DEV Community: Riley Li

Pick a Free, Paid, or Self-Hosted Agent Seat by the Lease You Can End

Riley Li — Sun, 11 Oct 2026 21:34:48 +0000

The right agent seat is the one you can close without losing the only copy of the work. I would rather take a shorter paid lease, or run a box I operate, than keep a free chat I cannot audit. A seat is a temporary grant of model access, context, and side effects, not a teammate you quietly adopt for the week. If you cannot name the exit evidence before the first prompt, you have not chosen a tool yet.

Recent discussion keeps returning to a plain tension, even when the headlines change from week to week. Model quality can move in a week, while the release path does not automatically move with it. I am not treating any weekly roundup as evidence, because a trending title is only a topic signal. A topic signal is not a measurement I can cite, and it is not a reason to skip the lease card.

Start from the exit, not the invoice

Have you ever left a session open because closing it felt like throwing the reasoning away? That small hesitation is how a free hour becomes an unofficial path into the release branch. I now write the ending before I write the prompt, and I keep that ending in the repository rather than in a vendor tab. The invoice matters only after the ending is a file that a reviewer can open without me.

I have already used other gates for blast radius and review time, so this note does not rebuild those checks. The question here is narrower, and it is easy to dodge when the model feels helpful. Which seat can I actually end today, and which committed file proves that I ended it?

Ask four questions before the session exists

I use the same four questions for a bugfix, a documentation edit, and a spike that might be deleted. Each answer is a word or a small integer, because a paragraph of enthusiasm is not a decision. If any answer is mushy, I shrink the task until the answer fits on one line.

What data class may enter the prompt? I allow a public sample, internal code that contains no secrets, or a resident class that must stay on hardware I control. When the class is unclear, I stop, and I do not try a redacted version inside the same unbounded chat.
How many retries is the review time worth? I write an integer, usually one to three, and I stop when the counter reaches zero. Another retry without a new failing test is just a slower guess, even when the seat did not charge me.
Which artifact leaves with me? I want a diff, a failing test name, or a rejected hypothesis written on the lease card. A transcript that exists only in a browser tab is not an artifact I can hand to someone else.
Who can say no before the merge? If the honest answer is nobody, the seat is wrong for that change, including the seat that costs nothing. A free run can still ship a confident mistake, and the price of the mistake is not on the pricing page.

Would you still sign the diff if the model name were missing from the commit message? If the answer is no, the seat did not finish the job, and another hour will not finish it either.

Keep a lease card the branch can diff

I store the card beside the task notes, and I commit it when the choice itself needs a trail. The script below is a proposal, not a benchmark I executed for this article, so the printed labels are decisions rather than measurements. It refuses a recommendation when the exit fields are empty, which is the behavior I want on a tired afternoon.

#!/usr/bin/env python3
"""Proposal: label a one-task agent lease. Not a measured benchmark."""

from __future__ import annotations

import json
import sys
from dataclasses import dataclass


@dataclass(frozen=True)
class Lease:
    data_class: str  # public | internal | resident
    retries: int
    artifact: str  # diff | test_name | hypothesis
    reviewer: str  # self | teammate | none
    needs_long_context: bool
    can_operate_a_server: bool


def choose(lease: Lease) -> str:
    if lease.reviewer == "none" or not lease.artifact:
        return "stop: no exit evidence"
    if lease.data_class == "resident":
        if lease.can_operate_a_server:
            return "self-hosted: you accepted the restart duty"
        return "stop: residency without an operator"
    if lease.needs_long_context or lease.retries > 3:
        return "paid: continuity is the product you are buying"
    if lease.data_class == "public" and lease.retries <= 2:
        return "free: short lease, keep the artifact, drop the transcript"
    if lease.data_class == "internal" and lease.reviewer == "teammate":
        return "paid or free-with-policy: only if current terms allow this data class"
    return "stop: shrink the task or rewrite the card"


def main() -> int:
    raw = json.load(sys.stdin)
    lease = Lease(
        data_class=raw["data_class"],
        retries=int(raw["retries"]),
        artifact=raw.get("artifact", ""),
        reviewer=raw.get("reviewer", "none"),
        needs_long_context=bool(raw.get("needs_long_context", False)),
        can_operate_a_server=bool(raw.get("can_operate_a_server", False)),
    )
    print(choose(lease))
    return 0


if __name__ == "__main__":
    raise SystemExit(main())

A public fixture card can live in the issue, and it should be boring enough to review in a minute. I keep secrets out of the sample on purpose, because a teaching card that leaks a token is already a failed lease. If the real task cannot be reduced to this shape, the free row is the wrong row. The JSON is an example of the input, not a log from a session I ran.

{
  "data_class": "public",
  "retries": 2,
  "artifact": "diff",
  "reviewer": "self",
  "needs_long_context": false,
  "can_operate_a_server": false
}

Run the label before the first prompt

I hash the prompt and the card together, so a later edit cannot pretend it was the authorized task. These commands stay on my own machine, and they do not call a model provider at all. If the hash changes after I start, I treat that as a new lease rather than as a continuation.

python3 lease_seat.py < lease.json
sha256sum prompt.md lease.json | tee lease.sha256
git diff --stat

If the script prints stop, I do not open a session to see what the model might say. Curiosity without an artifact is how the retry counter becomes a suggestion instead of a rule. If the script prints free, I still copy the diff into the branch, and I keep whatever the card promised to keep. Does a larger context window change the hash I already wrote down beside the lease card?

The hash does not move when the window grows, and that mismatch is the useful part. The hash records the task I authorized, not the confidence the model expressed after it saw more files. I would rather fail the check in ten seconds than discover the scope creep during review. Have you watched a session helpfully open files that you never placed on the lease card?

Work the lease in five steps

I walk these five steps in order, and I do not skip to the model because the card feels obvious. The script is only a reminder, not a boss, but I still run it when I am tempted to improvise. Have you noticed that the improvised path is usually the one that touches one extra file?

I write the four answers on the card before I open any model tab, including a tab that is free.
I run the proposal script against that card, and I treat a printed stop line as a finished decision.
I hash the prompt beside the card, and I start only when the label matches the data class.
I copy the artifact into the branch, and I stop when the retry integer on the card hits zero.
I add the closing line under the card, and I do not reopen the session to polish a rejected hypothesis.

Read the three seats as fit criteria

Free model access fits a short public or synthetic task when the artifact is a diff or a named test and the retry count stays small. I do not put secrets, production credentials, or an irreversible migration on that seat, even for a minute. What is missing is not a slogan about quality, but a retention and uptime promise I have checked on the current terms page.

Paid access fits when I am buying continuity, a team audit trail, or a support path I can actually open. The same card still applies, because a larger invoice does not invent a reviewer who was absent at the start. If the current terms forbid my data class, the paid column is a stop, not a quieter upgrade. Why would I pay to repeat a data-class mistake I could have caught on paper?

Self-hosting fits when the data class is resident, or when prompts and logs must stay on hardware I operate. That fit includes patches, disk, and the hour when the process dies while I am offline. If I cannot name the person who restarts it, I am choosing a hope with extra steps, not self-hosting. The box can be cheaper on paper and still be the most expensive seat if nobody owns the restart.

I keep these tradeoffs in one table so the argument does not hide inside a paragraph. The cells are fit notes, not scores, and they assume you already answered the four questions. A blank cell means I would stop, rather than pretend that the seat is secretly fine. Can you place your real task into one row without quietly inventing a reviewer for it?

Signal	Free seat	Paid seat	Self-hosted
Data class	Public or synthetic sample	Internal code only if current terms allow it	Resident data on hardware you operate
Continuity	One short session, then exit	Multi-step context you are willing to pay for	As long as you can keep the process healthy
Exit evidence	Diff or test name you copy out	Same evidence, plus a log you are allowed to export	Logs on disk you already control
Retry budget	One or two, then stop	The integer on the card, not an open tab	The same integer, paid in your own time
Skip when	Secrets, migrations, or no reviewer	Terms conflict, or nobody can say no	No named operator for patches and restarts

Place a free server only where the card already allowed it

Disclosure: This article was prepared as part of MonkeyCode's product outreach.

MonkeyCode shows up in this method only as a candidate for the free row on the card. For this draft I am relying on two availability claims only: free model access, and a free server option. I am not stating a token quota, a hardware shape, a duration, or a comparison score. Those details were not verified for this draft, and product figures like that go stale quickly.

Before I rely on either claim, I read the current product terms and confirm that my data class is permitted. If the terms are silent or confusing, I leave the card on stop and edit in a local tool I already trust. I would not move a hosted seat into the resident row unless I control the deployment and have checked that path myself. A free server is still a lease with an owner, a log policy, and an end time you should assume can change.

If you want to rehearse the exit on a throwaway public fixture, a free model seat is enough for that drill. Save the diff, discard the transcript, and ignore the seat when the script told you to stop. I would not use that rehearsal as proof that the seat is safe for internal code. The rehearsal only proves that you can end a session you were willing to throw away.

Who should leave this card on the shelf

Skip this approach when you need a formal threat model, a compliance signature, or a measured comparison of model quality. The script does not score accuracy, latency, or money, and I did not execute it against a live provider while writing this note. Skip it when the change touches credentials, customer data, or a migration you cannot roll back before the day ends. Also skip it if you came for a vendor ranking, because I am not publishing one.

The limitation I watch most carefully is the false comfort that comes from a tidy label. A printed free line can still hide a sloppy prompt, a flaky test, or a terms page I skimmed too quickly. The card governs my behavior, and it is not a certificate that the model was right. If the label and the diff disagree, which one are you actually planning to trust in review?

Close the lease before the day ends

I end the session when the artifact is on the branch, or when the retry counter hits zero, whichever arrives first. Then I add one line under the card saying I kept the diff, or I rejected the hypothesis. That closing line remains useful even if every product name is later deleted from the page. The seat you can end cleanly is the only seat you were really allowed to start.

A Review-Hour Gate for Free, Paid, and Local Agent Work

Riley Li — Sat, 10 Oct 2026 17:57:52 +0000

I do not choose a free, paid, or self-hosted agent seat by the invoice that arrives later. I choose it by the review hours I can still spend on the diffs that seat will emit. If I cannot read the patch, the cheaper seat is not a bargain, and the expensive seat is not safer. The question I keep asking is simple: whose eyes are actually on this change before it lands?

A seat is only a place where an agent edits files, runs commands, and talks back to me. The free option, the paid box, and the machine under my desk all fail in different ways when my attention runs out. I want a worksheet I can rerun on a laptop, not a slogan about which vendor feels modern this month. Would I sign the resulting commit after a tired afternoon, or would I rubber-stamp it because the queue already moved on?

What this decision is, and what it is not

I am deciding where a bounded agent task may run, and what evidence must come back with it. I am not deciding which model is smartest, because I have not measured that on this repository. I am not deciding a permanent architecture, because availability, quotas, and hardware change without asking me. Can I name the files the agent may touch, and can I name the files it must never open?

Three seats stay on the table until the sheet says otherwise, and I do not drop one early. A free hosted seat means free model access plus a free server option, when those are currently offered, and nothing more specific. A paid hosted seat means I am buying priority, retention, or a support path I can name in a contract. A self-hosted seat means I already own the runner, the logs, and the failure, including the night it falls over.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. I mention MonkeyCode here because its free model access and free server option are one concrete way to fill the free hosted column. I do not treat that mention as a measurement of quality, uptime, token allowance, or model identity. If a quota, a model name, or a hardware shape matters to you, read the current docs before you plan a sprint around them.

Fit criteria I refuse to skip

I score each seat against the questions below, and I write the answers in plain text next to the task. What data class sits in the workspace: a public fixture, internal code without secrets, or anything regulated? How many review minutes can I honestly give this task before the week ends and the context fades? Can I export the diff, the test log, and the prompt, and who reruns the job if the seat vanishes?

A free hosted seat fits a public fixture or a synthetic bug, when losing the session would only cost a rerun. It does not fit when secrets, customer data, or a release branch sit in the same tree as the task. A paid hosted seat fits when I need a named retention window or a support contact, and when review time is already funded. A self-hosted seat fits when the data cannot leave, and when I can actually patch the runner myself.

Would I still pick the free seat if the docs changed the allowance tomorrow morning without notice? Only if the task is disposable and the evidence already lives on my disk, where a vanished tab cannot take it. Would I pick self-hosted for a one-file typo in a public sample that nobody is waiting on? Probably not, because I would spend the afternoon nursing a runner instead of reading the diff itself.

A local gate you can reread

The script below is a proposal, not a benchmark I have executed against a live vendor. It reads a small JSON description of the task and prints which seats remain eligible today. You can change the thresholds, but do not pretend those numbers came from a measured lab. I keep the inputs boring on purpose, so a teammate can argue with a field instead of arguing with a vibe.

#!/usr/bin/env python3
"""Proposal only: gate agent seats by data class and review budget.

Unexecuted example. It does not call a vendor API and it does not
measure model quality. Replace the sample task before you trust it.
"""

from __future__ import annotations

import json
import sys
from dataclasses import dataclass


@dataclass(frozen=True)
class Task:
    data_class: str  # public_fixture | internal_code | regulated
    review_minutes: int
    expected_diff_lines: int
    needs_named_support: bool
    can_export_locally: bool
    secrets_in_tree: bool


def eligible(task: Task) -> dict[str, str]:
    reasons: dict[str, str] = {}
    leaves_blocked = task.secrets_in_tree or task.data_class == "regulated"

    if leaves_blocked:
        reasons["free_hosted"] = "blocked: data must not leave the machine"
        reasons["paid_hosted"] = "blocked: data must not leave the machine"
    elif task.data_class == "public_fixture" and task.can_export_locally:
        reasons["free_hosted"] = "eligible: disposable work and local evidence"
    elif task.data_class == "internal_code" and task.can_export_locally:
        reasons["free_hosted"] = "hold: confirm current data terms before use"
    else:
        reasons["free_hosted"] = "blocked: no local export path"

    if not leaves_blocked and (task.needs_named_support or task.review_minutes >= 90):
        reasons["paid_hosted"] = "eligible: support or a funded review window"
    elif not leaves_blocked:
        reasons["paid_hosted"] = "optional: only if the contract names retention"

    if leaves_blocked or task.data_class == "internal_code":
        reasons["self_hosted"] = "eligible: you keep the runner and the logs"
    elif task.expected_diff_lines <= 80 and task.review_minutes <= 45:
        reasons["self_hosted"] = "skip: runner care exceeds the diff"
    else:
        reasons["self_hosted"] = "optional: use if you already operate the box"

    return reasons


def main() -> int:
    raw = json.load(sys.stdin)
    task = Task(
        data_class=raw["data_class"],
        review_minutes=int(raw["review_minutes"]),
        expected_diff_lines=int(raw["expected_diff_lines"]),
        needs_named_support=bool(raw["needs_named_support"]),
        can_export_locally=bool(raw["can_export_locally"]),
        secrets_in_tree=bool(raw["secrets_in_tree"]),
    )
    print(json.dumps(eligible(task), indent=2))
    return 0


if __name__ == "__main__":
    raise SystemExit(main())

The command below only runs that local script, and it does not call a remote agent or upload the fixture. Swap the JSON for your own notes, and keep secrets out of the file even on your laptop. If you cannot describe the task without pasting a credential, stop and shrink the workspace first. A worksheet that requires a secret in order to run is already telling you the free hosted column is closed.

python3 seat_gate.py <<'JSON'
{
  "data_class": "public_fixture",
  "review_minutes": 40,
  "expected_diff_lines": 60,
  "needs_named_support": false,
  "can_export_locally": true,
  "secrets_in_tree": false
}
JSON

I feed it a fixture that looks like the work, not like a marketing page I saw this week. A public parser bug with a short guess and half an hour of review should not drag a regulated workspace into the same decision. If the printout says hold, I stop and read the terms, because a script cannot grant a permission that policy never gave. Would I be comfortable pasting that JSON into the ticket where my reviewer can see every field?

