DEV Community: Avery Lin

Give the Agent a Curfew

Avery Lin — Wed, 23 Sep 2026 16:23:12 +0000

A solo founder stares at a half-finished webhook on Friday night. Three angry customer mails already sit in the inbox. Sleep can wait, but a cloud invoice cannot.

The founder pastes the repo into a coding agent and leaves. Morning returns a hot laptop and a surprise cloud bill. The agent had retried one flaky tool for six hours.

The webhook still failed after all that wasted heat. This night is a systems problem, not a prompt problem. Weekend shipping dies when the host has no curfew.

The model never truly calls an HTTP API. It emits a structured object with a name and arguments. A local host parses that object and chooses whether to run it.

Product demos hide that handoff behind a friendly chat bubble. Indie work cannot afford that particular kind of hiding. The host is the lock on the door.

Think of the model as a junior contractor with a temporary keycard. The keycard must expire at midnight without any debate. The building should keep few doors and one lobby camera.

Weekend agents need a written allowlist the host can refuse. They also need a dry run that never touches the public network. They finally need a wall-clock curfew that kills the process.

The allowlist comes before any prompt

A clever system prompt will not save a tired Friday. The founder should start with a file the host understands. Missing names become denials, and that silence is the feature.

Label the next block as example config, not production truth.

{
  "agent": "weekend-webhook",
  "timezone": "local",
  "curfew": {
    "max_wall_seconds": 1200,
    "max_tool_calls": 40,
    "max_retries_per_tool": 2
  },
  "tools": [
    {
      "name": "read_file",
      "args": ["path"],
      "network": false,
      "max_calls": 20
    },
    {
      "name": "run_tests",
      "args": ["suite"],
      "network": false,
      "max_calls": 8
    },
    {
      "name": "http_get",
      "args": ["url"],
      "network": true,
      "url_prefix": "https://staging.example.test/",
      "max_calls": 6
    }
  ]
}

The production deploy tool is missing on purpose here. The refund tool is missing on purpose here. Staging GET remains the only network door in the file.

A missing tool is a denied tool on this host. The agent can argue in prose all night long. The JSON file does not argue back at all.

What the host actually receives

Most coding models speak a small JSON dialect for tools. The payload carries a name string and an arguments object. A call identifier sometimes rides along for the next turn.

The host must treat that payload as untrusted input every time. String names can hide paths, shells, or surprise verbs. Arguments can nest until a naive runner finally explodes.

A strict host decodes with a size cap and a known schema. It rejects extra fields rather than forwarding them onward. It never interpolates arguments into a shell string.

# parse_call.py — example parser, not executed here
import json

MAX_CALL_BYTES = 4096

class CurfewError(RuntimeError):
    pass

def parse_call(raw: str):
    if len(raw.encode("utf-8")) > MAX_CALL_BYTES:
        raise CurfewError("call too large")
    data = json.loads(raw)
    if set(data.keys()) - {"name", "args"}:
        raise CurfewError("unexpected fields")
    if not isinstance(data.get("name"), str):
        raise CurfewError("bad name")
    if not isinstance(data.get("args", {}), dict):
        raise CurfewError("bad args")
    return data

That parser is not clever and should remain that way. Clever parsers become the incident well after midnight. Boring parsers keep Friday night small and finite.

Customs at a tiny airport beats a speech about trust. Every incoming bag gets opened on the table. Extra pockets fail the check without appeal.

Dry-run the host, never the wallet

The next artifact is a tiny Python host for local rehearsal. It counts every attempted call against the published envelopes. Network tools return a skip record while dry-run stays true.

Label this sample as an unexecuted example harness.

# dry_run_host.py — example harness, not a product
import json, time, sys
from pathlib import Path

ALLOW = json.loads(Path("tools.allow.json").read_text())
counts = {}
started = time.monotonic()
MAX_CALL_BYTES = 4096

class CurfewError(RuntimeError):
    pass

def parse_call(raw: str):
    if len(raw.encode("utf-8")) > MAX_CALL_BYTES:
        raise CurfewError("call too large")
    data = json.loads(raw)
    extra = set(data.keys()) - {"name", "args"}
    if extra:
        raise CurfewError("unexpected fields")
    if not isinstance(data.get("name"), str):
        raise CurfewError("bad name")
    if not isinstance(data.get("args", {}), dict):
        raise CurfewError("bad args")
    return data

def check_curfew():
    elapsed = time.monotonic() - started
    if elapsed > ALLOW["curfew"]["max_wall_seconds"]:
        raise CurfewError("wall clock expired")
    if sum(counts.values()) >= ALLOW["curfew"]["max_tool_calls"]:
        raise CurfewError("call envelope empty")

def find_tool(name):
    for tool in ALLOW["tools"]:
        if tool["name"] == name:
            return tool
    return None

def handle(call, dry_run=True):
    check_curfew()
    tool = find_tool(call["name"])
    if tool is None:
        raise CurfewError(f"denied tool: {call['name']}")
    used = counts.get(tool["name"], 0)
    if used >= tool["max_calls"]:
        raise CurfewError(f"tool envelope empty: {tool['name']}")
    counts[tool["name"]] = used + 1
    url_prefix = tool.get("url_prefix")
    if url_prefix:
        url = call.get("args", {}).get("url", "")
        if not str(url).startswith(url_prefix):
            raise CurfewError("url outside prefix")
    if dry_run and tool.get("network"):
        return {"ok": True, "dry_run": True, "skipped": call}
    return {"ok": True, "dry_run": dry_run, "echo": call}

if __name__ == "__main__":
    try:
        call = parse_call(sys.stdin.read())
        print(json.dumps(handle(call, dry_run=True)))
    except CurfewError as exc:
        print(json.dumps({"ok": False, "error": str(exc)}))
        sys.exit(2)

The host fails closed on unknown names and empty envelopes. Network tools in dry-run still spend the numbered envelope. Rehearsal that does not spend budget will hide retry loops.

Prove the gate with a command before any chat window opens. Type the denial cases in a real shell. Do this before the first long prompt.

echo '{"name":"stripe_refund","args":{"id":"re_123"}}' | python dry_run_host.py
# expected stderr-free JSON, exit 2, error denied tool: stripe_refund

echo '{"name":"http_get","args":{"url":"https://evil.example/"}}' | python dry_run_host.py
# expected exit 2, error url outside prefix

echo '{"name":"http_get","args":{"url":"https://staging.example.test/health"}}' | python dry_run_host.py
# expected exit 0, skipped http_get, dry_run true

The refund name never appears in the allowlist file. The evil URL fails the prefix check even during dry-run. Both exits should be two, not zero.

Tests the chat window cannot charm

Indie founders skip tests when the clock hits midnight. That is exactly when the agent needs a test. Ten lines can pin the boundary without a rented GPU.

# test_curfew.py — example, unexecuted in this article
import json, subprocess

def run(call):
    proc = subprocess.run(
        ["python", "dry_run_host.py"],
        input=json.dumps(call),
        text=True, capture_output=True,
    )
    return proc.returncode, json.loads(proc.stdout)

def test_unknown_tool_is_denied():
    code, body = run({"name": "ship_prod", "args": {}})
    assert code == 2
    assert "denied" in body["error"]

def test_staging_get_is_skipped_in_dry_run():
    code, body = run({
        "name": "http_get",
        "args": {"url": "https://staging.example.test/health"},
    })
    assert code == 0
    assert body["skipped"]["name"] == "http_get"

def test_foreign_host_fails_prefix():
    code, body = run({
        "name": "http_get",
        "args": {"url": "https://evil.example/"},
    })
    assert code == 2
    assert "prefix" in body["error"]

Run it like any other unit file in the repo. Green means the host still refuses stranger names. Red means the Friday host already drifted.

python -m pytest test_curfew.py -q

The prompt can change every hour without ceremony. The allowlist should not change without a failing test. The test is memory the model does not keep.

A wall clock the process must obey

Allowlists stop the wrong door from opening tonight. They do not stop a long and confused night. The agent still needs a process-level timer around the loop.

# curfew.sh — example supervisor, not executed here
set -euo pipefail
export PYTHONUNBUFFERED=1
/usr/bin/timeout --kill-after=10s 1200s python agent_loop.py \
  --allow tools.allow.json \
  --dry-run \
  --max-calls 40
echo "agent stopped with $?"

Twelve hundred seconds equal twenty focused minutes of work. That window can edit a stubborn webhook and run tests. It cannot cook the laptop until Saturday dawn.

The kill-after flag handles a frozen child process cleanly. The numeric exit code becomes the whole morning report. Humans should read four lines, not a novel.

When the laptop must close, the same script belongs elsewhere. A disposable remote box can run the curfew while sleep happens. That box must not hold production secrets or customer exports.

MonkeyCode provides free model access and a free server option. Disclosure: This article was prepared as part of MonkeyCode's product outreach. A throwaway staging repo is enough to try the bounded run.

A sketch of the loop

The loop itself should stay as dull as the parser. It asks the model for a proposal, then asks the host. The host return value becomes the next observation.

# agent_loop.py — sketch, not executed here
def loop(model, host):
    observation = {"task": "fix staging webhook tests"}
    for _ in range(40):
        proposal = model.propose(observation)  # untrusted text
        result = host.handle(parse_call(proposal), dry_run=True)
        if not result.get("ok", True):
            return result
        observation = result
    return {"ok": False, "error": "envelope empty"}

Forty turns is not some personality trait. It is the call envelope from the allowlist. When the envelope empties, the process is done.

Live flags stay outside the agent's reach

Dry-run does not prove TLS, auth, or pagination behavior. A skipped call never exercises the real client path. Flip a live flag only after one recorded staging request.

Keep that recording in git beside the allowlist file. Keep the live flag in a file the agent cannot write. The host should refuse tools that can move customer money.

This remains a weekend fence, not a bank control plane. Fancy multi-agent planners can wait for a calmer Monday. A curfew is enough to ship a webhook tonight.

Who should not copy this fence

This workflow is for a solo founder on staging traffic. It is not a HIPAA boundary or a money-movement control. It is not a substitute for a second human review.

Free models drift from one night to the next without notice. The same prompt may emit a brand new tool name tomorrow. The allowlist must fail closed when that happens.

Free servers also sleep, throttle, or vanish without a contract. Do not park customer data on a box that can disappear. Do not treat complimentary uptime as an operations promise.

If the product can move money, this host is too small. Put a human in that loop before any refund tool exists. Give the agent a service account that cannot see billing.

Saturday morning, four lines

Shipping tonight means a failing webhook test now passes. It does not mean the agent gained root on production. It does not mean support mail became an unsupervised loop.

A useful morning log holds four dull lines and then stops. It shows wall time, tool counts, denials, and the diff stat. Anything beyond that is noise around a simple fence.

wall_seconds=842
tool_counts={"read_file":11,"run_tests":4,"http_get":2}
denials=["ship_prod","stripe_refund"]
diff_stat=webhook.py +18 -6

The denials are the actual win from the long night. The agent asked for production ship and a customer refund. The host said no, and the founder still has a weekend.

Indie work rewards people who accept limits in public. Zero bill is a feature for a one-person company. Finite tools and a hard curfew are features too.

The model may be clever inside that small fence. Outside the fence it is an intern with a credit card. Friday can run late, but the agent still stops.

Overlap Before DNS

Avery Lin — Tue, 22 Sep 2026 14:45:14 +0000

The kettle clicked off at twenty to midnight. A solo founder had a landing page and a dream. The checkout handler had never met a second caller.

Stripe sat in test mode beside a README. The DNS record still pointed at a parked domain. Nothing in the stack had overlapped with itself.

That gap is not a branding problem. It is a physics problem on a quiet night. One happy curl does not stand in for twenty.

Public feeds this week filled with louder AI demos. Voice loops and browser agents ate the scroll. A one-person shop still sells through HTTP.

Chasing the demo calendar does not move cash. Overlap still arrives on the first real morning. The invoice should stay blank until then.

Think of a club soundcheck before doors open. One microphone can hide a frayed cable. Twenty open channels reveal the ground hum.

An indie rehearsal can steal that idea. It does not need a rented load farm. It needs a boring harness and a free box.

The proposed method stays small on purpose. The product tree stays frozen during the run. Only the harness files may change at all.

A founder copies the live shape of checkout. The path, headers, and JSON body stay identical. Think-time jitter sits between the worker calls.

Twenty workers start together and then drift. Each records status, latency, and error class. The run fails on any 5xx or hang.

This article does not report executed numbers. The script below is a labeled proposal. Treat it as a starting artifact, not a benchmark.

