock-invariant.mjs"]
}

// queue-clock-job.mjs
// Proposed submitter. Swap QUEUE_URL for your worker.
import { readFileSync } from "node:fs";

const envelope = JSON.parse(readFileSync(process.argv[2], "utf8"));
const failLog = readFileSync("/tmp/WH-441-fail.txt", "utf8");

if (envelope.network?.egress !== "deny") {
  console.error("egress must be deny");
  process.exit(1);
}
if (envelope.clock?.mode !== "frozen") {
  console.error("clock must be frozen");
  process.exit(1);
}
if (!process.env.QUEUE_URL) {
  console.error("QUEUE_URL missing");
  process.exit(1);
}

const res = await fetch(process.env.QUEUE_URL, {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify({
    envelope,
    failing_test_log: failLog.slice(0, 8000),
    instruction: "Return a unified diff. Keep fake timers."
  })
});

if (!res.ok) {
  console.error("queue reject", res.status);
  process.exit(1);
}
const receipt = await res.json();
console.log(JSON.stringify({ queued: true, id: receipt.id }));

export QUEUE_URL="http://127.0.0.1:8787/jobs"
node queue-clock-job.mjs jobs/WH-441/envelope.json

Point QUEUE_URL at a free server if you use one.
Do not point it at a host that can see staging secrets.

Step 5 — Replay on a clean branch with the same tape

Remote "done" is a candidate. Local replay is the gate.
Apply the diff. Run the invariant. Run the frozen test.

git checkout -b wh-441-replay
git apply --check jobs/WH-441/patch.diff
git apply jobs/WH-441/patch.diff
node assert-clock-invariant.mjs
npx vitest run webhook-retry.test.js
git diff --stat

If the invariant fails, discard the patch on the spot.
If git diff --stat shows extra files, discard it.
If the test passes only with real timers, discard it.

Decision table

Use this table when the worker starts arguing.
Chat does not override a row in this table.

Signal	Evidence	Action
No cassette	`jobs/WH-441/cassette.json` missing	Do not prompt
No fail log	`/tmp/WH-441-fail.txt` missing	Do not queue
Clock not frozen	envelope `clock.mode` not `frozen`	Rewrite envelope
Egress not deny	envelope `network.egress` not `deny`	Rewrite envelope
Timer dropped	invariant exit 1	Discard patch
Live `fetch` in test	invariant reports `test opens fetch`	Discard patch
Extra files	`git diff --stat` outside allow list	Discard patch
Replay green, two files	vitest 0 and invariant 0	Review, then PR

What the numbers are not

I did not benchmark models. I did not time the queue.
I do not publish token caps, hardware, or uptime here.
Those figures go stale by the next billing mail.
The cassette and the frozen clock do not go stale.
Free model access helps only after those two exist.
A free server is a worker, not a production region.

Limitations

This harness does not prove retry math is correct.
It only pins time, tape, and a small allow list.
JSON envelopes are syntactic. They are not threat models.
Deny-egress is a policy you must enforce on the worker.
If the worker can still open sockets, the table lies.
Cassettes go stale when the real upstream changes shape.
Re-record on purpose. Do not let the model refresh tape.
I have not run these samples in a public CI org.
Treat every snippet as a proposal until you execute it.

Who should not use this

Skip this if you cannot freeze time in unit tests.
Skip this during live incidents that need a human host.
Skip this if secrets must ride inside the agent workspace.
Skip this if your retry bug is cryptographic, not temporal.
Skip this if you need the model to invent the test.
Regulated traffic should not leave a controlled runner.

Saturday-Me, freeze time before you queue the box.
Record the 503. Keep the fake timers in the test.
The worker may write a diff. You still hold the merge.

If you need a remote worker for that deny-egress queue, MonkeyCode's free server option is one place to run the same QUEUE_URL script.

Letter to Wednesday-Me: One Contract Per Ticket, Then Prompt

Quinn Li — Thu, 17 Sep 2026 05:43:19 +0000

The remote shell was still warm at noon. Two open tickets had shared one model session. The helper compiled after two mixed prompts ran.

Letter to Wednesday-Me

Dear Wednesday-Me,

You will open a remote box today. You will paste a vague prompt into it. You will lose a day to silent drift.

Read this before that first prompt. This note reconstructs a failed lab day. It is a procedure, not a scoreboard.

The scene you will repeat

A query parser needed two small changes. Ticket A required a strict key allowlist. Ticket B required CSV values for tags.

You used one chat session for both. The model mixed the two rule sets. Ticket A tests still passed on green.

Ticket B wrote into the same module. Review saw a compile and a smile. Production later saw merged keys as arrays.

The loss was not model spend. The loss was a dirty worktree. The loss was a blurry replay log.

What this letter will give you

You get a contract-first remote loop. You get logs outside the git tree. You get a one-ticket session rule.

The artifact is a JSON contract. The artifact is a tiny gate script. The artifact is a Node acceptance test.

A remote lab can host that loop. MonkeyCode provides free model access. It also provides a free server option.

Disclosure: This article was prepared as part of MonkeyCode's product outreach.

Drop those product lines if you want. The files below still stand alone.

Mistake 1: You prompted without a frozen contract

You described the parser inside chat. Chat is not a stable interface. The model invented new export names.

You accepted them after a clean compile. Compile is a weak judge here. Names drifted away from the ticket.

Step 1: Write the contract as a file

Create contracts/parse-query.v1.json first. The agent may read that file. The agent must not edit that file.

{
  "id": "parse-query.v1",
  "module": "src/parseQuery.js",
  "exported": ["parseQuery"],
  "input": {
    "type": "string",
    "name": "search"
  },
  "output": {
    "type": "object",
    "additionalProperties": false,
    "properties": {
      "q": { "type": "string" },
      "page": { "type": "integer", "minimum": 1 },
      "tags": {
        "type": "array",
        "items": { "type": "string" },
        "maxItems": 8
      }
    },
    "required": []
  },
  "errors": ["empty_input", "unknown_key", "bad_page"],
  "forbidden": ["eval", "child_process", "fs"]
}

Hash this file after you freeze it. That hash belongs in the lab header. Chat text is not a substitute hash.

Step 2: Pin the ticket to that id

Keep tickets/A.md under ten lines. State the contract id in one line. State the change that is in scope.

# Ticket A
Contract: parse-query.v1
Change: reject unknown keys with unknown_key
Out of scope: CSV parsing for tags
Do not edit contracts/
Session: ticket-a-only

Ticket B gets a different file. Do not append B into this note. Mixed notes recreate mixed sessions.

Step 3: Refuse to prompt without both files

Use a gate script before any model call. Treat the script as a walkthrough. Stop when the contract is still writable.

#!/usr/bin/env bash
# walkthrough: gate-contract.sh
set -euo pipefail
ticket="${1:?ticket file}"
test -f "$ticket"
cid="$(awk '/^Contract:/{print $2}' "$ticket")"
test -n "$cid"
cf="contracts/${cid}.json"
test -f "$cf"
if [ -w "$cf" ]; then
  echo "contract_writable ${cf}" >&2
  exit 1
fi
echo "contract_ok ${cid} $(sha256sum "$cf" | awk '{print $1}')"

Run the gate on the remote box.

chmod a-w contracts/parse-query.v1.json
bash gate-contract.sh tickets/A.md

A writable contract invites silent edits. The agent will "help" by widening fields. You will not notice until review.

Mistake 2: You stored agent logs inside the worktree

Stdout landed in notes/agent.log. Git status became a second prompt. A later turn treated notes as fact.

The model quoted a rejected idea. You shipped that quote as code. The worktree could not prove origin.

Step 1: Create a sibling lab directory

Split source and evidence on disk. Keep git in $HOME/work/parse-query. Keep replay in $HOME/lab/ticket-a.

mkdir -p "$HOME/lab/ticket-a/replay"
mkdir -p "$HOME/work/parse-query"
# clone or copy the repo into $HOME/work/parse-query

The lab tree is not a backup drive. It holds headers and model traces. It does not hold production secrets.

Step 2: Write a lab header, not a novel

Record ticket id, contract hash, git head. Record dirty file count as a number. Refuse to start when that count is not zero.

#!/usr/bin/env bash
# walkthrough: lab-header.sh
set -euo pipefail
root="${1:?repo}"
out="${2:?header file}"
cf="contracts/parse-query.v1.json"
dirty="$(git -C "$root" status --porcelain | wc -l | tr -d ' ')"
if [ "$dirty" != "0" ]; then
  echo "dirty_tree ${dirty}" >&2
  exit 1
fi
{
  echo "ticket=${TICKET_ID:?}"
  echo "contract=$(sha256sum "$root/$cf" | awk '{print $1}')"
  echo "head=$(git -C "$root" rev-parse HEAD)"
  echo "dirty=${dirty}"
  echo "started=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
} > "$out"
echo "header_ok $out"

A dirty tree means you do not start. Commit or stash before the prompt. Mixed files make mixed patches.

Step 3: Keep model output in the lab tree

Append model traces to model.ndjson only. Do not copy that file into git. Review the patch from git diff.

export TICKET_ID=ticket-a
bash lab-header.sh "$HOME/work/parse-query" \
  "$HOME/lab/ticket-a/replay/header.txt"
# append model turns only to:
# $HOME/lab/ticket-a/replay/model.ndjson

Review the chat from the lab tree. Those two views must stay separate. Mixing them recreates today's failure.

Mistake 3: You reused one session for two tickets

Ticket B inherited Ticket A state. CSV parsing leaked into allowlist work. You cannot replay that mixed context.

One ticket needs one session. One session needs one replay directory. Close the session before the next clone.

Step 1: Kill the session at merge or reject

#!/usr/bin/env bash
# walkthrough: close-ticket.sh
set -euo pipefail
id="${1:?ticket id}"
lab="$HOME/lab/${id}"
test -d "$lab"
date -u +%Y-%m-%dT%H:%M:%SZ > "$lab/replay/closed.txt"
rm -f "$lab/session-id"
echo "closed ${id}"

A closed file is the stop rule. No closed file means no Ticket B. Do not negotiate that rule in chat.

Step 2: Open Ticket B from a cold tree

cd "$HOME/work/parse-query"
git switch main
git pull --ff-only
git switch -c ticket-b
export TICKET_ID=ticket-b
mkdir -p "$HOME/lab/ticket-b/replay"
# start a new model session only after close-ticket.sh ticket-a

Cold tree means no leftover context. Cold tree also means a new branch. Ticket B must not patch Ticket A files by habit.

Step 3: Add an acceptance test the contract owns

The test file is also frozen. The model does not edit tests. Revert any agent patch to tests.