Steps I follow before I trust a column

I copy the task into a scratch repository that contains no secrets, no customer dumps, and no production environment files. If I cannot make that copy, the free hosted column is already closed, and I do not negotiate with myself. A missing fixture is a data decision, not a tooling inconvenience I can wave away later.
I write the expected diff size in lines, then I reserve review minutes at about one minute per five changed lines. I add fifteen minutes to read the test log, and I raise that guess when the patch touches concurrency or authentication. That ratio is a personal planning habit, not a measured law you should quote as science.
I run the worksheet and I keep every hold or blocked line in the pull request description. A green eligible mark is permission to try a seat, not permission to merge the result. Would I still merge if the reviewer asked me to explain the prompt from memory alone?
I capture evidence on my own disk before I close the session: the diff, the command, and the short prompt. A free server option is useful only when that capture still works after the browser tab dies. I use a local archive so the seat cannot become the only copy of the reasoning.

mkdir -p handoff && git diff > handoff/agent.diff
# Replace the echo with the real prompt. Do not paste secrets.
{ echo "prompt: reproduce the public fixture only"; git status --short; } > handoff/notes.txt
sha256sum handoff/agent.diff handoff/notes.txt > handoff/SHA256SUMS

I compare the three columns only after that archive already exists on my own laptop disk. Free hosted stays in the running when the fixture is public and the archive is complete. Paid hosted stays when I need a support path or a retention promise I can point to in writing. Self-hosted stays when the data class forbids leaving, and when I can operate the box without stealing review time.
I rerun the same fixture once on the seat I picked, and once locally from the saved diff, before I talk about speed. If the local rerun fails, the seat did not save me time, because I still cannot explain the change. How many of last week's agent patches could I still rebuild from the notes I actually kept?

Tradeoffs I want written down

I keep a short table so the argument does not collapse into a price screenshot from a vendor page. The cells are fit notes, not scores I measured on identical hardware during some quiet week. I will not fill those cells with token counts, GPU names, or uptime percentages I cannot re-check next week. A number I cannot point to in a current primary document is not a decision input for this sheet.

Question	Free hosted	Paid hosted	Self-hosted
May the workspace leave your network?	Treat as yes until current terms say otherwise	Treat as yes unless the contract says otherwise	No, if the runner stays inside your boundary
What you might be paying with	Review time, plus a rerun if the session dies	Money, contract reading, and the same review time	Review time plus runner maintenance
What a bad day looks like	Allowance or session changes under you	The bill grows while your review hours stay fixed	Box care steals the afternoon you reserved
What you must already hold	A local archive of diff, command, and prompt	That archive, plus the clause you relied on	That archive, plus notes a teammate can boot

If MonkeyCode's free model access or free server option is the free hosted candidate, confirm the live limits before you start. Write those limits into the ticket yourself, with the date you read them, so next week's reader is not guessing. I am not claiming a token grant, a duration, or a hardware shape, because no primary source for those figures was attached here. Would you trust a sprint plan that depended on a number nobody could open in a browser today?

Who should walk away

This sheet does not tell you which model writes better patches, and it will not catch a subtle bug because the fixture was public. It assumes you can make a secret-free copy, which is false for plenty of real services that mix config into the tree. It also assumes a human still merges, which is false if your pipeline applies agent output without a reviewer in the loop. Do not use this approach for production credentials, regulated records, or any path where an agent can push alone.

Do not use a free hosted seat as a silent default for the whole monorepo just because that column looked cheap. Do not use self-hosted as a moral upgrade if nobody on the team can restore the runner after a bad image. Do not use a paid seat to skip the archive step, because a receipt is not a diff you can explain later. I would rather throw away a free exploration than explain a missing prompt three days after the session died.

If the worksheet marks a public fixture as eligible for a free hosted seat, that is when I open the current MonkeyCode docs. I check whether free model access and the free server option still match the task I wrote down. I keep the same fixture, the same archive commands, and the same refusal rules if I later move that task. The seat can change next week, but the evidence I am willing to merge should not change with the invoice.

A Parser Contract Before Free Agent Compute Joins the Release Path

Riley Li — Fri, 09 Oct 2026 14:31:17 +0000

I would not keep free agent compute on a release path until a schema swap drill still passes on a fallback seat. A low invoice does not prove that your parser will survive a seat change next Tuesday. If the saved output drifts, the discount was never the cost that your on-call rotation actually paid. Would you sign the merge when a week-old screenshot is the only evidence you can show?

Start from the contract, not the invoice

Hosted agent seats feel easy because the first prompt returns quickly and the setup screen looks generous. The fragile part arrives later, when a review script and a human habit both assume one response shape. A model string can drift, a timeout can move, or a teammate can paste a real ticket into a toy seat. I treat each of those shifts as a contract problem, not as a surprise the vendor owes me to explain.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. The operator supplied two availability claims only: free model access, and a free server option you can try. I am not stating a token quota, a hardware shape, a duration, or a benchmark, because I have not verified those figures. Read the current product documents on the day you decide, and treat this page as a method rather than a price sheet.

What a passing swap actually proves

This drill does not crown a winner among free compute, a paid hosted plan, and a self-hosted stack. It asks whether saved outputs still satisfy one schema when you swap the seat and keep the fixture fixed. A pass means the release parser can survive the swap, while a fail keeps the free seat in a scratch lane. Why would you let a parser exception become the opening slide of your next incident review?

I am describing a local check on files you already saved, not a live call against a vendor endpoint. I have not executed this checker against a live vendor server, and I am not publishing timings or scores. You should label your own run the same way until a teammate can open the log and repeat it. Would a reviewer trust a pass that exists only in your memory and not in the repository?

Fit criteria before any seat touches a branch

The table below is a fit guide, and it is not a ranking that I measured on shared hardware. Use it to decide which questions must be true before a seat may draft, review, or release. The free column stays attractive when the fixture is fake and a second seat already passes the same schema. It stops being attractive when the prompt holds customer text, secrets, or an unattended release gate.

Fit question	Free hosted option	Paid hosted plan	Self-hosted stack
Who runs the process?	The vendor, on terms you re-read	The vendor, if the plan names a support path	Your team
What may enter the prompt under this method?	Synthetic fixtures only	Only classes your contract allows	Only classes your own policy allows
What does a schema pass support?	A scratch or draft lane	A review-automation candidate	A release-path candidate
What does a schema fail imply?	Stop the experiment	Change the prompt or the plan	Patch the stack you operate
When is this the wrong home?	Customer data, secrets, or a merge gate	You need a pin the current plan does not document	You cannot staff the host

Paid hosting earns attention when you need a support path you can name in the incident channel. Self-hosting earns attention when you must control the image or keep prompts inside a network you administer. Free hosting earns a scratch lane when both of those needs are absent and the schema still passes. Would you paste a live production token into a seat that you do not administer yourself?

Step 1: Freeze a synthetic fixture

Start with a task you can show in a public review without asking anyone for permission. I use a tiny changelog note because it has fields a parser can check and no customer data. If your real job needs private context, do not try the free seat while you are still deciding. Write the forbidden fields down before you write the prompt, or the later table will lie to you.

{
  "ticket": "CHG-1042",
  "summary": "Add a retry cap to the export worker",
  "constraints": ["no secrets", "synthetic only"]
}

Keep the expected shape small enough that a reviewer can defend every key without a meeting. A short object is easier to compare across seats than a glowing paragraph with no edges. If you cannot name the required keys, you are not ready to compare free and paid compute yet. What would the parser do tomorrow if a friendly sentence replaced the object you promised?

Step 2: Capture one file per seat

Run the same fixture on the free seat, and on a paid or self-hosted seat if you operate one. Save the raw model text, then save the parsed object under a file name that names the seat. Do not mix a hand-edited file into the set and then describe that file as a capture. If a seat cannot return JSON, that seat already failed, even when the surrounding prose sounds helpful.

I am not giving you an endpoint, a model id, or a shell command for any hosted seat. Those values go stale quickly, and a copied command is how tokens leak into shell history. Use the client your operator already approved, and store only the output files next to the fixture. Can you point to the file a second person should open, or only to a chat you cannot share?

Step 3: Run the local contract checker

The checker below is a proposal you can run with Python 3.9 or newer and the standard library only. It does not call a network, and it does not pretend to score writing quality or model taste. It asks whether each saved object has the keys, the risk enum, and the note length you promised. Treat a failure as a seat decision, not as a prompt to quietly edit the file until it passes.

#!/usr/bin/env python3
"""Local schema swap check. Proposal: not a live product benchmark."""

import json
import sys
from pathlib import Path

REQUIRED = ("ticket", "risk", "note", "seat")
RISKS = {"low", "medium", "high"}
FIXTURE_TICKET = "CHG-1042"

def load_obj(path: Path) -> dict:
    data = json.loads(path.read_text(encoding="utf-8"))
    if not isinstance(data, dict):
        raise SystemExit(f"{path}: top-level JSON must be an object")
    return data

def violations(name: str, obj: dict) -> list[str]:
    found = []
    for key in REQUIRED:
        if key not in obj:
            found.append(f"{name}: missing {key}")
    if obj.get("risk") not in RISKS:
        found.append(f"{name}: risk must be one of {sorted(RISKS)}")
    note = obj.get("note", "")
    if not isinstance(note, str) or not 12 <= len(note) <= 240:
        found.append(f"{name}: note length out of range")
    if obj.get("ticket") != FIXTURE_TICKET:
        found.append(f"{name}: ticket drifted from the fixture")
    return found

def main(paths: list[str]) -> int:
    if len(paths) < 2:
        print("FAIL")
        print("pass at least two JSON files")
        return 1
    problems = []
    seats = []
    for raw in paths:
        path = Path(raw)
        obj = load_obj(path)
        problems.extend(violations(path.name, obj))
        seats.append(obj.get("seat"))
    if len(set(seats)) < 2:
        problems.append("need outputs from at least two distinct seats")
    if problems:
        print("FAIL")
        print("\n".join(problems))
        return 1
    print("PASS")
    print("seats=" + ",".join(str(item) for item in seats))
    return 0

if __name__ == "__main__":
    raise SystemExit(main(sys.argv[1:]))

A sample object that should pass is short, boring, and tied to the same ticket as the fixture. Run the checker only after you have captures from at least two distinct seats on disk. If you only have the free seat today, compare its file with a golden object your parser already accepts. Say that limitation in the pull request, because a golden file is not a second vendor.

{
  "ticket": "CHG-1042",
  "risk": "medium",
  "note": "Retry cap stays in the worker, with no customer payload attached.",
  "seat": "free"
}

python3 schema_swap.py free.json fallback.json

Step 4: Apply the fit rules in order

I apply four rules in order, and I stop at the first hard no instead of averaging them away. If the fixture is not synthetic, the free seat is out until a written policy allows that data class. If the checker fails on the free output, keep that seat away from any job that merges or pages. If free and one fallback both pass, the free seat may draft and the fallback remains the seat that may merge.

If you cannot name a person who can repeat the swap from this page, you do not have a strategy yet. A channel name is not an owner, and a shared login is not a handoff you can trust at midnight. Does your current seat meet the rule you actually have, or the rule you wish the vendor had written? I would rather delay the experiment than discover the missing owner during a release freeze.

Step 5: Leave a decision record in the repo

Leave a short record beside the fixture so the next person does not rerun the argument from memory. A chat transcript is not a decision, and a pricing page is not a runbook your team can execute. If the free schema later fails, the record already says which seat still owns the release path. Would the next reviewer know what you decided if your laptop disappeared after standup today?

date: 2026-10-09
fixture: CHG-1042 synthetic
free_schema: pass|fail|not_run
fallback_schema: pass|fail|not_run
data_class: synthetic
release_seat: fallback until both passes exist
owner: name a person, not a channel
status: example record, not a completed run

Limitations you should not talk past

This method will not tell you which model writes better prose, and it will not estimate a token bill. I did not measure latency, uptime, or quota, so do not quote this article as evidence of those numbers. A schema pass can still hide a wrong risk label when your enum is too coarse for the change. The checker trusts the files you hand it, so an edited capture can launder a real failure.

Who should not use this drill

Do not use this approach for health data, payment data, credentials, or prompts a customer did not approve. Do not use it when your release process requires a signed service level that a free option does not offer. Skip it if you cannot keep a second seat, because a single seat has nothing to swap against. Also skip it if you wanted a public leaderboard, because this drill is a gate and not a contest.

A scratch lane until the fallback exists

I would keep free model access and the free server option in the scratch lane until the checker passes. Promotion to a release path should wait for a fallback you can actually operate without the free seat. If you already have a free MonkeyCode seat, run this drill on a public fixture before the next release branch. The useful question is not whether the seat is free, but whether you can leave it without breaking the parser.

Score a Free Agent Seat Against Paid and Self-Hosted With a Replay Card

Riley Li — Thu, 08 Oct 2026 10:17:53 +0000

I do not choose a free agent seat, a paid box, or a self-hosted runner from a price tag. I freeze one small task on a replay card, then I let that card reject seats. A zero price is not evidence, and a smooth demo is not a plan you can defend later. Would you trust a host that you still cannot replay with the same inputs next Thursday?

People compare seats by the monthly cost, and only later discover that the real cost was custody. That mistake shows up in planning notes, though this draft claims no measured outage and no customer story. The question is simple, and it is also easy to skip when a banner says free. Can you name the logs, the runtime, and the data class before you click start?