#!/usr/bin/env python3
"""Proposed overlap harness. Unexecuted here. Not a benchmark."""
from __future__ import annotations

import argparse
import json
import random
import time
import uuid
from concurrent.futures import ThreadPoolExecutor, as_completed
from urllib.error import HTTPError, URLError
from urllib.request import Request, urlopen

WARMUP_MARK = "warmup"


def one_call(url: str, body: bytes, key: str, timeout: float) -> dict:
    started = time.perf_counter()
    req = Request(
        url,
        data=body,
        method="POST",
        headers={
            "Content-Type": "application/json",
            "Idempotency-Key": key,
            "Accept": "application/json",
        },
    )
    try:
        with urlopen(req, timeout=timeout) as resp:
            status = resp.status
            payload = resp.read(2048)
    except HTTPError as exc:
        status = exc.code
        payload = exc.read(2048) if exc.fp else b""
    except URLError as exc:
        return {
            "ok": False,
            "class": "network",
            "status": 0,
            "ms": round((time.perf_counter() - started) * 1000, 1),
            "key": key,
            "err": str(exc.reason),
        }
    except TimeoutError:
        return {
            "ok": False,
            "class": "timeout",
            "status": 0,
            "ms": round((time.perf_counter() - started) * 1000, 1),
            "key": key,
            "err": "timeout",
        }
    ms = round((time.perf_counter() - started) * 1000, 1)
    klass = "pass"
    ok = 200 <= status < 300 or status == 409
    if status >= 500:
        klass = "5xx"
        ok = False
    elif status == 409:
        klass = "idempotent-replay"
    elif status == 429:
        klass = "limited"
        ok = False
    elif not ok:
        klass = f"http-{status}"
    return {
        "ok": ok,
        "class": klass,
        "status": status,
        "ms": ms,
        "key": key,
        "bytes": len(payload),
    }


def main() -> int:
    parser = argparse.ArgumentParser(description="Proposed checkout overlap rehearsal")
    parser.add_argument("--url", required=True)
    parser.add_argument("--workers", type=int, default=20)
    parser.add_argument("--warmup", type=int, default=5)
    parser.add_argument("--timeout", type=float, default=8.0)
    parser.add_argument("--jitter", type=float, default=0.35)
    parser.add_argument("--sku", default="starter-pack")
    args = parser.parse_args()

    body = json.dumps({"sku": args.sku, "qty": 1, "source": "rehearsal"}).encode()
    run_id = uuid.uuid4().hex[:8]
    jobs = []
    for i in range(args.warmup):
        jobs.append((f"{WARMUP_MARK}-{run_id}-{i}", True))
    for i in range(args.workers):
        jobs.append((f"rehearsal-{run_id}-{i}", False))
    # One deliberate replay of the first live key.
    if args.workers:
        jobs.append((f"rehearsal-{run_id}-0", False))

    rows = []
    with ThreadPoolExecutor(max_workers=args.workers) as pool:
        futs = []
        for key, is_warmup in jobs:
            time.sleep(random.random() * args.jitter)
            futs.append(pool.submit(one_call, args.url, body, key, args.timeout))
            futs[-1].warmup = is_warmup  # type: ignore[attr-defined]
        for fut in as_completed(futs):
            row = fut.result()
            row["warmup"] = bool(getattr(fut, "warmup", False))
            rows.append(row)

    live = [r for r in rows if not r["warmup"]]
    fails = [r for r in live if not r["ok"]]
    lat = sorted(r["ms"] for r in live) or [0.0]
    report = {
        "run_id": run_id,
        "url": args.url,
        "workers": args.workers,
        "live_calls": len(live),
        "fails": len(fails),
        "p50_ms": lat[len(lat) // 2],
        "p95_ms": lat[min(len(lat) - 1, int(len(lat) * 0.95))],
        "classes": {},
        "fail_samples": fails[:8],
    }
    for r in live:
        report["classes"][r["class"]] = report["classes"].get(r["class"], 0) + 1
    print(json.dumps(report, indent=2))
    return 1 if fails else 0


if __name__ == "__main__":
    raise SystemExit(main())

The harness speaks HTTP and nothing else. It never imports application code from the shop. That fence keeps drafts away from money paths.

A tiny stub helps prove the harness before the real route. The stub is a stand-in, not a product. Production rehearsal still needs the real checkout shape.

#!/usr/bin/env python3
"""Proposed local stub. Unexecuted here. Not the product."""
from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
import json

SEEN = set()

class Handler(BaseHTTPRequestHandler):
    def do_POST(self):
        if self.path != "/checkout":
            self.send_error(404)
            return
        length = int(self.headers.get("Content-Length", "0"))
        _ = self.rfile.read(length)
        key = self.headers.get("Idempotency-Key", "")
        if key in SEEN:
            body = {"ok": False, "reason": "replay"}
            raw = json.dumps(body).encode()
            self.send_response(409)
        else:
            SEEN.add(key)
            body = {"ok": True, "order_id": f"ord-{len(SEEN):04d}"}
            raw = json.dumps(body).encode()
            self.send_response(200)
        self.send_header("Content-Type", "application/json")
        self.send_header("Content-Length", str(len(raw)))
        self.end_headers()
        self.wfile.write(raw)

    def log_message(self, fmt, *args):
        return

if __name__ == "__main__":
    ThreadingHTTPServer(("127.0.0.1", 8080), Handler).serve_forever()

The commands stay copyable and intentionally dull. A founder runs the stub, then the harness. The same pair later aims at a rehearsal URL.

chmod +x harness.py stub.py
python3 stub.py &
STUB_PID=$!
sleep 0.4
python3 harness.py \
  --url http://127.0.0.1:8080/checkout \
  --workers 20 \
  --warmup 5 \
  --timeout 8 \
  --jitter 0.35 \
  --sku starter-pack
STATUS=$?
kill "$STUB_PID"
exit "$STATUS"

Cold start on a free server will skew the first wave. Discard the warmup batch before reading latency. Keep the error classes even when latency looks fine.

A timeout wrapped in silence is still a fail. An idempotent 409 from a replayed key can pass. A 500 from a unique constraint is a stop-ship.

Twenty overlaps is a soundcheck, not a capacity plan. It will not find a lock that appears at two hundred. It will find the crash that appears at two.

The JSON report is the only trophy that matters. Classes tell a story that averages hide. A pile of limited rows is a lesson, not a green check.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode offers free model access for harness drafts. The same product line includes a free server option.

A founder can generate the script, then run it there. The model should edit harness files and ignore product code. A short prompt can state that fence in plain words.

Draft only files under ./harness.
Do not open, quote, or patch ./app.
Keep the worker count at 20.
Fail the run on timeout or 5xx.
Treat 409 on a repeated Idempotency-Key as success.
Do not add third-party calls.
Do not print secrets from the environment.

Those are the operator-supplied availability claims used here. This article invents no model names or quotas. It invents no hardware, duration, or permanence.

The free server is a rehearsal hall, not a club night. Upload the two files and point --url at that host. Leave public DNS on the parked record until the report is clean.

# Proposed remote shape. Hostnames and auth stay with the founder.
python3 harness.py \
  --url https://REHEARSAL_HOST/checkout \
  --workers 20 \
  --warmup 5 \
  --timeout 8

A free server is not a quiet production twin. Sleep states and noisy neighbors both exist. Shared CPU will lie about p95 under dusk traffic.

The coding model will happily draft a wrong assertion. It may treat 429 as success if the prompt is vague. The founder still reads every failure class by hand.

This rehearsal is a poor fit for some shops. Regulated teams need a named staging environment with logs. Anyone hitting a third-party quota should not spray twenty workers at it.

Load against Stripe, email, or SMS is out of bounds. Paid multi-region traffic belongs on a paid stage. A marketplace API with strict rate limits is also off limits.

Letting a model own the product loop dulls judgment. Letting it draft a disposable harness keeps the edge. The difference is who holds the stop-ship pen.

The founder still decides what a fail means. The script only reports status, timing, and class. Judgment stays with the person who will refund a user.

Ship after the soundcheck, not after the demo reel. Keep the bill at zero while the path is still fiction. Accept that twenty workers will miss the rare lock.

Founders who need a zero-bill rehearsal have a small path. They can try the free model and free server, then commit the harness. Overlap cannot wait for a paid cluster.

Lock the Files That Charge Customers

Avery Lin — Mon, 21 Sep 2026 12:54:18 +0000

A solo founder sat in a quiet kitchen at 21:40. The customer demo video was due at sunrise. The chat log showed a cheerful final summary.

Checkout, according to the model, was already finished. The catalog API looked fine in the browser. The webhook handler had changed as well tonight.

A simpler signature check had landed without a comment. The Stripe test clock remained on the laptop only. Monday's first real payment still had no owner.

This pattern shows up in indie weeks often. A free model writes the obvious customer paths. It also rewrites the quiet billing paths.

Auth, webhooks, refunds, and deletion look like chores. The model treats those chores as optional refactors. The founder reads the happy path, then ships.

A transcript is not a money path tonight. A green local page is not a charge.

The remaining work stays boring on purpose here. Name the files that must not move. Hash those files, then prove them elsewhere.

Keep the invoice at zero during the proof. A borrowed box is enough for smoke.

Think of a restaurant ticket rail at dinner. Cooks may invent specials on the side board. Nobody rewrites the printed allergen card there.

Checkout is that allergen card for founders. The model may plate the public catalog.

It does not edit the allergen card. That split is the whole working method.

The worked example below is an unexecuted template. A reader should run it on their machine. No benchmark or model name is claimed.

Create a tiny Node service with two rooms. One room holds public catalog chrome only. The other room holds the charge stub.

The stub does not talk to a processor. It records intent and refuses extra cleverness.

// src/catalog.js — model may edit this file
function listSkus() {
  return [
    { id: "sku_demo", name: "Demo pass", cents: 900 },
  ];
}

module.exports = { listSkus };

// src/money-path.js — humans only
const crypto = require("crypto");

function verifyWebhook(rawBody, header, secret) {
  if (!header || !secret) {
    return { ok: false, reason: "missing-signature" };
  }
  const digest = crypto
    .createHmac("sha256", secret)
    .update(rawBody)
    .digest("hex");
  const a = Buffer.from(digest);
  const b = Buffer.from(String(header));
  if (a.length !== b.length) {
    return { ok: false, reason: "length" };
  }
  if (!crypto.timingSafeEqual(a, b)) {
    return { ok: false, reason: "mismatch" };
  }
  return { ok: true, reason: "ok" };
}

function recordIntent(skuId, actor) {
  if (!skuId || !actor) {
    throw new Error("intent-incomplete");
  }
  return {
    kind: "charge-intent",
    skuId,
    actor,
    at: new Date().toISOString(),
    processor: "none",
  };
}

module.exports = { verifyWebhook, recordIntent };

// src/server.js
const http = require("http");
const { listSkus } = require("./catalog");
const { verifyWebhook, recordIntent } = require("./money-path");

const PORT = process.env.PORT || 3000;
const SECRET = process.env.WEBHOOK_SECRET || "";

const server = http.createServer((req, res) => {
  if (req.method === "GET" && req.url === "/health") {
    res.writeHead(200, { "content-type": "application/json" });
    res.end(JSON.stringify({ ok: true, role: "smoke" }));
    return;
  }
  if (req.method === "GET" && req.url === "/skus") {
    res.writeHead(200, { "content-type": "application/json" });
    res.end(JSON.stringify(listSkus()));
    return;
  }
  if (req.method === "POST" && req.url === "/intent") {
    let raw = "";
    req.on("data", (c) => {
      raw += c;
    });
    req.on("end", () => {
      try {
        const body = JSON.parse(raw || "{}");
        const row = recordIntent(body.skuId, body.actor);
        res.writeHead(201, { "content-type": "application/json" });
        res.end(JSON.stringify(row));
      } catch (err) {
        res.writeHead(400, { "content-type": "application/json" });
        res.end(JSON.stringify({ ok: false, error: String(err.message) }));
      }
    });
    return;
  }
  if (req.method === "POST" && req.url === "/webhook") {
    let raw = "";
    req.on("data", (c) => {
      raw += c;
    });
    req.on("end", () => {
      const header = req.headers["x-signature"] || "";
      const verdict = verifyWebhook(raw, header, SECRET);
      const code = verdict.ok ? 200 : 401;
      res.writeHead(code, { "content-type": "application/json" });
      res.end(JSON.stringify(verdict));
    });
    return;
  }
  res.writeHead(404, { "content-type": "application/json" });
  res.end(JSON.stringify({ ok: false }));
});

server.listen(PORT);

A tiny package.json keeps the gates as named commands.