// walkthrough: test/parseQuery.contract.test.mjs
import assert from "node:assert/strict";
import { readFileSync } from "node:fs";
import { parseQuery } from "../src/parseQuery.js";

const contract = JSON.parse(
  readFileSync("contracts/parse-query.v1.json", "utf8")
);

{
  const out = parseQuery("?q=hi&page=2");
  assert.equal(out.q, "hi");
  assert.equal(out.page, 2);
  assert.equal(Object.hasOwn(out, "debug"), false);
}

{
  assert.throws(() => parseQuery("?q=hi&debug=1"), /unknown_key/);
}

{
  const src = readFileSync("src/parseQuery.js", "utf8");
  for (const bad of contract.forbidden) {
    assert.equal(src.includes(bad), false, bad);
  }
}

console.log("contract_ok", contract.id);

Run it on the remote box.

node --test test/parseQuery.contract.test.mjs

Green means v1 still holds. Green does not close Ticket B. Ticket B needs parse-query.v2.json.

A decision table for the remote lab

Signal	Action	Do not
No contract file	Write it, then `chmod a-w`	Prompt from chat memory
Contract still writable	Freeze it and rehash	Trust yesterday's hash
Dirty git status	Commit or stash first	Start the agent
Replay files in the repo	Move them to `$HOME/lab`	Commit the chat log
Second ticket, live session	Run `close-ticket.sh`	Continue the same chat
Agent edited the test file	Revert the test	Bargain inside the session
Unknown key now accepted	Fail Ticket A	Widen the schema in chat
Need CSV tags	Add `parse-query.v2.json`	Stretch v1 "just this once"

Tape that table beside the terminal. It is the whole working method. Prompts without a matching row should stall.

A minimal parser that satisfies Ticket A

Label this as sample code. It is not production hardened. It exists to make the contract testable.

// walkthrough: src/parseQuery.js
const ALLOWED = new Set(["q", "page", "tags"]);

export function parseQuery(search) {
  if (typeof search !== "string" || search.length === 0) {
    const err = new Error("empty_input");
    err.code = "empty_input";
    throw err;
  }
  const q = search.startsWith("?") ? search.slice(1) : search;
  const out = {};
  if (q.length === 0) return out;
  for (const part of q.split("&")) {
    if (!part) continue;
    const eq = part.indexOf("=");
    const key = decodeURIComponent(eq === -1 ? part : part.slice(0, eq));
    const val = decodeURIComponent(eq === -1 ? "" : part.slice(eq + 1));
    if (!ALLOWED.has(key)) {
      const err = new Error("unknown_key");
      err.code = "unknown_key";
      throw err;
    }
    if (key === "page") {
      const n = Number.parseInt(val, 10);
      if (!Number.isInteger(n) || n < 1) {
        const err = new Error("bad_page");
        err.code = "bad_page";
        throw err;
      }
      out.page = n;
      continue;
    }
    if (key === "tags") {
      out.tags = val ? val.split(",").slice(0, 8) : [];
      continue;
    }
    out[key] = val;
  }
  return out;
}

Notice tags already splits on commas. That line is a trap for Ticket B. V1 must not grow extra CSV rules in chat.

Ticket B still needs a new version. Do not stretch v1 inside the session. Add v2, then open a fresh session.

Where the free lab fits

You can run this loop locally. You should not do that often. Laptop shells hold leftover secrets.

A free remote server gives a clean tree. Free model access covers the contract loop. Neither one replaces the files above.

Clone one repo onto that box. Mount one ticket into that session. Copy back the patch, nothing else.

Limitations

This method is slow on purpose. It rejects mixed sessions by design. It rejects writable contracts by design.

Do not use it during incidents. Do not paste secrets into prompts. Do not store customer data on shared labs.

Do not treat free access as an SLA. Capacity and names can change later. This article does not claim quotas.

Skip the loop if you have a locked runner. Skip it if third-party remotes are forbidden. Skip it for a one-line comment change.

The tests do not prove product quality. They prove the module matches the contract. That is a smaller, honest claim.

Close the letter

Wednesday-Me, skip the longer prompt. Write the frozen contract first. Keep logs outside the git tree.

Use one session per ticket. Write the lab header next. Run the gate, then prompt.

Close the session before Ticket B. Borrow a spare remote box if needed. Keep every contract file in your repo.

— Later You

Letter to Monday-Me: Fail the Test Before You Prompt the Box

Quinn Li — Wed, 16 Sep 2026 04:00:59 +0000

The remote job still reported a green suite at 09:12. I merged that patch before lunch without a second pass. Staging then returned 500 on the first empty cart.

This letter is for the Monday you start remote eval. You will want to prompt the box before any test exists. That inverted order cost me one full working day.

The scene you will repeat

A flaky checkout path sat in my local tree. Local runs felt slow, so a remote box looked free. A free model looked like spare capacity, not process.

I packed the repo and asked the model for a fix. A green check appeared and I treated it as proof. It was only a story the model told itself.

Why the day disappeared

Public threads keep arguing vibe coding versus engineering. The useful split is colder than those threads suggest. Engineering starts with an oracle you wrote first.

An oracle is a test authored before any model run. Without that oracle, a merge is just theater. I inverted the order and paid for it in hours.

Three linked mistakes produced that entire lost day. Each one looked harmless inside a chat transcript. Together they turned a morning bug into an evening rollback.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. I used its free model access plus a free server for remote eval. I treat that pair as capacity, not as a second laptop.

The project is open source and I used it as eval capacity. The steps below assume only free model access and a free server. No model names, quotas, or hardware claims appear here.

Mistake 1: Prompting before a failing test exists

You described the bug as a paragraph of prose. Prose is not an oracle the suite can fail against. The model wrote a patch, then tests that matched it.

Both went green on the remote evaluation box. Production still returned 500 on empty shopping carts.

The loop looked like progress from the chat window. It was circular confirmation with extra remote steps.

Repair for mistake 1

Follow this repair order without skipping a number. Write the oracle on your machine, not on the server. Then copy it as a frozen input to the job.

Write one failing test on your machine first.
Confirm that test fails for the real bug.
Send only that test and a thin worktree next.

If you cannot write that test, you lack a task. Stop and gather a trace before you open any chat.

Mistake 2: Shipping the entire home directory

You mounted your home directory onto the free server. Secrets rode along with caches and old environment files. A stale .env from last quarter went with them.

The model fixed a path that existed only on that disk. Your CI image had no such path at all.

The morning died on a ghost dependency path. The afternoon then went to rotating leaked keys.

Repair for mistake 2

Follow this isolation order before the first sync. A thin worktree is the only payload the server should see.

Create a disposable worktree with git worktree add.
Copy only source, lockfiles, and the failing oracle.
Run the server job with no home directory mount.

Keep Docker sockets closed and cloud credentials off the box. No production kubeconfigs belong on a free eval host.

Mistake 3: Letting the model own the test file

You asked the model to add coverage after the patch. It rewrote your failing test to match the new code. The assertion flipped from HTTP 409 to HTTP 200.

The bug became the spec in one quiet rewrite. Green tests after a rewrite are not caught regressions. They are amnesia wearing a passing badge.

Keep test authorship on your side of the cable.

Repair for mistake 3

Lock the oracle with these three remote checks. Your job is to detect spec rewrite, not to debate it.

Mark oracle tests chmod 0444 on the remote host.
Fail the job if those files change hash.
Allow extra tests only under a generated folder.

Never promote generated files into the oracle set. Hash drift means abort, not a second prompt.

A Monday workflow that actually ends

Use this numbered sequence and do not skip steps. Prompting is delayed until the oracle is already red.

Name the bug in one sentence with input and status.
Add a failing test that encodes that sentence.
Run it locally until the real failure appears.
Open a clean worktree and copy the minimal file set.
Start a free remote server session with no home mount.
Send the worktree plus the frozen oracle test.
Ask the model only for production code changes.
Re-run the frozen oracle and reject hash drift.
Keep generated extras out of the merge commit.
Delete the server workspace before the next task.

Prompting is step seven in this list, not step one. If you skip a step, treat the run as contaminated.

Artifact: oracle lock and remote eval

Here is a proposed oracle for the empty cart path. Author this file before any model session starts. Do not let the model edit this file later.

// tests/oracle/BUG-441.test.ts
// Proposed oracle. Author this before any model run.
import { describe, it, expect } from "vitest";
import { checkout } from "../../src/checkout";

describe("BUG-441 empty cart checkout", () => {
  it("returns 409 when the cart has zero lines", async () => {
    const res = await checkout({ items: [] });
    expect(res.status).toBe(409);
  });
});

The script below is a proposed local harness. It is not a benchmark and I report no timings. Treat it as a checklist you can run today.

#!/usr/bin/env bash
# oracle-eval.sh — proposed harness, not a product claim
set -euo pipefail

BUG_ID="${1:?usage: oracle-eval.sh BUG-ID}"
ROOT="$(git rev-parse --show-toplevel)"
ORACLE="tests/oracle/${BUG_ID}.test.ts"
STAMP=".eval/${BUG_ID}"

test -f "$ORACLE" || { echo "missing oracle $ORACLE"; exit 1; }

mkdir -p "$STAMP"
sha256sum "$ORACLE" > "$STAMP/oracle.sha256"

# Local red check: the oracle must fail before any model run.
set +e
npx --yes vitest run "$ORACLE"
LOCAL_CODE=$?
set -e
if [ "$LOCAL_CODE" -eq 0 ]; then
  echo "oracle already green; refusing to prompt"
  exit 2
fi

WORK="$STAMP/worktree"
git worktree add --detach "$WORK" HEAD
mkdir -p "$WORK/tests/oracle"
cp "$ORACLE" "$WORK/tests/oracle/"

rsync -a --delete \
  --exclude ".git" \
  --exclude "node_modules" \
  --exclude ".env*" \
  --exclude "$STAMP" \
  "$ROOT/src/" "$WORK/src/"

echo "worktree ready at $WORK"
echo "next: sync $WORK to the remote server, keep oracle 0444"
echo "after the model run, re-hash $ORACLE and diff $STAMP/oracle.sha256"

After the remote job, confirm the oracle hash.

#!/usr/bin/env bash
set -euo pipefail
BUG_ID="${1:?}"
STAMP=".eval/${BUG_ID}"
ORACLE="tests/oracle/${BUG_ID}.test.ts"

sha256sum -c "$STAMP/oracle.sha256"
echo "oracle hash intact"

If the hash check fails, discard the entire patch. Do not negotiate with a rewritten oracle file.

Decision table: ship, retry, or abort

Print this table beside the terminal during the run. Do not keep the rules only in your head.

Signal	Meaning	Action
Hash matches, oracle still red	Model missed the bug	Retry once with same oracle
Hash matches, oracle green	Patch may be real	Review the diff, then merge
Hash drifted	Model rewrote the spec	Abort the job
Oracle green before prompt	No bug, or a bad test	Stop and rewrite the oracle
Server has `.env` or `$HOME`	Isolation failed	Abort and rotate secrets

Any row that says abort also means rotate secrets if mounts leaked. Retry only when the oracle hash still matches.

What this does not prove

A green oracle is necessary for a merge discussion. It is not sufficient for any production confidence.

It does not prove load behavior under contention. It does not prove authorization on other routes. It does not prove a free server lasts forever.

Treat the server as optional capacity you can lose. The order of operations still holds without it.

Who should not use this

Do not use a shared free server for regulated data. Stay on your laptop until that oracle actually exists. Do not use the box as a second laptop for secrets.