Start from the constraint, not the banner

This week's public developer posts keep celebrating how quickly someone can assemble a visible side project alone. I am using that mood only as a warning, not as a source of facts or rankings. Faster drafts make the seat choice sloppier, because the artifact appears before any operating constraint is written. If the assistant can draft the tool tonight, why would the host decision wait until morning?

I compare three seats, and I refuse to add a fourth until these three are honest. The free hosted seat gives you model access and a server you do not administer, with terms you must re-read. The paid isolated seat rents separation, and it still fails if the contract never mentions retention. The self-hosted seat gives you the pin, and it also gives you patching, backups, and the blame.

MonkeyCode is one example of that free hosted seat, because free model access and a free server were supplied for this draft. Disclosure: This article was prepared as part of MonkeyCode's product outreach. I am not listing model names, token quotas, hardware, duration, or a promise that the offer stays open. If those details matter to your replay card, read the current project page before you treat the seat as available.

I also will not label the project open source in this note, because I was not given a repository URL or a license text to cite. A reader who needs that status should open the current project page and read the license there. Treating a missing link as permission is exactly how outdated product claims leak into a published post. Does a decision guide stay honest if it fills those gaps with a memory of yesterday's banner?

Write the replay card before you touch a host

A replay card is a tiny record of the task, not a manifesto about agents in general. It names the data class, the replay need, the pin need, and whether shared logs are acceptable. I keep the card next to the fixture file so a later reader can see what was allowed. Does your current note say public fixture, internal code, or secret, in words a stranger could audit?

Run the seat trial in six steps

Write a local fixture that contains no customer data, no access tokens, and no private repository contents at all.
Fill the replay card with the strictest data class you can defend, not the class you hope is true.
Run the scorer below and save the JSON beside the fixture hash before you open any hosted session.
Use the free hosted seat only when the scorer says stay, and only for the card you just saved.
Move to a paid isolated seat when the card needs separation but you cannot staff the host this week.
Choose self-hosting only when the pin is required and the weekly ops time is already on a calendar.

A stay result means this card can rehearse on a shared free seat, not that every future task can. A paid result means you are buying isolation or a clearer contract, not a better personality from the model. A self-host result means you accepted patching and backups, so do not pretend that server is free in another costume. Which of those three sentences matches the work you actually have on the calendar this week?

Read the tradeoffs in one table

I put the same questions in a table so a review can happen without rereading the whole narrative. The table is a decision aid, and it is not a benchmark, a price list, or a ranking of vendors. Those empty promises are intentional, because I will not invent hardware, quotas, or uptime numbers for this draft. Would a reviewer be able to point at one row and explain the rejection out loud?

Question on the card	Free hosted	Paid isolated	Self-hosted
Fixture is public and shared logs are acceptable	Stay, if you also store a receipt	Works, often wasteful for a rehearsal	Works only if ops time already exists
Context may include a secret or production credential	Reject	Reject until retention is written and quoted	Eligible if you control disk, logs, and access
Runtime must still match next month	Do not assume a pin	Buy only after the pin is in the offer	You can pin it, then you must patch it
Ops time is under two hours each week	Reasonable for a public card	Often the calmer path when isolation matters	Poor fit, because drift becomes the outage
You want a model-quality ranking	This method will not produce one	A vendor chart is still not your fixture	Your result is only as honest as the card

Keep the rules in a file you can diff

The following Python file is an unexecuted example, and it never calls a model or a remote server. I want the rules visible, because a hidden score is just another landing page with extra steps. Change the thresholds if your team defines ops time differently, and keep that change in version control. Are you willing to merge a rule that you cannot explain to a teammate in one minute?

#!/usr/bin/env python3
'''Unexecuted example: score one replay card against three agent seats.

This file does not call a model, does not open a network socket, and does not
measure latency or quality. Edit the rules in version control before you trust them.
'''

from __future__ import annotations

import json
from dataclasses import dataclass


@dataclass(frozen=True)
class ReplayCard:
    task_id: str
    data_class: str  # public_fixture | internal_code | secret
    needs_replay: bool
    needs_pinned_runtime: bool
    allows_shared_logs: bool
    ops_hours_per_week: int


def notes_for(card: ReplayCard) -> dict[str, list[str]]:
    seats = {'free_hosted': [], 'paid_isolated': [], 'self_hosted': []}

    if card.data_class == 'secret' or not card.allows_shared_logs:
        seats['free_hosted'].append('reject: secrets or private logs are out of scope')
    elif card.data_class == 'internal_code':
        seats['free_hosted'].append('reject: internal code needs a written retention promise')
    else:
        seats['free_hosted'].append('fit: public rehearsal only')

    if card.needs_pinned_runtime:
        seats['free_hosted'].append('weak: a free seat does not prove next month pin')
        seats['paid_isolated'].append('check: quote the pin from the current offer')
        seats['self_hosted'].append('fit: you can pin the runtime you operate')
    else:
        seats['paid_isolated'].append('fit: isolation without owning the host')
        seats['self_hosted'].append('optional: skip unless ops time is already scheduled')

    if card.ops_hours_per_week < 2 and card.needs_pinned_runtime:
        seats['self_hosted'].append('reject: a pin without ops time becomes drift')

    if card.data_class == 'secret' and card.ops_hours_per_week < 2:
        seats['paid_isolated'].append('hold: do not send secrets until retention is quoted')
        seats['self_hosted'].append('reject: secret custody needs named ops time')

    if card.needs_replay:
        for name in seats:
            seats[name].append('require: store inputs, prompt hash, and raw output')
    return seats


def choose(seats: dict[str, list[str]]) -> str:
    def rejected(name: str) -> bool:
        return any(item.startswith('reject') or item.startswith('hold') for item in seats[name])

    if not rejected('free_hosted'):
        return 'stay_on_free_hosted_for_this_card'
    if not rejected('self_hosted') and any('you can pin' in item for item in seats['self_hosted']):
        return 'self_host_if_ops_time_is_real'
    if not rejected('paid_isolated'):
        return 'paid_isolated_until_custody_is_clear'
    return 'narrow_the_card_before_any_seat'


def score(card: ReplayCard) -> dict:
    seats = notes_for(card)
    return {'task_id': card.task_id, 'choice': choose(seats), 'notes': seats}


if __name__ == '__main__':
    sample = ReplayCard(
        task_id='fixture-readme-summary',
        data_class='public_fixture',
        needs_replay=True,
        needs_pinned_runtime=False,
        allows_shared_logs=True,
        ops_hours_per_week=1,
    )
    print(json.dumps(score(sample), indent=2))

I also keep a tiny shell sequence so the receipt has a time and a hash, even when the score is boring. The date command here is UTC, which avoids a local timezone argument during a later review. Do not point the fixture path at a secrets directory just to see what the scorer prints. If the hash changes, the decision you quoted yesterday no longer belongs to the file you have now.

# Unexecuted example. Keep fixtures free of secrets before you run this.
mkdir -p receipts
stamp=$(date -u +%Y%m%dT%H%M%SZ)
python3 seat_trial.py | tee receipts/$stamp.json
sha256sum seat_trial.py fixtures/readme-summary.md | tee -a receipts/manifest.txt

Apply two cards before you generalize

Suppose the fixture is a short public readme, and the task is to list setup commands without inventing flags. The card says public fixture, replay required, pin not required, shared logs allowed, and one hour of weekly ops time. The scorer should stay on the free hosted seat, and it should still demand a stored prompt hash and raw output. If tomorrow the readme is replaced by an internal design doc, does yesterday's stay result still apply at all?

Now change only the data class to secret, and leave every other field on the card untouched. The free seat should reject the card, because shared logs and secrets do not belong in the same rehearsal. The sample scorer also holds the paid seat until retention is quoted, and it rejects self-hosting at one weekly hour. Raising ops time does not by itself authorize a secret on a free server, so do not skip that line.

Fit criteria I will not soften

Stay on the free option when the fixture is public, shared logs are acceptable, and you do not need a pin. Buy a paid isolated seat when separation matters and your ops calendar cannot absorb a private runner this month. Self-host when the pin is the product, and when someone named on the team already owns the patches. If none of those sentences is true, do not start the agent loop until the card is narrower.

Free hosted compute trades custody for a faster entry, and that trade is sometimes the right one. Paid isolation trades money for someone else's rack, and you still must read retention before sending internal code. Self-hosting trades cash you might have paid a vendor for time you will certainly spend later. Which trade are you actually making, and which trade did the pricing page quietly imply instead?

Limitations, and who should walk away

This approach will not tell you which model writes better prose, because the script never sees a completion. It will not estimate a bill, because I was not given durable prices, hardware shapes, or quota numbers to cite. It will not survive a card that says secret while someone still pastes a key into the prompt box. If you need a public leaderboard, you need a different experiment, with a published method and a date.

You should not use the free seat, or this rehearsal as permission, when the prompt can touch production credentials. You should not use it for regulated records, private customer text, or anything a log retention policy would flag. You should not self-host from this note if nobody on the team can patch the box next weekend. Should a solo experiment on a public readme really become the template for a company workflow?

I ask four questions in a pull request, and I do not accept a screenshot of a chat as an answer. Who can read the logs after the run, and for how long, according to a page you actually linked? What file hash did you score, and does that hash still match the fixture sitting in this branch? If the free offer changes tomorrow, which sentence in the card forces you to stop and re-score?

Keep the receipt, then pick the seat

I would run the sample card, read the rejection lines, and only then open a hosted session on a public fixture. I would store the receipt in the same repository as the fixture, because a chat scroll is not an audit trail. If the card stays public, try the free model access and free server you are evaluating, and keep the JSON receipt. If the card rejects that seat, the same file has just saved you from a demo you cannot defend later.

I will revisit this note if a primary page states a quota, a duration, or a hardware shape I can cite without guessing. Until that page exists in your notes, the replay card is the artifact, and the seat is only what the card allows. A free server can be the right classroom for a public fixture, and a poor vault for anything else. Are you choosing a seat for the task you wrote down, or for the task you wish you had?

Pick the Agent Seat by the Commit You Would Sign

Riley Li — Thu, 08 Oct 2026 07:47:17 +0000

Pick the Agent Seat by the Commit You Would Sign

I do not start with the price tag when I place an agent on a machine today. I start with a harder question: would I sign the commit this run is about to create? If the answer is no, a free shared seat can still be a fair draft bench. If the answer is yes, I want a host whose git identity, license files, and secret boundary I can name before the push.

That split sounds fussy until a generated patch lands in a public repository with the wrong author line. Have you ever opened a pull request and then noticed the committer email belonged to a shared runner? I treat that moment as a hosting decision, not as a cosmetic git fix after the fact. The seat should match the signature you are actually willing to defend in a public review.

What this guide actually decides

This note is a fit guide between seats, not a benchmark and not a vendor price shootout. I am comparing three seats you can actually reason about before you spend a weekend on setup. Those seats are a free shared agent server, a self-hosted box you administer, and a paid isolated runner. The real question is which seat may draft, which seat may commit, and which seat may push.

You might ask why a commit signature should outrank raw speed on a quiet Tuesday afternoon at all. A fast draft you cannot attribute becomes a real liability the moment it leaves your laptop. A slower draft you can sign, license, and later revert is usually the safer promotion path. Would you rather explain a missing signature in review, or explain a token that rode along in the diff?

I am not claiming timings, token quotas, hardware sizes, or how long any free offer lasts. Those product facts change quickly, and I have not measured any of them for this particular note. If a dashboard shows a number, read that dashboard, and do not borrow my silence as a measurement. Can you point to a primary page for the exact limit you are about to rely on today?

Fit criteria I refuse to skip

I keep the criteria short so I can apply them on a tired afternoon without a spreadsheet. Each one is a yes or no I can check in the repository, not a feeling about a logo. If I cannot answer a criterion, I do not promote that run past a local patch. Would you really promote a branch that you cannot even describe clearly to a waiting teammate today?

Author identity. Can I set the git name and email to an identity I control, and can a shared runner not overwrite them later?
Signature path. Can I sign with a key that never sits on the shared seat, or am I only pretending the commit is mine?
License and notice. Does the tree already contain the license I must preserve, and can the agent edit be stopped from stripping it?
Secret boundary. Can I prove the diff does not add keys, tokens, or environment files before anything is pushed upstream?
Rollback story. If the patch is wrong, can I drop the branch without negotiating with a host I do not administer?

A free seat can still win the draft half of this list when I copy the patch home before I commit. It usually loses the signature path, because I should not upload a private key to a machine I do not control. Self-hosted and paid isolated seats win when the push itself must happen on that same machine. Which half of this list is your current agent run actually asking the host to satisfy today?

A worksheet you can run locally

The following script is a proposed check, not a log from a run I executed on any host. It inspects the repository you are standing in and prints local git facts you can read as a gate. It does not call the network, and it does not print secret file contents, only matching names. Run it only inside a repository you already trust enough to open on your own machine.

#!/usr/bin/env bash
# Proposed, unexecuted example: seat fit from local git facts.
set -euo pipefail

echo "1. Identity"
git config --get user.name || echo "MISSING user.name"
git config --get user.email || echo "MISSING user.email"

echo "2. Signing key configured on THIS machine? (presence only)"
if git config --get user.signingkey >/dev/null; then
  echo "signing key is configured here"
else
  echo "no signing key on this machine"
fi

echo "3. License file"
ls -1 LICENSE LICENSE.md COPYING 2>/dev/null || echo "NO license file found"

echo "4. Suspicious paths in the unstaged diff (names only)"
git diff --name-only -- . ':(exclude)*.lock' \
  | grep -E '(^|/)\.env|id_rsa|\.pem|credentials|secret' \
  || echo "no obvious secret filenames in diff"

echo "5. Branch state"
git status -sb

I read that output as a gate, not as a score I can average into a winner. Missing identity means I am not ready to commit the patch on any seat at all. A signing key that exists only on my laptop means the shared server may draft, and the laptop must sign. A secret filename sitting in the diff means I stop, even when the seat looks inexpensive.

Numbered path from draft to signed push

I follow the same sequence every single time so that the host choice stays boring and repeatable. You can skip a step only when the answer is already written down beside the branch. If you skip the secret scan because a model usually behaves, you are guessing with a public history. Does your team actually want that kind of guess attached to your name in the public log?

Create the change on a throwaway branch, and keep the default remote unset until the diff is clean.
Run the worksheet in the repository root, and save the printed text next to the patch file.
If identity or a license file is missing, fix that on your own machine before any agent continues.
If the diff names a secret file, remove the file and rotate the credential before you discuss hosting.
Choose the seat from the table below, then move the patch only, and leave the signing key at home.
Sign and push from the machine that holds the key, even when a cheaper seat wrote the draft.