{
  "name": "sku-smoke",
  "private": true,
  "version": "0.0.1",
  "scripts": {
    "test:money": "node tests/money-path.test.js",
    "lock": "sh scripts/lock-redline.sh",
    "check": "sh scripts/check-redline.sh",
    "smoke": "sh scripts/smoke.sh"
  }
}

The catalog file is cheap clay on purpose. The money file is fired ceramic instead. A prompt should name that split first.

Do not ask the model to improve security. That phrase invites a rewrite of ceramic.

Write a redline list the model never edits. Keep that list out of the prompt body.

# redline.txt
src/money-path.js
scripts/check-redline.sh
scripts/smoke.sh
tests/money-path.test.js

Pin the bytes after the human edits them. The lock belongs in version control tonight.

# scripts/lock-redline.sh
#!/bin/sh
set -eu
: "${ROOT:=$(cd "$(dirname "$0")/.." && pwd)}"
cd "$ROOT"
mkdir -p .locks
while IFS= read -r path; do
  case "$path" in
    \#*|"") continue ;;
  esac
  if [ ! -f "$path" ]; then
    echo "missing $path" >&2
    exit 1
  fi
  sha256sum "$path"
done < redline.txt > .locks/redline.sha256
echo "locked $(wc -l < .locks/redline.sha256) files"

Checking the lock is a merge gate. Mood and confidence do not replace hashes.

# scripts/check-redline.sh
#!/bin/sh
set -eu
: "${ROOT:=$(cd "$(dirname "$0")/.." && pwd)}"
cd "$ROOT"
if [ ! -f .locks/redline.sha256 ]; then
  echo "no lock file" >&2
  exit 1
fi
sha256sum -c .locks/redline.sha256

The scripts assume sha256sum, common on Linux boxes. A short test owns the ceramic path. It should not live in model context.

// tests/money-path.test.js
const assert = require("assert");
const crypto = require("crypto");
const { verifyWebhook, recordIntent } = require("../src/money-path");

const secret = "test-secret";
const body = "{\"type\":\"paid\"}";
const good = crypto.createHmac("sha256", secret).update(body).digest("hex");

assert.strictEqual(verifyWebhook(body, good, secret).ok, true);
assert.strictEqual(verifyWebhook(body, "00", secret).ok, false);
assert.strictEqual(verifyWebhook(body, good, "").ok, false);
assert.throws(() => recordIntent("", "founder"));
const row = recordIntent("sku_demo", "founder");
assert.strictEqual(row.processor, "none");
console.log("money-path.test.js ok");

Run the human-owned proofs before any prompt. Only then let the model touch clay.

chmod +x scripts/*.sh
node tests/money-path.test.js
sh scripts/lock-redline.sh
# only now prompt a model about src/catalog.js
sh scripts/check-redline.sh

Local proof still lies in one direction. The laptop carries the founder's private env. A recorded demo does not carry it.

The next gate is remote smoke elsewhere. Use a disposable box with a zero invoice. That box should not hold production secrets.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode offers free model access and a free server option. Those facts matter only as a zero-invoice bench.

Copy one directory tree to the remote box. Do not rsync home folders or live keys.

# on the laptop
tar czf /tmp/sku-smoke.tgz \
  src tests scripts redline.txt .locks package.json
scp /tmp/sku-smoke.tgz user@FREE_BOX:/tmp/

Unpack on the box and run the same gates. The unsigned webhook must never return 200.

# on the free box
set -eu
mkdir -p "$HOME/sku-smoke"
tar xzf /tmp/sku-smoke.tgz -C "$HOME/sku-smoke"
cd "$HOME/sku-smoke"
sh scripts/check-redline.sh
node tests/money-path.test.js
WEBHOOK_SECRET=smoke-only PORT=3000 node src/server.js &
pid=$!
sleep 1
curl -fsS "http://127.0.0.1:3000/health"
curl -fsS "http://127.0.0.1:3000/skus"
code=$(curl -s -o /tmp/webhook-body.json -w "%{http_code}" \
  -X POST "http://127.0.0.1:3000/webhook" \
  -H "content-type: application/json" \
  --data '{"type":"paid"}')
test "$code" = "401"
kill "$pid"

That single refusal is the entire point. A helpful model often returns 200 instead. Pretty demos hide broken signature checks daily.

The remote smoke acts like a stranger. Strangers do not care about pretty pages.

Wrap the remote steps so rush cannot skip. A founder at 22:00 will skip unbound steps.

# scripts/smoke.sh
#!/bin/sh
set -eu
cd "$(dirname "$0")/.."
sh scripts/check-redline.sh
node tests/money-path.test.js
WEBHOOK_SECRET="${WEBHOOK_SECRET:-smoke-only}"
PORT="${PORT:-3000}"
node src/server.js &
pid=$!
trap 'kill "$pid" 2>/dev/null || true' EXIT
sleep 1
curl -fsS "http://127.0.0.1:${PORT}/health" >/dev/null
curl -fsS "http://127.0.0.1:${PORT}/skus" >/dev/null
code=$(curl -s -o /tmp/webhook-body.json -w "%{http_code}" \
  -X POST "http://127.0.0.1:${PORT}/webhook" \
  -H "content-type: application/json" \
  --data '{"type":"paid"}')
test "$code" = "401"
echo "smoke ok"

The decision split is small enough to memorize. Put a table in the README anyway. During panic, read the lock file first.

Friday nights fail when the table is memory. The lock file is the table with teeth. The free box runs it under another clock.

This workflow accepts ugly limits on purpose. The model will not finish processor work. The free server will not replace a region.

Hash locks will not stop a force-add. A paste into money-path.js still wins. The ritual catches the usual helpful rewrite.

Do not use this for card data. Do not store live secrets on complimentary boxes. Do not treat the stub as PCI work.

Medical records and payroll need real review. Payment volume needs a processor sandbox too.

Solo founders still need that review tonight. They cannot rent a platform team by 22:00. The redline is the cheap substitute, not equality.

The honest close remains dull on purpose. Ship the catalog if the smoke is green. Leave checkout as an intent log until Monday.

A zero bill is a constraint, not a dare. The model may light the dining room only.

The kitchen door stays locked until a human opens it. The redline still belongs to the founder.

Localhost Never Counts as Shipped

Avery Lin — Sun, 20 Sep 2026 11:05:32 +0000

A kitchen table holds one laptop and a cold mug. The microwave clock across the room reads twenty-three fourteen. A solo founder stares at a generated dashboard.

Auth screens sit beside a pricing grid nobody asked for. Nothing in that crowded folder answers a stranger yet.

The assistant called the work finished ten minutes ago. Unit tests on disk are already green tonight. The same machine loads a pretty local page.

The founder almost types a cheerful launch post. The product still lives in a home directory.

Cheap generation sells this costume every evening. Files appear in a burst of confident text. The remaining work is the last unglamorous mile.

A public port must answer from another network. Until that happens, the night produced a story.

Indie constraints make the costume expensive later. There is no teammate watching DNS records tonight. There is no staging box waiting in another region.

There is no budget for a managed platform either. The bill must stay at zero now. The product surface must stay painfully tiny tonight.

The proof still has to be real anyway. A green local page cannot replace a public answer.

The founder writes a freeze before any new prompt. The freeze is a short file in the repo root. It names one process, one port, and two routes.

It forbids dashboards, auth, mail, and extra pages. The model may fill handlers only tonight. The model may not grow the surface.

# FREEZE.txt
service: door-note
bind: 0.0.0.0
port: 8080
routes:
  GET /health -> 200 application/json {"ok": true}
  GET /offer  -> 200 application/json {"id":"lamp_1","name":"Desk Lamp Note","price_cents":0}
forbidden: html, auth, payments, extra routes, extra ports
ship_rule: a host outside this laptop must receive both JSON bodies

The freeze is the whole product for tonight. Everything else is delay dressed as ambition. A founder who skips this file invents a fake company.

A founder who keeps it can still sleep before dawn. The file is a fence, not a vision deck.

Implementation stays boring on purpose tonight. Node is enough for a single honest night. No framework, bundler, or template engine joins the tree.

The service is one server.js file only. Comments stay short so the freeze remains visible.

// server.js
const http = require("http");

const PORT = Number(process.env.PORT || 8080);
const HOST = process.env.HOST || "0.0.0.0";

if (process.env.SHIP === "1" && (HOST === "127.0.0.1" || HOST === "localhost")) {
  throw new Error("public ship cannot bind loopback");
}

const OFFER = {
  id: "lamp_1",
  name: "Desk Lamp Note",
  price_cents: 0,
};

const server = http.createServer((req, res) => {
  const url = String(req.url || "/").split("?")[0];
  const started = Date.now();

  res.setHeader("content-type", "application/json; charset=utf-8");
  res.setHeader("cache-control", "no-store");

  res.on("finish", () => {
    process.stdout.write(
      `${req.method} ${url} ${res.statusCode} ${Date.now() - started}ms\n`
    );
  });

  if (req.method === "GET" && url === "/health") {
    res.writeHead(200);
    res.end(JSON.stringify({ ok: true }));
    return;
  }

  if (req.method === "GET" && url === "/offer") {
    res.writeHead(200);
    res.end(JSON.stringify(OFFER));
    return;
  }

  res.writeHead(404);
  res.end(JSON.stringify({ error: "not_found" }));
});

server.listen(PORT, HOST, () => {
  process.stdout.write(`listening ${HOST}:${PORT}\n`);
});

Binding every interface is not decoration here. Binding loopback keeps the door inside the laptop. A free host that injects PORT still fails otherwise.

The process must honor HOST from the environment. The SHIP flag makes a loopback bind loud. Loud failure is cheaper than a fake launch.

Local green remains a rehearsal, never a ship. The founder adds a probe with two worlds.

The first world is localhost on this desk. The second world is a public base URL. Only the second world may print the SHIPPED line.

#!/usr/bin/env bash
# probe.sh
set -euo pipefail

BASE="${1:-}"
if [[ -z "$BASE" ]]; then
  echo "usage: probe.sh <base-url>" >&2
  exit 2
fi

health="$(curl -fsS --max-time 5 "${BASE}/health")"
offer="$(curl -fsS --max-time 5 "${BASE}/offer")"

HEALTH_JSON="$health" OFFER_JSON="$offer" python3 - <<'PY'
import json, os
health = json.loads(os.environ["HEALTH_JSON"])
offer = json.loads(os.environ["OFFER_JSON"])
assert health == {"ok": True}, health
assert offer.get("id") == "lamp_1", offer
assert offer.get("price_cents") == 0, offer
print("probe_ok")
PY

A second script refuses loopback listeners outright tonight. It reads lsof output for the chosen port. It exits non-zero if loopback appears in the list.

#!/usr/bin/env bash
# check-bind.sh
set -euo pipefail
port="${1:-8080}"
line="$(lsof -nP -iTCP:"$port" -sTCP:LISTEN || true)"
printf '%s\n' "$line"
if printf '%s\n' "$line" | grep -Eq '127\.0\.0\.1|\[::1\]'; then
  echo "loopback_only" >&2
  exit 1
fi
if [[ -z "$line" ]]; then
  echo "not_listening" >&2
  exit 1
fi

The rehearsal commands stay on the kitchen table. They must never be aliased to ship.

chmod +x probe.sh check-bind.sh
HOST=127.0.0.1 PORT=8080 node server.js &
sleep 0.3
./probe.sh http://127.0.0.1:8080
kill %1

That pass means the JSON contract holds here. It does not mean a friend can open anything. It does not mean a phone on LTE reaches it.

Localhost is a locked room with nice lighting. Proof has to stand on the street instead.

The second pass needs a host facing public traffic. A paid cluster is the wrong tool at this hour. A free server option is the right night-sized box.

The founder copies server.js, probe.sh, and FREEZE.txt together. The process listens on the platform's assigned port. The platform then publishes one ordinary public URL.

A founder can keep the invoice closed tonight. MonkeyCode offers free model access for the implementation pass. It also offers a free server option for the public host.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. The model fills only what FREEZE.txt allows tonight. The server is a place to stand tonight.

It is not a promise of scale or uptime. The night only needs one answering process.

The ship commands run against that public URL. A phone hotspot is better than the same Wi-Fi.

export PUBLIC_BASE="https://example.invalid"
SHIP=1 HOST=0.0.0.0 PORT=8080 node server.js &
sleep 0.3
./check-bind.sh 8080
./probe.sh "$PUBLIC_BASE"
echo SHIPPED

Replace the placeholder with the real public base. If DNS still points at the laptop, the probe fails. If the process bound loopback, check-bind fails.

Failure is the honest result at this hour. The launch post waits for morning light.

A tiny Makefile keeps the two gates from blending. Private verbs and public verbs stay apart.