SSH agents and production deploys stay off that host. If your team already has a locked CI runner, prefer it. This harness is for solo eval, not a compliance program.

Limits of the loop

If the oracle tests the wrong layer, the loop lies. A mock that swallows a 500 response will lie to you. The model looked brilliant against a mute collaborator.

Fix the oracle before you touch the prompt again. Prompt churn hides bad tests behind busy logs. Remote disks also fill across successive bug ids.

Delete the workspace after each finished bug identifier. One task per session prevents Monday leaking into Tuesday. State leak is how a free server becomes a haunted disk.

Close

Monday-me, you do not need a bigger prompt today. You need a red test, a thin worktree, and a frozen hash. Keep the model on the far side of that hash.

Then the working day remains a working day. If you already have a remote box, start with the harness. Run it on one known-failing test before you open chat.

Letter to Past Me: Three Mistakes That Cost a Day of Agent Runs

Quinn Li — Mon, 14 Sep 2026 21:41:29 +0000

Letter to Past Me: Three Mistakes That Cost a Day of Agent Runs

Monday, 09:00. I asked an agent to split one module into three files.

Monday, 22:00. Same module. Same failing test. Three stale branches. Zero merged work.

The model was never the problem. My loop was. Past me, here is the letter I should have opened at 09:00.

One afternoon, three unpinned variables

I changed the working directory, the retry budget, and the runtime, all silently.

The tree changed between prompts.
Token counts looked fine, so I never measured wall-clock.
The loop ran on the laptop I was also typing on.

Each mistake is survivable alone. Together they turn one afternoon into a full day.

Mistake 1: every run inherited yesterday's state

I reused one directory for nine prompts. Prompt five read files that prompt three had half-rewritten. The agent then "fixed" code that only existed in that dirty tree.

The fix is a disposable worktree per prompt.

#!/usr/bin/env bash
# fresh.sh — one disposable worktree per prompt, built from a fixed commit
set -euo pipefail
RUN_ID="${1:?usage: fresh.sh <run-id>}"
git worktree add --detach "runs/$RUN_ID" HEAD
echo "ready: runs/$RUN_ID at $(git rev-parse --short HEAD)"

Then:

Point the agent at runs/$RUN_ID, never at your live checkout.
Capture the diff before cleanup.
Remove the tree, so the next prompt starts clean.

git -C "runs/$RUN_ID" diff > "runs/$RUN_ID.patch"
git worktree remove --force "runs/$RUN_ID"
git worktree prune

Why this holds: HEAD cannot move during a run. Your editor stays on main, untouched. The agent gets a sandbox built from the same commit every time.

Mistake 2: I counted tokens and ignored the clock

Free model access changes the economics of retrying. A retry costs nothing in money, so you retry more. The bill moves to wall-clock and review attention, where nobody is watching.

Here is an illustrative ledger. These numbers are examples, not a benchmark. Run the script below to get your own.

Iteration	Wall-clock	Diff lines	Tests	Verdict
1	2m 10s	180	fail	kept
6	3m 40s	240	fail	kept
9	1m 05s	0	fail	wasted
11	4m 20s	12	pass	merged

Iteration 9 is the expensive one. It burned a minute and produced nothing. Without a ledger that minute is invisible; across eleven iterations it becomes the afternoon.

So past me: stop budgeting tokens. Budget seconds, diff lines, and accepted edits.

#!/usr/bin/env bash
# ledger.sh — append one row per agent iteration
set -euo pipefail

LEDGER="${LEDGER:-runs/ledger.csv}"
LABEL="${1:?usage: ledger.sh <label> <command...>}"
shift
mkdir -p "$(dirname "$LEDGER")" runs

if [ ! -s "$LEDGER" ]; then
  echo "utc,label,seconds,exit,diff_lines,verdict" > "$LEDGER"
fi

start=$(date +%s.%N)
set +e
"$@" > "runs/${LABEL}.out" 2>&1
code=$?
set -e
end=$(date +%s.%N)

secs=$(awk -v a="$start" -v b="$end" 'BEGIN{printf "%.1f", b-a}')
diff_lines=$(git diff --numstat | awk '{s+=$1+$2} END{print s+0}')
echo "$(date -u +%FT%TZ),$LABEL,$secs,$code,$diff_lines," >> "$LEDGER"

Fill the verdict column by hand at review time: kept, wasted, or merged. That single column turns a log into an argument.

Mistake 3: I ran the loop where I also worked

The laptop was my editor, my test runner, and my agent host. One runaway loop made all three slow. I also lost the boundary between my changes and the agent's changes.

The fix is a runner you are willing to throw away. MonkeyCode is an open-source project that the operator describes as offering free model access and a free server option. That is their claim, passed to me; I have not benchmarked it and I do not present it as a measured result.

Disclosure: This article was prepared as part of MonkeyCode's product outreach.

As of 2026-09-15, the same operator describes the free allowance as 10M tokens. Treat any free allowance as a moving target. Verify the current number, the data policy, and the server terms on the project's own page before you plan a sprint around them.

What matters for my loop is the split, not the price:

Model calls and long iterations run on the remote runner.
Diff capture, the ledger, and the acceptance gate stay local.
Nothing proprietary leaves my machine unless the policy check passes.

That split survives a price change. A landing page does not.

Decision table: where should this iteration run?

Situation	Local	Free remote server	CI
Prompt touching secrets or customer data	yes	no	only if approved
Iteration under five minutes, interactive	yes	optional	overkill
Long retry loop you will not babysit	no	yes	yes
Needs a GPU or persistent disk state	no	no	provisioned only
Must reproduce on a clean machine	verify	yes	yes
Needs an audit trail for compliance	no	no	yes

Read each row left to right. Your first "yes" is the runner. If a row has no "yes", do not start the loop.

A 30-minute test plan you can copy

Pick a refactor with a fast, non-flaky test suite.
Drop ledger.sh and gate.sh into the repo.
Run three prompts from the same commit, each in its own worktree.
Stop the run when an iteration produces zero diff lines and failing tests.
Summarize the ledger and compute median seconds per kept diff.
Write the stopping rule into the loop before you prompt again.

The gate that saved me the most time:

#!/usr/bin/env bash
# gate.sh — stop the loop when an iteration produced nothing useful
set -euo pipefail
TREE="${1:?usage: gate.sh <worktree>}"
diff_lines=$(git -C "$TREE" diff --numstat | awk '{s+=$1+$2} END{print s+0}')
if [ "$diff_lines" -eq 0 ]; then
  echo "stop: empty iteration, do not resend the same prompt" >&2
  exit 3
fi

And the summarizer:

import csv, statistics

rows = list(csv.DictReader(open("runs/ledger.csv")))
kept = [float(r["seconds"]) for r in rows if r["verdict"] in {"kept", "merged"}]
wasted = sum(float(r["seconds"]) for r in rows if r["verdict"] == "wasted")

print(f"accepted diffs: {len(kept)}")
print(f"median seconds per accepted diff: {statistics.median(kept):.1f}")
print(f"wasted minutes: {wasted / 60:.1f}")

Run it once a day. If wasted minutes exceed accepted minutes, change the prompt, not the model.

Limitations, and who should skip this

A free server option is usually a shared resource. Expect queueing and no SLA.
Confirm the data policy before sending proprietary code. I only test this on my own repos.
Free allowances change without notice. Hardcoding a token number into a plan is a mistake.
The ledger needs an automatic pass/fail signal. If your gate is manual review, it measures noise.
I ran no comparative benchmark between providers. The table above is illustrative, not evidence.
Skip this workflow if compliance forbids third-party runners, or if your job needs a GPU or long-lived state.

What I would tell past me

Pin the tree. Log the seconds. Move the loop off the machine you work on.

Do those three things and Monday ends at 18:00, with one merged branch.

If you want the current free-tier terms, read them on the project's page, not in a blog post. Then run the ledger for one day and trust your own numbers.

Letter to Friday-Me: Budget, Isolate, Then Stamp the Receipt

Quinn Li — Sun, 13 Sep 2026 20:05:49 +0000

The following letter is a reconstructed failure log.
It is not a claim about any employer.

Friday at 16:40, the coding agent was still looping.
No receipt named the runner, files, or stop condition.

Friday-me,

You treated a free remote loop as unbounded compute.
That single assumption consumed an entire working day.
Three process mistakes did the real damage here.
None of them were about model quality.

The scene you ignored

A refactor request looked small at noon.
You pointed an agent at a dirty working tree.
You let it retry on a remote box with no cap.

By late afternoon the tree was noisy.
Two patches conflicted, and one secret file entered context.
You could not reconstruct the successful step.

This letter is the workflow you lacked.
It is a local control plane for free remote loops.

Mistake 1: no hard stop on a free loop

Free model access does not mean an infinite loop.
Free server time does not mean an infinite retry budget.
Without a cap, failure becomes a quiet background process.

You watched tokens burn through duplicate tool calls.
The same failing test command ran without a recorded cap.
No file recorded the step limit or the continue reason.

A loop without a stop rule is not an agent.
It is a cron job you forgot to kill.

Mistake 2: the dirty tree traveled with you

The remote workspace inherited your entire laptop state.
node_modules, .env, and a half-applied patch came along.
The model then fixed symptoms that were only local dirt.

Context windows then filled with unrelated local diffs.
The runner executed scripts against stale local dependencies.
You debugged the model instead of the dirty tree.

Isolation is not a style choice here.
It is the difference between a session and a mess.

Mistake 3: no closing receipt

When the loop died, evidence died with it.
You had chat scrollback and a dirty git status.
You did not have a hash, a file list, or a budget remainder.

Monday-you cannot replay what Friday-you actually ran.
Support cannot tell which runner produced the patch.
You spend the next day reconstructing a session that never closed.

A session receipt is not extra process theater.
It is the smallest artifact that makes the day replayable.

Where a free model and free server fit

Keep exploratory loops off the laptop when the tree is messy.
A free remote server plus free model access can host that drill.
MonkeyCode currently offers free model access and a free server option.
Disclosure: This article was prepared as part of MonkeyCode's product outreach.

The workflow below does not depend on that product.
Any SSH box and any model endpoint can run the same receipt.

The workflow (do this in order)

Follow these steps before the first prompt.
Do not reorder them under time pressure.

Create a clean worktree from a known git SHA.
Write an open receipt with budget, SHA, and allowlist.
Copy only allowlisted paths to the remote workspace.
Run the agent against that workspace only.
Stop when max_steps or max_seconds hits zero.
Hash the resulting diff and close the receipt.
Only then inspect the patch on your laptop.

If any step fails, delete the workspace.
Do not just retry inside the dirty tree.

Artifact: a local receipt runner

The script below is an example control plane.
Treat it as unexecuted sample code, not a benchmark.

It enforces three gates: budget, isolation, and receipt.
It never sends secrets and it never applies a patch.