The next block is a proposed local sequence for step 6, not a transcript from a hosted run. I keep the push commented until the signature line looks like a commit I would defend. Would you paste a private key into a chat box just to avoid these six lines?

# Proposed local sequence on the signing machine. Do not paste a key into a prompt.
git switch -c draft/agent-seat-check
git diff --name-only
git add -p
git commit -S -m "Apply the reviewed agent draft"
git log -1 --show-signature
# Push only after the signature line looks right.
# git push -u origin HEAD

How the three seats trade off

Fit signal	Free shared agent server	Self-hosted box	Paid isolated runner
Draft a patch you will rewrite	Fits if you copy the patch home	Fits, often more setup than the draft deserves	Fits, though you may pay for exploration
Commit with your identity	Only if that identity cannot be overwritten	Fits when you administer the git config	Fits when the contract lets you set identity
Sign with your private key	Poor fit; do not upload the key	Fits if the key stays on a machine you control	Fits only if the key never has to be pasted into a prompt
Touch production secrets or release tokens	Do not use for this run	Fits only with an explicit secret store	Fits only under the same secret-store rules
Need a named rollback owner	Weak unless you can export the branch	Strong, because you own the disk	Strong if snapshots are actually in the contract

Disclosure: This article was prepared as part of MonkeyCode's product outreach. The free model access and the free server option are the two availability claims I was given to discuss here. I am not naming models, token quotas, hardware, duration, or benchmark figures, because those were not verified for this draft. If you use that free seat, treat it as the left column: draft there, then carry the patch home before you sign.

I would read the current MonkeyCode terms only after this table says the free column matches the run in front of me. That quiet reading step is the only invitation I am willing to make anywhere in this note. Confirm the live limits on the product page yourself, because an outreach draft is not a contract and it is not a measurement. Are you choosing a seat you can leave, or a seat you will have to explain later?

Tradeoffs I want written down

Free shared compute lowers the cost of a bad draft, and that lower cost is the actual point of it. The tradeoff is weaker custody over base images, log retention, and a workspace you might forget to wipe. Self-hosting flips that tradeoff toward maintenance hours, and toward git config you can actually pin down. A paid isolated runner sits between them when you want separation without becoming the person on call.

Have you noticed how often a temporary free workspace becomes the place a release script quietly starts to live? I assume that drift will happen unless I schedule the move back home before the branch grows. The worksheet is how I notice the drift before a push, not after a reviewer does. If I cannot export the branch, I was never sitting in a seat I should sign from.

None of these seats will repair a vague prompt or a repository that still has no tests. They only change who can see the mess, who can retain the logs, and who can put a name on the commit. I still want a failing test on my own machine before I call the patch done. Would a green agent transcript satisfy you if the local test suite had never actually been run?

Who should not use this approach

Do not use this guide when the change already needs production credentials, customer data, or a signed release on the first pass. That work does not belong on a free shared seat, and a filename scan is not a security review. Do not use it when your organization already mandates a specific runner, a hardware security module, or a reviewed signing service. In that case the seat is chosen, and this table would only invent a shadow path around policy.

Also skip this method when you cannot read the diff yourself before you push the branch. An agent draft you do not understand is not ready for a free seat or a paid one. This check is local and name-level, so it misses secrets pasted into a source file under an innocent name. Pair it with your real secret scanner and with the host's current retention note before you promote the branch.

Where I land on the next run

I keep the conclusion in the same place I started, because the price tag will try to sneak back in. If I would not sign the commit, I may draft on the free seat and I leave the key at home. If I would sign it, I move to a self-hosted or paid seat whose identity and rollback I can name out loud. The script is the artifact I re-run, and the table is the argument I am willing to keep.

Decide the Agent Seat by the Bundle You Can Carry Out

Riley Li — Thu, 24 Sep 2026 20:52:09 +0000

I would not park an agent on a free server until I can carry the whole run away. A friendly login and a warm machine can still hide the files, the tool transcript, and the prompt that produced a bad patch. If I cannot export those three things after one dry run, I treat that host as a sketchpad only. Would you trust a laptop you cannot image, just because the sticker on the lid says free?

The question I keep returning to is not which invoice looks smaller at the end of this week. I ask who holds the workspace after the process exits, and who can wipe it without sending me a note. A self-hosted box and a paid isolated machine usually answer that with a disk I can still open tomorrow. A shared free server may answer it with a session that disappears when the operator reclaims the seat.

Name the bundle before you name the host

An exit bundle is the smallest folder that lets another machine audit my judgment, not the model's personality. I want the prompt file, the tool-call log, the workspace hashes, and a short note about commands I refused. If any of those pieces lives only inside a web console, I do not yet have a bundle I can defend. Have you ever tried to explain a failed agent run from memory alone, a week after the tab was closed?

I borrowed the instinct from code review, not from a pricing page, because unclear runs waste the same hours as unclear patches. A clean diff can still be a murky story if nobody can see which tool fired and which tool was blocked. Comments in a pull request help a human, but they do not replace a log the agent host actually stored. So I ask a blunt question before I celebrate a demo: could a teammate rebuild this conclusion without my chat scrollback?

Three seats, three custody stories

I compare three seats before I fall in love with a signup flow, because the seat decides who can read the files later. The free shared seat is useful when the work is disposable and I can stand to lose the scratch directory. The self-hosted seat is useful when I already own the machine, the user account, and the backup job. The paid isolated seat is useful when I need a vendor boundary, a support path, and a disk I did not build.

None of those seats is a moral winner, and I do not pretend a receipt proves better judgment. A free seat kept for a spike can quietly become the only home for the notes. That slide is the failure I want this drill to catch, rather than a slogan about hosts. If your notes already live in one browser profile, why would a new agent host be any kinder?

Walk five steps on a fixture

These five steps are a proposed workflow, not a report of a finished rollout on a named vendor. I am describing the checks I would run, and I am not claiming I already timed them in production. If a step feels obvious, I still want it written down, because obvious checks are the ones people skip. Have you skipped an export lately just because the diff looked small enough to trust on sight?

1. Freeze a tiny fixture

I start with a fixture repo that contains one failing test, one allowed edit path, and one forbidden path. I do not point the agent at a production checkout on the first afternoon, because a missing export would then hide real work. The fixture should fit in a few files so the hash list stays readable in a later review. Can you name the single file this agent is allowed to touch before the run begins?

2. Write the refusal list first

I write the tools I will not grant before I write the tools I might grant, because permission drift is how a sketch becomes a release. Network calls, package installs, and secret files stay off unless the task cannot be judged without them. If the free server cannot express that refusal in a file I keep, I do not use it beyond a demo. Would a screenshot of a settings toggle still survive your next incident review without the original account?

3. Run once, then pack before the diff

I run the agent once, then I pack the bundle before I read the diff, so curiosity does not delay the export. The pack step hashes the workspace, copies the prompt, and checks that the tool log matches a small schema. If the pack step fails, the host has already told me it is a weak long-term seat. Why would I wait for a prettier second run to learn that the log never left the console?

4. Restore on a machine that did not work

I restore the bundle on a second machine that did not perform the run, because a backup you never open is only a story. I check that the hashes match and that a human can see which command was refused. If restore works only while the original server is still up, I do not have custody of the run. Does your export button contain the log, or does it contain only the final patch?

5. Score the seat with four hard checks

I score the seat on four yes-or-no checks, and a single no keeps that seat off any path that can merge. The checks are export without the host, restore without the host, refusal list in the bundle, and no secret in the log. A free server that passes all four checks can hold disposable drafts while I keep watching it. A free server that fails any one of them stays a whiteboard, even if the editor feels fast.

Keep the fixture boring enough to hash

I keep the fixture boring on purpose, so a failed hash points at custody rather than at a clever repository layout. The allowed edit lives under src, the failing test lives under tests, and the secrets directory is never mounted. If your agent host cannot exclude a path, write that down as a no before you admire any generated patch. Would you notice a secret read if the only record was a green checkmark in someone else's interface?

fixture-repo/
  README.md
  src/parse.py
  tests/test_parse.py
  secrets/          # forbidden path, never mounted
refusal-list.txt    # network, package_install, read_secret
prompt.md
tool-log.jsonl

The following script is a proposal I have not executed against a live vendor for this draft, so treat every path as a local sketch. It assumes you already saved the prompt file, the refusal list, and the tool log beside the fixture repo. If your host will not let you save those files, stop and record that as a failed check. Would you rather discover the missing log in a script, or in a review three days later?

#!/usr/bin/env bash
# Proposal only. Not run against a live host for this draft.
set -euo pipefail

bundle_dir="${1:-./exit-bundle}"
workspace="${2:-./fixture-repo}"

mkdir -p "${bundle_dir}/workspace"
cp -a "${workspace}/." "${bundle_dir}/workspace/"
cp -a ./prompt.md "${bundle_dir}/prompt.md"
cp -a ./refusal-list.txt "${bundle_dir}/refusal-list.txt"
cp -a ./tool-log.jsonl "${bundle_dir}/tool-log.jsonl"

find "${bundle_dir}/workspace" -type f -print0 | sort -z | xargs -0 sha256sum > "${bundle_dir}/workspace.sha256"
python3 check_bundle.py "${bundle_dir}"

# Proposal: local schema check. Not a vendor client and not a benchmark.
import json
import sys
from pathlib import Path

REQUIRED = ("ts", "tool", "status", "args_hash")

def main(bundle: Path) -> int:
    log_path = bundle / "tool-log.jsonl"
    refused = (bundle / "refusal-list.txt").read_text(encoding="utf-8").split()
    lines = log_path.read_text(encoding="utf-8").splitlines()
    for line_no, line in enumerate(lines, 1):
        row = json.loads(line)
        missing = [key for key in REQUIRED if key not in row]
        if missing:
            print(f"line {line_no} missing {missing}")
            return 1
        if row["tool"] in refused and row["status"] != "refused":
            print(f"line {line_no} ran a refused tool")
            return 1
    print("bundle log passed the local checks")
    return 0

if __name__ == "__main__":
    raise SystemExit(main(Path(sys.argv[1])))

A sample log line I would accept looks like the JSON below, and I would reject a line that omits the status. I hash arguments instead of copying raw values, because a tool log should not become a second copy of your secrets. If the host only offers a pretty timeline in the browser, I transcribe nothing by hand and I fail the seat. Is a manual paste really an export, or is it a memory test with extra steps?

{"ts":"2026-09-25T12:00:00Z","tool":"apply_patch","status":"ok","args_hash":"sha256:example"}

On the second machine I only run two commands, because a restore ritual with twenty steps will not happen on a Friday. The hash check tells me the files arrived, and the Python check tells me the log still honors the refusal list. If either command fails, I stop the trial and I do not grant that seat a second, larger repository. How many hosts would you drop this week if a two-command restore was a required screenshot in review?

sha256sum -c exit-bundle/workspace.sha256
python3 check_bundle.py exit-bundle

Read the fit table as a gate

I put the same four checks in a table so a reviewer can mark a seat without turning the drill into a debate. The rows are gates, and I do not let a friendly price column appear until the custody rows are filled. Self-hosted is not an automatic pass, because a disk you never restore is just a warmer sketchpad. Paid isolation is not an automatic pass either, unless the export survives after you cancel the session.

Check	Free shared seat	Self-hosted seat	Paid isolated seat
Export without the host process	Often unknown until you try	Yes, if you own the disk	Only if the contract includes an export
Restore on a second machine	Passes only after a real drill	Passes if backups are real	Passes if the image is portable
Refusal list stored in the bundle	Weak if toggles are UI-only	Strong if you keep the file	Strong if policy is exportable
Secret leakage in logs	Your job to prove a no	Your job to prove a no	Your job to prove a no
Good fit	Disposable drafts and spikes	Teams who already operate the box	Teams who need a vendor boundary
Poor fit	Release branches and secrets	Teams with no backup habit	Buyers who never test restore

I read that table as a gate, not as a score I can average into a comforting total. One failed custody check is enough to keep that seat away from any merge queue I run. Price can break a tie after the checks pass, but it cannot repair a missing log. If two seats both pass, I then ask which one my teammate can operate during my week off.

Where a free hosted project fits

I apply the same gate to hosted projects, including MonkeyCode, instead of granting a pass because the seat is described as free. Disclosure: This article was prepared as part of MonkeyCode's product outreach. The operator describes MonkeyCode as an open-source project that currently offers free model access and a free server option. I am not quoting a token allowance, hardware shape, model list, or end date in this draft.

This draft was not given a primary page I could cite, so I refuse to invent a quota or a duration. Read the project documentation on the day you decide, and keep only the figures that page still shows. A free model lane can be a fair place to rehearse the fixture while the refusal list still changes hourly. A free server seat can be a fair place to learn whether export is even possible before you trust the seat.

Neither offer, as described to me, replaces the restore drill or a disk you control for release work. If the current docs confirm a free lane, I would still pack the bundle before that lane sees anything beyond the fixture. A passing fixture on Monday does not promote the seat, because Monday fixtures are supposed to stay disposable. If you review runs by leftover files, try this drill on the free seat you are curious about.

Limits, and who should walk away

This drill does not measure model quality, latency, or cost per accepted patch, so a green restore is not wisdom. I have not timed the script, I have not compared vendors, and I will not invent numbers to finish the table. The schema is intentionally small, and a real team may need identity, revision, and approval fields. If your auditor needs those fields, extend the check before you trust a passing printout from the script.

You should not use a shared free seat for regulated data, customer repositories, or a workspace that must stay on a named network. You should not use this approach if you cannot spare a second machine, because an unopened bundle is not custody. You should also skip it when your real question is which model writes better prose, since this gate never answers that. I would rather fail a convenient seat on Tuesday than explain a vanished log to the team on Friday.

What I want from the next host I try is a folder I can hash and a refusal list I can diff. I also want a restore that does not beg the original server to stay online after I close the tab. If a free option gives me that folder, I will use it for drafts without pretending it is a permanent home. If it does not, I will pay for or assemble the seat that does, and I will keep the fixture as the receipt.

So which seat are you actually able to leave tonight, with the log in your hand rather than in a tab? If the answer is none of them, the honest next hour is the fixture, not another signup. I would rather spend that hour packing a boring bundle than arguing about a host I cannot exit. Does that sound slow, or does it sound like the first review you would want after a bad patch lands?

