DEV Community: Harper Xu

Pin the Patch Contract, Not the Model

Harper Xu — Mon, 21 Sep 2026 13:38:47 +0000

A remote generator is a vendor you cannot pin. Pin the patch contract instead of the endpoint. Treat every model swap as an architecture event.

Chat output is not a safe apply API. That leftover hole sits in the contract. An unpinned model can ship a well-formed lie.

The constraint you actually have

You do not own the remote model you call. You do not pin its weights like a library. You also do not freeze its decoding path.

A free remote path makes this constraint visible. The generator can move overnight without any notice. Your repository does not move with that generator.

Your old tests may still pass after the swap. They mostly remember yesterday's habits and shapes. They do not name today's intent at all.

Think of the model as a shipping carrier. You do not control the truck on that route. You control the crate and the seal.

MonkeyCode offers free model access and a free server option. Disclosure: This article was prepared as part of MonkeyCode's product outreach.

Use that path as an untrusted vendor. Never hand that path your apply credentials.

Data flow worth drawing

Keep the data flow one-directional and dull. Intent leaves your repo as a typed request. A patch returns as a typed envelope.

Apply never reads chat prose as input. Chat remains a scratchpad only, nothing more. The envelope is the object you store.

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "title": "PatchEnvelope",
  "type": "object",
  "additionalProperties": false,
  "required": ["intent_id", "base_sha", "files", "tests"],
  "properties": {
    "intent_id": { "type": "string", "minLength": 8 },
    "base_sha": { "type": "string", "pattern": "^[0-9a-f]{40}$" },
    "files": {
      "type": "array",
      "minItems": 1,
      "items": {
        "type": "object",
        "additionalProperties": false,
        "required": ["path", "action", "diff"],
        "properties": {
          "path": {
            "type": "string",
            "pattern": "^(src|tests)/[A-Za-z0-9_./-]+$"
          },
          "action": { "enum": ["modify", "add"] },
          "diff": { "type": "string", "minLength": 1 }
        }
      }
    },
    "tests": {
      "type": "array",
      "minItems": 1,
      "items": { "type": "string", "pattern": "^tests/" }
    }
  }
}

Save the schema as contracts/patch-envelope.schema.json. The schema is the pin you actually own. The model is not the pin you own.

Your generator may run on a free remote server. That server still sits outside the apply room. Source leaves your tree only as packed intent.

Secrets stay on your side of the door. Envelopes come back for review on your side. Review never happens in the generator room itself.

# tools/pack_intent.py
# Proposal: freeze an intent before any remote call.
import argparse, json, subprocess, datetime, sys

parser = argparse.ArgumentParser()
parser.add_argument("--intent-id", required=True)
parser.add_argument("--goal", required=True)
parser.add_argument("--allow", action="append", required=True)
args = parser.parse_args()
base = subprocess.check_output(["git", "rev-parse", "HEAD"], text=True).strip()
intent = {
    "intent_id": args.intent_id,
    "goal": args.goal,
    "base_sha": base,
    "allow": args.allow,
    "packed_at": datetime.datetime.utcnow().strftime("%Y-%m-%dT%H:%M:%SZ"),
}
json.dump(intent, sys.stdout, indent=2)
print(file=sys.stderr)

python3 tools/pack_intent.py \
  --intent-id "timeout-$(date +%s)" \
  --goal "fail closed when the HTTP client exceeds 2s" \
  --allow 'src/**' --allow 'tests/**' \
  > /tmp/intent.json

That command does not generate any code. It only freezes the request for later use. Generation runs later against this frozen file.

Do not generate against a chat scroll. Chat scrolls are not replayable objects later. Frozen files survive a later model swap.

Failure domains

Draw three rooms with locked doors between them. The intent room holds a repo view. The generator room holds the remote model only.

The apply room holds your apply credentials. A model swap lives only next door. It must not open the apply door.

Schema failure needs a fourth locked room. Call that fourth room the envelope gate. The gate holds no apply credentials at all.

If the envelope fails schema, you drop it. Do not tidy a bad envelope inside apply. Hand repair mixes vendor text with trusted edits.

Network failure is not an apply retry. You may retry generate only after a drop. Apply then needs a completely fresh envelope.

Give that envelope a new intent id. Colliding intent ids hide those retries from audit. Hidden retries will break a later audit.

Model drift looks like a quiet roommate. The produced diff can still apply cleanly. Your old tests can still pass afterward.

The new behavior was never named in tests. That silence is the real outage mode. Passing tests are not a named contract.

The envelope therefore requires named tests for the intent. Those tests are not the whole suite. They are this intent's contract, nothing else.

A gate you can run locally

Treat the next script as a proposal. It fails closed on purpose, not open. It is not a production service yet.

# tools/gate_envelope.py
# Proposal: fail closed on schema, path, or base mismatch.
import json, subprocess, sys, pathlib
from jsonschema import Draft202012Validator

ROOT = pathlib.Path(__file__).resolve().parents[1]
schema = json.loads((ROOT / "contracts/patch-envelope.schema.json").read_text())
envelope = json.loads(pathlib.Path(sys.argv[1]).read_text())
Draft202012Validator(schema).validate(envelope)

head = subprocess.check_output(["git", "rev-parse", "HEAD"], text=True).strip()
if envelope["base_sha"] != head:
    sys.exit("base_sha does not match HEAD; regenerate, do not apply")

for item in envelope["files"]:
    path = pathlib.Path(item["path"])
    if path.is_absolute() or ".." in path.parts:
        sys.exit(f"rejected path: {path}")
    if item["action"] == "modify" and not path.exists():
        sys.exit(f"modify target missing: {path}")

print("envelope accepted for review")

Install the checker, then run it locally. Do this before any apply step runs. Skip this step and the rooms collapse.

python3 -m pip install jsonschema
python3 tools/gate_envelope.py /tmp/envelope.json
git apply --check /tmp/proposed.diff

A dry apply check is not behavior proof. It only proves that the diff parses. Behavior proof lives in the named tests.

mapfile -t T < <(python3 -c 'import json,sys; print("\n".join(json.load(open(sys.argv[1]))["tests"]))' /tmp/envelope.json)
pytest -q "${T[@]}"

If the model also wrote those tests, stop. You have built a circular test gate. Circular gates smile and let poison through.

Write the tests in the intent room. Keep high-risk tests off the model path. Let the model fill implementation details only.

Add a stub generator in CI next. The stub must emit invalid envelopes on purpose. CI must fail when the gate is missing.

# tools/stub_generator.py
# Proposal: negative fixture for the envelope gate.
import json, sys
bad = {
    "intent_id": "x",
    "base_sha": "not-a-sha",
    "files": [{"path": "../etc/passwd", "action": "modify", "diff": ""}],
    "tests": ["not-a-test"],
}
json.dump(bad, sys.stdout)

python3 tools/stub_generator.py --invalid > /tmp/bad.json || true
if python3 tools/gate_envelope.py /tmp/bad.json; then
  echo "gate failed open" >&2
  exit 1
fi

A green pipeline with no negative stub is theater. Theater is how drift lands in main. Force that drift to die in generate.

Decision matrix

Use this table as a hard gate. Do not use mood as a substitute. Mood belongs only in later review comments.

Signal	Generator room	Apply room
Model endpoint changed	Regenerate envelope	Block
Schema invalid	Drop output	Block
`base_sha` mismatch	Pack a new intent	Block
Path outside allowlist	Drop output	Block
Named tests missing	Reject intent	Block
Named tests pass, extra files appear	Drop output	Block
Reviewer note only, no envelope	Ignore	Block

The apply column is boring on purpose. Apply does not improvise on bad input. Improvisation stays in the generate room only.

Cheap failure belongs in the generate room. Expensive failure belongs nowhere in this design. The gate exists to keep them apart.

What you would change next

Store intent, envelope, and test output together. That bundle is your replay handle later. Replay is how you survive a model swap.

Then shrink what you send on the remote path. Stop shipping whole files for a local change. Send a function body when that is enough.

Less repo in the generator room always helps. The blast radius shrinks with the payload. Hostile disks then hold less of you.

If you use a free server, treat its disk as hostile. Do not mount your working tree on it. Send the packed intent file only, nothing else.

Add dual control on apply as a later change. One person accepts the envelope in review. Another person then runs the apply command.

Chat approval is not dual control at all. Chat history is vapor after the session. Vapor does not bind an apply action.

Limitations

This gate does not score model quality. It checks shape, path, and named tests. A wrong patch can still fit the crate.

The schema forbids deletes and absolute paths today. That rule will block some legitimate work. Widen it only with an explicit intent flag.

Remote generation moves source across a public network. Skip this remote path for any secrets. Skip it for customer data as well.

Skip it for unreleased product code too. Air-gapped teams should generate only on local hosts. Some teams should not generate remotely at all.

Teams without a human reviewer should stop here. The gate is a lock, not judgment. Locks do not read product intent for you.

Do not point apply credentials at the generator host. A free server remains a separate room. Shared credentials merge the rooms you drew.

If you try a free remote generator, start small. Use a throwaway branch and this gate. Leave production apply untouched until the gate holds.

Verification Needs Its Own Failure Domain

Harper Xu — Sun, 20 Sep 2026 11:36:42 +0000

Generated tests cannot vouch for generated code. They fail in the same places. You need a separate verification domain.

A model that writes a function also writes its exam. That is one author grading itself. You would not ship that in any other system.

Think of a locksmith who also prints the inspection sticker. The door looks certified from the hallway. The sticker never left the same workshop. Your AI pipeline often works exactly that way.

You already split generate from apply in other reviews. This piece is not that split. This is about the oracle that claims the patch is safe.

Constraints you actually have

You do not control the model's private checks. You control what may enter main. That is the only honest constraint you own.

The context window is not a specification. It is mixed, stale, and incomplete. Treat it as contaminated input, not as law.

Time fights you as well. A generated suite can pass tonight. It can miss the bug you will hit on Friday.

Cost fights you too. Cheap tokens invite extra tests from the same session. Extra tests from the same author add theater, not coverage.

You also cannot prove a hidden property the corpus never stated. Silence is not green. Green requires an oracle you already trusted.

Data flow that stays honest

Keep three streams, and never braid them. The corpus is frozen and human-owned. The candidate is generated and untrusted. The verdict is computed on a third host.

You send the model a task envelope only. You receive a patch, nothing else. You refuse tests, scripts, and CI edits from that reply.

The verifier host clones a clean tree. It applies the patch in a sandbox. It runs only the frozen corpus against that tree.

If the corpus is silent on a change, you fail closed. New behavior without an old oracle is a hole. You write the oracle first, then you generate.

Here is a proposed local gate. Label it unexecuted until you wire it. Do not treat it as a certified toolchain.

#!/usr/bin/env bash
# verify_gate.sh — proposed local gate, not production gospel
set -euo pipefail

PATCH=${1:?patch file required}
CORPUS=${2:?frozen corpus directory required}
ROOT=$(git rev-parse --show-toplevel)
WORKDIR=$(mktemp -d)
trap 'rm -rf "$WORKDIR"' EXIT

git clone --local "$ROOT" "$WORKDIR/tree"
git -C "$WORKDIR/tree" apply --check "$PATCH"
git -C "$WORKDIR/tree" apply "$PATCH"

# Product code may change. The scorekeeper may not.
if awk '/^diff --git /{f=0} /^diff --git .*\/(tests|spec)\// {f=1} f && /^\+\+\+ /{print}' "$PATCH" | grep -q .
then
  echo "refuse: patch touches tests; corpus stays frozen" >&2
  exit 2
fi

cd "$WORKDIR/tree"
python -m pytest "$CORPUS" -q --maxfail=1

That script encodes one architectural rule. The patch may change product code. It may not smuggle its own scorekeeper into the tree.

Pair the gate with a contract the corpus already owns. The generator should never receive this file if you can help it. Hidden oracles beat prompt-fed oracles.

# contracts/test_quote_shape.py
# Proposed example. Wire it before you invite a generator.

from app.billing import quote


def test_quote_never_goes_negative():
    total = quote(items=[], coupon="WELCOME")
    assert total >= 0


def test_quote_rejects_unknown_sku():
    try:
        quote(items=[{"sku": "nope", "qty": 1}], coupon=None)
    except ValueError:
        return
    raise AssertionError("unknown sku must fail")

You own those checks before any model runs. They describe money, not style. A generator that never saw them cannot teach to the test.

Move the patch across the boundary as a file. Do not pipe a chat transcript into pytest. Files have hashes. Chat logs do not.

# proposed flow on your verifier host
sha256sum candidate.patch > candidate.patch.sha256
./verify_gate.sh ./candidate.patch ./contracts

If the hash and the verdict disagree later, you have a story. If you only kept the chat, you have fog.

Failure domains, drawn as rooms

Picture three rooms with locked doors. Room A writes candidates. Room B stores the corpus. Room C applies merges.

Room A can burn down. You lose drafts and prompts. That loss is acceptable. Drafts are cheap. Oracles are not.

Room B must not share a filesystem with A. Shared disks are shared fate. Shared prompt history is shared fate too.

Room C accepts only artifacts that B already blessed. It does not chat with a model. It does not fetch "just one more test."

