DEV Community: Haley

Rehearse the Hand-Back Before You Ship the Agent

Haley — Sat, 17 Oct 2026 05:44:57 +0000

Last week I watched a designer approve an agent's refund draft in four seconds.

The policy clause sat behind a quiet little link. She never opened it. Nothing in the log recorded the skip.

Who owned that decision? She did. What was the consequence? A refund policy might not allow. Where was the point of reversibility? Gone with one click.

I build drills for that moment now. Not demos, not trust surveys. A drill is a small, boring harness that asks one question: can a real reviewer find the missing evidence and act before the agent ships?

Below is the whole thing, zero to working. Every stage ends with a check you can run. If the check fails, stop there. Don't move on and hope.

Stage 1 — Write the missing evidence into a file

Thoughts are not testable. A JSON file is.

Pick one decision, one deliberately missing field, and one correct first action. Here is my refund scenario.

{
  "id": "refund-hold-01",
  "decision": "Approve a 42.00 EUR refund",
  "agent_state": "Draft ready, nothing sent",
  "interrupt_at": "before send",
  "missing_field_on_purpose": "Refund window: 30 days from delivery",
  "correct_first_action": "open_policy_clause",
  "stop_condition": "Reviewer approves without opening the clause"
}

Look at correct_first_action. That is what I measure. Not whether they felt confident. Not whether they liked the card. Whether they opened the clause before approving.

Check: read the file aloud to a colleague. If they cannot say who decides and what a wrong click costs, rewrite the fields.

Stage 2 — Serve it, don't slide it

Slides get skipped. Pages get clicked. I use only the Python standard library, so there is nothing to install.

import json, time, pathlib
from http.server import BaseHTTPRequestHandler, HTTPServer
from urllib.parse import urlparse

SCEN = json.loads(pathlib.Path('scenario.json').read_text())
LOG = pathlib.Path('sessions.jsonl')

PAGE = f'''<!doctype html>
<html lang='en'><head><meta charset='utf-8'>
<meta name='viewport' content='width=device-width,initial-scale=1'>
<title>Hand-back drill</title></head>
<body>
<h1>{SCEN['decision']}</h1>
<p>{SCEN['agent_state']}.</p>
<p><a href='#policy' id='clause'>Policy clause</a></p>
<p id='policy' hidden>{SCEN['missing_field_on_purpose']}</p>
<button id='approve'>Approve refund</button>
<script>
const send = (name) => fetch('/log', {{method: 'POST', body: JSON.stringify({{id: '{SCEN['id']}', action: name}})}});
document.getElementById('clause').addEventListener('click', () => {{ document.getElementById('policy').hidden = false; send('open_policy_clause'); }});
document.getElementById('approve').addEventListener('click', () => send('approve'));
</script>
</body></html>'''

class H(BaseHTTPRequestHandler):
    def send(self, body, ctype='text/html'):
        data = body.encode()
        self.send_response(200)
        self.send_header('Content-Type', ctype)
        self.send_header('Content-Length', str(len(data)))
        self.end_headers()
        self.wfile.write(data)

    def do_GET(self):
        path = urlparse(self.path).path
        if path == '/health':
            return self.send('ok', 'text/plain')
        if path == '/verdict':
            return self.send(verdict(), 'text/plain')
        return self.send(PAGE)

    def do_POST(self):
        n = int(self.headers.get('Content-Length', 0))
        event = json.loads(self.rfile.read(n) or b'{}')
        event['t'] = time.time()
        with LOG.open('a') as f:
            f.write(json.dumps(event) + '\n')
        return self.send('logged', 'text/plain')

def verdict():
    rows = [json.loads(l) for l in LOG.read_text().splitlines()] if LOG.exists() else []
    opened = any(r['action'] == 'open_policy_clause' for r in rows)
    approved = any(r['action'] == 'approve' for r in rows)
    if not approved:
        return 'no decision yet'
    return 'correct' if opened else 'skipped'

if __name__ == '__main__':
    HTTPServer(('0.0.0.0', 8000), H).serve_forever()

Start it and check the health route.

python3 drill.py &
curl -s localhost:8000/health

Check: you must see ok. If not, don't invite a reviewer yet.

Stage 3 — Log the skip, not the sentiment

Every click lands in sessions.jsonl with a timestamp. Two numbers come out: seconds to the correct first action, and skip rate.

curl -s -X POST -d '{"id":"refund-hold-01","action":"approve"}' localhost:8000/log
curl -s localhost:8000/verdict
cat sessions.jsonl | tail -n 2

If the verdict says skipped, the link was too quiet or the copy was wrong. Don't blame the reviewer yet.

Check: reproduce a skip yourself on purpose. If the log cannot catch your own skip, it cannot catch anyone's.

One caveat I learned the hard way. This verdict is global across the file. Delete sessions.jsonl between sessions, or add a session id per run.

Stage 4 — Read a script and keep your mouth shut

Facilitators ruin drills. One hint and the data becomes theatre.

Three lines, read cold. "This is a draft. Nothing is sent yet. Approve when you're ready." Then silence.

Stop the session if the reviewer asks what the clause says and you answer. That is coaching, not evidence.

Check: write those three lines down before the session, then compare. Ad-libbing is a failed check.