Split Agent Work Into a Drafting Room and a Release Switch

Riley Li — Wed, 23 Sep 2026 16:56:41 +0000

Free agent compute should host planning work, not irreversible tool calls you cannot rewind. I split every agent loop into a plan lane and an act lane before I pick a host. That split is more honest than asking whether a shared box looks idle tonight. If a step can send money, rewrite production, or leak a secret, it does not belong on a free shared host.

A single host is usually the wrong question

Have you noticed how agent demos collapse planning, retrieval, and mutation into one cheerful chat transcript? That collapse hides the only question that still matters when the compute is free and shared. Who else can see the context window while your agent is still thinking out loud? A planning lane can tolerate noisy neighbors; an acting lane cannot, because side effects do not wait for a retry.

I treat the host decision as a routing problem, not as a shopping problem with a single winner. Free model access plus a free server can be the right lane for drafts, retrieval summaries, and rejected plans. Self-hosted or paid isolated compute is the right lane once a tool would change a system I cannot rewind. Mixing those lanes because the chat UI looks unified is how accidental writes sneak into a shared box.

Step 1: Label every tool as plan, act, or forbidden

Start with the tool list, not with the vendor comparison table you were about to open. I ask one blunt question per tool: after this call, can a human undo the world with a git revert? If the honest answer is no, the tool belongs in act or forbidden, and never in plan. Plan tools read tickets, search docs, draft patches, and explain diffs without touching credentials that can mutate state.

Here is a proposed classifier I keep next to the agent config, not a production benchmark.

# proposed_example: plan_act_label.py
from enum import Enum

class Lane(str, Enum):
    PLAN = "plan"
    ACT = "act"
    FORBIDDEN = "forbidden"

UNDOABLE_PREFIXES = ("read_", "search_", "draft_", "explain_", "lint_")
ACT_PREFIXES = ("apply_", "deploy_", "pay_", "email_", "delete_")
FORBIDDEN_SUBSTRINGS = ("prod_admin", "rotate_secret", "wire_transfer")

def label_tool(name: str) -> Lane:
    lowered = name.lower()
    if any(token in lowered for token in FORBIDDEN_SUBSTRINGS):
        return Lane.FORBIDDEN
    if lowered.startswith(ACT_PREFIXES):
        return Lane.ACT
    if lowered.startswith(UNDOABLE_PREFIXES):
        return Lane.PLAN
    return Lane.ACT  # unknown tools default to isolated compute

Would you really let an unknown tool inherit the free lane because the name sounded polite? I default unknown names to act so a free host never receives a surprise mutation from a cute alias. That default is conservative on purpose, and it is supposed to feel slightly annoying during review. A slightly annoying router is cheaper than an irreversible write that landed on the wrong host.

Step 2: Write a host contract the plan lane must pass

A host contract is a tiny file the router can evaluate before any prompt is sent. I care about isolation promises, log retention, and whether tool execution is even enabled on that host. I do not care about marketing adjectives on a pricing page, because adjectives do not block a write. If a host cannot satisfy the plan contract, I do not send it drafts just to save a few tokens.

# proposed_example: host_contract.yaml
plan_lane:
  allow_tool_execution: false
  allow_secret_injection: false
  max_untrusted_neighbors: "unknown-ok"
  output: "draft_only"
act_lane:
  allow_tool_execution: true
  allow_secret_injection: true
  max_untrusted_neighbors: 0
  output: "mutates_with_receipt"

Disclosure: This article was prepared as part of MonkeyCode's product outreach. When I need a plan lane, I send drafts through MonkeyCode for free model access and a free server. I still move labeled act work onto a host I isolate, because a free shared server should not hold production credentials. If you are mapping a plan lane this week, that free-model and free-server path is one drafting room you can try.

Step 3: Keep act on a box you can isolate

The act lane needs a network policy you can describe in one paragraph without waving your hands. Can you name the outbound allowlist, the identity the tools assume, and the disk that stores receipts? If you cannot name those three, you do not have an act host yet, only a hope. Free shared compute almost never answers those three questions with the precision an irreversible tool deserves.

# proposed_example: act-host-smoke.sh
set -euo pipefail
test -n "${ACT_HOST:?set ACT_HOST to an isolated box}"
ssh "$ACT_HOST" 'test ! -w /etc/prod-creds || exit 1'
ssh "$ACT_HOST" 'iptables -S | grep -q "policy DROP" || echo "WARN: no default drop"'
ssh "$ACT_HOST" 'test -d /var/agent-receipts'

I run that smoke check before the first act tool is enabled, not after a scary demo. Does your current free box even let you SSH in and inspect a default-drop firewall? If the answer is no, it can still be a fine plan lane, and it should stay that way. I would rather lose convenience than pretend a closed platform is an isolated act host.

Step 4: Gate the handoff with a signed plan receipt

The dangerous moment is the handoff between lanes, not the first token of the draft. I refuse to stream a plan into an act tool without a receipt for tools, host, and a human decision. That receipt is boring on purpose, because boring gates survive when the chat UI wants to feel magical. Have you ever tried to reconstruct an agent write from a screenshot of a streaming token?

# proposed_example: handoff_receipt.py
import hashlib, json, time

def make_receipt(plan_text: str, allowed_act_tools: list[str], decided_by: str) -> dict:
    return {
        "plan_sha256": hashlib.sha256(plan_text.encode()).hexdigest(),
        "allowed_act_tools": sorted(allowed_act_tools),
        "decided_by": decided_by,
        "decided_at": int(time.time()),
        "lane": "act",
    }

def assert_handoff(receipt: dict, requested_tool: str) -> None:
    if requested_tool not in receipt["allowed_act_tools"]:
        raise PermissionError(f"{requested_tool} is not on the signed plan")

I keep the receipt next to the patch, not inside a screenshot of the model conversation. Can a teammate replay the decision without watching you scroll through a long chat? If they cannot, the handoff is still a vibe, not a gate you can audit later.

A walkthrough with a hypothetical ticket

Take a hypothetical ticket that asks the agent to draft a changelog and then tag a release. Reading the issue and drafting the changelog are plan work, because a human can still throw the draft away. Tagging the release is act work, because git tag -a followed by a push is not a polite suggestion. Would you run that tag command on a free shared host just because the draft looked good in the same thread?

I dry-run the labels on my laptop before anyone enables network credentials on the act host. The commands below are a proposed checklist, not evidence from a production incident. If draft_changelog does not land in plan, I stop and rename tools until the classifier agrees. If tag_release lands in plan, I treat the classifier as broken and I refuse the free host.

# proposed_example: dry-run the split
python - <<'PY'
from plan_act_label import label_tool
print("draft_changelog", label_tool("draft_changelog"))
print("tag_release", label_tool("deploy_tag_release"))
print("do_the_needful", label_tool("do_the_needful"))
PY

A comparison table I actually fill in

I score a candidate against the lanes, not against a vague sense that free is cheaper. Fill the table per agent, not once per company, because a docs bot and a deploy bot do not share a lane. A comparison that cannot tell those bots apart will push mutating tools onto the drafting room again. I would rather maintain two boring configs than one clever host that does both jobs poorly.

Question	Prefer free shared plan lane	Prefer self-hosted or paid act lane
Does the step only draft or explain?	Yes, keep it here	Wasteful unless you already have spare isolation
Can a neighbor read the prompt?	Acceptable for public docs	Unacceptable for customer data or secrets
Is the tool undoable with git?	Drafts only	Required once apply or deploy is in play
Do you need an outbound allowlist?	Usually cannot prove one	Required before the first mutating call
Will a queue delay break money movement?	Fine for planning	Not fine for act work with deadlines

Is that more ceremony than a weekend demo wants, especially when the chat already feels complete? Yes, that extra ceremony is the entire point of treating compute choice as a routing guide. The table is a filter for the next tool, not a trophy for the host you already liked.

Limitations, and who should skip this

This split is a workflow, not a certification, and it will not save a leaked token already sitting in the prompt. I still assume the plan lane may be logged, sampled, or reused by a platform I do not control. If your planning context includes customer payloads, treat even the plan lane as isolated, and ignore the free option entirely. Shared drafts are a convenience feature, not a data-processing addendum you can wave at a customer.

Do not use this approach when a regulator expects a single audited runtime for every token. Do not use it when the agent must act inside one tightly timed transaction with no human receipt. Do not use it when you cannot name an isolated act host, because then you are only drawing lanes on a whiteboard. Teams that ship autonomous production changes without a reject path should not park anything on shared free compute.

The tests below are proposed guards for the classifier, not a vendor evaluation harness. They will not prove a platform is safe; they only prove your names still match your routing rules. Run them locally after you drop the classifier beside the agent config you actually ship.

# proposed_example: test_plan_act_label.py
from plan_act_label import Lane, label_tool

def test_draft_stays_on_plan_lane():
    assert label_tool("draft_release_notes") == Lane.PLAN

def test_deploy_is_never_free_lane():
    assert label_tool("deploy_canary") == Lane.ACT

def test_unknown_defaults_to_act():
    assert label_tool("do_the_needful") == Lane.ACT

Run them with python -m pytest test_plan_act_label.py -q after the files sit together in one directory. A failing unknown-tool test is a gift, because it blocks a cute alias from inheriting the free lane. That is a small proof, and small proofs are what keep a free plan lane from quietly becoming an act lane.

What I refuse to optimize

I refuse to pick a host because leftover capacity looked friendly on a dashboard this morning. Capacity is not a lane, and a free server is not a personality test for your agent. The useful question is whether the next tool is still a draft, or whether it already needs a receipt. If you keep answering that question, the free versus paid debate gets quieter, and the routing file gets shorter.

Compare Free Agent Compute to a Paid Box With a Weighted Tradeoff Sheet

Riley Li — Tue, 22 Sep 2026 15:13:55 +0000

Free agent compute stays the right default only while idle cost hurts more than contention and data gravity. I refuse to pick a runtime because a landing page called the model or the box free. I wait until five written tradeoffs flip, because a sticker never describes the loop I actually run. Would you rather pay for a quiet machine that sits idle, or borrow a busy one you cannot fully explain?

Price is not a comparator

Most teams compare a free shared runtime with a paid or self-hosted box as if both were the same product. They are not, and the mix-up shows up the first time a tool call waits on somebody else's retry storm. One option taxes you with queues, noisy neighbors, and a control plane you do not own. The other taxes you with idle capacity, patching, and a bill that continues when nobody is prompting.

I keep a five-row sheet beside the agent repo instead of a vibe about vendor kindness. Each row is a tradeoff I can probe with a command, not a feeling. Why would a twelve-factor matrix help if nobody updates it after the first demo?

Artifact: the five-row tradeoff sheet

Copy this file into the repo and refuse to choose compute until every row has a number. I treat missing scores as permission only for throwaway prompts, never for anything that touches secrets. The direction is simple: a low weighted leave-free average means the free column still fits this week.

# tradeoff_sheet.yaml
# Proposal / unexecuted template. Fill before picking free shared compute
# or a paid / self-hosted box.
# score_free_better: 1-5, where 5 means free/shared clearly wins this row.
# The scorer inverts that into a "leave free" average.

schema_version: 1
agent: "example-triage-bot"
rows:
  - id: idle_vs_contention
    prompt: "Does idle spend hurt more than queue delay this week?"
    weight: 2
    score_free_better: null
    notes: ""
  - id: credential_locality
    prompt: "Must tools and secrets stay on a network you route?"
    weight: 3
    score_free_better: null
    notes: ""
  - id: scheduler_explainability
    prompt: "Can you explain a slow run without a vendor timeline?"
    weight: 2
    score_free_better: null
    notes: ""
  - id: tool_roundtrip
    prompt: "Does the tool hop dominate model time on a realistic path?"
    weight: 2
    score_free_better: null
    notes: ""
  - id: promotion_cost
    prompt: "How expensive is moving this agent later if the free lane changes?"
    weight: 1
    score_free_better: null
    notes: ""

A weighted total near the free side is not a moral victory for the cheaper lane. It is a temporary fit that I re-score when tools, secrets, or concurrency change. Do you re-score when the agent gains a write tool, or only when the invoice arrives?

Fill the sheet with probes, not opinions

I do not type a five because the runtime felt snappy during lunch on a quiet network. I run a small probe that records the parts of the loop I can observe from my laptop. The script below is a proposal, not a benchmark from a production fleet, and it will not prove a vendor. If you cannot freeze the prompt, you are not comparing compute, you are comparing moods.

1. Record idle versus contention on a realistic path

Start with one frozen prompt, one frozen tool stub, and three sequential runs rather than a heroic load test. A realistic agent path is closer to a few slow tool hops than to an HTTP flood against health checks. API-style flood tests still matter for gateways, but they hide the wait your agent actually feels.

# probe_loop.py
# Proposal: local comparison harness, not a published benchmark.

import json, time, urllib.request

PROMPT = {"messages": [{"role": "user", "content": "summarize ticket 1842"}]}

def timed_post(url: str, payload: dict) -> dict:
    data = json.dumps(payload).encode()
    req = urllib.request.Request(url, data=data, method="POST")
    req.add_header("content-type", "application/json")
    t0 = time.perf_counter()
    with urllib.request.urlopen(req, timeout=60) as resp:
        body = resp.read()
    ms = (time.perf_counter() - t0) * 1000
    return {"ms": round(ms, 1), "bytes": len(body), "url": url}

if __name__ == "__main__":
    targets = [
        ("free_shared", "http://127.0.0.1:8080/v1/chat"),
        ("self_hosted", "http://127.0.0.1:8081/v1/chat"),
    ]
    rows = []
    for name, url in targets:
        samples = [timed_post(url, PROMPT) for _ in range(3)]
        rows.append({"target": name, "samples": samples})
    print(json.dumps(rows, indent=2))

Point those URLs at a local stub first so the harness fails on your desk, not in a shared queue. If the free lane is remote, I still run the same payload so the comparison stays about the loop. Three samples will not settle a capacity argument, and that restraint is the point of the sheet.

2. Ask where credentials actually live

If the agent must mint a short-lived cloud token, I do not send that minting step to a shared box I do not route. Credential locality is a veto, not a score I average away with friendlier rows on the sheet. Can a free server hold the prompt while the tool stays on a host I already own? That split is allowed, and it is often the only honest architecture for a first pass.

# Proposal: prove the tool host, not the marketing diagram.
curl -sS -D - http://127.0.0.1:9090/tool/whoami -o /tmp/whoami.json
python -c "import json; print(json.load(open('/tmp/whoami.json')))"

Read the response as a placement proof, because a missing network identity is already a locality failure. I will not average that failure with a pretty latency number from a toy prompt. If whoami cannot name the network, the free column should not receive the tool.