Most teams collapse A and B onto one laptop. That laptop then talks to CI with your identity. One prompt injection now poisons code and proof together.

This is not a review of the generator host itself. You already know that host is a blast radius. This review is about the oracle living next door and pretending it is independent.

If verification shares memory, credentials, or logs with generation, it is not independent. A unit test written in the same session is a roommate, not a referee. Roommates do not audit the lease.

Network policy should make the rooms boring. Room A reaches a model endpoint only. Room B reaches nothing outbound. Room C reaches your registry, not a chatbot.

Logs need the same split. Generator traces stay in A. Corpus hashes stay in B. Merge tickets in C cite both, and never mix the files.

# proposed record, written by the verifier, not the model
patch_sha256:  9f3c…
corpus_sha256: 41aa…
pytest_exit:   0
verifier_host: verify-07
generator_host: (cited, never trusted)

That record is the architecture. The model is a printer in Room A. Printers do not sign the building permit.

Where a disposable generator host fits

You still need somewhere to produce candidates. That somewhere should be disposable. It should never hold the frozen corpus.

MonkeyCode offers free model access and a free server option. Disclosure: This article was prepared as part of MonkeyCode's product outreach. Park generation there so Room A is not your laptop.

Keep the oracle off that box. Do not upload contracts to a throwaway server. Do not let the apply identity live there either.

A short pattern looks like this. Generate on the remote box. Pull a patch file home. Verify on a host that never held the prompt.

# proposed; your generator command stays yours
ssh generator 'python gen_candidate.py > /tmp/candidate.patch'
scp generator:/tmp/candidate.patch ./candidate.patch
./verify_gate.sh ./candidate.patch ./contracts

If the free server vanishes, you lost drafts. You did not lose the exam. That is the point of the room split.

Do not send production snippets to any shared generator to "make tests." That inverts the flow. The exam would then be written from the crime scene.

What you should change next

Sign the corpus and verify the signature in CI. A writable tests directory is an unsigned exam. Unsigned exams invite the author back into the grading room.

Add a path denylist in the merge queue, not only in a laptop script. The script above is a teacher. The queue is the lock.

# proposed merge-queue fragment
policy:
  refuse_if_patch_touches:
    - contracts/**
    - tests/**
    - .github/workflows/**
  require:
    - contracts_signature
    - verify_gate_exit_zero

Then grow oracles that are not example-based. Property tests and golden files age better than one happy-path pytest. Generated unit tests age like unused coupons.

If you can afford it, run two verifiers. Same patch, two hosts, one corpus hash. Disagreement is a signal. Agreement is still not proof of missing properties.

Mutation testing against the frozen corpus is the next honest metric. If killing a line does not fail a contract, you lacked an oracle. You did not lack another generated test.

Limitations, and who should not bother

This split fails when you have no frozen corpus. A greenfield spike still needs a human oracle first. Do not generate the product and the proof in one sitting and call it architecture.

This also fails when the product is the test suite. Fuzz harnesses and compiler tests need a different shape. Do not copy this gate onto those trees without redesign.

Regulated or safety-critical work needs more than pytest and a shell script. This article does not offer a certified method. Do not file it as one.

Solo prototypes can ignore the three rooms for a day. Do not ignore them the day you attach CI credentials. Theater starts at the first green badge you did not earn.

You should not use a remote generator for private data you cannot expose. Free compute is not a data policy. Room A still egresses whatever you paste.

Verification is a failure domain, not a plugin. If the author still writes the exam, you are grading a mirror. Keep the mirror in Room A, and keep the exam in Room B.

Every Prompt Is an Egress Event

Harper Xu — Sat, 19 Sep 2026 09:42:17 +0000

Every prompt you send is an egress event. Treat that generator like any other foreign network. You cannot unsay a secret after the packet leaves.

Architecture reviews start with constraints, not with models. Your working tree holds tokens, hostnames, and private paths. A remote generate plane must not receive that class.

This piece is an architecture review of the prompt path. It maps constraints, data flow, and failure domains. Then it gives you a local gate you can run.

Constraints on the prompt path

You do not control the remote generate host. You also do not control its disks or operators. That is normal for any compiler you did not build.

Free remote capacity makes this constraint sharper today. A free generate plane still sits off your laptop. Courtesy does not move the trust boundary one inch.

So you classify each path before you pack. You pack the allowed files before you send. You send only what a stranger may read.

Think of a shipping crate sitting on a dock. Customs inspects that crate before the ship sails. Your context pack is the same kind of crate.

Do not argue with the ocean after departure. Build a dock inspection you actually run.

The crate is not the whole warehouse. A generate prompt does not deserve the warehouse. It deserves a labeled box with a short inventory.

Data flow and failure domains

The flow stays simple once you name hops. The local editor reads the working tree first. A local gate then classifies each file path.

Allowed files fold into a narrow context pack. Denied files stay on the local disk. Detected secrets abort the whole export at once.

The pack leaves through a single client process. A remote model returns a patch artifact later. You review that artifact before any apply step.

Notice the data that never crosses the wire. Local production environment files never leave your laptop. Cloud keys and internal host maps stay put.

The generator only sees structure you marked public. It may see interfaces, tests, and safe comments. It must never see the plant combination lock.

Keep a policy file in the same repository. You review those edits like firewall rule changes. Treat a policy edit as an architecture change.

# egress_policy.yml — lives locally, never rides with the pack
allow:
  - "src/**/*.py"
  - "tests/**/*.py"
  - "README.md"
deny:
  - "**/.env*"
  - "**/*secret*"
  - "**/credentials*"
  - "**/*.pem"
  - "ops/**"
max_file_bytes: 65536
max_pack_files: 40

Do not upload that deny list with the pack. The deny list names rooms you keep locked. A foreign compiler does not need your floor plan.

Name failure domains or you will mix them. Domain A is the working tree on disk. Domain B is the classified pack you export.

Domain C is the remote generate service itself. Domain D is the reviewed patch you might apply. Do not share credentials across those four domains.

A leak in Domain B is an export incident. A crash in Domain C is only downtime. Do not treat those two failures as equal.

Convenience is how teams mix the domains. The usual mix-up looks harmless in a chat box. Speed is not a reason to skip inspection.

You dump the repository into the prompt window. The dump crosses Domain A into Domain C uninspected. That hop is the incident, not the model brand.

That is not a coding style problem at all. That is an egress control problem on the wire. Fast prompts still leave the building as data.

Another failure mode is quiet oversharing of topology. A helper module still hardcodes a staging hostname. The name is not a key, yet it maps your network.

Classification is more than a search for cloud tokens. You also label environment topology as restricted data. Hostnames can be as sensitive as passwords here.

A third failure is a resend without classify. You tweak one sentence and fire the pack again. Re-run the gate against the same working tree.

Run the gate on your machine every time. Do not run inspection on the generate host. The inspector belongs on the dock you own.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. Some teams place a remote helper in Domain C. MonkeyCode's free model access and free server option can fill that hop.

They still must not see Domain A files. The gate below does not depend on that product.

A gate you can run

The script below acts as the dock inspector. It is a labeled local example, not production magic. You should run it on a throwaway clone first.

#!/usr/bin/env python3
"""Local egress gate for a generate prompt pack.

Labeled example: run on a disposable clone, not production data.
"""
from __future__ import annotations

import fnmatch
import json
import re
import sys
from pathlib import Path

ROOT = Path(".").resolve()
POLICY = {
    "allow": ["src/**/*.py", "tests/**/*.py", "README.md"],
    "deny": [
        "**/.env*",
        "**/*secret*",
        "**/credentials*",
        "**/*.pem",
        "ops/**",
        "**/.git/**",
    ],
    "max_file_bytes": 65536,
    "max_pack_files": 40,
}

SECRET_RE = re.compile(
    r"(?i)(api[_-]?key|secret|token|password|begin [a-z]+ private key)\s*[:=]"
)

def rel(path: Path) -> str:
    return path.resolve().relative_to(ROOT).as_posix()

def denied(path: str) -> bool:
    return any(fnmatch.fnmatch(path, pat) for pat in POLICY["deny"])

def allowed(path: str) -> bool:
    return any(fnmatch.fnmatch(path, pat) for pat in POLICY["allow"])

def classify(path: Path) -> str:
    name = rel(path)
    if denied(name):
        return "deny"
    if not allowed(name):
        return "unlisted"
    if path.stat().st_size > POLICY["max_file_bytes"]:
        return "too_large"
    text = path.read_text(encoding="utf-8", errors="replace")
    if SECRET_RE.search(text):
        return "secret"
    return "ok"

def build_pack() -> dict:
    files = []
    for path in ROOT.rglob("*"):
        if not path.is_file():
            continue
        status = classify(path)
        if status in {"deny", "unlisted"}:
            continue
        if status != "ok":
            raise SystemExit(f"egress blocked: {rel(path)} ({status})")
        body = path.read_text(encoding="utf-8", errors="replace")
        files.append({"path": rel(path), "bytes": len(body.encode("utf-8"))})
        if len(files) > POLICY["max_pack_files"]:
            raise SystemExit("egress blocked: pack too wide")
    return {"root_name": ROOT.name, "files": files, "policy_sent": False}

def main() -> None:
    pack = build_pack()
    out = ROOT / "egress_pack.json"
    out.write_text(json.dumps(pack, indent=2), encoding="utf-8")
    print(f"pack ready: {out} files={len(pack['files'])}")
    print("send only listed file bodies, never the deny list")
    print("do not attach the rest of the tree")

if __name__ == "__main__":
    main()

Exercise the gate with a planted secret on purpose. You want the refusal, not a green pack.

mkdir -p src tests
printf 'print("ok")\n' > src/app.py
printf 'API_KEY=planted-value\n' > src/leaky.py
python3 egress_gate.py
# expected: egress blocked: src/leaky.py (secret)

Move the leaky file out of the allow paths. The gate should then build a narrow pack. Read the pack file before any client upload.

rm src/leaky.py
printf 'def test_ok():\n    assert True\n' > tests/test_app.py
python3 egress_gate.py
cat egress_pack.json

Wire your generate client to that manifest only. If the client can read extra paths, stop. A client that ignores the pack list is unsafe.

Watch the policy_sent field in the manifest. It must stay false on every upload. Domain C should never learn your deny patterns.

Change three things after this first gate works. Today the classifier is a regex plus glob. Regex will miss custom tokens and encoded blobs.

Next you attach a sensitivity label per directory. Store those labels in .egress-labels beside the code. The gate should fail closed on unlabeled paths.

Next, split human comments from machine generated comments. Generated comments often echo internal ticket numbers still. Those ticket numbers can map your org chart.

Next, give Domain C a throwaway identity only. Do not reuse the cloud credentials of apply. Generation needs no deploy role at all.

This approach is not for every team. Skip it if regulated data cannot leave the building. Skip it if legal forbids any remote generate hop.

Skip it if you paste whole repositories into a browser. The gate cannot save a copy-paste habit. Architecture does not outrun a human dump.

The scanner will false-negative on novel secret shapes. It will false-positive on the word token in docs. Read every refusal and do not mute the gate.

You also still need a human patch review. Egress control is not the same as correctness control. A clean pack can still yield a bad patch.

Remote generate remains useful under these strict rules. You still keep speed for boilerplate and tests. You keep the plant keys on the dock.

Hash the Envelope Before You Generate

Harper Xu — Fri, 18 Sep 2026 08:03:11 +0000

You do not control generation until inputs are pinned. A chat box is not an interface. It is an unbounded failure domain.

Most teams argue about models and prompts. That debate skips the real contract. The contract is everything the model may see.

Think of a compiler, not a conversation. You do not feed it your home directory. You pass sources, flags, and a working directory. Generation needs that same envelope.

Constraints you already have

Your apply host already holds secrets. It holds deploy keys and cloud tokens. Config files still name production hosts.

Dump the working tree into a prompt and you copy that surface. The model host becomes a second production context. That copy almost never has your real controls.

You also lose replay. Yesterday's tree is not today's tree. A floating context window cannot be audited later. Reviewers then guess which files the model actually saw.

So the constraint stays simple. The generate plane may read a hashed envelope. Nothing else crosses that boundary. If a file is not named, it does not exist.

Data flow that actually holds

Start from the apply host, not a chat UI. The apply host already knows the branch. It already knows the ticket. It should write a generation request as a file.

That file names allowed paths and a base commit. It names the task in one short sentence. It also names forbidden globs so secrets stay out.

You hash every included blob. You hash the request document itself. Then you send only that bundle to the generate host. The host never mounts your working tree. It never inherits your shell environment.

It writes a patch and a receipt. The receipt repeats the hashes. Reviewers check receipt against request. Apply happens only after that match. Chat logs are leftover debris. Receipts are the audit trail.

Here is a concrete envelope. Treat it as a checked-in contract. Do not treat it as a prompt.