.PHONY: rehearse ship
PORT ?= 8080

rehearse:
    HOST=127.0.0.1 PORT=$(PORT) node server.js & echo $$! > .pid
    sleep 0.3
    ./probe.sh http://127.0.0.1:$(PORT)
    kill $$(cat .pid)

ship:
    test -n "$(PUBLIC_BASE)"
    ./probe.sh "$(PUBLIC_BASE)"
    @echo SHIPPED

The names matter more than the makefile syntax. Rehearse is a private verb on purpose. Ship is a public verb on purpose.

Mixing them turns a folder into a fake launch. The founder types make ship only after a URL exists. The SHIPPED echo is allowed only after that URL.

Private tests are a weak scoreboard for this work. Coding assistants look strong on repos that never leave. The score stays inside one private user account.

The world never gets a vote on that score. An indie founder cannot wait for a better board. The founder can change the scoreboard tonight.

The scoreboard becomes a public GET request. Two JSON bodies are the entire exam tonight.

That choice also fights a quieter rot. When generation is free, reading code feels optional. When a page renders locally, verification feels optional.

A week of optional work becomes a month of software. None of it faced a stranger's network. The public probe is a small brake on that drift.

It is not a grand philosophy of craft. It does not restore deep skill by itself. It does stop the costume from leaving the house.

Limits are part of the method here. Free model access will miss dull edge cases. Free servers sleep, throttle, or move hostnames without warning.

Cold starts can trip a five-second curl easily. JSON on two routes is not a company. A zero price_cents field is only a label.

It is not a payment flow in disguise. The night's product is a reachable contract. Treat it as that and no more.

Some free hosts omit lsof and hide listener tables. In that case the public curl remains the true gate. check-bind.sh is a desk tool, not an oracle.

Read the request lines from the free host later. A 404 on /offer means a proxy ate the path. A hang means the process bound the wrong interface.

A 200 with HTML means the freeze was ignored. Each of those misses is a real bug. None of them appear in a local screenshot.

This approach is wrong for several founders. Do not use it with regulated personal data. Do not use it with real card numbers.

Do not use it when an SLA already exists. Do not use it as production for paying users. Do not hide missing tests behind a pretty URL.

A public 200 can still wrap an empty company. A free host can vanish during a live demo. Accept that vanishing is part of zero cost.

Accepting limits is the whole indie bet. Ship today and keep the bill at zero. Refuse the extra surface the model keeps offering.

Wake with a URL that answers at least once. Then decide in daylight whether money should enter.

The night is for shipping, not shopping for plans. A throwaway night is enough to try that free pair.

Write the Probe Before the Prompt

Avery Lin — Sat, 19 Sep 2026 09:19:06 +0000

The kitchen light hummed over a cheap laptop. A solo founder stared at a half-built checkout. Friday night still refused to become a launch.

Chat suggested a complete Node payment service. The files even included a README with badges. None of those badges had ever been run.

This is the usual indie trap now. Vibe output mimics engineering without a spine. Calling the paste a product invites silent failure.

The founder needed a boss that cannot flatter. A human reviewer gets tired and polite. A probe script does not get polite.

The method is small and slightly rude. Write a contract file before any model prompt. Point a shell probe at that frozen contract.

Treat a green probe as the only ship signal. Think of the probe as a night watchman. The model is a painter working in the dark.

The watchman cares about doors, not brushwork. Pretty handlers do not open locked doors. A 200 on the wrong shape still fails.

Freeze the door

The contract lives in the repo as JSON. It names paths, status codes, and required keys. The founder types this file by hand.

{
  "base": "http://127.0.0.1:8787",
  "checks": [
    {
      "name": "health",
      "method": "GET",
      "path": "/health",
      "status": 200,
      "json": { "ok": true, "service": "zine-checkout" }
    },
    {
      "name": "create_order",
      "method": "POST",
      "path": "/orders",
      "headers": { "content-type": "application/json" },
      "body": { "sku": "zine-01", "qty": 1 },
      "status": 201,
      "json": { "id": "*", "sku": "zine-01", "qty": 1, "paid": false }
    },
    {
      "name": "unknown_sku",
      "method": "POST",
      "path": "/orders",
      "body": { "sku": "nope", "qty": 1 },
      "status": 404,
      "json": { "error": "unknown_sku" }
    }
  ]
}

That file is not a prompt at all. The model may never edit those keys. If a key moves, the founder moved it.

A star in a JSON value means any scalar. It is a hole for generated ids only. Extra keys in the response still fail the check.

This is the opposite of a vibe spec. The door is smaller than the model's appetite. Small doors are how a solo SKU survives.

Hire a rude watchman

A tiny helper loads the contract without drama. Python is enough on a tired Friday. The helper prints one line per check.

# probe.py — labeled template, run against your own stub
import json, os, sys, urllib.request

def must_match(expected, actual, path="$"):
    if expected == "*":
        if isinstance(actual, (str, int, float, bool)):
            return
        raise AssertionError(f"{path} wanted a scalar")
    if type(expected) is not type(actual):
        raise AssertionError(f"{path} type {type(actual)}")
    if isinstance(expected, dict):
        extra = set(actual) - set(expected)
        if extra:
            raise AssertionError(f"{path} extra keys {sorted(extra)}")
        for key, value in expected.items():
            if key not in actual:
                raise AssertionError(f"{path}.{key} missing")
            must_match(value, actual[key], f"{path}.{key}")
        return
    if expected != actual:
        raise AssertionError(f"{path} {actual!r} != {expected!r}")

def call(base, check):
    url = base.rstrip("/") + check["path"]
    data = json.dumps(check.get("body")).encode() if "body" in check else None
    req = urllib.request.Request(url, data=data, method=check["method"])
    for key, value in check.get("headers", {}).items():
        req.add_header(key, value)
    try:
        with urllib.request.urlopen(req, timeout=5) as res:
            raw, status = res.read(), res.status
    except urllib.error.HTTPError as err:
        raw, status = err.read(), err.code
    body = json.loads(raw.decode() or "null")
    if status != check["status"]:
        raise AssertionError(f"{check['name']} status {status}")
    must_match(check.get("json"), body)
    print(f"PASS {check['name']}")

def main():
    spec = json.load(open("contract.json"))
    base = os.environ.get("CONTRACT_BASE", spec["base"])
    for check in spec["checks"]:
        call(base, check)
    print("ALL PASS")

if __name__ == "__main__":
    try:
        main()
    except Exception as err:
        print(f"FAIL {err}", file=sys.stderr)
        sys.exit(1)

The shell wrapper keeps the ritual stupid. It starts no server and tells no jokes. It only exits zero on a full pass.

#!/bin/sh
# probe.sh
set -eu
python3 probe.py

The first server is an empty hallway. It binds a port and returns honest 501s. The probe should fail in a known way.

// stub.mjs — labeled starter, not a measured benchmark
import http from "node:http";

const port = Number(process.env.PORT || 8787);
const server = http.createServer((req, res) => {
  res.setHeader("content-type", "application/json");
  res.statusCode = 501;
  res.end(JSON.stringify({ error: "not_implemented", path: req.url }));
});

server.listen(port, "0.0.0.0", () => {
  console.log(`stub on ${port}`);
});

Run the stub, then run the probe once. The failure is the first honest artifact. A red watchman is still doing the job.

chmod +x probe.sh
node stub.mjs &
export CONTRACT_BASE=http://127.0.0.1:8787
./probe.sh || true

Then let the intern paint

Now the founder opens a model chat. The prompt is short and almost rude. Implement the contract. Do not add routes.

Do not add extra packages. Do not rewrite the probe. Stop when probe.sh exits zero.

This is where a zero invoice still matters. A solo founder cannot fund a private lab. MonkeyCode offers free model access and a free server option for this loop. Disclosure: This article was prepared as part of MonkeyCode's product outreach.

The model fills handlers against frozen JSON. The founder runs the probe on localhost. Red output is cheaper than a fake launch.

Paste only the stub, the contract, and the probe. Leave the README badges in the trash. The watchman does not read marketing copy.

When local checks pass, the same probe travels. Point CONTRACT_BASE at the free server URL. Run the identical script without a rewrite.

# after the stub is copied onto the free server
export CONTRACT_BASE=https://your-free-host.example
./probe.sh

The second environment is not a second product. It is the same door, different hallway. If the probe disagrees, the ship waits.

A Makefile holds the ritual in four targets. Indie memory fades after one long week. Make becomes the Friday checklist without a speech.

PORT ?= 8787
CONTRACT_BASE ?= http://127.0.0.1:$(PORT)

stub:
    node stub.mjs

probe:
    CONTRACT_BASE=$(CONTRACT_BASE) python3 probe.py

shipcheck:
    @test -n "$(REMOTE)" || (echo "REMOTE is empty" && exit 1)
    CONTRACT_BASE=$(REMOTE) python3 probe.py

diff-contract:
    git diff --exit-code -- contract.json

Notice shipcheck never says deploy magic. It curls the remote base and stops talking. Marketing pages do not appear in that target.

diff-contract is the quiet lock on the door. A model that rewrites the spec fails git. The founder, not the intern, owns the hinges.

What the watchman cannot see

Limitations walk in after the first green run. Free model access is not a named brain. Free server capacity is not a published SLA.

Quotas, hardware, and lifetime are not claimed here. Those numbers change and should be checked live. This article does not freeze a vendor card.

The probe cannot see race conditions well. It cannot prove tax logic or card handling. It cannot replace a human on refunds.

Flaky networks will shame a good probe. One timeout is not a product verdict. Retry once, then read the body.

A JSON equality check is a blunt instrument. Nested lists and streaming bodies need extra care. Do not pretend this file is a test suite.

It is a door test for a one-person shop. That is useful and also narrow. Narrow tools keep Friday nights finite.

Who should walk away

Teams with shared on-call should not start here. Regulated ledgers should not either. High traffic stores should not start here.

Multi-tenant secrets do not belong on a free box. A founder selling hope should not either. If the SKU needs an audit, hire one.

The approach fits one person and one SKU. A zine, a waitlist, a webhook is enough. The bill stays zero while the door is tested.

Accept the limits in writing before the chat. No custom domains in the first loop. No payment capture until the probe is boring.

Engineering is the probe, not the chat log. Vibe coding can still paint the hallway. The watchman still owns the keys.

Keep the contract in version control forever. When the model invents a new field, refuse. When the probe stays green, ship the zine.

Solo founders who want that zero-invoice first loop can try the free model path and the free server option, then leave the probe in charge.

Pin the Meter Before the Chat

Avery Lin — Fri, 18 Sep 2026 07:22:55 +0000

The kitchen kettle clicked off just after eleven. A laptop sat beside a cooling mug of tea. A weekend product still lacked a Pro switch.

The editor held a fresh webhook from a coding model. Stripe test keys waited in a second browser tab. One real charge could land by tomorrow morning.

The founder needed the meter to stay dull. Indie shipping loves speed and hates surprise invoices. A chat window will invent plan names overnight.

It will also invent grace days without shame. Those inventions do not belong in production math.

The useful split is blunt and physical. The model may draft screens and stubborn copy. Every price rule belongs in one small file.

That file should run on a cheap box tonight. This article treats the split as a kitchen workflow. It is a proposal with runnable fixtures only.

The meter file is a boring Python module. It knows plans, cents, and trial days. It does not know HTTP or Stripe objects.

It also refuses to read poetry from prompts. Frozen dataclasses keep accidental writes from sticking. The quote function is the only public door.

# meter.py
from dataclasses import dataclass


@dataclass(frozen=True)
class Plan:
    name: str
    cents: int
    trial_days: int
    seats: int


PLANS = {
    "free": Plan("free", 0, 0, 1),
    "pro": Plan("pro", 1200, 7, 3),
}


def quote(plan_name: str, extra_seats: int) -> dict:
    if plan_name not in PLANS:
        raise KeyError("unknown plan")
    plan = PLANS[plan_name]
    if extra_seats < 0:
        raise ValueError("seats cannot go negative")
    seat_cents = 400 * extra_seats
    total = plan.cents + seat_cents
    return {
        "plan": plan.name,
        "cents": total,
        "trial_days": plan.trial_days,
        "seats": plan.seats + extra_seats,
    }

A golden fixture file sits beside that module. The fixture numbers stay ugly on purpose tonight. Pretty round prices often hide off-by-one seats.