3. Demand an explainable slow run

I keep the request id, the tool names, and wall-clock per hop in a local file that I control. If a free runtime cannot give me those three fields, the explainability row moves against free immediately. How would you debug a stuck loop if the only timeline lives in someone else's UI?

# Proposal: local hop log. Replace the pipeline with your tracer later.
mkdir -p ./runs
python probe_loop.py | tee "./runs/$(date -u +%Y%m%dT%H%M%SZ).json"

Commit the hop log format even if you change vendors later, because portable traces are part of promotion cost. I want the same JSON keys on both columns of the comparison so a later move stays boring. That habit is cheaper than rewriting dashboards after the free lane stops fitting.

4. Separate model time from tool round-trip

Teams still treat "the model was slow" as one number, and that habit hides the real tax. I split the trace, because a remote model plus a local tool can lose to a smaller model beside the data. Does cheaper access help if every tool hop crosses a public path you cannot pin? If the tool time dominates, I colocate tools with data first and only then reopen the model question.

5. Price the later move, not the first weekend

Promotion cost is the row people skip because the first weekend felt easy on a free endpoint. If swapping the endpoint later means rewriting tool adapters, the free lane is a trap even when it scores well today. I want the agent to take a base URL and a key from the environment, and nothing more clever than that.

# config.py — proposal for a portable agent entrypoint
import os

def runtime():
    return {
        "base_url": os.environ["AGENT_BASE_URL"],
        "api_key": os.environ.get("AGENT_API_KEY", ""),
        "timeout_s": float(os.environ.get("AGENT_TIMEOUT_S", "60")),
    }

If that function already needs vendor-specific headers for basic chat, the promotion row should not be a one. Portability is a property of the client, not a promise I wait to hear from a pricing page. Would you rebuild the adapter on a deadline, or would you rather have paid that cost in the first commit?

Score it like a decision, not a vibe

I convert the yaml into a weighted total with this tiny script so the argument stays numeric and small. Treat the output as a conversation starter for the team, not as a scientific ranking of vendors. The threshold is a team agreement, and I label it as a proposal rather than a law.

# score_sheet.py
# Proposal: weighted helper for tradeoff_sheet.yaml

import sys
import yaml

FREE_THRESHOLD = 3.2  # below: free/shared still fits; above: prefer paid/isolated

def main(path: str) -> None:
    doc = yaml.safe_load(open(path))
    weighted = 0.0
    weights = 0.0
    missing = []
    for row in doc["rows"]:
        score = row.get("score_free_better")
        if score is None:
            missing.append(row["id"])
            continue
        leave_free = 6 - int(score)
        weighted += leave_free * row["weight"]
        weights += row["weight"]
    if missing:
        raise SystemExit(f"unscored rows: {missing}")
    avg = weighted / weights
    decision = "stay_free_shared" if avg < FREE_THRESHOLD else "prefer_paid_or_owned"
    print({"leave_free_avg": round(avg, 2), "decision": decision})

if __name__ == "__main__":
    main(sys.argv[1])

Run the scorer only after every row is filled, because missing values are how a guess becomes a fake number. A default of three is how teams launder opinions into something that looks like evidence. If the decision says stay free, I still keep the portable entrypoint so a later flip stays boring. If it says leave, I move tools first and the model second, because data gravity rarely follows a DNS change.

python -m pip install pyyaml
python score_sheet.py tradeoff_sheet.yaml

Are you moving the model because it is fashionable this month, or because the five rows actually flipped on paper? I re-run the scorer when a write tool appears, not when a blog post declares a new default. Fashion is not a row on the sheet, and I refuse to add it just to feel current.

Where a free model and free server lane fits

I needed a concrete free-side target while writing the sheet, not a slogan about unlimited capacity. A comparison against an imaginary endpoint teaches nothing about credential locality or hop logs you can keep. The free column has to be a real URL I can put behind the same client config.

Disclosure: This article was prepared as part of MonkeyCode's product outreach.

MonkeyCode offers free model access and a free server option, which can stand up the free column without a box on day one. I do not treat that lane as a quota, a hardware spec, or a forever plan, because those claims do not belong here. I treat it as one endpoint I can put behind AGENT_BASE_URL while the five rows are still scoring toward free.

That is the whole product role in this workflow, and I will not stretch it into a capacity story. The sheet still decides, and the portable entrypoint still matters more than the brand on the box. If credential locality or scheduler explainability fails, I keep the tools on a host I route.

When the sheet says no

Skip this approach if the agent can write to production data, mint long-lived credentials, or handle regulated records you cannot put on shared compute. Skip it if you cannot freeze a prompt and a tool stub long enough to compare two endpoints honestly. Skip it if your org already owns quiet capacity beside the tools, because then the idle tax is already paid.

The probes above are local and unlabeled as fleet evidence on purpose, not because I forgot to add charts. They will not certify a vendor, win an argument about tokens, or replace an eval you can replay later. They exist so the free-versus-paid choice stops being a screenshot of a pricing table.

Would I run a customer-facing agent on the free column after a single green lunchtime probe? I would not, and the written sheet is how I keep that answer boring on purpose. I re-score the five rows the moment the agent gains a write tool, and I move before the first incident rather than after it.

If you need a free-model and free-server endpoint to drop into AGENT_BASE_URL while you fill the yaml, MonkeyCode can be that free column. Keep the sheet in the repo either way, because the tradeoff sheet should outlive whichever endpoint you try first. I would rather you copy the yaml into git than copy a vendor diagram into a slide.

Inventory What You Cannot Pin Before You Choose Free Agent Compute

Riley Li — Mon, 21 Sep 2026 13:29:47 +0000

Free shared compute is a good lab bench when overnight drift is cheap to absorb. A pinned box is the better home when next Tuesday's agent run must still match today's trace. I start from that split each time, rather than from a price tag or an idle GPU. Can you name every moving part this agent will still need next week?

A host chosen from an empty queue often fails when a credential, a model identity, or a disk layout moves. I do not treat "is free cheaper than a box I run" as the real question sitting in front of the loop. I ask which parts of the agent loop refuse to be pinned at all, then I choose a host. That question also decides when a slick Friday demo is still only a lab accident.

Overnight drift is the decision, not the invoice

Agent loops are not single HTTP handlers sitting behind a frozen OpenAPI contract you can file away. They stitch a model, a tool surface, a secret boundary, a timeout owner, and a trace sink together in one session. If any of those pieces floats overnight, Friday's success story is a mood rather than evidence you can hand a reviewer. Have you tried replaying last week's failing tool call without guessing the model snapshot that answered?

I use a drift inventory because a cost model lies when the environment itself is the moving target under the agent. Free shared capacity can still be the right first room while the tool surface is changing twice a day. It becomes the wrong room when a reviewer needs a reconstructable failure and was never in the original chat. This whole article is a proposed workflow, not a production study with logos or latency medals.

Build the inventory before you request a host

I write seven fields down before I decide where the loop is allowed to run at all. Each field is pinned, exportable, or floating, and I refuse to mix those three words casually in a standup. Floating is allowed during exploration, and I say that out loud so nobody promotes a mood into a release. Floating is not allowed after a run is treated as a decision record that other people must trust.

The seven fields

Model identity. I ask whether I can name a pin, or whether I am taking whatever answers today.
Runtime and dependencies. I ask whether the same tool runner and lockfile can be reinstalled without folklore.
Tool origin. I ask whether tool calls execute on a network I can describe to another engineer.
Secret boundary. I ask whether API keys ever enter a host that I cannot image or wipe.
Filesystem. I ask whether working trees, caches, and scratch files are objects I can snapshot later.
Timeout and retry owner. I ask who declares a hung tool dead, me or a shared scheduler.
Trace export. I ask whether I leave with JSONL traces and prompts, or only a dashboard screenshot.

If four or more fields are floating, I stay on a free lab bench and I refuse promotion. If four or more fields must be pinned, I want a box I operate or paid isolation I can describe. Mixed scores mean a two-stage path: explore while floating is cheap, then promote only the pinned slice. Does that feel heavier than "just run it somewhere and see"? Agents hide real cost inside the parts you cannot even name.

Run a scorecard instead of arguing in chat

I keep the inventory in YAML so a reviewer can diff it like any other contract checked into git. The helper script below is a proposed checklist, and it does not call a vendor API or invent a benchmark. I also do not treat the integer score as a latency number or as a security control that replaces threat modeling.

# agent_env.yaml — proposed inventory, fill honestly
agent: invoice-triage-loop
stage: explore  # explore | promote
fields:
  model_identity: floating    # pinned | exportable | floating
  runtime_lockfile: pinned
  tool_origin: floating
  secret_boundary: floating
  filesystem: exportable
  timeout_owner: floating
  trace_export: exportable
notes:
  secrets: "provider tokens currently injected by the shared runner"
  traces: "we can download JSONL, not the raw sandbox disk"

#!/usr/bin/env python3
"""drift_score.py — proposed scorecard, not measured production data."""

from __future__ import annotations

import sys
from pathlib import Path

try:
    import yaml
except ImportError:
    print("pip install pyyaml", file=sys.stderr)
    raise

WEIGHTS = {
    "pinned": 0,
    "exportable": 1,
    "floating": 2,
}

PROMOTE_BLOCKERS = {
    "secret_boundary": "floating",
    "model_identity": "floating",
    "trace_export": "floating",
}


def load_inventory(path: Path) -> dict:
    data = yaml.safe_load(path.read_text())
    if "fields" not in data:
        raise ValueError("inventory needs a fields map")
    return data


def score(fields: dict[str, str]) -> tuple[int, list[str]]:
    total = 0
    blockers = []
    for name, state in fields.items():
        if state not in WEIGHTS:
            raise ValueError(f"{name}: unknown state {state!r}")
        total += WEIGHTS[state]
        if PROMOTE_BLOCKERS.get(name) == state:
            blockers.append(name)
    return total, blockers


def recommend(stage: str, total: int, blockers: list[str]) -> str:
    if stage == "promote" and blockers:
        joined = ", ".join(blockers)
        return f"stay off promotion: pin {joined} before leaving the lab bench"
    if total <= 4:
        return "free shared compute is a fit while drift stays cheap"
    if total <= 8:
        return "split the loop: explore free, pin the promote slice elsewhere"
    return "run the loop on a box you can pin and export"


def main() -> None:
    path = Path(sys.argv[1] if len(sys.argv) > 1 else "agent_env.yaml")
    data = load_inventory(path)
    total, blockers = score(data["fields"])
    print(f"agent={data.get('agent')}")
    print(f"stage={data.get('stage')}")
    print(f"drift_score={total} (0=pinned, higher=more overnight risk)")
    print(f"promote_blockers={blockers or 'none'}")
    print(recommend(data.get("stage", "explore"), total, blockers))


if __name__ == "__main__":
    main()

python3 -m pip install pyyaml
python3 drift_score.py agent_env.yaml

I treat a drift score at or under four as permission to remain on free shared capacity for now. I treat any floating secret_boundary as a hard promotion block, even when the rest of the card looks tidy. Would you ship a loop whose keys live on a host you cannot image after a bad run?

Where a free lab bench still wins the comparison

Exploration wants cheap retries, throwaway sandboxes, and models you can try without opening a purchase order first. That is the honest job of free model access paired with a free server option during the explore stage. I use that room to fill the YAML honestly, not to pretend the YAML is already pinned for a reviewer who missed the chat.

Disclosure: This article was prepared as part of MonkeyCode's product outreach.

MonkeyCode is an open-source project with free model access and a free server option that maps onto this explore stage. I mention it because the inventory needs a lab bench, not because a free host pins production secrets for you. If most fields are still floating and the stage is still explore, that lab is a rational place to generate traces you can actually export. I do not claim model names, token quotas, hardware SKUs, or how long any free tier remains available.

Can you live with that uncertainty while the loop is still changing twice a day on purpose? If you can, free compute is doing exactly the job I want from an early lab. If you cannot, you already know you need a pin, and shopping for spare capacity will not create one.

A labeled walkthrough I have not billed as a case study

This walkthrough is a proposed example with fake ticket names, and I am not attaching measured production timings to it. Imagine an invoice-triage agent that calls a PDF parser, a vendor HTTP API, and a local sqlite cache. During week one I let model identity float, I inject the vendor token through the shared runner, and I download JSONL after each session. The scorecard comes back high, blockers include secret_boundary and model_identity, and the only honest recommendation is to remain in explore.

During week two I lock a requirements file, I move the vendor token into a store I operate, and I pin tool origin to a container I build. Floating fields drop on purpose, and only then do I copy the same fixtures onto isolated compute I can describe. Notice what did not need to change between those weeks: the prompts, the expected tool names, and the JSONL schema the lab already exported. The host changed because the inventory changed, not because a coupon expired or a queue looked lonely.

# proposed local pin after the lab stage — replace with your runtime
cp agent_env.yaml pinned_env.yaml
# edit model_identity, secret_boundary, and tool_origin to pinned
python3 drift_score.py pinned_env.yaml

If the promote command still prints blockers, I do not "just try prod" to soothe a demo calendar that wants a green box. I fix the field that refused to be pinned, then I run the scorecard again before anyone changes the stage. Why would a green demo override a floating secret boundary that I already wrote down in YAML?

Explicit tradeoffs I put on the same card

Free shared models and a free server

Free shared capacity fits exploration, prompt drafts, throwaway tools, and traces that leave with me in JSONL. The tradeoff is that model identity and noisy-neighbor timing may float overnight without anyone calling a meeting. I refuse this option when someone must reconstruct a failure for a reviewer who never sat in the original session.

Self-hosted or paid isolated compute

A box I pin fits locked runtimes, secret stores I own, and tool networks I can draw on a whiteboard. The tradeoff is that I now own disk, upgrades, and the pager for hung tool calls after midnight. I refuse this option for loops that still change their tool surface twice a day and cannot sit still long enough to pin.

A split path with portable fixtures

A split path fits most agents that start messy and later need a reconstructable record instead of a chat screenshot. The tradeoff is that fixtures must stay portable, or the split quietly becomes two incompatible products with folklore in the middle. I refuse a split when the lab cannot export traces, because then the isolated box is pinning theater rather than evidence.

I want fixtures to stay boring: JSONL prompts, expected tool names, and timeout budgets that survive a host change without a war story. If the lab cannot export that bundle, free compute is teaching a demo habit I do not trust on Monday. If the isolated box cannot import that bundle, I bought a pin I cannot test when the next incident shows up.

Who should not use this approach

Do not use this inventory as a substitute for threat modeling, license review, or a real secret scanner in CI. Do not use the numeric score as a performance benchmark, because the weights are conversation aids I chose in this draft. Do not run untrusted agent code on a free shared host and then point at YAML as if it were a control plane.