{
  "apiVersion": "generate.local/v1",
  "kind": "GenerationEnvelope",
  "metadata": {
    "id": "ticket-1842-rename-retry",
    "createdAt": "2026-09-18T12:00:00Z"
  },
  "spec": {
    "baseCommit": "9f3c1a0e8b77d2c1a4e6f0b9c8d7e6f5a4b3c2d1",
    "task": "Rename retry helper; keep public signatures.",
    "include": [
      "src/retry.ts",
      "src/retry.test.ts"
    ],
    "excludeGlobs": [
      "**/.env",
      "**/*secret*",
      "**/*.pem",
      "**/node_modules/**"
    ],
    "maxBytes": 65536,
    "output": {
      "format": "unified-diff",
      "maxFiles": 4,
      "maxBytes": 32768
    }
  }
}

Keep that document small on purpose. Small envelopes fail closed. Giant envelopes only pretend to be architecture.

A validator you can run today

Do not trust a human to pack the bundle. Humans paste extra files under time pressure. A script should refuse the model call instead.

Save this as pin_envelope.py. It reads the envelope and copies allowed files. It writes a tarball plus SHA-256 sums. If it exits non-zero, you stop.

#!/usr/bin/env python3
"""Build a pinned generation envelope. Refuse unbounded context."""
from __future__ import annotations

import hashlib
import io
import json
import sys
import tarfile
from pathlib import Path

MAX_FILE_BYTES = 32 * 1024


def sha256_bytes(data: bytes) -> str:
    return hashlib.sha256(data).hexdigest()


def load_envelope(path: Path) -> dict:
    doc = json.loads(path.read_text(encoding="utf-8"))
    if doc.get("kind") != "GenerationEnvelope":
        raise SystemExit("kind must be GenerationEnvelope")
    spec = doc.get("spec") or {}
    if not spec.get("baseCommit"):
        raise SystemExit("spec.baseCommit is required")
    if not spec.get("include"):
        raise SystemExit("spec.include must list files")
    return doc


def assert_allowed(root: Path, rel: str, exclude_globs: list[str]) -> Path:
    path = (root / rel).resolve()
    if not str(path).startswith(str(root.resolve())):
        raise SystemExit(f"path escapes workspace: {rel}")
    if not path.is_file():
        raise SystemExit(f"missing file: {rel}")
    for glob in exclude_globs:
        if path.match(glob) or Path(rel).match(glob):
            raise SystemExit(f"excluded by glob {glob}: {rel}")
    return path


def main() -> None:
    if len(sys.argv) != 4:
        raise SystemExit("usage: pin_envelope.py ENV.json WORKDIR OUTDIR")
    env_path = Path(sys.argv[1])
    workdir = Path(sys.argv[2]).resolve()
    outdir = Path(sys.argv[3])
    outdir.mkdir(parents=True, exist_ok=True)

    doc = load_envelope(env_path)
    spec = doc["spec"]
    exclude = spec.get("excludeGlobs") or []
    max_bytes = int(spec.get("maxBytes") or 65536)

    blobs = []
    total = 0
    for rel in spec["include"]:
        path = assert_allowed(workdir, rel, exclude)
        data = path.read_bytes()
        if len(data) > MAX_FILE_BYTES:
            raise SystemExit(f"file too large: {rel}")
        total += len(data)
        if total > max_bytes:
            raise SystemExit("envelope exceeds spec.maxBytes")
        blobs.append((rel, data, sha256_bytes(data)))

    receipt = {
        "envelopeSha256": sha256_bytes(env_path.read_bytes()),
        "baseCommit": spec["baseCommit"],
        "files": [
            {"path": p, "sha256": h, "bytes": len(d)}
            for p, d, h in blobs
        ],
    }
    receipt_path = outdir / "receipt.json"
    receipt_path.write_text(json.dumps(receipt, indent=2) + "\n", encoding="utf-8")

    tar_path = outdir / "context.tar"
    with tarfile.open(tar_path, "w") as tar:
        tar.add(env_path, arcname="envelope.json")
        tar.add(receipt_path, arcname="receipt.json")
        for rel, data, _ in blobs:
            info = tarfile.TarInfo(name=f"tree/{rel}")
            info.size = len(data)
            tar.addfile(info, fileobj=io.BytesIO(data))

    print(f"wrote {tar_path}")
    print(f"envelope sha256 {receipt['envelopeSha256']}")


if __name__ == "__main__":
    main()

Run it against a throwaway tree first. Confirm the happy path before you argue policy.

mkdir -p /tmp/demo/src /tmp/out
printf 'export function retry() { return 1 }\n' > /tmp/demo/src/retry.ts
printf 'test("retry", () => {})\n' > /tmp/demo/src/retry.test.ts
printf 'SECRET=not-for-models\n' > /tmp/demo/.env
python3 pin_envelope.py envelope.json /tmp/demo /tmp/out
sha256sum /tmp/out/context.tar /tmp/out/receipt.json

Then force a negative path. Point include at .env and watch it die. That failure is the architecture working. Do not "fix" it by widening the glob list.

python3 - <<'PY'
import json
from pathlib import Path
doc = json.loads(Path("envelope.json").read_text())
doc["spec"]["include"] = [".env"]
Path("/tmp/bad.json").write_text(json.dumps(doc, indent=2))
PY
python3 pin_envelope.py /tmp/bad.json /tmp/demo /tmp/out-bad
# expected: excluded by glob **/.env

If that command succeeds, your exclude list is theater. Stop there and repair the envelope. Do not call a model with a broken packer.

Failure domains this split creates

The envelope builder can fail. It can hash the wrong commit. That failure stays local and reviewable. It does not talk to a model. You fix the document and rerun the hasher.

The generate host can fail next. It can ignore the envelope and ask for more files. Your network policy must deny that fetch. No extra clone. No extra archive. No "just one more path."

The model can fail after that. It can emit a diff outside include. The apply plane must reject that diff. A receipt that names two files cannot apply three. Pretty summaries do not override path math.

Review can fail last. People rubber-stamp fluent prose. Force the review UI to show hashes first. Show the path list before any explanation. Hide the story until the receipt matches.

Notice the chat transcript is not in this chain. If your only record is a thread, you have no architecture. You have a memory of a conversation.

Where a free generate host fits

You still need somewhere to run the model call. That host should not be your laptop checkout. It should not be the deploy runner either. Those two machines already hold the blast radius you are trying to shrink.

Disclosure: This article was prepared as part of MonkeyCode's product outreach.

MonkeyCode offers free model access and a free server option. Those two facts matter as generate-plane placement, not as a slogan. You upload a pinned tarball. You take back a diff and a receipt. You do not mount the apply workspace on that server.

If you already have an isolated generate runner, keep it. The envelope does not require a vendor. It requires a boundary you can hash. A free server is useful when you lack a spare isolate. It is harmful if you paste a checkout into a web chat. That paste is the old unbounded interface in a new tab.

What you change next

Store envelopes in git beside the ticket branch. Reviewers then see the input contract. They stop guessing from a dumped thread. The pull request should include envelope.json and receipt.json before any patch.

Make CI refuse generate jobs without receipt.json. A job that only stores a patch is incomplete. Incomplete jobs should never reach humans. Incomplete jobs should never reach git apply.

Shrink include until the task actually breaks. Then add one file, not ten. That pain shows which files were ritual. Ritual context is how secrets leak into prompts.

Bind output paths to the same allowlist. A retry rename should not rewrite Dockerfile. If the model needs more files, it requests a new envelope. It does not scrape the disk. A second envelope is cheaper than a silent extra file.

An apply-side check that stays boring

After the model returns, do not merge on tone. Verify the diff against the receipt. Keep the check smaller than the model call.

#!/usr/bin/env bash
set -euo pipefail
receipt="$1"
diff="$2"
python3 - "$receipt" "$diff" <<'PY'
import json, re, sys
receipt = json.load(open(sys.argv[1]))
allowed = {row["path"] for row in receipt["files"]}
text = open(sys.argv[2]).read()
paths = set(re.findall(r'(?m)^(?:--- |\+\+\+ )[ab]/(.+)$', text))
extra = sorted(p for p in paths if p not in allowed)
if extra:
    raise SystemExit("diff escapes envelope: " + ", ".join(extra))
print("diff stays inside envelope")
PY

Wire it like this against a known-good receipt.

chmod +x check_diff.sh
./check_diff.sh /tmp/out/receipt.json proposed.patch

That script is boring on purpose. Architecture that needs a speech is usually a leak. If the check and the hasher disagree, you have two sources of truth. Delete one.

Limitations and who should skip this

This workflow assumes you can name the files. Broad refactors across two hundred modules will fight the allowlist. That fight is useful. It is also slow. Do not pretend otherwise.

The hasher does not judge code quality. It only pins bytes. You still need tests on the apply plane. You still need a human at the review gate. A green hash is not a green build.

Do not put customer data in include just because the script allows it. Pinning is not a privacy policy. It is a blast-radius cap. Caps fail when you stuff the envelope with everything "just in case."

Skip this in a scratch repo with no secrets. A teaching demo can stay in a chat window. Production checkouts cannot. Skip this if the generate host can still read $HOME. An envelope on paper with a mounted home directory is theater.

You now have a typed inbound envelope, a hasher, and an apply check. The model sits downstream of those three. Keep it there. If you try a free generate host, send the tarball, not the repo. The receipt must echo the hashes you printed locally. Anything else is a different system than the one you reviewed.

The Generator Host Is a Separate Failure Domain

Harper Xu — Thu, 17 Sep 2026 06:08:20 +0000

Remote generation is not inside your trust boundary. Treat the host as a foreign compiler farm. You review egress first, then you review the diff.

That sounds harsh. It is also cheap insurance. A borrowed inference box can draft without sharing your blast radius.

You still want speed. You still want a second pair of eyes. You do not want that pair inside your VPC.

Start with constraints, not model names

You have three constraints that do not negotiate. Customer data stays on your side of the wire. Apply stays on a machine you control. The generator may vanish tomorrow and your tree must still build.

Those constraints beat any demo. A free drafting host is useful only inside them. If a workflow needs that host to stay forever, you already lost.

Some teams use MonkeyCode here for the drafting plane. It provides free model access and a free server option.

Disclosure: This article was prepared as part of MonkeyCode's product outreach.

You send redacted context. You receive text. You never let that host mount your repo.

Data flow is a mail slot, not a merge

Picture a locked workshop with a mail slot. You slide a brief through the slot. A clerk you do not employ types a draft. You carry the paper home and typeset it yourself.

That is the whole architecture. Pack context on your laptop. Strip secrets at the slot. Accept text from a host you do not own. Apply only after local review.

Sketch the path before you write scripts. If you cannot draw it, you cannot review it.

[working tree + secrets]  ->  packer  ->  redactor
        |                                      |
        |                                      v
        |                              [brief.md] --egress--> [generator host]
        |                                      |
        |                                      v
        |                              [draft.diff + receipt]
        v                                      |
[review + tests + apply]  <---- never mounts --+

The arrows matter more than the boxes. Egress is one way. Apply never points back at the host. The receipt is the only souvenir you keep.

Here is a packing step you can run before any remote call.

#!/usr/bin/env bash
# pack_context.sh — build a redacted brief, never ship the tree
set -euo pipefail
ROOT="$(git rev-parse --show-toplevel)"
ALLOW="$ROOT/brief.allow"
OUT="${TMPDIR:-/tmp}/brief-$(git rev-parse --short HEAD).md"

{
  echo "# Task"
  echo "$1"
  echo
  echo "# Allowed paths"
  if [[ -f "$ALLOW" ]]; then
    cat "$ALLOW"
  else
    git diff --name-only main...HEAD | head -n 20
  fi
} > "$OUT"

python3 redact_prompt.py "$OUT"
echo "$OUT"

The script names files. It does not dump .env. It does not tar the repo. That is the point of the slot.

Keep an allowlist beside the packer. Tomorrow you will thank yourself.

# brief.allow — paths the remote host may hear about
src/payments/retry.py
src/payments/client.py
tests/payments/test_retry.py

Now the redactor. Keep it boring. Boring gates survive Friday deploys.

# redact_prompt.py
import re, sys
from pathlib import Path

SECRET = re.compile(
    r"(?i)(api[_-]?key|secret|token|password)\s*[:=]\s*\S+"
)
ASSIGN = re.compile(
    r"(?i)(AWS|GITHUB|OPENAI|NPM)_[A-Z0-9_]+\s*=\s*\S+"
)

def redact(text: str) -> str:
    text = SECRET.sub("[REDACTED]", text)
    text = ASSIGN.sub("[REDACTED]", text)
    return text

path = Path(sys.argv[1])
path.write_text(redact(path.read_text()), encoding="utf-8")

You run that on every brief. You do not run it on the model host. The host never sees the original bytes.

After the host replies, you store a receipt, not a merge. The receipt is an audit hinge. It says where text came from. It does not bless the diff.

HEAD_SHA="$(git rev-parse HEAD)"
BRIEF_HASH="$(shasum -a 256 "$OUT" | awk '{print $1}')"
PATCH_HASH="$(shasum -a 256 /tmp/draft.diff | awk '{print $1}')"

cat > /tmp/generation-receipt.json <<EOF
{
  "commit": "$HEAD_SHA",
  "brief_sha256": "$BRIEF_HASH",
  "patch_sha256": "$PATCH_HASH",
  "host": "remote-draft",
  "applied": false
}
EOF

Then you check the patch without writing the tree. Failure on apply is your domain. The clerk already left the building.

git apply --check /tmp/draft.diff
# only after a human reads draft.diff and the receipt:
# git apply --cached /tmp/draft.diff

Notice the host is gone by this line. Your editor, your tests, your rollback. The foreign compiler does not get a second vote.