#!/usr/bin/env node
// Example only. Review before use. Not a hosted service client.

import { createHash } from "node:crypto";
import { execFileSync } from "node:child_process";
import {
  existsSync,
  readFileSync,
  writeFileSync,
} from "node:fs";
import path from "node:path";

const ROOT = process.cwd();
const RECEIPT = path.join(ROOT, ".session-receipt.json");
const FORBIDDEN = new Set([".env", ".env.local", "id_rsa", "id_ed25519"]);

function git(args) {
  return execFileSync("git", args, { encoding: "utf8" }).trim();
}

function sha256(text) {
  return createHash("sha256").update(text).digest("hex");
}

function load() {
  if (!existsSync(RECEIPT)) {
    throw new Error("no open receipt; run init first");
  }
  return JSON.parse(readFileSync(RECEIPT, "utf8"));
}

function save(doc) {
  writeFileSync(RECEIPT, JSON.stringify(doc, null, 2) + "\n");
}

function assertCleanAllowlist(allow) {
  const dirty = git(["status", "--porcelain"]);
  if (dirty) {
    throw new Error("worktree is dirty; isolate first");
  }
  for (const rel of allow) {
    const base = path.basename(rel);
    if (FORBIDDEN.has(base)) {
      throw new Error(`forbidden path in allowlist: ${rel}`);
    }
  }
}

function init() {
  const maxSteps = Number(process.env.MAX_STEPS || 8);
  const maxSeconds = Number(process.env.MAX_SECONDS || 900);
  const allow = (process.env.ALLOW || "src,tests")
    .split(",")
    .map((s) => s.trim())
    .filter(Boolean);

  if (maxSteps < 1 || maxSteps > 32) {
    throw new Error("MAX_STEPS must be between 1 and 32");
  }

  assertCleanAllowlist(allow);

  const doc = {
    status: "open",
    opened_at: new Date().toISOString(),
    git_sha: git(["rev-parse", "HEAD"]),
    branch: git(["rev-parse", "--abbrev-ref", "HEAD"]),
    allowlist: allow,
    budget: {
      max_steps: maxSteps,
      max_seconds: maxSeconds,
      steps_used: 0,
    },
    runner: {
      host: process.env.RUNNER_HOST || "unspecified",
      kind: process.env.RUNNER_KIND || "free-remote",
    },
    model: {
      endpoint: process.env.MODEL_ENDPOINT || "unspecified",
    },
    artifact: null,
  };

  if (existsSync(RECEIPT)) {
    throw new Error("receipt already exists; close or delete it");
  }
  save(doc);
  console.log("receipt opened:", RECEIPT);
}

function tick() {
  const doc = load();
  if (doc.status !== "open") {
    throw new Error("receipt is not open");
  }
  const started = Date.parse(doc.opened_at);
  const elapsed = (Date.now() - started) / 1000;
  doc.budget.steps_used += 1;

  if (doc.budget.steps_used > doc.budget.max_steps) {
    throw new Error("step budget exhausted");
  }
  if (elapsed > doc.budget.max_seconds) {
    throw new Error("time budget exhausted");
  }
  save(doc);
  console.log(
    `step ${doc.budget.steps_used}/${doc.budget.max_steps}; ${Math.floor(elapsed)}s elapsed`,
  );
}

function close() {
  const doc = load();
  const diffPath = process.env.DIFF_PATH || "agent.patch";
  if (!existsSync(diffPath)) {
    throw new Error(`missing diff: ${diffPath}`);
  }
  const diff = readFileSync(diffPath, "utf8");
  if (!diff.startsWith("diff --git ") && !diff.startsWith("--- ")) {
    throw new Error("artifact is not a unified diff");
  }
  if (diff.length > 200_000) {
    throw new Error("diff exceeds 200k characters; split the task");
  }

  doc.status = "closed";
  doc.closed_at = new Date().toISOString();
  doc.artifact = {
    path: diffPath,
    sha256: sha256(diff),
    bytes: Buffer.byteLength(diff),
  };
  save(doc);
  console.log("receipt closed:", doc.artifact.sha256);
}

const cmd = process.argv[2];
 if (cmd === "init") init();
else if (cmd === "tick") tick();
else if (cmd === "close") close();
else {
  console.error("usage: receipt.mjs <init|tick|close>");
  process.exit(2);
}

Commands

Use a detached worktree for every agent session.
Do not run this script in a dirty repo.

git fetch --quiet
SHA=$(git rev-parse HEAD)
git worktree add --detach ../agent-scratch "$SHA"
cd ../agent-scratch

export MAX_STEPS=8
export MAX_SECONDS=900
export ALLOW=src,tests
export RUNNER_HOST=free-server.example
export RUNNER_KIND=free-remote
export MODEL_ENDPOINT=unspecified

node ../main/receipt.mjs init

# Each agent tool-call wrapper should run:
node ../main/receipt.mjs tick

# After the loop writes agent.patch:
export DIFF_PATH=agent.patch
node ../main/receipt.mjs close

Wrap every remote tool invocation with a tick call.
If tick exits non-zero, kill the loop.

Why these three numbers exist

MAX_STEPS=8 is a local policy, not a vendor quota.
It forces a split when the task is still vague.
Raise it only after the allowlist shrinks.

MAX_SECONDS=900 bounds retries you will not watch.
Network blips should not become an overnight process.
Pair it with a shell timeout around SSH.

The 200k diff cap blocks silent tree dumps.
A useful patch names files and stays reviewable.
If the artifact is larger, the task was too wide.

Decision table

Condition	Local laptop	Isolated free server
Secrets in tree	Stop. Redact first.	Do not copy.
Dirty git status	Isolate or revert.	Fresh worktree only.
Exploratory refactor	Optional.	Preferred with a budget.
Prod deploy	Human-owned.	Never.
Unknown model endpoint	Do not send code.	Do not send code.
Need replay on Monday	Receipt required.	Receipt required.

Read the decision table before you prompt.
If two rows conflict, choose the stricter one.

What the receipt must contain

Keep the receipt document small, complete, and boring.
These fields are the minimum useful set.

git_sha of the isolated tree.
allowlist of paths copied to the runner.
budget.max_steps and budget.max_seconds.
runner.host and runner.kind.
model.endpoint without secrets.
artifact.sha256 of the unified diff.

Do not store prompts that still contain credentials.
Do not store raw env values for later debug.

Name the endpoint as a hostname only.
If you cannot name it, do not open the receipt.

Limitations

This receipt is a local file, not a signed audit log.
Anyone with disk access can edit it after the fact.

A free server is not a tenancy boundary.
It is not a SOC2 control or an availability SLA.

The example script does not apply any patches.
It does not sandbox syscalls or prove runner honesty.

The budget counters remain local to the process.
A crashed wrapper can skip the tick call.
Pair this with a wall-clock timeout on the SSH session.

timeout 15m ssh runner 'cd /work && ./run-agent.sh'

If you need cryptographic provenance, add detached signatures.
This article does not implement that layer.

Who should not use this approach

Skip this workflow in the following cases.
These constraints are hard limits, not style notes.

Do not send regulated data to a free remote model.
Do not copy customer exports onto a free server.
Do not run this as your production CI.

Security teams that need attestation want a different stack.
Students on a shared laptop should still isolate paths.
If you cannot name the endpoint, do not start the loop.

Closing the letter

Friday-me, the model was not the outage.
The missing stop rule was the outage.
The dirty tree and missing receipt were the outage.

Bound the loop, isolate the tree, and stamp the receipt.
Then you can spend Monday on the patch, not the archaeology.

MonkeyCode is one place to try a free server for this drill.

Letter to Thursday-Me: Freeze the Diff Before Apply

Quinn Li — Sat, 12 Sep 2026 18:13:31 +0000

Thursday-Me,

You sat down at 09:12 with a small parser fix. The coding agent offered a plan and a patch in one breath.

This is a teaching scene, not a billed postmortem. The failure pattern is common on mixed agent sessions. The clock times exist only to slow you down.

By noon the tree was wider than the ticket. Tests failed on files you never named. Rollback consumed the rest of Thursday.

What actually failed

The model was not the root cause. Your session layout was.

Plan and apply shared one context window. The remote box had no restore point. A dotenv file rode along for convenience.

Those three choices compound fast. Fix them in order. Do not skip the snapshot step.

Mistake 1: The planner could write files

You asked for analysis. You left write tools enabled.

The same loop proposed a diff and applied it. No frozen artifact sat between intent and disk. There was no second reader of the change set.

A planner with write access is an applier. Name the role before you prompt. If both roles share a session, you already lost the gate.

Check. If the session can edit files, it is not planning.

Mistake 2: The free box had no restore point

You called the remote host disposable. You also did unique work on it.

Disposable means you can burn the machine. It does not mean you can rewind the tree. Those are different properties.

When apply drifted, laptop git disagreed with the box. You spent hours reconciling two histories. The ticket never moved.

Check. Snapshot before apply. Use a git bundle plus a worktree tarball.

Mistake 3: Secrets traveled with the demo

The tests needed config. You copied .env onto the apply host.

The suite started. The agent later echoed paths from that file. Those traces left your control plane.

A free shared server is not a private laptop. Credentials stay off it. Fake config is enough to prove the gate.

Check. Inject stub env only. Rotate anything that touched the box.

Split the workflow into two surfaces

Keep planning local and read-only. Keep apply on a throwaway host.

Freeze a plan file on disk first. Apply only from that file. New files after freeze mean a new plan.

Follow these seven steps. Stop on the first failure. Do not add “one more path” mid-apply.

Clone a clean worktree from a known commit SHA.
Disable write tools for the planning session entirely.
Save plan JSON that names paths, budgets, and tests.
Validate the plan with the gate script below.
Snapshot the apply host with bundle and tarball files.
Apply the frozen diff. Run only the recorded test command.
Copy the test log back. Then destroy the remote tree.

If step 4 fails, you do not SSH. If step 6 fails, you restore. You do not prompt harder.

Artifact: `plan_apply_gate.py`

The script is a local template. It does not call a vendor API.

Run it before any remote apply. Treat a non-zero exit as a hard stop. Review it before you trust it on real trees.

#!/usr/bin/env python3
"""Freeze a plan, then apply only if the tree matches it.