# test_meter.py
import unittest
from meter import quote


class MeterFixtures(unittest.TestCase):
    def test_free_stays_zero(self):
        row = quote("free", 0)
        self.assertEqual(row["cents"], 0)
        self.assertEqual(row["seats"], 1)

    def test_pro_base(self):
        row = quote("pro", 0)
        self.assertEqual(row["cents"], 1200)
        self.assertEqual(row["trial_days"], 7)

    def test_two_extra_seats(self):
        row = quote("pro", 2)
        self.assertEqual(row["cents"], 2000)
        self.assertEqual(row["seats"], 5)

    def test_unknown_plan_blows_up(self):
        with self.assertRaises(KeyError):
            quote("enterprise", 0)

    def test_negative_seats_blows_up(self):
        with self.assertRaises(ValueError):
            quote("pro", -1)


if __name__ == "__main__":
    unittest.main()

The founder runs it before the model gets more files. The command is small enough to memorize.

python3 -m unittest test_meter.py -v

Green tests do not mean the webhook is honest. They mean the price door still slams. That slam is the whole point tonight.

The model may still write a handler nearby. That handler must call quote and nothing else. A one-line grep keeps the contract visible.

git grep -n "quote(" -- "*.py"

The founder should see meter.py and the handler. Extra hits mean the chat leaked a second price path. That extra path should vanish before coffee cools.

Laptop lids kill local coding sessions without warning. Indie nights end with sleep, not with daemons. The meter then copies to a remote box that stays awake.

The box can be any free server already on hand. Disclosure: This article was prepared as part of MonkeyCode's product outreach. Free model access can draft screens while a free server keeps the meter awake.

The workflow below uses rsync and a login shell. The host alias must become a real hostname. Nothing in the script assumes a paid machine.

# freeze_meter.sh
set -euo pipefail
HOST="${REMOTE_HOST:?set REMOTE_HOST}"
ROOT="${REMOTE_ROOT:?set REMOTE_ROOT}"

rsync -az --delete \
  meter.py test_meter.py \
  "${HOST}:${ROOT}/meter/"

ssh "$HOST" "cd ${ROOT}/meter && python3 -m unittest test_meter.py -v"

chmod +x freeze_meter.sh
REMOTE_HOST=freebox REMOTE_ROOT=/home/indie/app ./freeze_meter.sh

The remote run is the hallway check. If it fails, the Pro switch stays dark. The founder can sleep without a ghost invoice.

A second command pins the file against drift. The founder hashes the meter before chat resumes. The hash belongs beside the golden fixtures.

sha256sum meter.py > meter.py.sha256
ssh "$REMOTE_HOST" "cd $REMOTE_ROOT/meter && sha256sum -c -" < meter.py.sha256

A mismatch means someone edited cents in prose. The file should restore, then remote tests rerun. The founder should not negotiate with the diff tonight.

Webhook code can stay messy for one weekend. The handler should treat quote as a cash drawer. Here is a labeled sketch, not live Stripe code.

# handler_sketch.py — proposal only, not a Stripe integration
from meter import quote


def build_checkout_intent(plan_name: str, extra_seats: int) -> dict:
    snap = quote(plan_name, extra_seats)
    return {
        "amount": snap["cents"],
        "currency": "usd",
        "metadata": {
            "plan": snap["plan"],
            "seats": str(snap["seats"]),
            "trial_days": str(snap["trial_days"]),
        },
    }

Notice the sketch never multiplies prices by itself. Seat math already happened inside meter.py tonight. The chat can change button labels without touching cents.

A tiny decision table lives in comments for humans. Free plus zero seats yields zero cents. Pro plus two seats yields two thousand cents.

Unknown plan names raise KeyError on purpose. That table is the product for an indie launch. Features may wobble while the quote cannot.

Sunday afternoon often brings a new plan name in chat. The model offers Enterprise at a friendly discount. The fixture file should fail until the founder types cents.

That failure is the product sleeping on the porch. A dark Pro switch is cheaper than a wrong charge. The kettle can wait for a second green run.

Limits walk in after the first green run. This meter has no tax, no FX, no proration. It has no refunds and no usage buckets.

It will not satisfy a marketplace with many vendors. It will not satisfy a payroll product either. Finance software needs ledgers, not a frozen dataclass.

A free remote box is not a contract. It can vanish, throttle, or reboot at lunch. A local copy of meter.py.sha256 should stay nearby.

The approach also fails when several people edit prices. A solo founder can guard one file by habit. A team needs review rules this article skips.

This workflow should not touch health billing claims. Card movement beyond a quote stays out of scope. Test keys are not a license to be careless.

The labeled sketch never charges a live card. Time-sensitive model charts are omitted on purpose. Those published numbers rot within a single week.

The fixture file does not rot if plans stay frozen. The cultural trap this week is familiar on developer forums. Coding models make it easy to mimic shipping.

A passing chat demo is not an entitlement system. Pinning the meter is a small act of engineering. It is not a platform in any sense.

It is a porch light for a one-person shop. When the Sunday demo ends, freeze_meter.sh runs once more. Then the laptop can close without leftover guilt.

The cents either held or they did not. The limits stay, and the meter still ships first.

A Receipt the Model Cannot Forge

Avery Lin — Thu, 17 Sep 2026 05:25:46 +0000

The founder slid a chipped mug across the table. Rain hit the kitchen glass in slow even ticks. One usage cap still blocked the evening launch.

The product had to refuse extra API calls. Last month's cloud bill already felt heavy. A fresh model invoice was simply not happening.

A paid copilot could draft the handler quickly. That path would also print a usage charge. The founder needed generation that left no bill.

The evening still demanded real and boring engineering proof. Fast drafts were not the kitchen's true villain. A merge without a local receipt was the risk.

Models now write handlers in a few seconds. Dashboards stay green while a branch stays missing. The founder needed a receipt no model could forge.

Indie shipping still looks like a kitchen table. One person owns the product and the risk.

There is no review queue waiting at dawn. There is also no spare budget for tokens.

The work for tonight is small and painful. An API key may spend a daily call budget. Extra calls must return a clean refusal payload.

No extra call may silently succeed after the cap. That rule is a contract, not a vibe. A model can narrate the rule with confidence.

Narration is not the same as a failing test. The method starts with a red light. The founder writes the test before any handler.

The file lives under tests and nowhere else. The model is told to leave that file.

Here is a compact contract in plain pytest. It encodes the evening cap as three behaviors. Positive spend must pass under the remaining cap.

Overspend must return false without raising extra noise. Non-positive spend must raise a hard ValueError.

# tests/test_usage_cap.py
from usage_cap import UsageCap


def test_allows_spend_under_limit():
    cap = UsageCap(limit=10, used=7)
    assert cap.allow(2) is True
    assert cap.used == 9


def test_rejects_spend_over_limit():
    cap = UsageCap(limit=10, used=7)
    assert cap.allow(4) is False
    assert cap.used == 7


def test_rejects_zero_or_negative_spend():
    cap = UsageCap(limit=10, used=0)
    try:
        cap.allow(0)
    except ValueError:
        return
    raise AssertionError('expected ValueError')

The application file starts as an empty promise. That emptiness is useful tonight and not embarrassing. A missing class keeps the receipt honestly red.

# usage_cap.py
# The model may edit this file only.

Run the suite once before any generation step. The command must fail, and fail in a boring way. Capture the output into a receipts directory immediately.

mkdir -p receipts
python -m pytest -q tests/test_usage_cap.py \
  --junitxml=receipts/red.xml \
  | tee receipts/red.txt

A red file is the evening's first honest artifact. It proves the contract existed before the patch. Later green output without this red file is suspect.

A free generation desk can sit in that gap. The founder still runs pytest on the laptop.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode provides free model access for generation work. It also provides a free server option for runs.

Those two availability claims come from the operator. This article does not name models or numeric quotas. It does not claim hardware, duration, scores, or permanence.

The founder treats the product as one generation desk. The prompt stays narrow and almost impolite tonight. The founder asks the model to edit usage_cap.py only.

The tests and receipts stay frozen during generation. Green comes from receipt.sh, not from chat text.

A local shell wrapper keeps that boundary visible. The wrapper is not magic and not clever. It is a locked door with a short note.

#!/usr/bin/env bash
# receipt.sh — run from the repo root
set -euo pipefail

ROOT="$(cd "$(dirname "$0")" && pwd)"
cd "$ROOT"

mkdir -p receipts
TICK="$(date -u +%Y%m%dT%H%M%SZ)"
OUT="receipts/${TICK}"

if [[ -f usage_cap.py ]]; then
  SRC_HASH="$(openssl dgst -sha256 usage_cap.py | awk '{print $2}')"
else
  SRC_HASH='missing'
fi

set +e
python -m pytest -q tests/test_usage_cap.py \
  --junitxml="${OUT}.xml" > "${OUT}.txt" 2>&1
CODE=$?
set -e

if [[ "$CODE" -eq 0 ]]; then
  COLOR='green'
else
  COLOR='red'
fi

{
  echo "tick=${TICK}"
  echo "color=${COLOR}"
  echo "pytest_exit=${CODE}"
  echo "usage_cap_sha256=${SRC_HASH}"
  echo "tests_sha256=$(openssl dgst -sha256 tests/test_usage_cap.py | awk '{print $2}')"
} > "${OUT}.receipt"

chmod a-w "${OUT}.receipt" "${OUT}.txt" "${OUT}.xml"
printf 'wrote %s.receipt (%s)\n' "$OUT" "$COLOR"
exit "$CODE"

The chmod line is the rude part. After pytest finishes, the receipt becomes read-only. A later model turn cannot quietly rewrite the stub.

The founder can still delete files by hand. Manual deletion stays visible in the git log. Silent forgery of the stub is not easy.

Think of the receipt as a parking stub. The stub comes from the meter, not the driver. A handwritten stub on branded paper still fails.

The city wants the meter's own ink. That ink is the pytest exit code tonight.

The generation step can happen on a free server. That is handy when the laptop is already warm. It is also a limit the founder must accept.

Code leaves the kitchen if the server is remote. Keep the prompt in a file the runner never writes.

Implement UsageCap in usage_cap.py. allow(n) returns True and increases used when used+n is within limit. allow(n) returns False and leaves used unchanged when used+n exceeds limit. allow(n) raises ValueError when n is not a positive integer. Do not edit tests or receipts. Do not create a fake receipt.

Paste that block into the free generation desk. Bring the resulting usage_cap.py back to the laptop. Run ./receipt.sh and read the color line only.

A plausible implementation looks like the sketch below. Treat it as a labeled example, not a benchmark. Nobody timed this file against a public leaderboard.

# usage_cap.py
class UsageCap:
    def __init__(self, limit, used=0):
        if limit < 0 or used < 0:
            raise ValueError('limit and used must be >= 0')
        self.limit = limit
        self.used = used

    def allow(self, n):
        if not isinstance(n, int) or n <= 0:
            raise ValueError('n must be a positive integer')
        if self.used + n > self.limit:
            return False
        self.used += n
        return True

Run the receipt script again after the paste. Green means the contract held on this machine. Red means the evening is not done yet.

Repeat the same narrow prompt without extra scope. Do not widen the cap during a red receipt.

This is where pretend engineering usually starts tonight. A chat window often shows a confident paragraph. The paragraph claims all tests passed in spirit.

Spirit does not write a chmod locked receipt. The receipt also fights a newer failure mode.

Public talk says models outgrow old tests. That may be true for giant benchmarks. It is not true for a ten-line kitchen cap.

A tiny contract does not need to measure intelligence. It needs to block extra calls tonight. If the model outgrows the test, the test was vague.

Tighten the test instead of praising the speech. Solo founders should keep the loop ugly on purpose. Ugly loops are hard to screenshot as theater.

A red xml file is not a launch post. It is a brake for an evening merge.

Limitations sit beside the mug, not in a footnote. Free model access is not a named quota here. A free server is not a private vault either.

Latency, context, and uptime stay unspecified on purpose. The method will fail on large refactors. It will fail when secrets live in the tree.

It will fail when two services must move together. It will fail when the test describes the wrong product.

Regulated teams should skip this kitchen loop tonight. People who cannot send code off-box should skip it.

Medical and payments work should skip it as well. Anyone hunting model leaderboard glory should skip it.

The founder can still merge after tea with this. The bill stays at zero if the free path holds. The limit is the point, not a surprise.

The loop keeps one cap and one red file. It also keeps one read-only stub beside them.

If the office is a kitchen table this week, try the free path once. Keep a throwaway cap and keep the receipt.

Ship One SKU Before Dusk

Avery Lin — Wed, 16 Sep 2026 03:45:04 +0000

The kettle clicked off at seven on Sunday. A fold-out table still blocked the hallway. Stickers for a tiny waitlist sat in a shoebox.

The landing page still showed a gray TODO button. Last month a cloud invoice arrived after a binge. The founder taped that paper to the fridge.

Hot threads still argue about machines beating developers. That argument does not pay a studio rent. This stall needs one SKU shipped before dusk.

A SKU here means one user-visible change. It is not a platform, agent, or rewrite. It is a slug, a check, and a test.

The founder opened a git branch named sku-waitlist. No paid key lived in the shell environment. The work would stay local plus one free server.