Failure domains you should draw on a whiteboard

Draw three boxes. Do not draw one happy pipeline. The laptop holds secrets, keys, and the working tree. The generator host holds prompts, drafts, and logs you do not control. CI holds tests, signatures, and the right to merge.

If the generator host burns, your repo still boots. If the laptop leaks, the host should hold nothing durable. If CI is wrong, you still refuse an unsigned apply.

That split is the review. Most teams skip it. They paste a stack trace into a chat box. The chat box becomes a fourth domain with no owner.

Watch retention. A free shared host may keep prompts. You should assume it does. Design the brief as if it will be read aloud in a hallway.

Here is a tiny test that fails loud when a brief still carries secrets.

# test_brief_redaction.py
from pathlib import Path
import re, sys

brief = Path(sys.argv[1]).read_text(encoding="utf-8")
needles = [
    r"(?i)api[_-]?key\s*[:=]\s*\S+",
    r"(?i)password\s*[:=]\s*\S+",
    r"AKIA[0-9A-Z]{16}",
    r"-----BEGIN (RSA |OPENSSH )?PRIVATE KEY-----",
]
for n in needles:
    if re.search(n, brief):
        raise SystemExit(f"secret pattern still in brief: {n}")
print("brief is clean enough to leave the laptop")

Run it in the same breath as packing. Do not send a brief that failed this gate. Do not skip the gate because the task feels small.

OUT="$(./pack_context.sh "add retry around the payment client")"
python3 test_brief_redaction.py "$OUT"
# only then: send "$OUT" to the drafting host

You now have a reproducible fence. It is not a product tour. It is architecture you can rerun on Monday.

What this architecture refuses to do

It refuses to stream your tree. It refuses to let the host write files. It refuses to treat fluency as review. Those refusals are features.

It also refuses to promise uptime. A free server is a favor, not a cluster. You keep a local fallback for the same brief format. When the host is gone, the packing scripts still work.

Regex redaction is not a DLP product. It will miss novel secret shapes. It will not understand screenshots. It will not save you from pasting a dump by hand.

Do not put regulated health data in the brief. Do not put unreleased keys in the brief. Do not put production connection strings in the brief. If your threat model forbids any egress, stop here. Use a machine that never routes out.

This pattern is wrong for embargoed kernel work. It is wrong for incident response with live credentials. It is wrong when you cannot explain the diff in standup. It is wrong if apply must happen inside the same process that drafted the text.

What you would change next

First, make the allowlist mandatory. Today the packer can fall back to a diff name list. Tomorrow a missing brief.allow should exit nonzero.

Second, sign the receipt. A detached signature should tie brief hash, patch hash, and head commit. CI can reject apply without that triple. Unsigned drafts stay in /tmp.

Third, replay locally. Keep the brief format stable. When you later run a local model, the same packer feeds it. The host becomes swappable. The fence stays.

Fourth, bound log retention on your side. Delete briefs after merge. The remote host may keep copies. Your laptop should not pile them beside the repo.

None of that needs a bigger model. It needs a smaller blast radius. Architecture work is mostly saying no to extra arrows.

A short review you can repeat

Ask four questions before any remote draft. What leaves the laptop. What the host can retain. What apply is allowed to touch. What you will do when the host disappears.

If you cannot answer those, you are not reviewing architecture. You are hoping. Hope is not a failure domain.

The generator is a foreign compiler. You already know how to treat those. You sandbox them. You inspect object files. You do not let them login.

Keep that habit when the compiler starts talking. The sentence that feels like a teammate is still just bytes crossing a trust line.

If you need a drafting host off your runtime network, try the free server option and keep apply local.

Split Generate and Apply Into Two Planes

Harper Xu — Wed, 16 Sep 2026 04:17:13 +0000

You should not generate on the canonical tree. Generation and apply remain separate failure domains always. Mix those planes and one bad patch owns both.

The public AI coding debate skips this split. People argue about model skill and tests. They rarely draw the architecture boundary first.

Think of a kitchen and a dining room. You cook food in one room only. You do not plate dinner on the stove.

Treat the canonical repository as the dining room. The agent workspace is the hot kitchen. Food moves only after a pass at the counter.

Constraints you actually have

You do not control the model's next token. You do control mounts, env, and apply. Those three knobs define the real architecture now.

Ignore them and the model owns your filesystem. The generator needs a compiler, tests, and files. It does not need production secrets at all.

It does not need your private deploy keys. It does not need a writable origin mount. Shared mounts collapse two planes into one.

Canonical state still has a different job entirely. It stores reviewed history and named release tags. It must stay boring, small, and fully attributable.

An agent session is none of those things. The review window collapses under real deadlines. Teams then apply from the same dirty checkout.

That is how scratch files become production code. You need a plane the agent cannot keep. You also need a plane the agent cannot see.

A free remote host can hold the kitchen. Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode provides free model access and a free server option.

You can keep generation off your laptop disk. That remote host is still untrusted compute though. Treat it as a contractor laptop in a lobby.

You hand it a task bundle, not house keys. You take back a patch file, not shells. Write access to origin never leaves your apply host.

Data flow that survives a bad session

Start with a task bundle, not a live tree. The bundle contains a sparse checkout recipe only. It also contains a test command and size budget.

It contains no dotenv files and no ssh agents. The generator builds scratch state from that bundle. It writes code, runs tests, and emits artifacts.

The only exit products are a diff plus logs. Those files leave through a review inbox path. They do not leave through a git push.

You inspect the diff on a machine you trust. You reject path escapes, secrets, and binary blobs. You apply with git apply and then commit.

Canonical history never saw the generator disk layout. Here is a proposed guard for local apply. Treat the script as an example, not gospel.

#!/usr/bin/env python3
"""plane_guard.py — refuse mixed generate/apply planes."""
from pathlib import Path
import os
import sys

CANONICAL = Path(os.environ["CANONICAL_ROOT"]).resolve()
SCRATCH = Path(os.environ["AGENT_SCRATCH"]).resolve()
DIFF = Path(os.environ["REVIEW_DIFF"]).resolve()

FORBIDDEN_ENV = ("SSH_AUTH_SOCK", "AWS_SECRET_ACCESS_KEY", "GITHUB_TOKEN")

def fail(msg: str) -> None:
    print(f"plane-guard: {msg}", file=sys.stderr)
    sys.exit(2)

if CANONICAL == SCRATCH:
    fail("scratch plane equals canonical root")

if CANONICAL in SCRATCH.parents:
    fail("scratch plane sits inside canonical tree")

if SCRATCH in CANONICAL.parents:
    fail("canonical tree sits inside scratch plane")

for key in FORBIDDEN_ENV:
    if os.environ.get(key):
        fail(f"secret env {key} is visible")

text = DIFF.read_text(encoding="utf-8", errors="replace")
if "\0" in text:
    fail("diff contains binary payload")

blocked = (".env", "id_rsa", "credentials.json", "kubeconfig")
for name in blocked:
    if name in text:
        fail(f"diff mentions blocked path {name}")

print("plane-guard: generate/apply split looks intact")

Wire this guard in front of apply only. Do not wire it inside the agent process. The agent must not skip its own fence.

#!/usr/bin/env bash
# apply_reviewed_diff.sh — proposed apply path, not a generator hook
set -euo pipefail

export CANONICAL_ROOT="${CANONICAL_ROOT:?}"
export AGENT_SCRATCH="${AGENT_SCRATCH:?}"
export REVIEW_DIFF="${1:?diff path required}"

python3 plane_guard.py
git -C "$CANONICAL_ROOT" apply --check "$REVIEW_DIFF"
git -C "$CANONICAL_ROOT" apply --index "$REVIEW_DIFF"
git -C "$CANONICAL_ROOT" commit -m "apply reviewed generator diff"

Notice the commit happens only after the check. The scratch path never receives a git commit. Secret values stay absent from that environment.

That is the data flow, not a poster slogan. A remote generation job can follow this sketch. Keep the canonical remotes off that host.

# proposed remote scratch session on throwaway compute
rsync -a --exclude '.env' --exclude '.git' task-bundle/ "$AGENT_SCRATCH/"
ssh generator-host 'cd "$AGENT_SCRATCH" && run-agent && git diff > /tmp/out.diff'
scp generator-host:/tmp/out.diff ./review/inbox/out.diff

The laptop remains the only apply principal here. The generator host remains a disposable kitchen still. If the session dies, you lose scratch only.

A tiny manifest keeps the bundle honest. Treat this file as a proposed contract. Do not treat it as a vendor schema.

# task-bundle/manifest.yml — proposed local contract
budget:
  max_files: 12
  max_diff_bytes: 65536
test: "python -m pytest -q tests/unit"
exclude:
  - ".env"
  - "*.pem"

Copy the manifest with the sparse sources. The generator may ignore budget if unsupervised. Your apply host must enforce the budget later.

Failure domains

Draw four boxes and refuse to merge them. The prompt box can lie without any warning. The scratch box can be wiped without grief.

The review box can stall and must stall. The apply box must stay dull forever. Dull apply is a feature, not a tax.

If the model prompt-injects itself, damage stays scratch-side. If the free server disk leaks, you lose bundles. You do not lose production deploy keys then.

That is the point of the plane split. If review is skipped, the architecture already failed. A pretty green test log is not review.

Tests ran on the generator's own chosen word. The generator may have written those tests too. Believe tests after they run on trusted apply.

Network is its own failure domain as well. Scratch compute should not reach your prod APIs. It should not reach cloud metadata services either.

It should not reach canonical git with write rights. A common leak is a shared Docker socket. Another leak is a cached cloud credential helper.

Another leak is a home directory rsync copy. Each leak collapses two planes into one plane. You want failure to be loud and local.

A killed scratch virtual machine is cheap failure. A rewritten main branch is expensive failure instead. Choose the cheap failure on purpose every time.

# proposed isolation checks before a generate session
test -z "${SSH_AUTH_SOCK:-}" || echo "agent socket is visible"
test ! -S /var/run/docker.sock || echo "docker socket is mounted"
env | grep -E 'AWS_|GITHUB_|KUBE' || true
git -C "$CANONICAL_ROOT" remote -v

Run those checks on the laptop before copy. Do not run them only on the generator. The generator has incentive to lie about them.

What you should change next

Stop mounting the repo into the agent runtime. Copy a sparse task bundle instead of mounts. Delete the scratch tree after the diff lands.

Keep the review inbox on a machine you trust. Add an ownership check on every apply step. The applying identity must not be the generator.

Different keys, different hosts, and different audit logs. Same human is fine, same principal is not. Cap the diff before charm can hide scope.

A generator that rewrites the monorepo is not helping. Reject diffs over a file budget you set. Architecture is also about saying no early.

# proposed size gate on the apply host
files=$(grep -c '^diff --git ' "$REVIEW_DIFF" || true)
bytes=$(wc -c < "$REVIEW_DIFF")
test "$files" -le 12 || { echo "too many files"; exit 1; }
test "$bytes" -le 65536 || { echo "diff too large"; exit 1; }

Do not chase model scores as the next move. The real bottleneck is the apply path today. Harden that path before you add more prompts.

A calmer apply path beats a louder model. If you need throwaway generation compute, split first. The free server option belongs on scratch only.

Do not point that plane at canonical state. Who should skip this two-plane design completely? Solo prototypes on throwaway repos can ignore it.

Kata folders you will delete tonight can too. Production history cannot ignore the split though. Customer data and deploy keys cannot ignore it.

This approach will annoy you at first pass. Extra copies feel slow and purely ceremonial now. That ceremony is the review boundary in motion.

Speed without planes is just shared fate. Limitations are real and you should name them. Sparse bundles miss local context the model wants.

Remote scratch hosts can vanish during a run. The guard script cannot parse every patch trick. You still need a human on the apply box.

You now have a two-plane architecture, not prompts. Keep cooking in the kitchen on purpose. Serve only what survived the counter pass.

Leave the dining room boring on purpose too. Boring history is the prize you keep. Let the agent rage in scratch, not origin.

Ephemeral Generators Need a Review Boundary

Harper Xu — Mon, 14 Sep 2026 21:49:41 +0000

A free model and a free server change your budget, not your threat model. The interesting engineering problem is the boundary around the generator. I review that boundary before any generated diff reaches a repository.

This is an architecture review, not a product tour. I assume the workspace is disposable, the model may change under me, and nothing persists unless I write it somewhere durable. Those assumptions drive every decision below.

Start With the Constraints

Treat a free workspace as ephemeral by default. Assume it can be reclaimed mid-run without warning. That single constraint forces you to checkpoint early and often.

Assume the model string you pinned yesterday may not describe today's weights. Providers swap versions quietly. Record what you asked for, and record what you got back.

Assume nothing about egress. A generator that can reach your metadata endpoint will eventually try. Deny by default at the sandbox layer, not in the prompt.