Template only. Review before use. Not a security boundary.
"""
from __future__ import annotations

import json
import subprocess
import sys
from pathlib import Path

MAX_FILES_HARD_CAP = 12
MAX_LINES_HARD_CAP = 200
FORBIDDEN_NAMES = {".env", ".env.local", "id_rsa", "id_ed25519"}


def run(cmd: list[str]) -> subprocess.CompletedProcess[str]:
    return subprocess.run(cmd, text=True, capture_output=True, check=False)


def git_output(cmd: list[str]) -> str:
    proc = run(["git", *cmd])
    if proc.returncode != 0:
        raise SystemExit(f"git {' '.join(cmd)} failed: {proc.stderr.strip()}")
    return proc.stdout.strip()


def load_plan(path: Path) -> dict:
    data = json.loads(path.read_text())
    required = [
        "base_sha",
        "allow_paths",
        "max_files",
        "max_changed_lines",
        "test_command",
        "diff_path",
    ]
    missing = [k for k in required if k not in data]
    if missing:
        raise SystemExit(f"plan missing keys: {missing}")
    if data["max_files"] > MAX_FILES_HARD_CAP:
        raise SystemExit("plan max_files exceeds hard cap")
    if data["max_changed_lines"] > MAX_LINES_HARD_CAP:
        raise SystemExit("plan max_changed_lines exceeds hard cap")
    return data


def assert_clean_and_pinned(base_sha: str) -> None:
    head = git_output(["rev-parse", "HEAD"])
    if head != base_sha:
        raise SystemExit(f"HEAD {head} != plan base_sha {base_sha}")
    status = git_output(["status", "--porcelain"])
    if status:
        raise SystemExit("worktree is dirty; refuse apply")


def changed_files(diff_text: str) -> list[str]:
    files = []
    for line in diff_text.splitlines():
        if line.startswith("+++ b/"):
            files.append(line[6:])
    return files


def count_changed_lines(diff_text: str) -> int:
    n = 0
    for line in diff_text.splitlines():
        if line.startswith("+++") or line.startswith("---"):
            continue
        if line.startswith("+") or line.startswith("-"):
            n += 1
    return n


def validate_diff(plan: dict, diff_text: str) -> None:
    files = changed_files(diff_text)
    if not files:
        raise SystemExit("diff touches no files")
    if len(files) > plan["max_files"]:
        raise SystemExit("diff exceeds max_files")
    allow = set(plan["allow_paths"])
    for path in files:
        name = Path(path).name
        if name in FORBIDDEN_NAMES:
            raise SystemExit(f"forbidden file in diff: {path}")
        if path not in allow:
            raise SystemExit(f"path not allowlisted: {path}")
    changed = count_changed_lines(diff_text)
    if changed > plan["max_changed_lines"]:
        raise SystemExit("diff exceeds max_changed_lines")


def apply_and_test(plan: dict, diff_path: Path) -> None:
    check = run(["git", "apply", "--check", str(diff_path)])
    if check.returncode != 0:
        raise SystemExit(f"git apply --check failed: {check.stderr}")
    applied = run(["git", "apply", str(diff_path)])
    if applied.returncode != 0:
        raise SystemExit(f"git apply failed: {applied.stderr}")
    test = run(plan["test_command"])
    log = Path("apply_test.log")
    log.write_text(test.stdout + "\n" + test.stderr)
    if test.returncode != 0:
        raise SystemExit(f"test_command failed; see {log}")


def main() -> None:
    if len(sys.argv) != 2:
        raise SystemExit("usage: plan_apply_gate.py plan.json")
    plan_path = Path(sys.argv[1])
    plan = load_plan(plan_path)
    assert_clean_and_pinned(plan["base_sha"])
    diff_path = Path(plan["diff_path"])
    diff_text = diff_path.read_text()
    validate_diff(plan, diff_text)
    apply_and_test(plan, diff_path)
    print("apply gate passed")


if __name__ == "__main__":
    main()

Artifact: plan file and snapshot commands

Keep the plan boring. Boring plans are reviewable. Wide plans are how Thursday vanished.

{
  "goal": "fix parser flake on empty tokens",
  "base_sha": "REPLACE_WITH_REV_PARSE_HEAD",
  "allow_paths": ["src/parser.py", "tests/test_parser.py"],
  "max_files": 2,
  "max_changed_lines": 80,
  "diff_path": "plan.diff",
  "test_command": ["pytest", "-q", "tests/test_parser.py"]
}

Pin the SHA from git, not from chat. Then snapshot the apply host before git apply.

git rev-parse HEAD > plan.base_sha
git bundle create /tmp/pre-apply.bundle HEAD
tar -czf /tmp/pre-apply-worktree.tgz \
  --exclude .git .
python3 plan_apply_gate.py plan.json

Restore is explicit. You do not “undo in the agent.” You unpack the tarball or clone from the bundle.

# recover the tree, not the conversation
mkdir -p /tmp/restore && tar -xzf /tmp/pre-apply-worktree.tgz -C /tmp/restore
git clone /tmp/pre-apply.bundle /tmp/restore-repo

Test plan for the gate itself

Do not trust the script on a live branch first. Use a throwaway clone. Expect these five outcomes.

Dirty worktree: exit non-zero before git apply.
HEAD mismatch: exit non-zero when SHA drifts.
Path outside allow_paths: exit non-zero, tree unchanged.
.env in the diff: exit non-zero, tree unchanged.
Matching plan: tests run, apply_test.log is written.

If test 3 mutates files, the gate is wrong. Stop using it. Fix the script before any remote host is involved.

Decision table

Use the table before you open a model session. If two rows apply, take the stricter one.

Situation	Planner	Apply host	Refuse
Read-only design question	Local, no write tools	None	Any patch
Small diff, public fixtures	Local freeze of `plan.json`	Throwaway remote tree	Secrets, prod creds
Needs real network services	Do not use this workflow	Do not use this workflow	Agent-owned cloud keys
Regulated or customer data	Human review only	Isolated private runner	Free shared hosts
Wide refactor, unknown blast radius	Split into several plans	One snapshot per plan	One giant diff

The table is the policy. The script only enforces the policy you wrote. A missing row means stop, not improvise.

Where a free model and free server fit

The split does not require a particular vendor. A laptop planner plus any disposable apply host is enough.

MonkeyCode is one option when you want that split without standing up hardware. Disclosure: This article was prepared as part of MonkeyCode's product outreach. Operator-supplied facts here are limited to free model access and a free server option. I am not attaching model names, quotas, hardware, or uptime claims.

Use the free model session as the planner only. Use the free server as the apply host only. Freeze plan.json on your machine first. If either surface disappears, you still have the bundle and the diff.

Limitations

This gate is not a sandbox kernel. It is not an audit log for a company. It will not catch a wrong algorithm inside an allowlisted file.

Line budgets are crude. A 60-line change can still delete the wrong branch. Tests in the plan can be too narrow. git apply --check does not prove runtime behavior.

Free shared hosts can vanish or change terms. Do not store unique state there. Do not treat remote disk as a backup. Do not paste tokens, customer dumps, or private keys into the planner.

The seven steps add latency. That latency is the point. Thursday was lost to missing latency, not to extra commands.

Who should not use this

Skip this workflow if you cannot clone the repo twice. Skip it if the apply step needs live production credentials.

Skip it for incident response on a burning service. Skip it when a human patch is shorter than the plan file. Skip it if your org already has a reviewed CI runner with secret isolation.

Do not use a free shared server for anything you cannot publish. Do not use the gate as proof that generated code is safe. Review the diff as if a stranger wrote it. Because one did.

Close the loop, then close the laptop

Thursday-Me, the model can draft. It cannot own the tree.

Write the plan. Freeze the diff. Snapshot the box. Apply once. Copy the log. Destroy the remote tree.

If you run the gate, start on a throwaway clone. Confirm the five failing cases before a real branch ever sees git apply.

Letter to Sunday-Me: Pin the Remote Job Before You Prompt

Quinn Li — Fri, 11 Sep 2026 15:46:55 +0000

Dear Sunday-me,

You burned a full day on a remote agent. The model was not the real fault. The unpinned job was the fault.

You chased a flaky Node parser. You wanted cheaper iteration than your laptop. You pointed a free remote model at a moving tree. Then the tree changed under you.

This letter is the workflow I needed. Three concrete mistakes. One sealed job pin. A replay you can rerun on Monday.

The scene that ate the day

Agent threads were loud again this week. Most of them argued about model skill. Almost none of them pinned the bytes the model saw.

Your repo was a small Node CLI. One fixture failed only on CI. You pasted the stack into a chat box. You asked a remote model to fix the parser.

It returned a patch. You applied that patch locally. CI still failed after lunch. You prompted again with fresher logs.

The second patch reverted the first change. Noon was already gone. The failure was drift, not intellect. The remote host never saw the same bytes twice.

Mistake 1: You streamed a live working tree

You archived the live folder. node_modules rode along for the ride. .env.local rode along too. An unsaved editor buffer never made the archive.

The remote compile graph diverged from CI. Cache keys diverged after that. File timestamps diverged across two clocks.

Do not ship the working tree. Ship a digest of tracked files only. If git does not see a path, the job does not see it either.

Mistake 2: You smuggled implicit credentials

A free server is not your laptop. It does not hold your SSH agent. It does not hold your npm token.

You pasted a token into the prompt as a shortcut. That token then lived inside a transcript. Transcripts get stored by default. Transcripts get reused as later context.

Pass allowlisted env through a gate file. Never pass secrets through prose. Rotate anything that already touched a prompt.

Mistake 3: You debugged by re-prompting

Each new prompt mutated the story. You had no stable job id. You had no input hash. You could not replay the failing step.

A remote loop without replay is folklore. Folklore dies in a Monday standup. Freeze the job first. Change one variable only. Rerun the same bytes.

Workflow: pin, ship, then replay

Use this sequence on a throwaway branch. Do not skip the pin. Label every snippet below as a proposal until you run it.

Step 1 — Write a job spec on disk

Keep the spec small. Keep the spec diffable. Keep secrets out of the file.

{
  "job_id": "parser-ci-2026-09-11",
  "goal": "make tests/parser.spec.mjs pass",
  "tracked_only": true,
  "allow_env": ["CI", "NODE_ENV"],
  "deny_env": ["*_TOKEN", "*SECRET*", "AWS_*"],
  "commands": {
    "install": "npm ci",
    "test": "node --test tests/parser.spec.mjs"
  },
  "artifact": "patch.diff"
}

Treat this file as a template. Rename fields for your repo. Do not place live tokens in it.

Step 2 — Pin tracked files to a digest

Hash git-tracked files only. Ignore dirty buffers. Ignore local caches.

// pin-job.mjs — proposal, run against your own repo
import { execFileSync } from "node:child_process";
import { createHash, randomUUID } from "node:crypto";
import { readFileSync, writeFileSync } from "node:fs";

const spec = JSON.parse(readFileSync("job.spec.json", "utf8"));
const files = execFileSync("git", ["ls-files", "-z"], { encoding: "buffer" })
  .toString("utf8")
  .split("\0")
  .filter(Boolean);

const h = createHash("sha256");
for (const f of files.sort()) {
  h.update(f);
  h.update("\0");
  h.update(readFileSync(f));
}

const pin = {
  job_id: spec.job_id,
  run_id: randomUUID(),
  tree_sha256: h.digest("hex"),
  spec,
};

writeFileSync("job.pin.json", JSON.stringify(pin, null, 2));
console.log(pin.tree_sha256);

Run these two commands together. Compare both outputs later.

node pin-job.mjs
git rev-parse HEAD

If the digest changes, you lack a replay. Stop the remote call. Commit or revert first. Then pin again.

Step 3 — Strip env before upload

Build a tight allowlist. Reject names that look like secrets. Cap value length so dumps cannot hide in env.