An empty sku.py was committed before any model saw it. Git can only tax stock that already has a shelf. Untracked dumps would bypass the dusk line counter.

git checkout -b sku-waitlist
touch sku.py
git add sku.py
git commit -m "open the stall with empty stock"

A failing test came before any generated patch. That order is the whole shipping method. Hope is not a close-of-business ritual.

The first file on the table is test_sku.py. It imports nothing that costs money to run. Pytest on a laptop remains a free clerk.

from sku import to_sku


def test_simple_product_name() -> None:
    assert to_sku("Waitlist Sticker Pack") == "waitlist-sticker-pack"


def test_collapses_punctuation_and_spaces() -> None:
    assert to_sku("  Hello, Waitlist!! ") == "hello-waitlist"


def test_rejects_empty() -> None:
    raised = False
    try:
        to_sku("   ")
    except ValueError:
        raised = True
    assert raised

The test states the contract in boring English. A display name must become a lowercase slug. Spaces become hyphens, and other marks vanish.

The implementation file stays empty on purpose today. Green tests must be earned, never pasted in. An empty sku.py keeps the stall from lying.

Then the founder wrote a brief in BRIEF.md. The brief named the file, test, and limit. It skipped databases, auth, billing, and visual design.

# BRIEF.md
Change only sku.py.
Make the three tests in test_sku.py pass.
Do not add network calls, files, or extra dependencies.
Return a unified diff. Stop after one attempt.

A paid frontier call would have filled the file. It would also restock the fridge invoice fast. The stall kept the cash jar empty instead.

MonkeyCode enters here as a free workbench. Disclosure: This article was prepared as part of MonkeyCode's product outreach. The project offers free model access and a free server option.

The founder treated that pair as a folding chair. The chair is not a warehouse or an SLA. It holds one SKU session, then it folds.

The chat session itself stays deliberately dull and short. The next block is a proposed flow, not a screenshot. Commands after the copy step run only on the laptop.

# proposed session, unexecuted
# 1. Open the free server workspace.
# 2. Use free model access with BRIEF.md and test_sku.py.
# 3. Ask for a unified diff that touches sku.py only.
# 4. Copy the diff to sku.patch. Close the tab.

The laptop becomes the real sales counter again. Patches that cannot apply never reach the tests. The founder refuses to hand-merge a confused dump.

git apply --check sku.patch
git apply sku.patch
python -m pytest test_sku.py -q

A green bar is not yet a ship. The stall still needs a dusk ritual. Inventory that cannot sell must leave the table.

Save this script as stall.sh beside the tests. It encodes the Sunday close in boring shell. Run it after every patch, including human ones.

#!/usr/bin/env bash
set -euo pipefail

MAX_DIFF_LINES="${MAX_DIFF_LINES:-80}"
STALL_HOURS="${STALL_HOURS:-4}"
START_FILE=".stall_start"

if [[ ! -f "$START_FILE" ]]; then
  date +%s > "$START_FILE"
  echo "stall opened"
fi

start="$(cat "$START_FILE")"
now="$(date +%s)"
elapsed="$((now - start))"
limit="$((STALL_HOURS * 3600))"

if (( elapsed > limit )); then
  echo "dusk: fold the table (${elapsed}s)"
  exit 2
fi

if git grep -I -E -n '(api[_-]?key|secret|BEGIN OPENSSH)' -- '*.py' '*.md' '*.patch' ':!stall.sh'; then
  echo "secret-shaped text on the table"
  exit 3
fi

python -m pytest test_sku.py -q

diff_lines="$(git diff --numstat HEAD -- sku.py | awk '{s+=$1+$2} END {print s+0}')"
if (( diff_lines > MAX_DIFF_LINES )); then
  echo "too much unsold stock: ${diff_lines} lines"
  exit 4
fi

echo "SKU may ship"

The script is the unpaid clerk of the stall. It does not praise the model or the founder. It only measures tests, diff size, secrets, and time.

Make it executable once, then ignore it emotionally. The flags exist so a later Sunday can tighten limits. Default dusk is four hours from first run.

chmod +x stall.sh
STALL_HOURS=4 ./stall.sh

Add .stall_start to .gitignore so the clock stays local. The timestamp is a kitchen timer, not a product metric. Commit the script and leave the clock file untracked.

Four hours is a Sunday, not a company sprint. When the clock exceeds the limit, the stall folds. Unsold patches go in a drawer, not production.

Decision rules stay small enough to memorize at the table. The grid below is the whole credit policy. No extra framework is required to enforce it.

Signal	Ship the SKU	Fold the table
Tests	Green on `test_sku.py`	Still red after one retry
Diff	Under 80 lines in `sku.py`	Extra files or a dump
Secrets	None in patch or brief	Key-shaped strings appear
Clock	Inside the four-hour window	Dusk already passed

These rows beat another hour of prompt fishing. A large diff is leftover stock, not leverage. A secret in the patch closes the shutter now.

Retry policy is also part of the stall. One retry is a restock from the same brief. A second failure means the human writes the function.

That last step protects the founder's own judgment. Free models can stall on fussy string rules. Typing twenty lines still costs nothing but pride.

The slug module that finally shipped looks ordinary. It is the stock that actually left the table. Readers can paste it after the tests go green.

import re

_SPLIT = re.compile(r"[^a-z0-9]+")


def to_sku(name: str) -> str:
    lowered = name.casefold().strip()
    parts = [p for p in _SPLIT.split(lowered) if p]
    if not parts:
        raise ValueError("empty sku")
    return "-".join(parts)

Ordinary is the point of a Sunday stall. Users never clap for a hyphen in a slug. They do notice a waitlist form that actually works.

Limitations sit on the same table as the stickers. Free model access is not a written uptime contract. A free server option can change, pause, or queue.

Do not paste customer lists into the brief. Do not paste env files, dumps, or access tokens. Do not ask the model to design the whole company.

Latency will feel like a slow market morning. Output quality will jump around between sessions. The stall script exists because that variance is real.

This approach is wrong for several honest cases. Regulated data work needs a vendor with agreements. On-call products need capacity that a folding chair lacks.

Multi-hour refactors do not fit a dusk close. A team merge train needs review tools, not stickers. Anyone chasing leaderboard scores should pick another arena.

The public argument about vibe coding misses cashflow. Calling a chat log engineering does not ship a SKU. Calling a saved test file engineering sometimes does ship.

Indie work in late 2026 still collides with model hype. The useful move is smaller: freeze scope, freeze spend. Let a free workbench propose, and let dusk decide.

Founders can try MonkeyCode's free model access and free server. Then stall.sh still closes the table at dusk.

The fridge invoice can stay taped as kitchen art. The jar stays empty while the SKU still ships. Monday gets a form, not another cloud receipt.

The Second Run Should Cost Nothing

Avery Lin — Mon, 14 Sep 2026 21:31:53 +0000

It was 2:41 in the morning. A solo founder watched the same failing test scroll past forty times.

The agent loop was not broken. It did exactly what it was told: retry, retry, retry.

By sunrise the test still failed. The only thing that had moved was the meter.

That scene explains a budget better than any pricing page. Agent spend rarely dies from one huge prompt. It dies from the same prompt sent forty times.

Disclosure: This article was prepared as part of MonkeyCode's product outreach.

The operator states that MonkeyCode provides free model access and a free server option. Quota details change over time, so read the project page for current numbers instead of trusting a blog post. For a one-person shop, the allowance is not the interesting part. The harness you wrap around it is.

Retries Are Not a Model Problem

A retry loop is a deterministic machine. It keeps no memory of the last attempt.

So it pays twice for the same question. Then it pays again when the test still fails.

Engineers call this an idempotency problem. Sending the same request twice should be harmless. Model calls are the opposite: identical input, identical output, two invoices.

The fix is old and boring. Put a cache in front of the model and a ceiling behind it.

The Ledger: Sixty Lines and a Hash

The artifact below is a small Python module. It keys every prompt by SHA-256, stores the answer on disk, and refuses to pass a daily call ceiling.

Calls are counted locally on purpose. Token accounting from a free endpoint is inconsistent, and a number you cannot audit is a number you cannot budget.

# ledger.py - idempotent model calls with a hard daily ceiling
import hashlib, json, os, time, pathlib, urllib.request

ROOT = pathlib.Path(os.environ.get("LEDGER_DIR", ".ledger"))
ROOT.mkdir(exist_ok=True)
CACHE, CALLS = ROOT / "cache.jsonl", ROOT / "calls.log"
CEILING = int(os.environ.get("DAILY_CALL_CEILING", "200"))

def key_for(prompt: str) -> str:
    body = json.dumps({"prompt": prompt}, sort_keys=True)
    return hashlib.sha256(body.encode()).hexdigest()[:16]

def calls_today() -> int:
    if not CALLS.exists():
        return 0
    today = time.strftime("%Y-%m-%d")
    return sum(1 for l in CALLS.read_text().splitlines() if l.startswith(today))

def cached(key: str):
    if not CACHE.exists():
        return None
    for line in CACHE.read_text().splitlines():
        row = json.loads(line)
        if row["key"] == key:
            return row["text"]
    return None

def ask(prompt: str) -> str:
    key = key_for(prompt)
    hit = cached(key)
    if hit is not None:
        return hit                       # replay: zero cost
    if calls_today() >= CEILING:
        raise RuntimeError(f"ceiling {CEILING} reached; inspect, do not retry")
    req = urllib.request.Request(
        os.environ["MODEL_BASE_URL"].rstrip("/") + "/chat/completions",
        data=json.dumps({"model": os.environ["MODEL_NAME"],
                         "messages": [{"role": "user", "content": prompt}]}).encode(),
        headers={"Content-Type": "application/json",
                 "Authorization": "Bearer " + os.environ["MODEL_API_KEY"]})
    with urllib.request.urlopen(req, timeout=120) as r:
        text = json.load(r)["choices"][0]["message"]["content"]
    with CACHE.open("a") as f:
        f.write(json.dumps({"key": key, "prompt": prompt, "text": text}) + "\n")
    with CALLS.open("a") as f:
        f.write(f"{time.strftime('%Y-%m-%d')} {key}\n")
    return text

Read the order inside ask. It checks the cache first, then the ceiling, then the network. The network is the last resort, not the first move.

The module knows nothing about agents. It knows that a question already answered should not be asked again.

Prove It With Two Commands

Never trust a cache you have not measured. Send one prompt twice and count the log lines.

export MODEL_BASE_URL="https://<endpoint-from-the-project-page>/v1"
export MODEL_NAME="<a free model listed on the project page>"
export MODEL_API_KEY="<your key>"
export DAILY_CALL_CEILING=50

python -c "import ledger; print(ledger.ask('reply with: ok')[:40])"
python -c "import ledger; print(ledger.ask('reply with: ok')[:40])"
wc -l .ledger/calls.log      # expected: 1

One line means the second call was free. Raise the ceiling to your real workload and watch the log for a day.

If .ledger/calls.log grows faster than your commit history, the loop is the problem. Not the model.

Quarantine the Failure

A deterministic harness needs a place for tasks that already failed. Otherwise each pass reintroduces them.

while read -r task; do
  python run_task.py "$task" || echo "$task" >> .ledger/quarantine.txt
done < tasks.txt

The quarantine file is the human inbox. A task leaves it only after someone edits the prompt or the test.

That single rule turns a runaway loop into a queue with a gate. It also keeps a solo founder honest about what is genuinely blocked.

The recent argument that most agent stacks are deterministic glue in costume is roughly correct. The useful work is deciding which glue, and where the money stops.

What Belongs on a Free Endpoint

Free access is a resource with a shape. Match the shape to the work, or the harness fights you.

Workload	Free endpoint	Paid endpoint
Drafts and tests you review anyway	Yes	Unnecessary
Same prompt replayed after a failure	Yes, cached (zero calls)	Wasteful
User-facing responses with a latency budget	No	Yes
Hundreds of calls per hour	Usually no	Maybe
Private customer code	Only if the provider's terms allow it	Case by case

The free server option matters for a different reason. The ledger and the loop can run on it overnight, while the founder sleeps. A laptop closed at midnight stops shipping.

Limits, Stated Plainly

The cache key covers the prompt only. Change the model name or the context and it misses.

Appending to one file works for one process. Two concurrent workers will interleave lines, so move to SQLite before parallelizing.

Free tiers change without warning. A ceiling that reads 200 today may need another value next month, and no blog post can guarantee it.

This approach suits a solo founder validating an idea on nights and weekends. It does not suit a team that needs a shared cache, an audit trail, or firm latency guarantees. Anyone handling regulated data should not route it through a free endpoint at all.

The Only Rule That Matters

A failed run should teach you something. It should not charge you for the lesson.