Assume the repository itself is input you do not control. A CONTRIBUTING.md file can carry instructions. Your generator reads it as text and may treat it as intent.

If those four assumptions hold, the rest of the review is mechanical. You are designing a pipe, not a collaborator.

The Data Flow I Want

Generation should never write into a working tree you care about. It writes into a throwaway workspace and emits one artifact: a patch plus a packet describing it.

The flow has five stages. Prompt goes in, ephemeral workspace comes up, generator produces a diff, the packet is built, a reviewer decides. Nothing in that chain auto-applies to main.

Here is the shell skeleton for one run. The script below is a proposal, not a benchmarked tool.

#!/usr/bin/env bash
# gen.sh - one run, one workspace, one packet.
set -euo pipefail

RUN_ID="$(date -u +%Y%m%dT%H%M%SZ)-$$"
SRC="${1:?usage: gen.sh <repo> <prompt-file>}"
PROMPT_FILE="${2:?usage: gen.sh <repo> <prompt-file>}"

WORK="$(mktemp -d "/tmp/gen-$RUN_ID.XXXX")"
mkdir -p "$WORK/out"

# Shallow clone keeps the free disk budget intact.
git clone --depth 1 --quiet "$SRC" "$WORK/repo"
git -C "$WORK/repo" checkout --quiet -b "gen/$RUN_ID"

# The generator runs with egress denied at the sandbox layer.
# No secrets are passed through the environment.
"$GENERATOR_BIN" --prompt-file "$PROMPT_FILE" --workdir "$WORK/repo"

git -C "$WORK/repo" add -A
git -C "$WORK/repo" diff --cached --binary > "$WORK/out/patch.diff"

python3 packet.py "$WORK/repo" "$RUN_ID" "${MODEL_ID:-unspecified}" \
  > "$WORK/out/packet.json"

echo "packet: $WORK/out/packet.json"

The packet is the part most teams skip. Without it, a reviewer sees a diff and guesses at context. With it, the reviewer sees a fingerprint and a classification.

#!/usr/bin/env python3
"""Build a review packet from an ephemeral generation run.

Proposal code. I have not run this exact form in production.
"""
import hashlib
import json
import subprocess
import sys
from pathlib import Path


def git(repo: str, *args: str) -> str:
    return subprocess.run(
        ["git", "-C", repo, *args],
        capture_output=True, text=True, check=True,
    ).stdout


def classify(paths: list[str]) -> dict[str, int]:
    buckets = {"ci": 0, "iac": 0, "deps": 0, "src": 0, "other": 0}
    dep_files = {"package.json", "requirements.txt", "go.mod", "Cargo.toml"}
    for f in paths:
        if f.startswith((".github/", ".gitlab-ci")):
            buckets["ci"] += 1
        elif f.endswith((".tf", ".tfvars")) or "k8s" in f:
            buckets["iac"] += 1
        elif Path(f).name in dep_files:
            buckets["deps"] += 1
        elif f.startswith("src/"):
            buckets["src"] += 1
        else:
            buckets["other"] += 1
    return buckets


def packet(repo: str, run_id: str, model: str) -> dict:
    diff = git(repo, "diff", "--cached", "--binary")
    changed = [p for p in git(repo, "diff", "--cached", "--name-only").split() if p]
    buckets = classify(changed)
    return {
        "run_id": run_id,
        "model_requested": model,
        "diff_sha256": hashlib.sha256(diff.encode()).hexdigest(),
        "files_changed": len(changed),
        "blast_radius": buckets,
        "needs_human_review": buckets["ci"] > 0 or buckets["iac"] > 0,
    }


if __name__ == "__main__":
    print(json.dumps(packet(sys.argv[1], sys.argv[2], sys.argv[3]), indent=2))

The gate rule is one line. Any diff touching CI or infrastructure requires a human before merge. Everything else can queue normally.

Failure Domains, Not Features

An architecture review is mostly a list of ways the thing breaks. Here is mine for ephemeral generation workers.

Failure domain	Trigger	Blast radius	Containment
Workspace reclaimed mid-run	free-tier eviction	lost tokens, partial patch	write packet every N seconds
Silent model swap	provider updates weights	untested code looks blessed	record model string per run
Prompt injection via repo files	generator reads docs as intent	edits to CI config	deny egress, never auto-apply
Credential reach	environment passthrough	leaked deploy token	scoped tokens, no secrets in workspace
Disk exhaustion	full clone plus dependencies	run dies without a packet	shallow clone, hard size cap
Cross-run contamination	two runs share a home directory	wrong diff attributed to wrong run	per-run directories, no shared cache

Only one of those is about model quality. The rest are ordinary operations problems, and they are the ones that actually bite.

MonkeyCode enters this review as the ephemeral worker. The operator states that free model access and a free server option are available, so the generation step can run on hardware you do not own. The operator also states a free tier of roughly 10M tokens. Confirm current quotas and limits on the project page before planning around them, because free tiers move.

Disclosure: This article was prepared as part of MonkeyCode's product outreach.

What matters architecturally is that the worker stays stateless. The free server should hold no secrets, no durable cache, and no authority to merge. It produces a packet and disappears. If a product cannot satisfy that, it is the wrong worker regardless of price.

What I Would Change Next

I would sign the packet. A hash inside an unsigned JSON blob proves nothing if the uploader can rewrite both. Signing makes the artifact the unit of trust.

I would add a per-run ceiling. Count tokens, wall time, and changed lines, then abort past a threshold. Free compute still costs you review attention, and that is the scarce resource.

I would log replays. Store every prompt, model string, and packet hash. When a diff surprises you next month, the log is the only way back.

I would separate the egress policy from the tool. Today most generators treat network access as ambient. It should be a capability you grant, scoped by destination, auditable after the fact.

Limitations and Who Should Skip This

This workflow cannot build projects that need secrets at compile time. If your build fetches private packages, an egress-denied ephemeral worker will fail early and often.

It also breaks down on monorepos with long builds. Ephemeral free compute plus a twenty-minute toolchain is a bad pairing.

Skip this approach if you work in a regulated codebase with data residency rules. Skip it if nobody is on call to review the queue. Skip it if you need bit-for-bit reproducible builds across months, because ephemeral workers are the wrong primitive for that.

The honest summary is unglamorous. Free model access and a free server remove a cost barrier. They do not remove the review boundary, the failure domains, or the need for a packet a human can read.

Run the script once against a throwaway repository and see which failure domain reaches you first. That answer tells you more than any feature page will.

Never Unpack a Patch Onto the Tree

Harper Xu — Sun, 13 Sep 2026 20:32:54 +0000

You should never let a remote generator write your tree. The working copy is a privileged control plane. You treat generation as cargo that arrives sealed.

This is an architecture review, not a product pitch. You will walk constraints, data flow, and failure domains. Then you will see what to change next.

The public argument about AI coding skill misses layout. Fluent generated text does not earn write access. A smooth patch can still poison a branch.

Planes you refuse to merge

You keep three planes apart on purpose. Local context packing stays on your own laptop. Remote generation stays on a separate draft host.

Local apply stays behind a human command. The generator never sees .git or .env. It never mounts your repo as a disk.

Think of a loading dock behind a locked warehouse. Trucks only drop crates at that dock. Those trucks never walk the stocked aisles.

Your working tree is that aisle space. A free remote model can still draft diffs. A free server can still host that draft.

Neither fact grants the server a git remote. Write access is not some courtesy upgrade. It is a failure domain you refuse to share.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode currently offers free model access for drafts. It also offers a free server option you can use.

You still run the git write path locally. Swap the vendor and the planes still hold. Remove every brand name and the rule survives.

Data flow, crate by crate

Start from a working tree you already trust. You pick files by allowlist, never by panic. You copy those files into a staging pack.

The packer strips secrets before any network hop. It drops lines that match key patterns. It drops files whose names look like credentials.

You send only that pack to the generator. The request is source, not a login shell. The response is files, not a merge commit.

Those returned files land in a quarantine directory. That directory sits outside every git worktree. git status in your repo must ignore that folder.

You inspect the crate before you open it. Path names must stay inside an allowlist. A throwaway clone must accept the dry run.

Only then do you copy a hunk into the tree. You still type the commit message yourself. You still run the test command yourself.

Here is a packer you can run locally. Treat this script as a labeled proposal. Review it before you point it at secrets.

#!/usr/bin/env python3
"""Local context packer. Proposal only. Review before use."""
from pathlib import Path
import io
import re
import tarfile

ALLOW = {".py", ".ts", ".go", ".rs", ".md"}
DENY_NAMES = {".env", "id_rsa", "credentials.json"}
SECRET = re.compile(r"(api[_-]?key|secret|BEGIN PRIVATE)", re.I)

def pack(root: Path, out: Path) -> None:
    root = root.resolve()
    buf = io.BytesIO()
    with tarfile.open(fileobj=buf, mode="w:gz") as tar:
        for path in root.rglob("*"):
            if not path.is_file():
                continue
            if path.suffix not in ALLOW:
                continue
            if path.name in DENY_NAMES:
                continue
            rel = path.relative_to(root)
            if any(part == ".git" for part in rel.parts):
                continue
            text = path.read_text(encoding="utf-8", errors="replace")
            if SECRET.search(text):
                continue
            data = text.encode("utf-8")
            info = tarfile.TarInfo(rel.as_posix())
            info.size = len(data)
            tar.addfile(info, io.BytesIO(data))
    out.write_bytes(buf.getvalue())

if __name__ == "__main__":
    pack(Path("."), Path("/tmp/context-pack.tgz"))
    print("wrote /tmp/context-pack.tgz")

You run it from a clean clone, not production. You list the tarball before any upload. Surprise paths mean you stop the hop.

python3 pack_context.py
tar -tzf /tmp/context-pack.tgz

The generator returns a second archive of files. You never extract that archive onto the repo. You extract it under /tmp/quarantine for that run.

RUN_ID=$(date +%s)
mkdir -p "/tmp/quarantine/$RUN_ID"
tar -tzf /tmp/generated.tgz
tar -xzf /tmp/generated.tgz -C "/tmp/quarantine/$RUN_ID"

Record the parent hash beside the run identifier. You will need that hash when crates come back. A missing hash means you discard the crate.

mkdir -p "/tmp/quarantine/$RUN_ID"
sha256sum /tmp/context-pack.tgz > "/tmp/quarantine/$RUN_ID.parent-hash"
cat "/tmp/quarantine/$RUN_ID.parent-hash"

Then a local checker decides if the crate may move. This checker reviews paths, not the model's tone. Model tone is not a security control here.

#!/usr/bin/env python3
"""Quarantine a generated tree, then dry-run it on a clone."""
from pathlib import Path
import shutil
import subprocess
import sys

ALLOWED_PREFIXES = ("src/", "tests/", "docs/")
FORBIDDEN_PARTS = {".git", ".ssh", ".github", "node_modules"}

def normalize(rel: Path) -> str:
    return rel.as_posix().lstrip("./")

def path_allowed(rel: Path) -> bool:
    text = normalize(rel)
    if rel.is_absolute() or ".." in rel.parts:
        return False
    if any(part in FORBIDDEN_PARTS for part in rel.parts):
        return False
    return any(text.startswith(prefix) for prefix in ALLOWED_PREFIXES)

def check_quarantine(qdir: Path) -> list[str]:
    rejected: list[str] = []
    files = [p for p in qdir.rglob("*") if p.is_file()]
    if not files:
        return ["<empty>"]
    for path in files:
        rel = path.relative_to(qdir)
        if not path_allowed(rel):
            rejected.append(normalize(rel))
    return rejected

def dry_run(qdir: Path, repo: Path) -> int:
    work = Path("/tmp/apply-check")
    if work.exists():
        shutil.rmtree(work)
    subprocess.run(
        ["git", "clone", "--local", str(repo), str(work)],
        check=True,
    )
    for path in qdir.rglob("*"):
        if not path.is_file():
            continue
        rel = path.relative_to(qdir)
        dest = work / rel
        dest.parent.mkdir(parents=True, exist_ok=True)
        dest.write_bytes(path.read_bytes())
    diff = subprocess.run(
        ["git", "-C", str(work), "diff", "--stat"],
        text=True,
        capture_output=True,
        check=True,
    )
    print(diff.stdout or "no diff")
    conflict = subprocess.run(
        ["git", "-C", str(work), "diff", "--check"]
    )
    return conflict.returncode

def main() -> int:
    qdir = Path(sys.argv[1]).resolve()
    repo = Path(sys.argv[2]).resolve()
    rejected = check_quarantine(qdir)
    if rejected:
        print("rejected paths:")
        print("\n".join(rejected))
        return 1
    return dry_run(qdir, repo)

if __name__ == "__main__":
    raise SystemExit(main())

Run the checker against the repo you actually trust. A nonzero exit means the crate is trash. You delete it before anyone gets curious.

python3 quarantine_check.py "/tmp/quarantine/$RUN_ID" /path/to/repo

You should confirm parent segments cannot sneak into names. Python will show .. inside the path parts. Your checker must treat that as a hard reject.

python3 - <<'PY'
from pathlib import Path
rel = Path("src/../.git/hooks/pre-commit")
print(rel.parts)
print(".." in rel.parts)
PY

If the checker exits nonzero, you delete the crate. You do not just peek with a recursive copy. Peeking is how path traversal becomes a commit.