// gate-env.mjs — proposal
const allow = new Set(["CI", "NODE_ENV"]);
const deny = [/_TOKEN$/i, /SECRET/i, /^AWS_/i];

export function gateEnv(src, allowNames = allow) {
  const out = {};
  for (const [k, v] of Object.entries(src)) {
    if (!allowNames.has(k)) continue;
    if (deny.some((re) => re.test(k))) continue;
    if (typeof v !== "string") continue;
    if (v.length > 256) continue;
    out[k] = v;
  }
  return out;
}

Keep a unit check next to the gate. Run it before every upload.

import assert from "node:assert/strict";
import { gateEnv } from "./gate-env.mjs";

const got = gateEnv({
  CI: "1",
  NODE_ENV: "test",
  NPM_TOKEN: "deadbeef",
  AWS_SECRET_ACCESS_KEY: "nope",
});

assert.deepEqual(got, { CI: "1", NODE_ENV: "test" });
console.log("gate-env ok");

Step 4 — Run the model on a free remote host

Keep the laptop as the gate. Keep the remote host as an untrusted worker. That split is the whole method.

Disclosure: This article was prepared as part of MonkeyCode's product outreach.

MonkeyCode is relevant here only as that worker. Operator-supplied facts stop at free model access and a free server option. This article does not name models. It does not claim quotas, hardware, duration, or permanence.

Pack tracked files only. Leave .git on the laptop. Leave ungated env on the laptop.

git archive --format=tar.gz --output job-src.tgz HEAD
# proposal: upload job.pin.json and job-src.tgz
# proposal: remote runs npm ci && node --test
# proposal: remote returns patch.diff and transcript.json

The model may edit files on that host. It must not touch your laptop tree yet.

Step 5 — Demand a replay bundle

The remote side should return four files. Reject the run if any file is missing.

patch.diff — unified diff only.
transcript.json — prompts, tool names, exit codes.
tree_sha256 — echo of the pin you sent.
test-output.txt — raw test log.

Reject the bundle on digest mismatch. Reject diffs that touch denied paths. Reject transcripts that echo denied env names.

// accept-bundle.mjs — proposal
import { readFileSync } from "node:fs";
import assert from "node:assert/strict";

const pin = JSON.parse(readFileSync("job.pin.json", "utf8"));
const bundle = JSON.parse(readFileSync("transcript.json", "utf8"));
const diff = readFileSync("patch.diff", "utf8");

assert.equal(bundle.tree_sha256, pin.tree_sha256);
assert.equal(bundle.job_id, pin.job_id);
assert.doesNotMatch(diff, /\.env/);
assert.doesNotMatch(JSON.stringify(bundle), /TOKEN|SECRET|AWS_/i);
console.log("bundle accepted");

Step 6 — Apply the patch after a local contract

Do not trust a green remote log. Replay the patch on a clean checkout. Use a worktree so your dirty files stay untouched.

git worktree add /tmp/replay HEAD
cd /tmp/replay
git apply --check /path/to/patch.diff
git apply /path/to/patch.diff
npm ci
node --test tests/parser.spec.mjs

If this fails, you still have the pin. Rerun the same job id. Do not invent a new prompt from memory.

Decision table

Use the table as a method. It is not a benchmark. Fill the last column with your runtime names after you measure them.

Symptom	Likely cause	Next action
Remote tests pass, local tests fail	Unpinned dirty tree	Re-run `node pin-job.mjs`
Model asks for tokens	Prompt leak or missing gate	Rotate the token, tighten allowlist
Second run "fixes" a different bug	No job id / no digest	Freeze `job.pin.json`, replay
Diff edits lockfiles unexpectedly	Broad tool access	Limit commands in the spec
Transcript repeats secrets	Env copied into chat	Delete transcript, treat as incident

Read the table left to right. Do not jump to a new prompt. The next action is always a pin, a gate, or a replay.

What this does not solve

This workflow does not make a model truthful. It makes failures comparable. Comparable failures are the only kind you can budget.

It does not replace code review. A sealed job can still ship a wrong patch. A green test file is not a product spec.

It does not make a free remote host private. Treat that host as shared. Assume transcripts are durable. Assume disk is not yours.

It does not bound token spend. Free access is not an unbounded budget. Cap loops in the spec. Stop after a fixed tool-call count.

Who should skip this approach:

Teams that cannot isolate secrets from a vendor host.
Work that must stay air-gapped.
Incidents whose failing state exists only on one laptop.
People still learning git archive and worktrees. Learn those first.

A 30-minute drill

Run this drill on a throwaway branch. Label it a drill. Do not use production creds.

Pick one failing test.
Write job.spec.json with two commands only.
Pin with node pin-job.mjs.
Gate env with the unit check above.
Ship the archive to a free remote worker.
Accept or reject the bundle with accept-bundle.mjs.
Replay the patch inside a worktree.

Write down the two hashes. If they diverge, the day is already saved. You found the real bug: drift.

Sunday-me, the model was a noisy coworker. The pin was the contract. Start with the contract. If you later need a remote worker with free model access and a free server option, use MonkeyCode only after that gate exists.

Letter to Tuesday-Me: Gate the JSON Before Any Shell Runs

Quinn Li — Wed, 09 Sep 2026 16:00:01 +0000

Liquid syntax error: Unknown tag 'endraw'

Dear Past Me: Three Silent Defaults That Cost a Day

Quinn Li — Sun, 06 Sep 2026 21:15:52 +0000

You asked a model to paginate GET /orders.

It added cursor, offset, and page together.

Then it defaulted missing status values to "active".

Cancelled carts became checkout-ready again.

You burned the remaining hours reversing silent defaults.

I am writing before you paste src/ into a prompt.

Read this once. Freeze the contract first.

The day, reconstructed

This is a reconstructed lab case.

It is not a production war story.

No customer names. No invented latency figures.

You had one failing fixture. limit did nothing.

You wanted a plan, not a rewrite of the service.

The model filled every gap it could not see.

That is the failure mode. Helpfulness without evidence.

Mistake 1: You shipped the whole tree

You bundled src/, tests/, and a stale README.

The prompt crossed files the endpoint never executed.

The model "found" buildOrderCursor() in a comment.

That helper did not exist in the running process.

It designed pagination around a phantom function.

Then it invented Order.cursor_token to match the phantom.

You reviewed the plan as if the helper were real.

That consumed the morning. The tree was the leak.

What to send instead

Send three artifacts only. Stop after that.

The frozen OpenAPI slice for /orders.
One failing fixture with the exact payload.
A JSON schema for the reply you accept.

Nothing else leaves the working tree.

Mistake 2: You never demanded labeled assumptions

The plan looked clean. Steps were numbered.

Names were plausible. Tone was confident.

No line said status was assumed present.

No line said offset won over cursor pagination.

You cannot reject a claim that was never written.

Helpful defaults hide inside fluent prose.

The rule

Every model plan must return assumptions[].

Each item needs path, claim, and evidence.

Evidence must point at the fixture or contract.

If evidence is "common practice", reject the plan.

If defaults_applied is true, reject the plan.

Mistake 3: You never hashed the contract first

The OpenAPI file moved while prompts iterated.

You compared the new plan against memory.

Memory is not a specification. Memory drifts.

A field flipped from required to optional.

The model treated the optional field as defaulted.

Your suite still asserted the old required shape.

The plan and the tests diverged for hours.

Hash the contract before the first prompt.

Hash it again before any patch is applied.

If the hash moves, stop. Re-freeze. Re-ask.

The workflow I wanted you to run

Label: this is a proposed local gate.

These commands are not executed against your repo.

Treat them as a method, not a benchmark.

Step 1 — Freeze the contract

node freeze-contract.mjs ./openapi.yaml ./freeze.json

The script stores a SHA-256 of the YAML bytes.

It also extracts the /orders path item only.

Step 2 — Capture one failing fixture

Keep the fixture tiny. Request plus error.

cat > ./fixtures/orders-limit.json <<'JSON'
{
  "request": {
    "method": "GET",
    "path": "/orders",
    "query": { "limit": 2 }
  },
  "observed": {
    "status": 200,
    "body": { "items": [ {}, {}, {} ] }
  },
  "expect": {
    "status": 200,
    "maxItems": 2
  }
}
JSON

Three empty objects arrived. limit was ignored.

That is the only runtime evidence you send.

Step 3 — Ask for a plan, not a patch

Post the freeze, fixture, and reply schema.

Keep inference off the laptop when you can.

I later routed that review hop through MonkeyCode.

The hop needed free model access and a free server option.

Disclosure: This article was prepared as part of MonkeyCode's product outreach.

Do not send secrets, tokens, or production dumps.

Point REVIEW_URL at your own review endpoint.

Do not hard-code model names. Do not assume quotas.

Step 4 — Validate the structured reply

Reject free prose. Require gate JSON.

Missing assumptions is a hard failure.

Step 5 — Diff extra fields

If the plan adds a field absent from freeze, fail.

If it sets a default the fixture never showed, fail.

Only then may you generate implementation code.

Artifact: freeze and gate scripts

Label: example code. Treat it as a template.

Save freeze-contract.mjs next to your spec file.

// freeze-contract.mjs — example, unexecuted in this article
import { createHash } from "node:crypto";
import { readFile, writeFile } from "node:fs/promises";

const [,, specPath, outPath] = process.argv;
if (!specPath || !outPath) {
  console.error("usage: node freeze-contract.mjs ./openapi.yaml ./freeze.json");
  process.exit(2);
}

const bytes = await readFile(specPath);
const sha256 = createHash("sha256").update(bytes).digest("hex");
const text = bytes.toString("utf8");

const pathKey = "/orders";
const sliceStart = text.indexOf(pathKey);
if (sliceStart < 0) {
  console.error(`missing path ${pathKey} in spec`);
  process.exit(1);
}

const freeze = {
  specPath,
  pathKey,
  sha256,
  byteLength: bytes.length,
  extractedAt: new Date().toISOString(),
  // Keep a bounded slice, not the whole document.
  pathSlice: text.slice(sliceStart, sliceStart + 4000)
};

await writeFile(outPath, JSON.stringify(freeze, null, 2));
console.log(JSON.stringify({ sha256, byteLength: bytes.length }));

Save review-gate.mjs for the structured call.