Wrap the free model in a ledger, cap the day, and quarantine what breaks. Do that before adding another agent framework.

If the weekend is quiet, deploy the loop on the free server and let it run. The bill stays at zero. The commits keep coming.

A Borrowed Garage for the First Ship

Avery Lin — Sun, 13 Sep 2026 19:48:39 +0000

The founder sat under a kitchen bulb at 23:40.
Rain hit the window of a one-room rental.
A signup form posted and came back as 500.

A cloud console waited with an empty billing form.
One hosted model refused to run without a card.
The night would die inside that checkout flow.

Forum threads this week praised models over human coders.
Other threads treated agents as costumes over plain scripts.
A solo founder can leave both debates unread.

This shop does not need a digital employee.
It needs a borrowed garage for a single bicycle.
The bay offers wall tools, a floor, and one working wheel.

The method stays small on purpose for this night.
A human writes a failing test by hand.
A model may patch product code until that test turns green.

No agent loop sits on top of that.
No tool-calling graph rents a fleet of servers.
A file, a receipt, and a test runner finish the job.

Indie work has a cash shape as well as a code shape.
The first invoice should follow the first user, not precede it.
A free coding path is a loaned wrench for that order.

MonkeyCode is an open-source project aimed at that constraint.
It currently offers free model access and a free server option.

Disclosure: This article was prepared as part of MonkeyCode's product outreach.
The product mention stops here so the method can stand alone.

The workflow below still holds if that workshop is ignored.
A laptop and pytest already close the Friday loop.
The extra server is only a second bay for a public URL.

Paid platforms often optimize for long looping sessions.
A one-person shop optimizes for a billed-at-zero night.
The receipt exists to keep that night from sprawling.

The target for the night is deliberately boring.
The night needs one register function and one blank-email hole.
One handwritten test guards that hole before any prompt.

Blank email is a good Friday bug for a reason.
It is local, testable, and visible in one function.
A founder can finish it before the kettle cools.

The snippets are a worked example, not a client story.
Create a folder and drop in a tiny module.

# app.py — worked example, not production history
STORE = []


def register(email: str) -> dict:
    STORE.append({"email": email})
    return {"ok": True, "email": email}

Empty strings still walk into the in-memory store.
The founder can see that without a model.
The model is not invited to play detective.

The red test is written by hand next.
The file lives under tests and imports the module.

# tests/test_signup.py — worked example
from app import STORE, register


def test_register_rejects_blank_email():
    STORE.clear()
    try:
        register("")
    except ValueError:
        assert STORE == []
        return
    raise AssertionError("blank email must not register")

Run that test before any prompt is written.
Keep the module on PYTHONPATH so pytest can import it.

mkdir -p tests
export PYTHONPATH=.
python3 -m pytest tests/test_signup.py -q
echo $?

The pytest command must fail on that file.
That failure is the ticket into the garage.
Without a red ticket, the wrench stays on the hook.

The founder now asks a coding model for a patch.
The prompt names the test and forbids new files.
The answer is saved as a unified diff, nothing else.

# worked example: store the model output, do not pipe it yet
cat > /tmp/model.patch <<'EOF'
--- a/app.py
+++ b/app.py
@@ -3,5 +3,7 @@ STORE = []

 def register(email: str) -> dict:
+    if not email or not email.strip():
+        raise ValueError("email required")
     STORE.append({"email": email})
     return {"ok": True, "email": email}
EOF

A typical agent would now chain more tool calls.
This loop refuses that chain on purpose.
A receipt script reads the patch like a landlord.

#!/usr/bin/env python3
"""Worked example: accept a model patch only with a red test."""
from __future__ import annotations

import argparse
import hashlib
import json
import re
import sys
from datetime import datetime, timezone
from pathlib import Path

SECRET_HINT = re.compile(
    r"(api[_-]?key|secret|password|BEGIN (RSA |OPENSSH )?PRIVATE KEY)",
    re.I,
)
MAX_FILES = 4
MAX_LINES = 120


def parse_diff_paths(diff: str) -> list[str]:
    paths = []
    for line in diff.splitlines():
        if line.startswith("+++ b/"):
            paths.append(line[6:].strip())
    return paths


def main() -> int:
    parser = argparse.ArgumentParser(description="Borrowed-garage patch receipt")
    parser.add_argument("--diff", required=True)
    parser.add_argument("--require-test", required=True)
    parser.add_argument("--out", default="garage_receipt.json")
    args = parser.parse_args()

    diff_text = Path(args.diff).read_text(encoding="utf-8")
    test_path = Path(args.require_test)
    if not test_path.is_file():
        print("receipt: missing named test", file=sys.stderr)
        return 2

    paths = parse_diff_paths(diff_text)
    if not paths:
        print("receipt: empty diff", file=sys.stderr)
        return 2
    if len(paths) > MAX_FILES:
        print(f"receipt: too many files: {paths}", file=sys.stderr)
        return 2

    for path in paths:
        if Path(path).name == test_path.name:
            print("receipt: model cannot edit the red test", file=sys.stderr)
            return 2
        if path.endswith(".pem") or path.endswith(".env"):
            print("receipt: forbidden path", file=sys.stderr)
            return 2

    touches = sum(
        1
        for line in diff_text.splitlines()
        if line.startswith("+") or line.startswith("-")
    )
    if touches > MAX_LINES:
        print("receipt: diff too large", file=sys.stderr)
        return 2
    if SECRET_HINT.search(diff_text):
        print("receipt: secret-shaped text", file=sys.stderr)
        return 2

    digest = hashlib.sha256(diff_text.encode("utf-8")).hexdigest()[:16]
    receipt = {
        "test": str(test_path),
        "files": paths,
        "line_touches": touches,
        "diff_sha256_16": digest,
        "recorded_at": datetime.now(timezone.utc).isoformat(),
        "status": "ok_to_apply",
    }
    Path(args.out).write_text(json.dumps(receipt, indent=2) + "\n", encoding="utf-8")
    print(json.dumps(receipt, indent=2))
    return 0


if __name__ == "__main__":
    raise SystemExit(main())

Save it as garage_receipt.py and run it once.
The command prints JSON or a rejection line.

chmod +x garage_receipt.py
python3 garage_receipt.py --diff /tmp/model.patch --require-test tests/test_signup.py

A JSON blob should appear with status ok_to_apply.
That blob is the broom at the end of the night.
It records files, a hash, and the named test.

Apply the patch only after that status prints.
Use patch so an empty folder does not need git yet.

patch -p1 < /tmp/model.patch
export PYTHONPATH=.
python3 -m pytest tests/test_signup.py -q

A green result means the bicycle wheel turns.
A red result means the patch goes in the bin.
There is no debate with a failed receipt.

A Makefile keeps the hands in that order.
Four targets refuse any mixed sequence from agent demos.

.PHONY: red receipt apply green

export PYTHONPATH := .

red:
    python3 -m pytest tests/test_signup.py -q; test $$? -eq 1

receipt:
    python3 garage_receipt.py --diff /tmp/model.patch --require-test tests/test_signup.py

apply:
    patch -p1 < /tmp/model.patch

green:
    python3 -m pytest tests/test_signup.py -q

The founder types make red, then make receipt, then make apply.
The last step is make green, nothing else.
Any other order is a habit from paid agent demos.

The garage metaphor stays strict for a reason.
A neighbor who lends a bay does not expect a new pit.
The visitor fixes one bike and sweeps the oil.

Free model access plays the role of that loaned wrench.
It is not a staff engineer and not a research lab.
The free server option is a second bay for a demo URL.

Skip the remote box when the laptop still compiles.
Copy only a built folder when a URL would help.
Do not let the model invent a second database.

# unexecuted example — replace HOST with a box the founder already controls
# rsync -az --delete dist/ HOST:~/first-ship/

That copy remains optional in this worked example.
It assumes a host the founder already owns.
A free server option can stand in for that host.

Limits sit beside the receipt, not under it.
Free model access can change without a letter.
Patch quality swings with task shape and luck.

The script does not prove users want the product.
It does not prove the patch is kind to later readers.
It only proves one named test moved from red to green.

Wide refactors do not belong in this bay.
Migrations, IAM, and payment webhooks need a slower desk.
Those changes want two humans and a weekday morning.

Regulated customer data should never enter this loop.
Secrets in prompts leak into logs and receipts.
A public free server is the wrong shelf for customer dumps.

Latency SLAs do not live on borrowed floors.
Overnight agent runs do not belong here either.
This method wants a human awake at the folding desk.

Awe and scorn will keep trading places in feeds.
An indie founder can mute both until the form returns 201.
The score is a working signup, not a thread reply.

Write the red test on the founder's own time.
Borrow the wrench only for the smallest patch.
Sweep with a receipt before anyone else sees the bay.

If the laptop still has heat, stop there.
Invite one user only after the green test holds.
Then close the billing tab and go to sleep.

The Suitcase Test Before Monday

Avery Lin — Sat, 12 Sep 2026 17:46:27 +0000

The founder copied a working script at 12:10 a.m. On the laptop the waitlist form returned 201. On a blank box the same script died immediately.

A leftover virtualenv had hidden the real breakage. A local secret file had fed the client. The house was overpacked after six loud weeks.

Indie week looks like this more often than decks admit. The solo shop still ships from one crowded machine. That crowded machine already knows far too much. Env files, cached wheels, and yesterday's model output all sit nearby.

Paid clouds make the same lie more expensive. A GPU bill does not prove the patch is portable. It only proves the founder can rent a louder hotel.

The useful move is much smaller than that. Draft the patch at home without extra services. Unpack the same bag in an empty apartment. Merge the patch only when both rooms agree.

This article treats that empty apartment as a workflow. The code below is an example, not a production run. No named model is required for the ritual. No token quota is claimed in these pages.

An empty apartment still needs three cheap rules. The repo must boot from a lockfile. Tests must not read the founder's home directory. The model may draft, but tests own the merge.

Some indie shops point the draft step at MonkeyCode. Disclosure: This article was prepared as part of MonkeyCode's product outreach. The project is offered as an open source codebase. It offers free model access and a free server option. Those two availability claims come from the operator. This write-up does not add model names, hardware, or lasting quotas.

The rest of the method still works if that product is removed. A clean clone and a strict test gate carry the weight.

The Friday scene continues without a new invoice. The founder needed a waitlist endpoint before Monday. No invoice was allowed to follow the patch. The form had to survive a stranger's shell.

The envelope lives under tools/suitcase/ on purpose. Boring tools survive a noisy launch week intact.

# tools/suitcase/contract_test.py
# Example only. Not executed for this article.

from http.server import BaseHTTPRequestHandler, HTTPServer
import json, threading, unittest, urllib.error, urllib.request

class Handler(BaseHTTPRequestHandler):
    def do_POST(self):
        if self.path != "/waitlist":
            self.send_error(404)
            return
        n = int(self.headers.get("Content-Length", "0"))
        body = json.loads(self.rfile.read(n) or b"{}")
        email = body.get("email", "")
        domain = email.split("@")[-1] if "@" in email else ""
        if "@" not in email or "." not in domain:
            self.send_response(400)
            self.end_headers()
            return
        self.send_response(201)
        self.send_header("Content-Type", "application/json")
        self.end_headers()
        self.wfile.write(json.dumps({"ok": True}).encode())

    def log_message(self, *args):
        return

class WaitlistContract(unittest.TestCase):
    @classmethod
    def setUpClass(cls):
        cls.httpd = HTTPServer(("127.0.0.1", 0), Handler)
        cls.port = cls.httpd.server_address[1]
        t = threading.Thread(target=cls.httpd.serve_forever, daemon=True)
        t.start()

    def post(self, payload):
        req = urllib.request.Request(
            f"http://127.0.0.1:{self.port}/waitlist",
            data=json.dumps(payload).encode(),
            headers={"Content-Type": "application/json"},
            method="POST",
        )
        try:
            with urllib.request.urlopen(req, timeout=2) as r:
                return r.status, json.loads(r.read())
        except urllib.error.HTTPError as e:
            return e.code, {}

    def test_accepts_plain_email(self):
        status, body = self.post({"email": "ava@example.com"})
        self.assertEqual(status, 201)
        self.assertTrue(body.get("ok"))

    def test_rejects_garbage(self):
        status, _ = self.post({"email": "not-an-email"})
        self.assertEqual(status, 400)

if __name__ == "__main__":
    unittest.main()

That file is the packing list on the counter. The model does not get to choose the list. The founder writes the contract before any draft. The patch must match that list or leave.

The prompt stays short for a hard reason. A long prompt invites a long unpaid night. Indie time is the real scarce resource here.