Failure domains on this layout

The first failure domain is the outbound prompt. A useful file can still hide a token. Your packer is a filter, not a proof.

If the filter misses, the server learns the secret. You rotate that secret as if it leaked. You do not argue with the model about intent.

The second failure domain is the inbound crate. A patch can rewrite workflows you never asked for. It can plant a path that walks toward .git.

Quarantine exists because file names often lie. That src/../.git/hooks/pre-commit path is not a source file. Your checker must reject parent segments every time.

The third failure domain is availability of the draft host. The free server can stall, rate-limit, or vanish. Your ship date cannot live on that host.

That is why apply stays local and boring. You can still edit by hand when drafts die. Remote generation is an optimization, not a runtime.

The fourth failure domain is false confidence after a dry run. git diff --check does not run your tests. A clean apply can still ship a logic bomb.

You keep tests on the same machine that commits. The remote host never receives your test credentials. It never receives the production config files either.

A useful analogy here is airport cargo screening. The plane does not taxi into your warehouse. Bags move through a separate hall first.

You are not being precious about tools. You are drawing a trust boundary on disk. Disk is the place where branches actually change.

What you should change next

Today the allowlist is a tuple of prefixes. That is too coarse for a large monorepo. Next you should map each task to a path budget.

A path budget is a short signed list of globs. The generator may touch only those globs. Anything else is a rejected crate, full stop.

You should also hash every file that leaves. Store the hash beside the run identifier. When the crate returns, you match the conversation.

Today the dry run still clones with --local. That is fast, and it is also leaky. A local clone can still see your remotes.

Next you should clone from a bare mirror instead. The mirror has no working secrets and no hooks. Repo hooks are another quiet write path.

You should refuse generated workflow files by default. CI YAML is a remote code execution surface. Treat it like a new production binary.

None of this requires a smarter model. It requires a smaller blast radius on disk. Radius is an architecture choice you already own.

Who should not use this layout

Do not use this layout for incident hotfixes. A quarantine bus adds minutes you may not have. Type the fix and skip the draft host.

Do not use it if you cannot list allowlists. A wide open src/ in a huge repo is weak. Split the tree before you invite a generator.

Do not auto-apply crates from a cron job. The whole point is a human on the write path. Automation here recreates the problem you just drew.

Do not send customer data in the pack. Free servers are still not your compliance boundary. If the file is sensitive, it stays offline.

Limits you should not paper over

The scripts above are proposals, not audited tools. They will miss encodings, symlinks, and sparse checkouts. They will miss secrets that look like prose.

They also do not measure model quality at all. This review is about failure domains, not tokens. Token counts would belong in a different article.

You still need a human who can read the diff. Architecture cannot replace that last pair of eyes. It can only keep the eyes off a burning branch.

You keep the generator on the loading dock. You keep the warehouse keys in your pocket.

Bound the Generator at the Review Gate

Harper Xu — Sat, 12 Sep 2026 18:33:02 +0000

You should split generation from merge on purpose. The generator is a failure domain, not a teammate. A local review gate keeps that boundary honest.

Most teams collapse those two planes by habit. They paste a prompt, accept a tree, and push. That pattern is a hallway with no doors.

Constraints

You do not control the model's training set. You also do not control a remote generation host. You do control which files may enter git.

Think of the generator as a noisy workshop offsite. The workshop can cut wood for you. It cannot hang the door on your house.

You inspect every piece at the gate. A generated patch is lumber, not a finished wall. Merge authority stays in your repo, always.

A hosted coding box can still help this flow. You send a narrow brief and receive a patch. You never send credentials, topology maps, or merge rights.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode provides free model access and a free server option. You can park that option in the workshop role.

Swap the host later if you still want. The gate does not care about the brand. Architecture cares about the cut, not the logo.

Data flow

Keep one direction of travel for data. A redacted prompt goes out across the wire. A unified diff comes back and nothing else.

You assemble the prompt from a brief template. You never dump .env into that request. You never attach kubeconfigs, SSH keys, or customer dumps.

The host returns text, not a live checkout. You save that text as incoming.patch on disk. You still do not apply it to the worktree.

A local validator owns the next hop. The validator reads bytes instead of model intent. Intent is not an interface you can trust.

Here is a starting gate you can run first. Treat the script as a proposal, not a certified control.

#!/usr/bin/env python3
"""proposal: local review gate for untrusted unified diffs"""
from pathlib import Path
import re
import sys

ALLOWED_PREFIXES = ("src/", "tests/", "docs/")
DENIED_NAMES = {".env", "id_rsa", "credentials.json", "kubeconfig"}
DENIED_PATTERNS = [
    re.compile(r"curl\s+[^\n]*\|\s*(sh|bash)"),
    re.compile(r"chmod\s+777"),
    re.compile(r"os\.system\("),
]

def iter_paths(patch: str):
    for line in patch.splitlines():
        if line.startswith("+++ b/"):
            yield line[6:]

def allowed(path: str) -> bool:
    p = Path(path)
    if p.is_absolute() or ".." in p.parts:
        return False
    text = str(p)
    return text.startswith(ALLOWED_PREFIXES)

def main(path: str) -> int:
    patch = Path(path).read_text(encoding="utf-8")
    if "diff --git" not in patch:
        print("reject: not a git unified diff")
        return 2
    if re.search(r"^GIT binary patch", patch, re.M):
        print("reject: binary patch")
        return 2
    paths = list(iter_paths(patch))
    for p in paths:
        if Path(p).name in DENIED_NAMES or not allowed(p):
            print(f"reject: path {p}")
            return 2
    for rx in DENIED_PATTERNS:
        if rx.search(patch):
            print(f"reject: pattern {rx.pattern}")
            return 2
    print("accept: patch may enter human review")
    return 0

if __name__ == "__main__":
    sys.exit(main(sys.argv[1]))

You invoke it with a boring command. The numeric exit code is your only contract.

python3 tools/review_gate.py incoming.patch
echo $?
# 0: humans may read the diff
# 2: the worktree never sees the bytes
git apply --check incoming.patch

Notice what the script refuses to do. It does not merge or fetch extra files. It does not call the model again.

Failure domains

Draw four boxes and refuse to merge them. Prompt assembly is the first box you own. It leaks if you paste secrets in a hurry.

The generator host is the second box. It can hallucinate dependencies and invent missing APIs. It can emit a helper that shells out.

The review gate is the third box. It can fail closed or fail open. The gate must fail closed on errors.

Merge and deploy form the fourth box. Only signed reviewed trees belong in that box. Generated text is not a merge signature.

Airport screening is the picture to steal. The workshop is allowed to pack a suitcase. Security still opens every bag before the plane.

The plane does not load unchecked bags. Talent in the workshop does not change that. Your production cluster is the plane here.

If the generation host is remote, this cut matters. You should assume the host can see the prompt. You should assume it cannot see production.

What should the gate actually read from a patch? Paths are the cheap signal you get first. Behavior is the expensive signal you still need.

You want tests in the same patch. A patch with no tests is a sketch. Sketches do not get to rename production modules.

Add a second check that counts test files. Keep that rule small and highly visible.

def test_touch_ok(paths):
    code = [p for p in paths if p.endswith((".py", ".ts", ".go"))]
    tests = [p for p in code if p.startswith("tests/") or "/tests/" in p]
    return bool(code) and bool(tests)

You still need a human after that. A model can write a test that asserts nothing. The ratio is a tripwire, not a proof.

Git will not protect you by default. git apply does not know your allowlist. You wrap apply so fingers cannot skip the gate.

#!/bin/sh
# proposal: never apply a generated patch without the gate
set -eu
patch="$1"
python3 tools/review_gate.py "$patch"
git apply --check "$patch"
git apply "$patch"
git diff --stat

You now have data flow with deliberate friction. That friction is the architecture you wanted. Speed without a gate is just blast radius.

Keep a decision table beside the script. A table is a contract people can argue with. Hidden rules in chat do not survive rotation.

Read each row as a promotion rule. The generator may propose a src change. It may not promote CI, IAM, or deploy yaml.

If a change needs workflow files, you type them. That is a failure-domain cut, not stubbornness. Machines that ship themselves are not being reviewed.

What to change next

The current gate still trusts raw filename prefixes. Prefixes are a weak wall under pressure. A path with .. can fool a naive check.

You must normalize paths before you allow them. You reject absolute paths on first sight. You reject parent traversal without a discussion.

You should hash every accepted patch on disk. Then store the digest beside the ticket. Later CI can refuse trees that do not match.

sha256sum incoming.patch | tee incoming.patch.sha256

# proposal: CI checks bytes, and never calls the model
name: patch-provenance
on: pull_request
jobs:
  gate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: python3 tools/review_gate.py incoming.patch
      - run: sha256sum -c incoming.patch.sha256

You should stop pasting prompts from live incidents. Build a brief with fields you allow. You list service name, symptom, and failing test.

You list non-goals and you stop there. Leave hostnames and tokens out of that brief. If the model needs a stack trace, redact it.

Redaction is part of prompt assembly, not polish. Give a future self-hosted runner a fake network. A host you do not control will not do that.

Your gate must assume outbound calls happened. You should deny binary patches in this flow. Generated jars and images skip review too easily.

Text diffs are the only artifact on this path. Store the brief next to the digest. Future you will need both during incident review.

Limitations

This design does not make the model honest. It only makes promotion expensive and visible. Expense is how you buy a smaller failure domain.

The regex list will rot in weeks. New exfil tricks will miss curl | sh. You extend the gate when you learn, in review.

The allowlist will annoy you during large refactors. That pain is a useful design signal. Move the boundary with a reviewed config change.

Do not use this approach inside a production VPC. Do not use it when the patch must touch IAM. Do not use it for hot incident patches alone.

If your team cannot run tests locally, stop. The gate becomes theater without a test run. Theater is worse than an honest manual review.

Try the flow on a throwaway repository first. Write a failing test with a tight name. Send only that test and a short brief.

Save the reply as a patch file. Run the gate before you read for style. Then read the diff aloud, file by file.

You are listening for surprise in the file list. You treat unexpected files as a domain leak. Reject extra files even when tests pass.

If you already have a generator host, keep it in that workshop box. MonkeyCode's free models and free server can live there. Merge stays on your laptop either way.

Keep Generation Off the Runtime Network

Harper Xu — Fri, 11 Sep 2026 16:02:38 +0000

You should keep generation off your runtime network. That constraint beats a pile of prompt rules. A remote coding hop is only a worker.

It is not a cluster peer. You do not share routes with it. You do not share identity with it.

Teams invert this under deadline pressure. They drop a model box beside app nodes. Then secrets leak through routes nobody drew.

Think of a print shop downtown. You send a manuscript in a sealed envelope. You collect pages at the counter later. You never hand the shop your house key.

A generation host is that shop. It may read a redacted bundle. It may emit a tarball. It must not open a path back.

The constraints you actually have

Runtime owns state, traffic, and identity. Generation owns none of those three. Mix them and you create one failure domain.

Your editor may sit on a trusted laptop. Your CI may sit on a trusted runner. Neither should mount the generation host as a sibling.

You also lack a durable capacity story. Free hops vanish, throttle, or move. Design the hop as disposable from day one.

Do not store cluster kubeconfigs on that box. Do not store cloud roles on that box. Do not store production DNS on that box.

The only credential it may see is narrow. Scope it to one job identifier. Expire it when the tarball lands.

Current coding agents tempt a worse shape. They want a loop that can touch tools. A loop with cluster reach is a merged domain.

You can still use a model for drafts. You cannot let the draft host route packets. Drafts travel as files, not as sessions.

Data flow for one generation job

Draw the path as a one-way valve. Trusted side packs a bundle. Trusted side pushes that bundle out.

The generation host writes artifacts to a drop folder. Trusted side pulls the folder later. Trusted side verifies before any merge.

Nothing on the generation host starts runtime calls. No webhooks into prod. No git push with a deploy key.

Name the four hops in plain language. Pack lives on trusted ground. Generate lives on the isolated host. Fetch returns to trusted ground. Gate decides merge or reject.

Here is a packer that strips secrets first. Treat it as an example, not a hardened product. Run it on the trusted side only.