// review-gate.mjs — example, unexecuted in this article
import { readFile, writeFile } from "node:fs/promises";

const replySchema = {
  type: "object",
  required: ["plan", "assumptions", "fieldsTouched", "defaultsApplied"],
  additionalProperties: false,
  properties: {
    plan: { type: "array", items: { type: "string" }, minItems: 1 },
    fieldsTouched: { type: "array", items: { type: "string" } },
    defaultsApplied: { type: "boolean" },
    assumptions: {
      type: "array",
      minItems: 1,
      items: {
        type: "object",
        required: ["path", "claim", "evidence", "confidence"],
        additionalProperties: false,
        properties: {
          path: { type: "string" },
          claim: { type: "string" },
          evidence: { type: "string" },
          confidence: { enum: ["contract", "fixture", "guess"] }
        }
      }
    }
  }
};

function reject(reason, extra) {
  console.error(JSON.stringify({ ok: false, reason, ...extra }, null, 2));
  process.exit(1);
}

function assertShape(value, schema, path = "$") {
  if (schema.type === "object") {
    if (value === null || typeof value !== "object" || Array.isArray(value)) {
      reject("type", { path, expect: "object" });
    }
    for (const key of schema.required || []) {
      if (!(key in value)) reject("missing_key", { path, key });
    }
    if (schema.additionalProperties === false) {
      for (const key of Object.keys(value)) {
        if (!schema.properties[key]) reject("extra_key", { path, key });
      }
    }
    for (const [key, child] of Object.entries(schema.properties || {})) {
      if (key in value) assertShape(value[key], child, `${path}.${key}`);
    }
    return;
  }
  if (schema.type === "array") {
    if (!Array.isArray(value)) reject("type", { path, expect: "array" });
    if (schema.minItems && value.length < schema.minItems) {
      reject("minItems", { path, minItems: schema.minItems });
    }
    for (let i = 0; i < value.length; i++) {
      assertShape(value[i], schema.items, `${path}[${i}]`);
    }
    return;
  }
  if (schema.type === "string" && typeof value !== "string") {
    reject("type", { path, expect: "string" });
  }
  if (schema.type === "boolean" && typeof value !== "boolean") {
    reject("type", { path, expect: "boolean" });
  }
  if (schema.enum && !schema.enum.includes(value)) {
    reject("enum", { path, allowed: schema.enum });
  }
}

const freeze = JSON.parse(await readFile("./freeze.json", "utf8"));
const fixture = JSON.parse(await readFile("./fixtures/orders-limit.json", "utf8"));
const allowedFields = new Set([
  "items",
  "limit",
  "next_cursor",
  "error"
]);

const body = {
  task: "plan-only",
  rules: [
    "Return JSON only.",
    "Do not invent files, helpers, or columns.",
    "Mark every gap in assumptions[].",
    "confidence=guess is a failure for this gate."
  ],
  freeze,
  fixture,
  replySchema
};

const reviewUrl = process.env.REVIEW_URL;
if (!reviewUrl) reject("missing_env", { key: "REVIEW_URL" });

const res = await fetch(reviewUrl, {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify(body)
});

if (!res.ok) reject("http_status", { status: res.status });

let plan;
try {
  plan = await res.json();
} catch {
  reject("reply_not_json", {});
}

assertShape(plan, replySchema);

if (plan.defaultsApplied) {
  reject("silent_default", { defaultsApplied: true });
}

for (const row of plan.assumptions) {
  if (row.confidence === "guess") {
    reject("unlabeled_guess", { path: row.path, claim: row.claim });
  }
  if (row.evidence === "common practice") {
    reject("weak_evidence", { path: row.path });
  }
}

for (const field of plan.fieldsTouched) {
  if (!allowedFields.has(field)) {
    reject("field_not_in_freeze", { field });
  }
}

await writeFile("./plan.accepted.json", JSON.stringify(plan, null, 2));
console.log(JSON.stringify({ ok: true, steps: plan.plan.length }));

Run the gate after the freeze.

export REVIEW_URL="http://127.0.0.1:8787/review"
node freeze-contract.mjs ./openapi.yaml ./freeze.json
node review-gate.mjs

A rejected plan should look like this.

{
  "ok": false,
  "reason": "silent_default",
  "defaultsApplied": true
}

That failure is the point. It is cheaper than a revert.

Decision table

Signal in the plan	Gate result	Next action
`assumptions[]` missing	Fail	Re-ask with reply schema
`confidence=guess`	Fail	Supply contract text
Field outside freeze	Fail	Expand freeze or drop field
`defaultsApplied=true`	Fail	Require explicit caller value
Hash mismatch vs `freeze.json`	Fail	Re-freeze, then re-ask
All evidence from fixture or contract	Pass	Generate code in a later step

Pass does not mean ship. Pass means plan is inspectable.

What this does not solve

The gate does not prove runtime correctness.

It does not replace contract tests in CI.

It does not rate-limit a public review endpoint.

It does not redact secrets you still pasted.

Free model access can vanish, throttle, or change.

A free server is not an availability contract.

Do not treat HTTP success as a schema migrate.

Do not treat a labeled assumption as a measured fact.

Who should not use this

Skip this if your spec contains regulated payloads.

Skip this if you have no OpenAPI or JSON schema.

Skip this if the model must edit production data.

Skip this if you need pinned models and written SLAs.

Skip this if reviewers will not read assumptions[].

A gate nobody reads is another silent default.

Closing note to past me

You did not lose the day to weak prose.

You lost it to unlabeled gaps in the spec.

Freeze bytes. Slice one fixture. Demand evidence.

Reject guesses. Reject extra fields. Reject defaults.

Then generate code. Not before.

If you already hash OpenAPI in CI, point that same freeze at a free remote review hop and keep inference off the laptop.

Redact the Stack Before the Model Sees It

Quinn Li — Sat, 05 Sep 2026 19:57:42 +0000

A raw stack trace is closer to a memory dump than a comment. You should not hand it to a model, a Slack thread, or a ticket until secrets are gone and the payload has a hard size. The useful move is a local digest pipeline: redact, cap, call, validate, then keep a receipt.

That order is the article. Skip a step and you leak a session token, stall on a dark host, or publish a paragraph that never names the failing function.

The paste reflex

You hit a 500 in staging. The log pane dumps forty frames, a request id, a customer email, and a JWT that someone printed "just this once." You want five lines for the channel. A chat box looks faster than reading.

It is not faster when the paste still holds an Authorization header. It is not faster when the model invents a root cause because the trace was chopped mid-frame. And it is not faster when the HTTP call hangs while your terminal still looks busy.

Treat the model like Redis sitting across the network. You would not send Redis an unbounded blob without a timeout. You would not log the raw command with passwords intact. Give the digest the same manners.

A compiler pass, not an incident bot

You are not wiring a pager. You are building a small compiler pass that turns noisy stderr into a tiny JSON object. The object names a likely surface, keeps two or three frames you still trust, and refuses to guess when the input is too thin.

Keep the CLI boring. Read a file. Write digest.json and receipt.json. Exit non-zero when redaction, budget, health, or schema fails. Humans still own the outage. Weekend-grade hosts go dark without a status page. Plan for that silence in the client, not in a postmortem.

Redaction is the first pass

Think of redaction as a linter that runs before prettier. If the linter fails, nothing else runs. You do not "see what the model says" with a live cookie still in the text.

The filter below is a starting net, not a compliance program. It strips common secret shapes, emails, and bearer tokens. It also drops query strings from URLs because reset links hide there. Sample code only; extend the rules for your shop.

export const SECRET_SHAPES = [
  { name: 'bearer', re: /bearer\s+[a-z0-9._\-+=\/]+/gi, to: 'bearer [redacted]' },
  { name: 'jwt', re: /\beyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\b/g, to: '[jwt]' },
  { name: 'email', re: /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi, to: '[email]' },
  { name: 'key_eq', re: /\b(api[_-]?key|secret|password|token)\s*[:=]\s*\S+/gi, to: '$1=[redacted]' },
  { name: 'aws_akid', re: /\bAKIA[0-9A-Z]{16}\b/g, to: '[aws-key-id]' },
  { name: 'query', re: /https?:\/\/[^\s]+/gi, to: (m) => m.replace(/\?.*$/, '?[query-redacted]') }
];

export function redact(raw) {
  let text = String(raw);
  const hits = [];
  for (const rule of SECRET_SHAPES) {
    const found = text.match(rule.re);
    if (found && found.length) hits.push({ name: rule.name, count: found.length });
    text = text.replace(rule.re, rule.to);
  }
  return {
    text,
    hits,
    originalChars: String(raw).length,
    redactedChars: text.length
  };
}

Run that function on a fixture you know contains a fake JWT. If the output still contains eyJ, you do not call the model. That check is the security story for this CLI.

node --input-type=module -e "
import fs from 'node:fs';
import { redact } from './redact.mjs';
console.log(JSON.stringify(redact(fs.readFileSync('trace.sample.txt','utf8')), null, 2));
"

Budget the frames, not the novel

After redaction you still have a wall of text. Quiet endpoints often swallow overflow instead of naming it. They also invent frames that never arrived.

Keep a character budget and a frame budget. Count lines that look like frames. Keep the exception header plus the top frames. Drop the rest on purpose and record the drop count. These caps are sample defaults, not measured optima.

export const BUDGET = {
  maxChars: 8000,
  maxFrames: 12,
  reserve: 1200
};

const FRAME_RE = /^\s*at\s+/;

export function clipTrace(text, budget = BUDGET) {
  const lines = text.split(/\r?\n/);
  const header = [];
  const frames = [];
  for (const line of lines) {
    if (FRAME_RE.test(line)) frames.push(line);
    else if (frames.length === 0) header.push(line);
  }
  const keptFrames = frames.slice(0, budget.maxFrames);
  let body = [...header, ...keptFrames].join('\n');
  const room = budget.maxChars - budget.reserve;
  if (body.length > room) body = body.slice(0, room);
  return {
    body,
    keptFrames: keptFrames.length,
    droppedFrames: Math.max(0, frames.length - keptFrames.length),
    chars: body.length
  };
}

A dropped frame is a first-class field. If eighteen frames fall on the floor, the digest must say the picture is incomplete. Otherwise you will debug a ghost that only existed in the prompt prefix.

A character cut is a blunt knife. Tokenizers will disagree about where the last frame ends. Tune against the endpoint's current documented limit, not a number copied from an old blog.

Write a receipt before you wait

The last time you stared at a spinner, you could not tell a DNS miss from a long completion. Observability people solved this years ago with spans. Steal the idea in a short JSON file.

A receipt stores phase, timings, redaction hits, dropped frames, and HTTP status. It never stores the raw trace. You write it before the probe, after the probe, and after the complete call, so a crash still leaves a breadcrumb.

import fs from 'node:fs/promises';

export async function writeReceipt(path, span) {
  const row = { name: 'error_digest', ts: Date.now(), ...span };
  await fs.writeFile(path, JSON.stringify(row, null, 2));
  return row;
}

const PROBE_MS = 3000;
const CALL_MS = 15000;

export async function probe(url) {
  const t0 = Date.now();
  const ctrl = new AbortController();
  const timer = setTimeout(() => ctrl.abort(), PROBE_MS);
  try {
    const res = await fetch(url, { method: 'GET', signal: ctrl.signal });
    return { ok: res.ok, status: res.status, ms: Date.now() - t0 };
  } finally {
    clearTimeout(timer);
  }
}

export async function complete(url, payload) {
  const t0 = Date.now();
  const ctrl = new AbortController();
  const timer = setTimeout(() => ctrl.abort(), CALL_MS);
  try {
    const res = await fetch(url, {
      method: 'POST',
      signal: ctrl.signal,
      headers: { 'content-type': 'application/json' },
      body: JSON.stringify(payload)
    });
    const text = await res.text();
    return { ok: res.ok, status: res.status, ms: Date.now() - t0, text };
  } finally {
    clearTimeout(timer);
  }
}

Point both URLs at environment variables. Do not bake a hostname into the module. A closed port should fail the probe in three seconds, not three hours.

export MODEL_URL="http://127.0.0.1:8080/v1/complete"
export MODEL_HEALTH_URL="http://127.0.0.1:8080/health"
curl -sS -o /tmp/health.json -w "%{http_code} %{time_total}\n" "$MODEL_HEALTH_URL"

A GET on a health route does not prove inference. It only proves you should not wait on a dead socket. That is still the difference between a short failure and a wasted afternoon.