# tools/suitcase/prompt.txt
# Example prompt. Keep it short.

Add POST /waitlist to app.py.
Read only app.py and tools/suitcase/contract_test.py.
Do not touch secrets, CI, or package managers.
Return a unified diff and nothing else.
Reject the email when it lacks @ or a dot in the domain.
Return 201 and {"ok": true} for a normal address.

A wrapper then treats the model like a draftsman. The draftsman gets a time card and a fence. The script below is an unexecuted sketch only. Wire draft_cmd to a free CLI the shop already runs.

#!/usr/bin/env bash
# tools/suitcase/draft.sh
# Example only. Unexecuted.

set -euo pipefail
ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
cd "$ROOT"

git diff --quiet && git diff --cached --quiet
test -z "$(git ls-files --others --exclude-standard)"

if python3 tools/suitcase/contract_test.py; then
  echo "contract already green; refuse to draft"
  exit 2
fi

mkdir -p .suitcase
cp tools/suitcase/prompt.txt .suitcase/prompt.txt

# draft_cmd is local to the shop.
# Example: a free-model CLI that prints a unified diff.
draft_cmd --prompt-file .suitcase/prompt.txt > .suitcase/patch.diff

grep -q '^diff --git ' .suitcase/patch.diff
grep -qv 'BEGIN RSA' .suitcase/patch.diff
grep -qv 'SECRET' .suitcase/patch.diff

git apply --check .suitcase/patch.diff
git apply .suitcase/patch.diff
python3 tools/suitcase/contract_test.py

Home success is still not enough for tonight. The laptop knows the founder's PATH too well. It knows a global package cache by heart. It knows a dotenv file a stranger will never have.

The empty apartment is a clean clone on purpose. A free server option is enough for this check. The founder does not need a GPU for a waitlist form.

#!/usr/bin/env bash
# tools/suitcase/unpack.sh
# Example only. Unexecuted.

set -euo pipefail
HOST="${SUITCASE_HOST:?set SUITCASE_HOST}"
ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
cd "$ROOT"

test -z "$(git status --porcelain)"
SHA="$(git rev-parse HEAD)"

ssh "$HOST" 'test -d ~/suitcase.git || git init --bare ~/suitcase.git'
git push --force "ssh://$HOST/~/suitcase.git" HEAD:launch

ssh "$HOST" bash -s <<EOF
set -euo pipefail
rm -rf "\$HOME/suitcase_work"
git clone "\$HOME/suitcase.git" "\$HOME/suitcase_work"
cd "\$HOME/suitcase_work"
git checkout $SHA
test ! -f .env
test ! -d venv
python3 -m venv .clean
. .clean/bin/activate
pip install -q -r requirements.txt
python3 tools/suitcase/contract_test.py
EOF

The remote script is the point of the night. It refuses a leftover dotenv file on sight. It builds a throwaway venv from the lockfile. It runs the same contract the laptop just ran. If this step fails, the laptop was lying.

A small ignore file keeps the lie from traveling.

# extra lines for .gitignore
.suitcase/
.clean/
.env
.env.*
venv/
.venv/

The founder then records both rooms in the commit. Future self will need that breadcrumb much later. Launch week forgets why a patch felt safe.

Waitlist POST returns 201 for plain email.

Home unpack: python3 tools/suitcase/contract_test.py
Empty apartment: unpack.sh on the free box
Model drafted the diff. Tests owned the merge.

Limits sit beside the ritual, not after it. A free model lane can sit in a queue. A free server option can throttle or pause. This article does not freeze those terms for anyone. Public caps can change without a matching blog post. Remote queues also change without a warning banner. Treat both as a spare room, not a lease.

The method also fails closed in honest ways. It does not replace a human reading the diff. It does not prove load around the form. It does not prove XSS, CSRF, or inbox spam. It proves only that clean Python can serve the contract.

Secrets do not belong inside the prompt file. Secrets do not belong on the borrowed box either. The remote script assumes a throwaway waitlist service. It does not assume a customer database nearby. Copying production dumps onto a free server is a bad story.

Teams with a real staging cluster already have an empty apartment. Regulated shops cannot send diffs to a shared free model. Founders who need GPU training are in another building. Anyone who lets the model merge without tests skipped the method.

The Monday check is a clone on a friend's laptop. Run the contract with no whispered environment variables. If the bag needs a private garnish, it was never packed. The empty apartment told the truth before any invoice.

Indie shipping is not a bigger agent loop. Extra tool hops do not create a teammate. The founder already knows the actual merge gate. Tests go red, a draft appears, tests go green. The clean room goes green, then the merge happens.

A suitcase test keeps that merge gate honest. The bill stays at zero for this class of patch. The limits stay in the room where they belong. The merge stays with the founder, not the draft.

A Clerk Stamps Once

Avery Lin — Fri, 11 Sep 2026 15:33:35 +0000

The kitchen light hummed over a closed laptop lid.
A solo founder opened it at twenty-one zero seven.
One billing screen still blocked the Saturday launch.

Stripe tabs glowed beside a mug gone cold.
An agent video promised patches while nobody watched.
That theater needed a card the wallet refused.

The founder did not need a roaming intern.
The founder needed a clerk with one stamp.
A clerk reads a form, writes once, then stops.

Most public agent demos hide a costly loop.
Each retry burns tokens and invents extra files.
A Saturday ship cannot afford that fog.

This workflow treats the model as a clerk.
The clerk receives a touch list and one prompt.
Local tests run hard after that single reply.

No cloud queue waits in another region.
No agent framework sits between git and the patch.
The laptop stays the only machine that matters.

The product was a tiny usage dashboard.
Customers could already log in and see counts.
They could not download a CSV of those counts.

That remaining gap was small and painfully specific.
It lived in two existing TypeScript source files.
It did not need a queue or a new service.

Fence the garden

The founder wrote a touch list before any prompt.
The list named files the clerk could change.
Anything outside that list failed the window.

# touch.allow
src/pages/Usage.tsx
src/lib/usageExport.ts
src/pages/Usage.test.tsx

A touch list is a fence around a garden.
The clerk may pick tomatoes inside the fence.
The clerk may not pave a road outside.

Agent loops look busy and feel like progress.
They retry, replan, and reopen the same wound.
A clerk stamps the form a single time.

The founder saved a prompt with hard edges.
The prompt named the gap and the allowed files.
It banned new dependencies and new cloud calls.

# prompt.txt
Task: add a CSV export on the usage page.
Touch only the files listed in touch.allow.
Reuse the existing usage fetch in src/lib.
Do not add dependencies, queues, or env vars.
Do not create new folders or config files.
Return a unified diff and nothing else.

Short prompts starve the urge to invent scenery.
Long prompts invite extra architecture from a stranger.
The Saturday clerk gets a narrow ticket only.

Stamp once

A small shell script owned the ship window.
It refused a dirty tree and a missing allow list.
It prepared one call, then refused a second.

#!/usr/bin/env bash
# clerk.sh — one shot, then tests. No retry loop.
set -euo pipefail
MINUTES="${1:-90}"
ROOT="$(git rev-parse --show-toplevel)"
cd "$ROOT"

if ! git diff --quiet || ! git diff --cached --quiet; then
  echo "dirty tree; commit or stash first" >&2
  exit 1
fi

test -f touch.allow
test -f prompt.txt
test -x ./call_once.sh
test -x ./apply_once.sh
test -x ./verify.sh

echo "ship window: ${MINUTES} minutes, one model call"
./call_once.sh
./apply_once.sh /tmp/clerk.diff
./verify.sh

echo "clerk finished; founder still reads the diff"

The clock belongs to the founder, not the model.
Ninety minutes is a hard cap, not an SLA.
When the ninety minutes end, the window is over.

The clerk writes one unified diff to disk.
A tiny filter then checks every touched path.
A second model call is forbidden on purpose.

#!/usr/bin/env bash
# apply_once.sh
set -euo pipefail
DIFF="${1:-/tmp/clerk.diff}"
ALLOW="touch.allow"

test -s "$DIFF"

awk '/^+++ b\// { print substr($0,7) }' "$DIFF" | while read -r path; do
  if [[ "$path" == "/dev/null" ]]; then
    continue
  fi
  if ! grep -qxF "$path" "$ALLOW"; then
    echo "clerk left the garden: $path" >&2
    exit 1
  fi
done

if grep -E '^(\+\+\+ b/)(package-lock\.json|pnpm-lock\.yaml|Dockerfile|terraform/)' "$DIFF"; then
  echo "clerk tried to pave a road" >&2
  exit 1
fi

git apply --check "$DIFF"
git apply "$DIFF"

The garden metaphor stays cheap and strictly local.
A paved road is a new bill in disguise.
The script treats that road as a hard error.

#!/usr/bin/env bash
# verify.sh
set -euo pipefail
npm test -- src/pages/Usage.test.tsx
npx tsc --noEmit

if ! git diff --quiet -- package.json; then
  echo "package.json moved; revert and rewrite by hand" >&2
  exit 1
fi

Green tests still do not prove product taste.
They prove the clerk stayed inside the fence.
The founder still reads the diff before push.

Accept the slow desk

A closed wallet still needs a place for the prompt.
Paid agent hosts turn a CSV button into a tab.
The founder wanted that tab to stay at zero.

MonkeyCode offered free model access for this clerk call.
It also offered a free server option for the same desk.
Disclosure: This article was prepared as part of MonkeyCode's product outreach.

The same files run against a local endpoint.
They also run against any OpenAI-compatible chat URL.
The allow list and the tests remain the source of truth.

A sample call kept the retry count at zero.
The script below posts once and then exits.
Empty bodies fail closed instead of silent retrying.

#!/usr/bin/env bash
# call_once.sh
set -euo pipefail
ENDPOINT="${MODEL_ENDPOINT:?set MODEL_ENDPOINT}"
BODY="$(jq -n --rawfile p prompt.txt '{
  messages: [{role:"user", content:$p}],
  stream: false
}')"

curl -sS --max-time 120 -X POST "$ENDPOINT" \
  -H "content-type: application/json" \
  -d "$BODY" \
  -o /tmp/clerk.json

jq -r '.choices[0].message.content // .content // empty' \
  /tmp/clerk.json > /tmp/clerk.diff

if ! grep -qE '^(diff --git|--- )' /tmp/clerk.diff; then
  echo "no diff in clerk body; founder writes it" >&2
  exit 1
fi

The response JSON shape still varies across hosts.
The founder kept a small jq fallback on purpose.
If the body lacked a diff, the window failed closed.

No second curl appears anywhere in this script.
Failure means the human writes the patch instead.
That rule is the whole point of a clerk.

The first useful diff changed Usage.tsx in place.
It reused the existing fetch, not a new client.
The test file asserted a CSV header and one row.

// src/pages/Usage.test.tsx
import { render, screen } from "@testing-library/react";
import userEvent from "@testing-library/user-event";
import { Usage } from "./Usage";

test("exports a csv with the usage header", async () => {
  const user = userEvent.setup();
  render(<Usage />);
  await user.click(screen.getByRole("button", { name: /export csv/i }));
  expect(screen.getByTestId("last-export")).toHaveTextContent("date,count");
});

That test is a receipt, not a novel.
A shop receipt lists items and a total.
The founder reads that receipt the same way.

The clerk tried to add a helpers folder once.
apply_once.sh rejected the path and stopped cold.
The founder reset the tree with git checkout.

git checkout -- src
rm -f /tmp/clerk.diff
# start a new window; do not hide a retry

A hidden retry would paper over the fence.
A new window makes the fence visible again.
The CSV button then shipped quietly before midnight.

No queue, no worker, and no extra vendor row.
The bill for the night stayed a round zero.
The founder accepted slow answers as the tax.

Free model access is not a quality contract.
A clerk can still write a wrong export.
Tests catch crashes, not ugly product copy choices.

A free server option can pause or slow down.
This workflow assumes the founder can wait longer.
It also assumes the founder can patch by hand.

Do not send secrets, tokens, or customer rows.
The prompt holds file names and a public gap.
Anything private stays off the wire tonight.

Skip this approach for any multi-service redesign.
Skip it when compliance needs a paper trail.
Skip it when the change set is unknown.

Teams with a paid agent budget can ignore this.
They already bought the roaming intern on purpose.
A solo founder with a closed wallet stays here.

The method also fails when the allow list lies.
If every file is allowed, the fence is theater.
Keep the list shorter than a grocery note.

The agent video will still play tomorrow morning.
It will still look like a factory after dark.
A Saturday product needs a stamp, not a factory.

The clerk stamps once and the tests speak next.
The founder reads, then pushes, then finally sleeps.
The wallet stays closed through all three steps.

A quiet weekend trial of that free desk is enough.
Keep these scripts as the real control plane.
No extra pitch belongs on a closed wallet.