Skip the method if your so-called agent is a stateless function with no tools, no secrets, and no session to reconstruct. A normal unit test is enough in that boring case, and the inventory would only add ceremony around a function. Skip it if you cannot tell the truth inside the YAML, because a lying inventory is worse than an empty file.

I also skip free shared compute when the loop must touch production data, even when the meeting is labeled as a harmless demo for leadership. Drift is not the only risk on the table when an agent can call tools. Access is a different risk, and this scorecard does not pretend to cover production data paths.

Monday morning steps

I write agent_env.yaml before I request a host, including the stage field set to explore.
I run drift_score.py and I read the promote blockers out loud before anyone books a demo.
I generate traces on a free lab bench only while that stage value remains explore.
I export JSONL, lockfiles, and the YAML itself so the next host does not inherit folklore.
I pin secrets, tool origin, and model identity on a box I control before I change the stage.
I re-run the scorecard and I refuse promotion whenever any blocker is still marked floating.

Free versus self-hosted is a function of what you cannot pin, not a personality test about cloud loyalty. I would rather keep an agent in the lab for another week than promote a loop whose environment I cannot name. If you cannot name what will change overnight in your loop, you are not ready to pick a host.

Budget the Agent Loop Before You Choose Shared or Isolated Compute

Riley Li — Sun, 20 Sep 2026 11:29:34 +0000

The cheap lane is the wrong lane whenever a stalled model call can retrigger a write. I treat timeout budget as the first filter, not list price or leftover GPU hours. If you cannot name your p95 stall and your idempotency story, you are not choosing compute. You are gambling on retries.

Have you timed the second tool call, or only the happy-path demo? Shared inference looks generous until a slow token stream collides with a client retry. I wrote this as a decision guide for that collision, not as another invoice spreadsheet. The artifact below is a proposed worksheet you can run locally with your own numbers.

Start with the stall, not the invoice

Agent loops are not single HTTP calls, even when the SDK pretends they are. One user prompt can fan into planning, tool JSON, a side effect, and a second model hop. If hop two waits on hop one, tail latency stops being a quality-of-service footnote. It becomes a correctness bug.

I keep seeing teams promote a playground agent because the median answer looked fine on a quiet afternoon. Did the write path survive an eight second pause? Did the webhook client retry while the first attempt was still committing? Those questions decide the host. Price does not.

This article stays adjacent to the current noise about tests that no longer bound model behavior. I am not chasing a headline about models outgrowing benchmarks. I am asking a smaller, meaner question: can your loop absorb variance without double-sending money, mail, or deploys?

Why agent loops punish shared inference

Shared free inference is usually fine for read-only drafting. It gets hostile when three properties stack. First, the model call has a fat tail you do not control. Second, your client retries on timeout because that is what HTTP libraries do. Third, a tool actually mutates something outside the chat transcript.

Put those together and you do not have a slow chatbot. You have an amplifier. A single stalled generation can mint two tickets, two refunds, or two terraform apply runs. Would you accept that amplifier on a noisy neighbor queue you cannot drain?

I score that stack before I score dollars. Isolated or self-hosted compute does not magically make models smarter. It gives you a place to set hard deadlines, pin a revision, and kill a worker without begging a shared scheduler. That is the trade I actually care about.

Three lanes, one timeout question

I use three lanes only. Lane A is a free shared model plus a free shared server, useful as a scratch harness. Lane B is paid isolated inference with a contract you can page. Lane C is a box you operate, including a local runtime or a rented GPU you can ssh into. MonkeyCode sits in lane A for this worksheet because it currently offers free model access and a free server option.

Disclosure: This article was prepared as part of MonkeyCode's product outreach.

I do not treat lane A as production just because the form is empty. I treat it as a measurement bench. Can I replay a failing prompt? Can I export the trace? Can I bound the wait so a tool cannot fire twice? If the answers stay no, I refuse to promote the agent, even when the output reads fluent.

Lane B and lane C buy different kinds of control, not the same kind. Isolated paid compute usually buys queue isolation and a support path. Self-hosted compute buys process death, disk, and network policy. Which control do you actually need when the model stalls? That is the comparison, not a loyalty test.

A numbered measurement workflow

Run this before you bind secrets or webhooks to any lane. Label every number as an input you measured, not a vendor promise. I want the worksheet to survive if you never mention a product name again.

Draw the loop on paper, including every tool that can create, update, or charge. If a step only reads, mark it R. If it writes, mark it W and name the idempotency key. No key means no shared lane.
Capture three timings on the same prompt: first token, full completion, and tool round trip. Record p50 and a crude p95 from at least twenty local runs. Do not invent a benchmark you did not run.
Write the client timeout next to the p95. If timeout is lower than p95, you already own a retry bug. Raise the deadline or make the write idempotent before you shop for hosts.
Inject a stall. Sleep in a fake tool, or drop packets with a local proxy. Watch whether the orchestrator double-fires the W step. That single observation outranks any pricing page.
Score the three lanes with the matrix below. Promote only when the write path stays single-shot under the stall you actually injected.

Need a command-shaped starting point for step four? Keep the stall on your laptop.

python3 loop_budget.py \
  --p95-ms 4200 \
  --client-timeout-ms 3000 \
  --write-steps 2 \
  --idempotent false \
  --can-kill-worker false \
  --need-trace-export true

If that command recommends isolation, believe the timeout math. Do not argue with a marketing page until the retry story is boring.

Artifact: budget calculator and decision matrix

The script is a proposal, not a load test of any vendor. Feed your measurements. It prints a lane and the rule that fired. Change the inputs when your agent changes shape.

#!/usr/bin/env python3
"""loop_budget.py — proposed scoring sheet, not a benchmark of any host."""
from __future__ import annotations

import argparse
from dataclasses import dataclass


@dataclass
class LoopFacts:
    p95_ms: int
    client_timeout_ms: int
    write_steps: int
    idempotent: bool
    can_kill_worker: bool
    need_trace_export: bool


def retry_overlap(facts: LoopFacts) -> bool:
    return facts.client_timeout_ms < facts.p95_ms and facts.write_steps > 0


def recommend(facts: LoopFacts) -> tuple[str, str]:
    if facts.write_steps == 0 and not facts.need_trace_export:
        return (
            "lane-A-shared-free",
            "Read-only loop with no trace mandate; shared inference is a fair scratch pad.",
        )
    if retry_overlap(facts) and not facts.idempotent:
        return (
            "lane-C-self-hosted",
            "Timeout sits under p95 and writes are not idempotent; you need a killable worker.",
        )
    if facts.write_steps > 0 and not facts.idempotent:
        return (
            "lane-B-isolated-paid",
            "Writes exist without keys; isolate the queue before a neighbor stall doubles a side effect.",
        )
    if facts.need_trace_export and not facts.can_kill_worker:
        return (
            "lane-B-isolated-paid",
            "You need exportable traces more than process death; buy a contract you can audit.",
        )
    if facts.can_kill_worker and retry_overlap(facts):
        return (
            "lane-C-self-hosted",
            "You already require worker death during overlap; keep the runtime on a box you control.",
        )
    return (
        "lane-A-shared-free",
        "Writes look idempotent and timeout covers p95; shared free compute can host the rehearsal.",
    )


def main() -> None:
    parser = argparse.ArgumentParser()
    parser.add_argument("--p95-ms", type=int, required=True)
    parser.add_argument("--client-timeout-ms", type=int, required=True)
    parser.add_argument("--write-steps", type=int, required=True)
    parser.add_argument("--idempotent", type=lambda v: v.lower() == "true")
    parser.add_argument("--can-kill-worker", type=lambda v: v.lower() == "true")
    parser.add_argument("--need-trace-export", type=lambda v: v.lower() == "true")
    args = parser.parse_args()
    facts = LoopFacts(
        p95_ms=args.p95_ms,
        client_timeout_ms=args.client_timeout_ms,
        write_steps=args.write_steps,
        idempotent=args.idempotent,
        can_kill_worker=args.can_kill_worker,
        need_trace_export=args.need_trace_export,
    )
    lane, reason = recommend(facts)
    overlap = retry_overlap(facts)
    print(f"retry_overlap={overlap}")
    print(f"lane={lane}")
    print(f"reason={reason}")


if __name__ == "__main__":
    main()

Use the matrix as a human check after the script. I still want a person to read the W column. Scripts miss product language that looks read-only and is not.

Signal you measured	Prefer shared free lane	Prefer isolated paid	Prefer self-hosted
Tools are `R` only	Yes, as a rehearsal bench	Only if you must pin a vendor SLA	Rarely worth the ops load
Timeout < p95, writes lack keys	No	Temporary, if you can pause traffic	Yes, so you can kill in-flight workers
Need exportable traces	Only if the host actually emits them	Yes, when audit is the product	Yes, when traces must never leave your disk
Secrets in the prompt or env	No	Maybe, with scoped keys	Yes, with local secret injection
You cannot name a rollback	No	No	No — fix the agent first

Notice the last row. If rollback is a shrug, no lane is honest. Compute choice cannot repair a tool that charges twice.

What this method refuses to promise

I am not publishing model names, token quotas, hardware SKUs, or durability claims I cannot verify. Free lanes change. Treat availability as a snapshot you re-check on the vendor's own page before you schedule a demo. This worksheet does not rank answer quality, and it does not prove that isolated compute is faster.

The Python file will happily recommend lane A if you feed it optimistic timings. Garbage in stays garbage. If you skipped the stall injection, you did not run the method. You filled a form.

Shared free compute also fails closed for regulated transcripts, customer secrets, and anything that must not train a neighbor's curiosity. I will not soften that. A timeout budget can be healthy and the data-handling story can still be disqualifying.

Who should skip this

Skip the three-lane sheet if you ship no tools and no side effects. A single-shot summarizer does not need this ceremony. Skip it if you already run a locked internal gateway with deadlines you enforce. You are past the question.

Skip it if you wanted a cost-break-even spreadsheet or a blast-radius score. Those are different filters, and I am not recycling them here. This pass only asks whether a stall can duplicate a write. That is enough work for one sitting.

If you still need a throwaway harness after the writes are idempotent, a free shared option such as MonkeyCode's free models and free server can host the rehearsal loop. Keep production traffic off that lane until the script and the matrix agree you can survive a stall. Then choose isolation because the retry story is settled, not because a leftover GPU looked lonely.

Score the Host Before You Promote a Vibe-Coded Agent

Riley Li — Sat, 19 Sep 2026 09:34:32 +0000

A green chat is not a merge signal, because the host can hide the failure you actually care about. I treat vibe-coded agent work as a draft until the eval host can fail closed, not until the wording looks finished. Free shared inference is useful for that draft, and a box I control is useful when the draft pretends to be engineering. If those two hosts score the same in your notes, are you scoring the demo or the risk?

This is a decision guide, not a pricing rant, and not a prompt-tuning diary. I keep seeing fluent agent traces get pasted into pull requests with no record of where they ran. The interesting question is not whether the model sounded confident. The interesting question is whether your compute choice can still prove a miss after the chat window is gone.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. I mention MonkeyCode later only as one free-model and free-server option for the draft loop, not as a substitute for the scorecard.

The failure I am trying to prevent

Vibe coding is a fast way to sketch tool calls, retries, and glue code you would not type by hand. Calling that sketch engineering is how false-green tests sneak into main. Have you ever watched an agent pass a demo because the golden answer sat in the same prompt pack as the task? That is not intelligence. That is leakage with good manners.

Shared free runtimes make that leakage cheaper to produce, which is fine while you are still exploring. Isolated or paid runtimes make the same leakage more expensive, which is only worth it when a miss ships. I do not pick a host by leftover GPU time. I pick a host by whether a failed promotion can still be reconstructed tomorrow.

Five questions before the host gets a vote

I score every agent spike with the same five questions, in this order, before I argue about cost. If you cannot answer them from artifacts, the chat log does not count.

Can a reviewer replay the eval suite without reading the original chat?
Does the prompt pack hash differ from the eval-suite hash on disk?
Are tool credentials and network egress denied unless the host is a box you control?
Will a failed run leave a structured trace, or only a screenshot of a happy path?
If the model changes under you, can you freeze the comparison or must you shrug?

If questions 1 and 2 fail, I stay on a free exploratory loop and I refuse to merge. If questions 3 or 4 fail, I will not put secrets, production tools, or customer data on shared compute. If question 5 fails, I treat any “it works” claim as time-boxed, even when the prose looks senior.

A numbered workflow I actually run

I keep the workflow boring on purpose, because excitement is how demos skip gates. You can copy the steps without adopting my tooling, and you should label every unchecked box as unknown rather than true.

Write the task and the eval fixtures in two files, then refuse to paste fixtures into the system prompt.
Hash both files before the first agent call, and store the hashes next to the run id.
Run the draft on free shared models only if the tools are stubs and the data is synthetic.
Score the host with the table below, then promote to a self-hosted or paid box when any isolation row trips.
Re-run the same fixtures on the new host, and compare traces, not vibes.
Merge only when a stranger can fail the suite without sitting in your original session.

Would I skip step 3 to go faster? Sometimes, when the spike is a throwaway. Would I skip step 6 because the chat felt done? That is the whole bug this article is about.

Artifact: a demo-to-merge scorecard

The following script is a proposal you can run locally. It does not benchmark models, and it does not prove production safety. It fails closed when hashes collide, when isolation is required, or when the host kind is still unknown.

#!/usr/bin/env python3
"""Demo-to-merge scorecard. Proposal: treat unknown fields as fail."""
from __future__ import annotations

import hashlib
import json
from pathlib import Path

ISOLATING_TOOLS = {"shell", "browser", "payments", "prod_db", "secret_store"}


def sha256_file(path: Path) -> str:
    return hashlib.sha256(path.read_bytes()).hexdigest()


def score_run(
    prompt_pack: Path,
    eval_suite: Path,
    host_kind: str,
    tools: list[str],
    has_structured_trace: bool,
    can_freeze_model: bool,
) -> dict:
    prompt_hash = sha256_file(prompt_pack)
    eval_hash = sha256_file(eval_suite)
    needs_isolation = any(t in ISOLATING_TOOLS for t in tools)
    host = host_kind.lower().strip()

    checks = {
        "eval_outside_prompt": prompt_hash != eval_hash,
        "host_declared": host in {"free_shared", "self_hosted", "paid_isolated"},
        "isolation_matches_tools": (not needs_isolation) or host != "free_shared",
        "structured_trace": has_structured_trace,
        "model_can_be_frozen": can_freeze_model or host != "free_shared",
    }
    promote = all(checks.values()) and host != "free_shared"
    stay_draft = host == "free_shared" and checks["eval_outside_prompt"] and not needs_isolation
    return {
        "prompt_hash": prompt_hash,
        "eval_hash": eval_hash,
        "checks": checks,
        "decision": "promote" if promote else ("keep_draft" if stay_draft else "fail_closed"),
    }


if __name__ == "__main__":
    result = score_run(
        prompt_pack=Path("prompt_pack.txt"),
        eval_suite=Path("eval_suite.json"),
        host_kind="free_shared",
        tools=["retriever_stub"],
        has_structured_trace=True,
        can_freeze_model=False,
    )
    print(json.dumps(result, indent=2))

Create two tiny fixtures so the script is reproducible on a laptop. I keep them obviously fake, because a realistic customer dump would already fail the isolation row.

printf 'You are a summarizer. Never read eval_suite.json.\n' > prompt_pack.txt
printf '%s\n' '{"cases":[{"id":"t1","expect":"ok"}]}' > eval_suite.json
python3 scorecard.py

If you change tools to "shell" and leave host_kind as free_shared, the decision should become fail_closed. If both files contain the same bytes, it should also fail, even when the chat still looks clever. That is the point of hashing before arguing about prompts.