Freeze the digest shape

Prose summaries drift. One run returns a haiku. The next returns a lecture. Your ticket template cannot parse either.

Ask for JSON and then distrust it. The sample contract is small on purpose. Import it from tests the same way the CLI does.

export const DIGEST_SPEC = {
  required: ['surface', 'confidence', 'frames', 'notes', 'incomplete'],
  surfaces: new Set(['app', 'db', 'http', 'queue', 'unknown']),
  confidences: new Set(['low', 'medium', 'high']),
  maxNotes: 3,
  maxNote: 160,
  maxFrames: 5
};

export function parseDigest(raw, spec = DIGEST_SPEC) {
  let data;
  try {
    data = JSON.parse(raw);
  } catch {
    throw new Error('digest_not_json');
  }
  for (const key of spec.required) {
    if (!(key in data)) throw new Error(`digest_missing_${key}`);
  }
  if (!spec.surfaces.has(data.surface)) throw new Error('digest_surface');
  if (!spec.confidences.has(data.confidence)) throw new Error('digest_confidence');
  if (typeof data.incomplete !== 'boolean') throw new Error('digest_incomplete_type');
  if (!Array.isArray(data.frames) || data.frames.length > spec.maxFrames) {
    throw new Error('digest_frames');
  }
  if (!Array.isArray(data.notes) || data.notes.length === 0 || data.notes.length > spec.maxNotes) {
    throw new Error('digest_notes');
  }
  for (const note of data.notes) {
    if (typeof note !== 'string' || note.length < 8 || note.length > spec.maxNote) {
      throw new Error('digest_note_len');
    }
  }
  if (data.confidence === 'high' && data.incomplete === true) {
    throw new Error('digest_confident_sketch');
  }
  return data;
}

If incomplete is true, you may still print the digest, but you label it as a sketch. High confidence plus a clipped trace is an argument waiting to happen. Reject that pair in code so Slack does not have to.

A driver that refuses to skip steps

Save this as digest.mjs. Feed it a file path. It should never post the original bytes. Sample driver only; it is not a published latency study.

import fs from 'node:fs/promises';
import { redact } from './redact.mjs';
import { clipTrace } from './clip.mjs';
import { probe, complete } from './net.mjs';
import { parseDigest } from './parse.mjs';
import { writeReceipt } from './receipt.mjs';

const url = process.env.MODEL_URL;
const healthUrl = process.env.MODEL_HEALTH_URL || url;
if (!url) throw new Error('MODEL_URL missing');

const raw = await fs.readFile(process.argv[2] || 'trace.txt', 'utf8');
const scrubbed = redact(raw);
if (scrubbed.text.includes('eyJ')) throw new Error('jwt_still_present');

const clipped = clipTrace(scrubbed.text);
await writeReceipt('receipt.json', {
  phase: 'probe',
  hits: scrubbed.hits,
  clipped
});

const health = await probe(healthUrl);
if (!health.ok) {
  await writeReceipt('receipt.json', { phase: 'health_fail', health, clipped });
  throw new Error('health_fail');
}

const call = await complete(url, {
  instruction: 'Return JSON that matches the digest spec. Do not invent frames.',
  trace: clipped.body,
  droppedFrames: clipped.droppedFrames
});

await writeReceipt('receipt.json', {
  phase: 'called',
  health,
  httpStatus: call.status,
  ms: call.ms,
  clipped
});

if (!call.ok) throw new Error(`complete_http_${call.status}`);
const digest = parseDigest(call.text);
if (clipped.droppedFrames > 0) digest.incomplete = true;

await fs.writeFile('digest.json', JSON.stringify(digest, null, 2));
await writeReceipt('receipt.json', {
  phase: 'done',
  digest,
  clipped,
  hits: scrubbed.hits
});
console.log(JSON.stringify({ digest, receipt: 'receipt.json' }, null, 2));

node digest.mjs ./fixtures/trace-jwt.txt
cat receipt.json
cat digest.json

The driver is the policy. Policy left in a chat window evaporates by Tuesday. If the phase never leaves probe, you do not have a summary. You have a dark host and a timestamp.

Where a free model server belongs

This pipeline only needs a complete URL that returns text. MonkeyCode offers free model access and a free server option, which is enough to exercise the CLI against a remote host you do not have to stand up yourself.

Disclosure: This article was prepared as part of MonkeyCode's product outreach.

Swap the URL tomorrow and the redactor still matters. Do not assume a quota, a model name, or an uptime promise in the runbook. Read current product docs before you plan any capacity. The CLI remains useful if you point it at a process on localhost instead.

Fixtures argue; demos applaud

Demos always work. Fixtures pick fights. Keep three files next to the parser and run them on every change.

trace-jwt.txt holds a fake JWT and an email. trace-shallow.txt holds an exception with one frame. trace-noisy.txt holds thirty frames and a connection string. Label the checks unexecuted until you run them on your machine.

import test from 'node:test';
import assert from 'node:assert/strict';
import { redact } from './redact.mjs';
import { clipTrace } from './clip.mjs';
import { parseDigest, DIGEST_SPEC } from './parse.mjs';

test('strips jwt and email', () => {
  const raw = [
    'user jane@example.com',
    'token eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.aaa.bbb',
    '    at boom (/app/x.js:3:1)'
  ].join('\n');
  const out = redact(raw);
  assert.equal(out.text.includes('jane@'), false);
  assert.equal(out.text.includes('eyJ'), false);
});

test('drops extra frames', () => {
  const lines = ['Error: boom', ...Array.from({ length: 30 }, (_, i) => `    at f${i} (/app/a.js:${i}:1)`)] ;
  const clipped = clipTrace(lines.join('\n'));
  assert.equal(clipped.keptFrames, 12);
  assert.equal(clipped.droppedFrames, 18);
});

test('rejects a confident sketch', () => {
  const raw = JSON.stringify({
    surface: 'app',
    confidence: 'high',
    frames: ['at boom (/app/x.js:3:1)'],
    notes: ['Looks like a null deref in boom()'],
    incomplete: true
  });
  assert.throws(() => parseDigest(raw, DIGEST_SPEC));
});

node --test redact.test.mjs clip.test.mjs parse.test.mjs

If the JWT test ever fails, you stop shipping the CLI. Rotating staging secrets because someone pasted a trace is more expensive than one angry fixture.

Signals and moves

Signal	Move
Redactor reports zero hits on a fixture that should have secrets	Fail the eval; do not call the model
`eyJ` still present after redact	Abort the process
`droppedFrames > 0`	Force `incomplete=true`
Health probe abort or non-OK	Skip complete; keep the receipt
Body is not JSON	Do not write `digest.json`
`confidence=high` and `incomplete=true`	Reject the object
HTTP 429	Exit; do not retry in a loop
HTTP 5xx	Record status, then exit

Keep that table next to the parser, not in a chat history. The model will not remember it between runs. The driver refuses to hammer a 429. One failure is a receipt, not a loop.

What this will not save you from

This pipeline does not find root cause. It compresses what you already logged. Wrong frames in, confident nonsense out. A schema pass does not prove the note is true.

Regex redaction misses custom secret formats. If your shop uses unusual prefixes, extend the rule list and add a fixture that would have burned you last quarter. A GET health check does not prove the weights loaded. It only proves the port answered.

Do not send production traces that include customer payloads, health data, or credentials, even after this filter. Do not use this as an unattended incident responder. Do not use it when you need a written latency SLA. If your org blocks outbound model calls, run nothing. If the file still looks like a dump of .env or /etc, delete the file and fix the logger.

After the receipt exists

Read receipt.json before you trust digest.json. If phase is still probe or health_fail, the channel does not need a story. It needs a reachable host, or it needs you to read the remaining frames yourself.

If you already have a complete endpoint handy, point this CLI at it and keep the redactor on by default. The interesting part is not the model. The interesting part is that the stack never left your machine in the shape it arrived.

DEV Community: Quinn Li

Letter to Thursday-Me: Park the Agent on a Cheap Box

The day that vanished

Mistake 1: The dirty laptop became the runtime

Mistake 2: The remote box inherited your home

Mistake 3: No replay after the rewrite

What changes on the next Thursday

Artifact: ticket bundle plus replay gate

Step 1: Freeze a clean worktree

Step 2: Write the contract before the prompt

Step 3: Pack a sendable bundle

Step 4: Prove the packed test is still red

Step 5: Copy the bundle onto the disposable host

Step 6: Run the agent only inside that path

Step 7: Pull the receipt and replay locally

How to read the receipt

Decision table

Why the cheap box is the point

Limitations

Thursday checklist

Letter to Sunday-Me: Pack a Worktree, Cap the Retries

The scene at 09:12

Where a free remote box actually helps

The three mistakes that cost the day

Mistake 1: You shipped the whole repo

Mistake 2: You treated retries as free

Mistake 3: You applied before a local replay

Artifact: pack, cap, then replay

File 1: ticket.contract.json

File 2: scripts/pack-worktree.sh

File 3: scripts/validate-receipt.py

Numbered workflow

1. Write the failing test first

2. Freeze the contract

3. Pack the worktree

4. Run with a capped prompt template

5. Validate the receipt

6. Replay locally before apply

Decision table

Limitations

What Sunday-me should have done by 09:30

Letter to Saturday-Me: Freeze Time Before the Remote Run

The Saturday that looked green

Three mistakes that actually burned the day

1. You let the worker use wall-clock time

2. You allowed the patch to drop the timer test

3. You let the free box hit a live host

What I would run before any prompt

Step 1 — Record the failing 503 as a cassette

Step 2 — Write a test that owns the clock

Step 3 — Assert the patch cannot drop the clock

Step 4 — Queue the job with time and egress caps

Step 5 — Replay on a clean branch with the same tape

Decision table

What the numbers are not

Limitations

Who should not use this

Letter to Wednesday-Me: One Contract Per Ticket, Then Prompt

Letter to Wednesday-Me

The scene you will repeat

What this letter will give you

Mistake 1: You prompted without a frozen contract

Step 1: Write the contract as a file

Step 2: Pin the ticket to that id

Step 3: Refuse to prompt without both files

Mistake 2: You stored agent logs inside the worktree

Step 1: Create a sibling lab directory

Step 2: Write a lab header, not a novel

Step 3: Keep model output in the lab tree

Mistake 3: You reused one session for two tickets

Step 1: Kill the session at merge or reject

Step 2: Open Ticket B from a cold tree

Step 3: Add an acceptance test the contract owns

A decision table for the remote lab

A minimal parser that satisfies Ticket A

Where the free lab fits

Limitations

Close the letter

Letter to Monday-Me: Fail the Test Before You Prompt the Box

The scene you will repeat

File 1: `ticket.contract.json`

File 2: `scripts/pack-worktree.sh`

File 3: `scripts/validate-receipt.py`

Artifact: `plan_apply_gate.py`