# pack_prompt.py — example packer, unexecuted in your org until you review it
from pathlib import Path
import hashlib, json, tarfile, os, re, time

ROOT = Path(".").resolve()
OUT = Path("/tmp/gen-job")
DENY = re.compile(r"(BEGIN (RSA |OPENSSH )?PRIVATE KEY|AKIA[0-9A-Z]{16}|api[_-]?key\s*=)", re.I)
SKIP = {".env", ".pem", ".key", "kubeconfig", "id_rsa"}

def allowed(path: Path) -> bool:
    if any(path.name.endswith(s) or path.name == s for s in SKIP):
        return False
    rel = path.relative_to(ROOT).as_posix()
    return not rel.startswith((".git/", "node_modules/", "secrets/"))

def pack(job_id: str, paths: list[str]) -> Path:
    OUT.mkdir(parents=True, exist_ok=True)
    staging = OUT / job_id
    if staging.exists():
        raise SystemExit("job id already packed")
    staging.mkdir()
    manifest = {"job_id": job_id, "files": [], "packed_at": int(time.time())}
    for raw in paths:
        src = (ROOT / raw).resolve()
        if ROOT not in src.parents and src != ROOT:
            raise SystemExit(f"path escapes workspace: {raw}")
        if not src.is_file() or not allowed(src):
            continue
        text = src.read_text(errors="replace")
        if DENY.search(text):
            raise SystemExit(f"secret-like content in {raw}")
        dest = staging / src.relative_to(ROOT)
        dest.parent.mkdir(parents=True, exist_ok=True)
        dest.write_text(text)
        digest = hashlib.sha256(text.encode()).hexdigest()
        manifest["files"].append({"path": str(src.relative_to(ROOT)), "sha256": digest})
    (staging / "manifest.json").write_text(json.dumps(manifest, indent=2))
    tar_path = OUT / f"{job_id}.tar.gz"
    with tarfile.open(tar_path, "w:gz") as tar:
        tar.add(staging, arcname=job_id)
    print(tar_path)
    print(hashlib.sha256(tar_path.read_bytes()).hexdigest())
    return tar_path

if __name__ == "__main__":
    job = os.environ.get("GEN_JOB_ID", "job-demo")
    pack(job, ["README.md", "src/app.py", "prompts/task.md"])

You copy that tarball onto the generation host. You do not copy your shell history. You do not copy ~/.ssh. You do not copy CI OIDC tokens.

The generation host should see a short job token only. That token writes one drop object. It cannot read other jobs. It cannot talk to your API.

# trusted side: copy the bundle out, never mount $HOME
job="${GEN_JOB_ID:?set GEN_JOB_ID}"
install -m 600 /tmp/gen-job/${job}.tar.gz ./outbox/${job}.tar.gz
sha256sum ./outbox/${job}.tar.gz | tee ./outbox/${job}.sha256

# isolated host: work inside a disposable directory
mkdir -p /var/gen/${job}/drop
tar -C /var/gen/${job} -xzf /inbox/${job}.tar.gz
# run your generator against /var/gen/${job}/${job} only
# write /var/gen/${job}/drop/artifact.tar.gz when finished

Pull stays on trusted ground. You fetch bytes. You check the digest. You inspect before merge.

# fetch_and_gate.sh — example gate, review before you use it
set -euo pipefail
job="${GEN_JOB_ID:?}"
expect="$(cut -d ' ' -f1 < outbox/${job}.sha256)"
curl -fsS "https://gen-drop.example/${job}/artifact.tar.gz" -o /tmp/${job}-art.tar.gz
got="$(sha256sum /tmp/${job}-art.tar.gz | awk '{print $1}')"
test "$got" = "$expect" || { echo "digest mismatch"; exit 2; }
mkdir -p /tmp/${job}-art
tar -C /tmp/${job}-art -xzf /tmp/${job}-art.tar.gz
# reject absolute paths and parent traversal
if tar -tzf /tmp/${job}-art.tar.gz | grep -E '(^/)|(^\.\./)|(/\.\./)'; then
  echo "unsafe member path"; exit 3
fi
# reject obvious runtime bindings inside the artifact
if grep -R -E 'kubeconfig|BEGIN OPENSSH PRIVATE KEY|AKIA[0-9A-Z]{16}' /tmp/${job}-art; then
  echo "artifact looks like a secret store"; exit 4
fi
echo "gate passed for ${job}; copy into a review branch, not main"

Keep the host off the runtime bridge. Docker makes the idea visible. An internal network has no default egress to your app net.

docker network create --internal gen-plane
docker network create runtime-plane

# generation worker: no attachment to runtime-plane
docker run --rm --network gen-plane --name gen-worker \
  -v $PWD/inbox:/inbox:ro \
  -v $PWD/drop:/drop \
  alpine:3.20 sleep 3600

# prove the worker cannot resolve or reach runtime services
docker exec gen-worker sh -c 'wget -qO- http://app.runtime-plane:8080/health || echo isolated'

If you need a fetch from trusted CI, do it from CI. Do not give the worker a callback URL. Callbacks turn the print shop into a tenant.

Failure domains, kept apart

Name the domains before you draw boxes. Runtime fails by serving wrong answers. Generation fails by emitting wrong files. The gate fails by accepting a bad tarball.

If the generation host dies, runtime still serves users. You retry the job later. You do not page the on-call for a draft box.

If the artifact is poisoned, the gate should reject it. Hash mismatch is a hard stop. Secret-like content is a hard stop. Path traversal is a hard stop.

If the job token leaks, blast radius stays small. It can drop one object at most. It cannot list cluster secrets. It cannot open SSH.

If you peer the networks, those domains collapse. One prompt injection becomes a lateral step. That is the failure you are buying.

A useful picture is a kitchen and a loading dock. The dock can receive crates. The kitchen should not share floor drains with the dock. Shared drains move the wrong fluids.

Agent loops make the drain metaphor worse. A loop that can call tools wants reach. Reach across planes is how a draft becomes an incident.

You can keep a tiny allowlist of tools on the hop. File read inside the bundle is enough. File write inside the drop folder is enough. Process spawn against production is not.

job token scope (example claim set, not a vendor format)
  sub: gen-job-20260911-17
  aud: drop-writer
  paths: /var/gen/job-20260911-17/drop/*
  methods: PUT
  exp: 20 minutes
  net: gen-plane only

That claim set is a design sketch. You still implement it with your own signer. Do not paste a long-lived cloud role into the hop.

What this architecture refuses to do

It refuses live deploys from model output. It refuses model-owned merge buttons. It refuses shared volumes with /var/run/secrets.

It also refuses “just this once” exceptions. A single peered debug session becomes a template. The next incident copies that template.

You review generated code on a branch. Humans merge after tests. The hop never learns your deploy credential.

Where a free remote hop fits

Some teams still want a box that is not the cluster. They want model access without parking GPUs beside app nodes. They want that box disposable.

MonkeyCode offers free model access and a free server option. Disclosure: This article was prepared as part of MonkeyCode's product outreach. You can park generation there as a worker, then pull artifacts through your own gate.

The product does not replace the valve. It does not own your runtime routes. Treat any free hop as capacity you may lose without notice.

If you try that hop, keep it off your runtime routes. Copy bundles in. Pull tarballs out. Leave identity at home.

What I would change next

This sketch still trusts a single digest file. I would split pack identity from fetch identity. I would sign the drop with a key the hop cannot read.

I would add a content-type allowlist per path. Markdown and source files may pass. Shell installers and Terraform applies would not pass cold.

I would record a generation bill of materials. Job id, bundle digest, artifact digest, gate version. That record belongs in the pull request, not on the hop.

I would kill leftover job directories on a timer. Disposable means delete. Leftover drops become a second repository of your source.

I would also ban outbound DNS on the generation net. If the worker must fetch a tool, you vendor that tool. Surprise egress is a hidden peer.

Limits, and who should not use this

This is an isolation pattern, not a model benchmark. It does not prove output quality. It does not prove the hop will be there tomorrow.

Do not use it if policy forbids any third-party host. Do not use it if you generate inside a sealed compiler. Do not use it if the model must drive production APIs.

Do not use it as an excuse to skip review. A clean digest can still contain a logic bomb. The gate catches shape problems, not intent.

Local generation on an air-gapped laptop can be simpler. The same valve still helps there. Pack, generate, fetch, gate. The network just becomes a directory.

You wanted a remote coding hop. Keep it as a print shop. Collect the pages. Then decide, on your side, whether they enter the building.

Don't Wire the Model Straight to SSH

Harper Xu — Wed, 09 Sep 2026 16:18:09 +0000

You must split planner and runner before any generate step. An agent is two hops with unequal privilege, not one brain. Hide that split and the host becomes the chat window.

Most generation loops still collapse those hops. A prompt enters, then a remote shell quietly follows. The model reaches your machine like a trusted coworker.

That shape fails in small and boring ways. The planner invents a flag your service never shipped. The runner applies it, and you debug the wrong box.

The constraint you actually own

You do not control the model's next token stream. You do control which sockets the planner may touch. Treat that limit as architecture, not as a later patch.

Variable models make this constraint tighter, not looser. Latency wobbles and the output format drifts without warning. A free call still cannot hold an operational contract.

So freeze three facts on your own laptop first. Name the allowed files, commands, and rollback path. Everything else stays outside the trust boundary you drew.

Think of a drawbridge rather than an open lobby door. The castle keeps the keys on the inside always. The visitor never walks the halls without a card.

Data flow that cannot lie to itself

Name three processes and refuse to merge them later. Call them planner, gate, and runner without clever branding. Give each process one mailbox and no extra sockets.

The planner sees the contract and the user prompt. It never sees SSH keys, cloud creds, or live disks. It emits a patch object, not a hopeful paragraph.

The gate sees that patch and the frozen contract. It never calls a model and never opens a shell. It accepts or rejects with a short machine reason.

The runner sees only an approved job file. It never sees the prompt and never retries the model. It applies the files, verifies health, then exits.

If one process can perform two of those jobs, stop. You do not have a loop in that case. You have one blob wearing a friendly agent name.

Check a contract into git before the planner speaks. The file below is a proposal you can copy. Keep the job_id boring and dated on purpose.

{
  "job_id": "resize-health-timeout-2026-09-09",
  "allowed_paths": [
    "deploy/healthcheck.sh",
    "deploy/systemd/app.service"
  ],
  "forbidden_prefixes": ["/etc", "/root", "/.ssh", "deploy/.."],
  "allowed_commands": [
    ["systemctl", "reload", "app"],
    ["curl", "-fsS", "http://127.0.0.1:8080/health"]
  ],
  "max_diff_bytes": 4096,
  "max_runtime_sec": 30,
  "rollback": ["git", "-C", "/opt/app", "checkout", "--", "deploy/"]
}

The planner may only fill files on that list. A story about why the patch is wise is noise. Noise does not cross the gate.

A gate you can run on a laptop

Label this script as a local example, not a product. It reads a patch from stdin and writes one job. It has no vendor SDK and no hidden retry.

#!/usr/bin/env python3
"""Proposal: privilege split for a generation loop."""
import hashlib, json, pathlib, sys

CONTRACT = json.loads(pathlib.Path("contract.json").read_text())

def fail(msg: str) -> None:
    print(json.dumps({"ok": False, "error": msg}))
    raise SystemExit(1)

def normalize(path: str) -> str:
    p = pathlib.PurePosixPath(path)
    if p.is_absolute() or ".." in p.parts or p.as_posix() != path:
        fail(f"unsafe path: {path}")
    return p.as_posix()

def main() -> None:
    patch = json.loads(sys.stdin.read())
    if patch.get("job_id") != CONTRACT["job_id"]:
        fail("job_id mismatch")
    files = patch.get("files") or []
    if not files:
        fail("empty patch")
    allowed = set(CONTRACT["allowed_paths"])
    total = 0
    clean = []
    for item in files:
        path = normalize(item.get("path", ""))
        body = item.get("content", "")
        if path not in allowed:
            fail(f"path not allowed: {path}")
        total += len(body.encode("utf-8"))
        clean.append({"path": path, "content": body})
    if total > CONTRACT["max_diff_bytes"]:
        fail("diff too large")
    digest = hashlib.sha256(
        json.dumps({"job_id": patch["job_id"], "files": clean}, sort_keys=True).encode()
    ).hexdigest()
    job = {
        "ok": True,
        "digest": digest,
        "commands": CONTRACT["allowed_commands"],
        "rollback": CONTRACT["rollback"],
        "files": clean,
        "max_runtime_sec": CONTRACT["max_runtime_sec"],
    }
    pathlib.Path("approved.job.json").write_text(json.dumps(job, indent=2))
    print(json.dumps({"ok": True, "digest": digest}))

if __name__ == "__main__":
    main()

Run it like a filter, not like a chatbot sidecar. Keep the model on the left of the pipe. Keep the host on the right of the pipe.

python3 plan_stub.py > patch.json
python3 gate.py < patch.json
test -f approved.job.json || exit 1
python3 runner.py approved.job.json

The runner should look dull in code review. Dull means it cannot phone the planner. Dull means a failed health check never widens the contract.

#!/usr/bin/env python3
"""Proposal: apply an approved job, never a prompt."""
import json, pathlib, subprocess, sys

def main(job_path: str) -> None:
    job = json.loads(pathlib.Path(job_path).read_text())
    if not job.get("ok"):
        raise SystemExit("refusing unapproved job")
    root = pathlib.Path("worktree")
    timeout = int(job["max_runtime_sec"])
    for item in job["files"]:
        target = (root / item["path"]).resolve()
        if root.resolve() not in target.parents and target != root.resolve():
            raise SystemExit(f"escaped worktree: {target}")
        target.parent.mkdir(parents=True, exist_ok=True)
        target.write_text(item["content"])
    for argv in job["commands"]:
        subprocess.run(argv, check=True, timeout=timeout)
    print("applied", job["digest"])

if __name__ == "__main__":
    main(sys.argv[1])

Notice what this runner refuses to import. There is no HTTP client for a model. There is no prompt variable hiding in a comment. Failure goes to rollback argv, not back into chat.