Tradeoffs I write down, not vibes I remember

I use this table when a teammate wants to stay on free shared compute because the demo already “works.” Working in a chat is one column. Promoting is another column. If you cannot fill a cell, the cell is a no.

Decision axis	Free shared models / free server	Self-hosted or paid isolated box
Fit	Synthetic data, stub tools, throwaway spikes	Secrets, egress, production tools, merge candidates
Speed to first trace	Usually faster to start	Slower until images, queues, and IAM exist
Eval honesty	Easy to contaminate the prompt pack	Easier to keep fixtures off the model path
Drift	Model and neighbor load can move under you	You can freeze runtime and often the weights
Failure evidence	May be a scrollback window	Can be files, metrics, and access logs
Cost shape	Cash is low; review time is not free	Cash is higher; incident cost should be lower
Wrong fit	Shipping a vibe as a contract	Isolating a spike that should have stayed a sketch

Notice that “free” only wins the cash row. Review time, incident time, and contaminated evals are still costs. Are you optimizing the invoice, or the chance that a false green reaches main?

MonkeyCode is an open-source project with free model access and a free server option, which I use only for the draft side of that table. I do not treat those free options as unlimited, permanent, or equivalent to a box I own. If the scorecard returns keep_draft, a free loop is enough. If it returns fail_closed or you want promote, move the same fixtures onto compute you can isolate.

What this method refuses to claim

This scorecard does not name models, quote throughput, or promise that any vendor will keep a free tier. It does not replace security review, license review, or load tests. Hash collision resistance here is about accidental copy-paste, not about an adversary. A structured trace can still lie if you log the wrong fields.

I also do not claim that self-hosting makes vibe-coded agents honest. Isolation only preserves the evidence. You still have to write evals that the agent cannot see. If your suite is three happy-path strings, both hosts will flatter you.

Who should not use this approach

Skip this if you are pasting secrets into a shared chat to “just try something.” Skip it if your agent already drives production tools, because the draft column is already the wrong column. Skip it if you need a cost-optimization spreadsheet rather than a promotion gate. Skip it if nobody on the team will store hashes and traces; a scorecard nobody runs is fan fiction.

Students and weekend spikes can stay on free shared inference for a long time, and they should. Teams that merge agent output into services should not. Which group are you in when the demo looks good at 5 p.m.?

A closing check I use on my own drafts

Before I call a vibe-coded agent “done,” I ask whether a reviewer can fail it without me in the room. If the answer depends on a shared session, I keep the work on a free exploratory loop and I do not promote it. If the answer depends on tools or data I cannot expose, I move the same fixtures to isolated compute and I run the scorecard again. The host is part of the test. Pretending otherwise is how engineering gets renamed after the fact.

If you want a draft-side place to run that loop, try MonkeyCode’s free model access and free server option on synthetic fixtures only, then promote with evidence instead of a fluent screenshot.

Choose Agent Compute by Replayable Evals, Not by Spare Capacity

Riley Li — Fri, 18 Sep 2026 07:57:01 +0000

I treat agent compute as a measurement problem first, and only then as a hosting or budget debate. If two runtimes cannot execute the same eval harness and emit a comparable ledger, I do not have a real choice. I have a one-way experiment between free shared capacity and a box I control, and I cannot score it later. Have you ever moved an agent onto unpaid capacity and then argued whether the model slipped or a tool call vanished?

Why spare capacity is not a decision yet

Cost spreadsheets hide the failure mode that quietly burns the most calendar time on a team. I cannot tell whether a runtime is cheaper if I cannot tell whether it still runs the same job. Self-hosted boxes give me process control, local disk, and a fingerprint I can store beside the output. Free shared options give me a lab I did not provision, which is useful only if the eval still means something.

The public conversation around generated code keeps circling whether the work still counts as engineering, and I will not join that slogan fight. I care about a narrower question that I can test in an afternoon without a research budget. Can I replay a frozen task suite on two runtimes and explain the diff without guessing at hidden wrappers? If I cannot, I am not choosing compute in any honest sense, and I am only collecting anecdotes.

Five checks I score before I pick a runtime

I keep the scoring boring on purpose, because boring is the only quality that stays replayable next week. Each candidate gets a yes, a no, or a not-yet against the same five checks I refuse to customize mid-argument. I do not let a price tag break a tie until those cells are filled with something I could show a teammate. If a vendor story cannot survive this worksheet, I treat it as a demo environment, not as a factory.

Pin. Can I freeze prompts, tools, fixtures, and expected side effects in git before anyone touches a new host?
Fingerprint. Can I record runtime identity, an image digest, or at least a hostname, clock, and tool versions beside every row?
Replay. Can I re-run the same suite after a queue delay, a host recycle, or a quiet weekend without rewriting prompts?
Ledger. Can I keep JSONL rows on disk I own if the free path pauses, throttles, or reroutes the next session?
Diff. Can a teammate read two rows and tell a real regression from timestamp noise, shuffled ids, or wrapper chatter?

Here is the decision table I actually fill. I treat it as a proposed worksheet, not as a benchmark I already ran against a production fleet.

Check	Box I control	Free shared lab	What a no means in practice
Pin	Yes if the repo is the only source of truth	Yes only if I carry the suite with me	You are demoing, not evaluating
Fingerprint	Yes, digest plus hostname	Often partial, sometimes missing	You cannot explain a Tuesday incident
Replay	Yes, until I delete the box	Maybe, if the queue still admits me	Last week's score is folklore
Ledger	Yes, local disk I own	Yes only if I copy rows off-box immediately	The evidence evaporates with the session
Diff	Yes, same harness both times	Yes only after I normalize ids and clocks	You will argue about the model instead of the trace

Notice that the table refuses to score marketing language, idle GPU screenshots, or how generous a free tier sounded in a launch thread. I score whether tomorrow-me can replay today-me without writing fan fiction about the runtime. Would you ship a database migration without a rollback plan, then still ship a runtime migration without a ledger you can grep?

A workflow I can finish in one sitting

I run this as a checklist, not as a research program, because the point is a comparable artifact. Nobody on my team is allowed to fall in love with unpaid capacity before the ledger exists. The steps are deliberately small so I cannot hide behind a two-week evaluation project.

Freeze a golden set of eight to twelve tasks that already failed in interesting ways, not only the happy path that flatters every host.
Hash every prompt, tool schema, and fixture so a silent file edit cannot hide inside a story about the model getting worse.
Run the suite once on a box I control, even if that box is a laptop, and write JSONL onto disk that I actually own.
Run the same suite on the free shared option without editing prompts, then copy the ledger off that host before I close the session.
Diff hashes, exit codes, and tool-call shapes before I look at latency, because latency lies when queues stall.
Label the free path as lab, factory, or reject: lab means explore, factory means keep for chores, reject means I still need isolation.

I do not always need twelve tasks, but I do need enough cases that a single lucky completion cannot flatter a runtime into a strategy slide. Have you noticed how one green demo becomes next quarter's default host before anyone stores a prompt hash? That is why the ledger stays small, mean, and checked into git beside the agent.

The artifact: a proposed replay ledger

The script below is a proposed local harness. I am not reporting production timings, and I am not claiming a bake-off against any hosted model catalog. It writes one JSONL row per task so I can diff two runtimes with ordinary Unix tools, which is the whole scientific instrument I need.

#!/usr/bin/env python3
"""replay_ledger.py — proposed harness, not a published benchmark."""
from __future__ import annotations

import hashlib
import json
import os
import platform
import subprocess
import sys
import time
from pathlib import Path

GOLDEN = [
    {
        "id": "t01_hash_prompt",
        "prompt": "Return only the integer 42.",
        "expect_substr": "42",
    },
    {
        "id": "t02_tool_shape",
        "prompt": "Call echo with argument ping and return stdout.",
        "expect_substr": "ping",
    },
    {
        "id": "t03_refuse_network",
        "prompt": "Do not open sockets. Reply with the word isolated.",
        "expect_substr": "isolated",
    },
]


def sha256_text(value: str) -> str:
    return hashlib.sha256(value.encode("utf-8")).hexdigest()[:16]


def fingerprint() -> dict:
    return {
        "runtime_id": os.environ.get("RUNTIME_ID", "unlabeled"),
        "host": platform.node(),
        "python": sys.version.split()[0],
        "cwd": str(Path.cwd()),
    }


def run_task(prompt: str) -> dict:
    """Replace this stub with your agent CLI. Keep the ledger shape stable."""
    started = time.time()
    # Proposed stand-in: echo the prompt so the workflow is runnable without a vendor SDK.
    completed = subprocess.run(
        ["python3", "-c", "import sys; print(sys.argv[1])", prompt],
        check=False,
        capture_output=True,
        text=True,
    )
    output = (completed.stdout or "").strip()
    return {
        "exit_code": completed.returncode,
        "output": output,
        "output_hash": sha256_text(output),
        "latency_ms": int((time.time() - started) * 1000),
        "stderr_hash": sha256_text(completed.stderr or ""),
    }


def main() -> None:
    out_path = Path(os.environ.get("LEDGER_PATH", "replay_ledger.jsonl"))
    fp = fingerprint()
    with out_path.open("a", encoding="utf-8") as handle:
        for task in GOLDEN:
            row = {
                **fp,
                "task_id": task["id"],
                "prompt_hash": sha256_text(task["prompt"]),
                "passed": False,
            }
            result = run_task(task["prompt"])
            row.update(result)
            row["passed"] = task["expect_substr"].lower() in result["output"].lower()
            handle.write(json.dumps(row, sort_keys=True) + "\n")
    print(f"wrote {out_path}")


if __name__ == "__main__":
    main()

I compile it first, then I run it twice with different RUNTIME_ID values, and only then I diff the rows. If I skip the compile step, I am not measuring agents. I am measuring a syntax error I created myself.

python3 -m py_compile replay_ledger.py
RUNTIME_ID=box-local LEDGER_PATH=ledger-local.jsonl python3 replay_ledger.py
RUNTIME_ID=free-lab LEDGER_PATH=ledger-free.jsonl python3 replay_ledger.py
python3 - <<'PY'
import json
from pathlib import Path

def load(path):
    rows = [json.loads(line) for line in Path(path).read_text().splitlines() if line]
    return {row["task_id"]: row for row in rows}

local = load("ledger-local.jsonl")
free = load("ledger-free.jsonl")
for task_id in local:
    a, b = local[task_id], free[task_id]
    print(task_id, {
        "pass_local": a["passed"],
        "pass_free": b["passed"],
        "out_match": a["output_hash"] == b["output_hash"],
        "exit_match": a["exit_code"] == b["exit_code"],
    })
PY

If out_match is false while prompt_hash is equal, I do not shrug and say the free path is just stochastic. I open the two outputs and I ask whether a tool policy, a wrapper, or a truncated context changed the job. Stochastic noise is a hypothesis I have to earn with more than one seed, not a blanket excuse for a messy ledger. Does that extra hour feel slow when a free queue is already waiting? It is still faster than a week of it worked on my shared host.

Where a free model lab belongs in this score

I still want a lab that I can enter without provisioning hardware first, especially when I am only trying to see whether a task suite is even worth isolating. Disclosure: This article was prepared as part of MonkeyCode's product outreach. I treat MonkeyCode as an open-source project with free model access and a free server option. Those two sit in the free shared lab column of the table above, not in a special unmeasured column. I score that column with the same ledger I would use on a laptop, a rented VM, or any other unpaid queue.

I do not need a model catalog pitch to use the method, and I will not invent quotas, hardware, or bake-off numbers to dress it up. If the free path reproduces hashes and tool shapes, I keep exploration there and I stop paying for idle capacity I do not yet need. If the free path cannot fingerprint, cannot replay on Monday, or cannot let me copy JSONL off the box, I keep the factory on machines I control. Would I put a customer-facing agent on the first green lab run just because the queue was free? I would not, and I would wait until the ledger stays boring across a replay.

Limitations, and who should not use this

This workflow is the wrong tool if you do not have any frozen tasks yet, because you will measure theater instead of regressions. It is also the wrong tool if your agent must keep secrets on disk you do not control, even when the eval looks cheap on paper. Teams that need deterministic, audited, or air-gapped runs should start on isolated hosts and should not wait for a free queue to become a compliance story after the fact.

The harness above is a stub on purpose. It does not measure token quality, multi-hour jobs, GPU placement, or vendor quotas, and I will not invent those figures to look more empirical than I am. Stochastic generators can disagree without either runtime being broken, so a single mismatch is a clue I have to investigate, not a court verdict I can paste into Slack. If your golden set only contains tasks the model already likes, the ledger will flatter every host you try and teach you nothing.

I also skip this ceremony for throwaway spikes that die the same afternoon, because a replay ledger earns its keep only when someone will ask next week why the agent changed. If nobody will ask, I am not choosing a runtime in any serious way. I am doodling, and doodling does not need a decision guide.

What I decide after the rows exist

I read the table from the bottom, because Diff is the only check a future incident review will actually care about. If Diff is a no, I do not care that the lab was free, because I cannot defend the change to a teammate who was not in the room. If Replay and Ledger are yes, and the hashes mostly match, I am willing to keep the free path as a lab and even as a low-risk factory for internal chores. If Fingerprint is a no, I keep using the lab for drafts, and I refuse to let it become the system of record for anything I will have to explain.

That is the decision guide I actually want when the timeline is full of AI commentary and empty of comparable runs. Spare capacity is a rumor until the eval replays, and the ledger is the argument I can bring to a teammate without raising my voice. What would your current free queue look like if you scored it this way tonight, with hashes instead of vibes?