If apply fails, you run the rollback from the same job file. You do not paste the stack trace into the planner. That courtesy is how a loop eats a host.

Failure domains, drawn as three boxes

Draw three boxes on a napkin before you open SSH. Label them prompt-side, gate-side, and host-side in ink. Then stop adding arrows that feel convenient.

Prompt-side fails by fluent invention. It writes a plausible systemd flag your unit file never had. That failure belongs in a file you can delete.

Gate-side fails by being too kind with strings. A prefix check on deploy/ still loves deploy/../etc. Normalize the path, reject dots, and reject absolute paths.

Host-side fails by ambient authority you forgot was there. If the runner user can rewrite unit files anywhere, a bad job still wins. Give that user a worktree mount and no extra groups.

The analogy is a hotel key card, not a master key. The guest opens one numbered door for one night. The front desk never lends the whole board.

A free remote server is still a host-side box. Zero invoice does not move the box into the planner. Cost is not a trust boundary, and it never was.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode offers free model access and a free server option, which is enough to rehearse this split. Rehearsal still starts with the gate on your laptop.

You write the contract where the model cannot call home. You approve the job in a process the runner cannot prompt. The free host only sees approved.job.json and a short argv list.

Prove the gate before you prove the model

Chat logs do not replay. Job files with digests do. Treat the gate like a parser test, not like a demo day script.

# job_id mismatch must die
echo '{"job_id":"wrong","files":[{"path":"deploy/healthcheck.sh","content":"x"}]}' \
  | python3 gate.py ; echo exit:$?

# path escape must die
python3 - <<'PY' | python3 gate.py ; echo exit:$?
import json
print(json.dumps({
  "job_id": "resize-health-timeout-2026-09-09",
  "files": [{"path": "deploy/../etc/passwd", "content": "nope"}]
}))
PY

# oversized diff must die
python3 - <<'PY' | python3 gate.py ; echo exit:$?
import json
print(json.dumps({
  "job_id": "resize-health-timeout-2026-09-09",
  "files": [{"path": "deploy/healthcheck.sh", "content": "x" * 5000}]
}))
PY

You want three non-zero exits and no approved.job.json leftover. If a case writes a job file, the gate is theater. Theater is how privilege split dies in review.

A passing happy path should print a digest and nothing else. Save that digest next to the contract in git. Tomorrow you can ask whether production still matches that hash.

Who should not run this loop

Do not sell this split as a security product. It is an architecture review pattern for generation. It will not save you from a stolen runner key.

Do not point the runner at a shared production bastion. Rehearse on a throwaway host with a snapshot. If you cannot snapshot, you cannot afford the experiment.

Skip the split when you only generate comments or docs. The blast radius is already tiny in that case. Extra processes would only slow a harmless edit.

Skip it when nobody can freeze allowed_paths in writing. A loop with an open path list is still chat beside SSH. The drawbridge is stuck open, whatever the model costs.

What to change next

Change subprocess so every command is argv, never a shell string. The proposal above already leans that way on purpose. Keep leaning until shell=True cannot sneak back.

Change health checks from curl exit codes to a pinned digest. An HTTP 200 can still serve yesterday's wrong page. Read the body and hash it against a known fixture.

Change the runner so it dies after one job. A long-lived runner becomes a daemon while you look away. Daemons collect extra permissions the napkin never drew.

Keep the control plane boring on purpose after those changes. Boring is the failure domain you can actually name. Boring is how the model stays off the SSH socket.

Treat Generated Infra as Untrusted Input

Harper Xu — Tue, 08 Sep 2026 14:59:40 +0000

You treat every generated infrastructure file as untrusted input. You do not merge it because a model sounded confident. You review it like a stranger opened production's pull request.

An agent will fill the gaps you leave. That habit is the product, not a bug. It invents a retry policy when you stay silent.

It draws a box and names the box a service. You stop that habit in the constraint file. The meeting after the outage is already too late.

Think of the model as a contractor without your blast radius. You would not hand that contractor the DNS cutover. You hand them a scratch pad, then inspect every line.

Freeze the assumption boundary

You write the assumption boundary before the first prompt. The file stays small on purpose. It names decisions the agent must never make.

# constraints.yaml
owner: platform
review_plane: local
scratch_runtime: ephemeral
control_plane: forbidden_on_scratch

data_flow:
  inbound: public_https
  outbound:
    - payments_api
    - audit_log
  forbidden:
    - raw_card_data_to_scratch
    - prod_secrets_to_prompt

assumptions_agent_must_not_invent:
  - retry_budget
  - failover_target
  - data_classification
  - tls_termination_owner

failure_domains:
  - edge
  - app
  - payments
  - audit

promote_if:
  - validator_exit_0
  - human_ack

You keep this file in git. You do not let the prompt rewrite it. The agent may read the law. It does not own the law.

This is architecture review, not prompt theater. Constraints go first. Generation goes second.

Promotion waits for both gates. A frozen file beats a clever system prompt. Prompts drift under pressure.

Files get blamed in the postmortem, which is what you want. Blame needs an object with a hash. A chat transcript is not that object.

Data flow is a fence, not a story

A generated diagram will tell a comforting story. Stories hide arrows behind pretty boxes. You force every arrow into a spoken name.

You ask one question of every generated box. What data crosses this line, and who encrypts it. Missing answers mean you reject the sketch now.

You do not clarify later on a data hop. Later is how card data lands on scratch. The fence is the review, not the slide.

Customs officers do not accept a charming itinerary. They accept a declared path. You should treat generated hops the same way.

Here is a checker that treats architecture JSON as hostile. It fails closed. It does not negotiate with the sketch.

# review_arch.py
import json, sys, yaml

ALLOWED_OUT = {"payments_api", "audit_log"}
FORBIDDEN_ASSUME = {
    "retry_budget",
    "failover_target",
    "data_classification",
    "tls_termination_owner",
}

def load():
    constraints = yaml.safe_load(open("constraints.yaml"))
    generated = json.load(open("generated_arch.json"))
    return constraints, generated

def fail(msg):
    print(f"REJECT: {msg}")
    sys.exit(1)

def main():
    c, g = load()
    if g.get("control_plane_host") == "scratch":
        fail("control plane landed on scratch runtime")
    for hop in g.get("outbound", []):
        if hop not in ALLOWED_OUT:
            fail(f"undeclared outbound hop: {hop}")
    invented = set(g.get("assumed", [])) & FORBIDDEN_ASSUME
    if invented:
        fail(f"agent invented {sorted(invented)}")
    domains = set(c["failure_domains"])
    drawn = set(g.get("failure_domains", []))
    if not drawn.issubset(domains):
        fail("unknown failure domain in sketch")
    if g.get("secrets_in_prompt"):
        fail("production secrets entered the prompt")
    print("PASS: architecture stays inside the fence")

if __name__ == "__main__":
    main()

Feed it a sketch that looks tidy and still cheats. Tidy is not evidence. Evidence is an allowed hop list.

{
  "control_plane_host": "scratch",
  "outbound": ["payments_api", "telemetry_vendor"],
  "assumed": ["retry_budget"],
  "failure_domains": ["edge", "app", "shared"],
  "secrets_in_prompt": false
}

python3 review_arch.py
# REJECT: control plane landed on scratch runtime

You run the checker on every generation. A green log is not a feeling. It is a mechanical gate in front of promote.

If the checker cannot parse the sketch, you fail closed. Unreadable architecture is still untrusted input. You ask for a new draft, not a better story.

Fix the host, and the next rejection still waits. Undeclared telemetry is a new failure domain wearing a vendor name. You still do not merge it.

# after you move control_plane_host off scratch
python3 review_arch.py
# REJECT: undeclared outbound hop: telemetry_vendor

That second failure is the whole lesson. The agent did not become safer after one fix. It became quieter. Quiet is not a review.

Scratch runtime is its own failure domain

You need a place to let the agent be wrong. That place is not your cluster. It is a scratch runtime with no path to canonical state.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode offers free model access and a free server option. You park generation there and keep review local.

The scratch host is a sandbox with a short memory. It is not a region. It is not a failover target. It is not allowed to hold the apply key.

The free server sees a redacted prompt and a throwaway repo. It does not see production tokens. It does not see the customer table.

If the scratch host dies, you lose a draft. That outcome is acceptable by design. A draft is cheap. A control plane is not.

You already treat cache nodes as disposable. Treat generation hosts the same way. Do not promote a scratch box into the traffic path.

Do not copy secrets into the prompt once. The once becomes a log line you do not own. Redact first. Generate second.

# redact.sh
set -euo pipefail
src="$1"
out="$2"
sed -E \
  -e 's/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/REDACTED_EMAIL/g' \
  -e 's/AKIA[0-9A-Z]{16}/REDACTED_KEY/g' \
  -e 's/(postgres|mysql):\/\/[^[:space:]]+/REDACTED_DSN/g' \
  "$src" > "$out"
echo "redacted prompt at $out"

chmod +x redact.sh
./redact.sh prompt.raw.md prompt.redacted.md
less prompt.redacted.md

You read the redacted file with your own eyes. Then you send only that file. If you cannot explain a remaining token, you delete the line.

A scratch runtime that never sees secrets cannot leak them later. That is not a vendor promise. That is a data-flow choice you made on purpose.

Failure domains stay human-owned

The agent will collapse domains to look tidy. Tidy is not an availability strategy. Edge, app, payments, and audit fail for different reasons.

You keep those names frozen in the constraint file. The sketch may only place boxes inside written names. A new name is a rejected draft.

When generated YAML adds a fifth domain called shared, you reject it. Shared is where ownership goes to die. Shared is how a cache outage takes payments.

You encode that rudeness as a test. Tests do not get polite in standup. They fail on the laptop before anyone pages.

# test_domains.py
import json

def test_no_shared_domain():
    g = json.load(open("generated_arch.json"))
    assert "shared" not in g.get("failure_domains", [])
    assert "misc" not in g.get("failure_domains", [])

def test_payments_has_no_scratch_dependency():
    g = json.load(open("generated_arch.json"))
    deps = g.get("domain_deps", {}).get("payments", [])
    assert "scratch" not in deps

def test_audit_is_not_best_effort_guess():
    g = json.load(open("generated_arch.json"))
    assert g.get("audit_mode") != "invented"
    assert g.get("audit_mode") in {"required", "dual_write"}

pytest -q test_domains.py

A failing test is cheaper than a war room. You let the test stay blunt. The agent will not take offense at the stack trace.

Watch domain_deps the same way. Payments must not list scratch as a dependency. If it does, the sketch tried to live in the wrong failure domain.

Audit is the easy one to degrade in a generated design. The model will mark it best effort to keep the happy path pretty. Pretty is how you lose the only trail you needed.

What you would change next

This gate is still thin on purpose. It catches invented retries and stray hops. It does not catch a polite lie inside a legal name.

A model can cite payments_api and still dump PII into logs. You would add schema lint on every event payload next. Field names would need a classification tag.

You would also sign the review in git. A validator exit code is not a person. You would require an Acked-by trailer on the promotion commit.

git interpret-trailers --trailer "Acked-by: $(git config user.name)" \
  --in-place .git/COMMIT_EDITMSG

No trailer means no deploy. That keeps a human in the loop. It does it without a two-hour architecture theater.

You would split generate and apply into two identities. The scratch runtime may write generated_arch.json. It must never run Terraform against production.

# generate identity: write artifacts only
export AWS_PROFILE=scratch-writer

# apply identity: never present on the scratch host
# export AWS_PROFILE=prod-applier

Different keys belong to different actions. Different accounts if your budget allows it. Same laptop is fine. Same cloud role is not.

You would version the constraint file with the sketch. A passing validator against yesterday's fence is a miss. Pin both hashes in the promotion note.

echo "constraints=$(git rev-parse HEAD:constraints.yaml)" >> promote.note
echo "sketch=$(sha256sum generated_arch.json)" >> promote.note

That note is the architecture review artifact. It survives the chat window. It survives the intern who was on call.

Who should not use this loop

Do not use a free scratch host for regulated workloads. Do not paste patient records or card data into prompts. Do not point that host at a production kubeconfig.

This method assumes the draft is disposable. If the draft is the business, you stop. You need a contract and a private runtime first.

Do not skip the validator because the diagram looks clean. Clean diagrams are how assumptions travel between teams. If you cannot run review_arch.py, you are not ready.

Teams without written data classification should not start here. Write the classification before any generation. Generation without classification is only faster guessing.

If you cannot name inbound data and outbound hops, pause. The agent will name them for you. That naming is the incident report, written early.

Close the loop

You freeze assumptions in constraints.yaml. You redact the prompt on your machine. You generate on a scratch runtime that can disappear.

You run review_arch.py and the domain tests. You read the diff like a hostile pull request. Then you promote, or you throw the draft away.

The agent sketches. You own the fence. Generated infra stays untrusted input until those gates pass.

You can hold the sketch on a disposable draft host. MonkeyCode's free model access and free server option fit that role. Keep constraints local. Keep production off that host.