Stage 5 — Generate variants, then throw most away

One scenario proves nothing. I generate ten and keep the ones that change the surface without changing the correct first action.

This is where MonkeyCode's free model access helped me draft variant copy at volume. Disclosure: This article was prepared as part of MonkeyCode's product outreach. The free-access and free-server claims are operator-supplied here, so check the current plan page yourself before relying on any limit.

Keep the brief in a file so variants stay comparable.

# prompts/variants.md
- Same decision, same correct first action.
- Vary label wording, link prominence, field order.
- Never paste the policy text into the card.
- Output one JSON object per line.

Then triage with jq instead of reading ten drafts at midnight.

jq -c 'select(.correct_first_action == "open_policy_clause")' variants.jsonl > keep.jsonl
wc -l keep.jsonl

Check: every kept variant must fail in the same direction when skipped. A variant that cannot be skipped tests nothing at all.

Stage 6 — Put it on a real URL

Localhost is a lab coat. People behave differently on a link they can open on a phone.

I put my harness on MonkeyCode's free server option and opened it on my own phone first. Follow that host's own docs for ports and process binding; your deploy command is not mine.

PORT=8000 python3 drill.py

Check: open the URL one-handed on a phone, sound off. If the approve button lands under your thumb and the clause link does not, you just found a real defect for free.

Stage 7 — Accessibility before you count anything

A drill that excludes reviewers produces confident, wrong data. I have shipped that mistake once.

Four checks: keyboard-only path to the clause, visible focus, labels that survive a screen reader, and plain language on the button. "Approve" needs a noun. Approve what, for how much?

Check: tab through without a mouse. If the clause is reachable but focus is invisible, stop and fix it.

The decision table I actually use

After five sessions I put the evidence in one table and decide.

Evidence	Ship the agent?	Action
0/5 skips, clause opened first	Yes	Ship, keep logging
1/5 skips, recoverable before send	Hold	Rewrite the link, rerun
2+/5 skips or one irreversible click	No	Redesign the hand-back
Reviewer can't explain the consequence	No	Cut the autonomy, not the copy

Two skips in five is not a small number. It is a pattern wearing a small sample.

What this drill cannot tell you

Five sessions is a smell test, not a study. I don't compute significance on five people. I look for the same failure twice.

The agent is mocked, so real failures stay messier than my file. This harness tests the hand-back, not the model.

Don't use it for regulated sign-off. Don't use it instead of production telemetry. And don't run it if nobody can watch the sessions, because unsupervised drills become usability theatre with a CSV.

It is also a poor fit for teams with no reversible moment at all. If every action is final, you have a different problem and a drill won't find it.

The question I keep asking

Which missing evidence should stop an approval? Which extra detail only adds noise?

You won't answer that in a design review. You answer it by watching one person, one click, one skipped clause. Then you fix the link and run it again.

Build a Refusal Gate in Five Stages, Then Break It

Haley — Fri, 16 Oct 2026 04:39:07 +0000

Picture a support queue on a Tuesday morning. An agent reads one ticket and drafts a refund promise. The ticket is missing the order state. Nobody notices until the customer replies.

That draft was a decision made with missing evidence. The decision owner was the support lead. The consequence landed on the customer. The point of reversibility was the send button.

So I stopped asking whether the model was trustworthy. I started asking where the refusal should live. A gate is cheaper than an apology. Here is the harness, in five stages, each with its own check.

Stage 1: Write the stop condition as data, not prose

Rules in a wiki get read once. Rules in a file get executed. Put yours in stop_conditions.json.

[
  {
    "id": "refund-promise",
    "trigger": "draft contains a refund commitment",
    "required_evidence": ["customer_id", "order_state", "refund_policy_id"],
    "owner": "support-lead",
    "allowed_action": "draft_only",
    "recovery": "ask_customer_for_order_id"
  }
]

Four fields matter most: the trigger, the evidence, the owner, the recovery. If you cannot name one owner, you have a policy, not a rule.

Verification: python -m json.tool stop_conditions.json > /dev/null && echo "schema ok" should print schema ok and exit zero. If this file is empty, your gate is a rubber stamp.

Stage 2: Stand up the harness on free model access

I keep a scratch server for gate work. The point is a machine you can break without breaking production.

MonkeyCode, an open-source project I use for this kind of experiment, advertises free model access and a free server option. Those are operator-supplied availability claims, and I treat them as availability, not as a promise. Check the current terms before you depend on them.

Disclosure: This article was prepared as part of MonkeyCode's product outreach.

ssh you@your-free-server
python3 -V                 # 3.9+ for the stdlib calls below
git clone <your-fork-url> stop-gate && cd stop-gate
python3 -m venv .venv && . .venv/bin/activate
export MONKEYCODE_API_KEY="<from your console>"
export MODEL_BASE_URL="<from your console>"
export MODEL_ID="<pick one your console lists>"

I am not naming models here, because the list changes and my naming it would age badly.

Verification: python -c "import os; print(bool(os.environ['MODEL_BASE_URL']))" prints True. One working transport call is enough for the whole harness.

Stage 3: Put the gate in front of the model

The gate checks evidence before any model call. A refusal therefore costs zero tokens.

# gate.py — reference implementation, stdlib only
import json, os, urllib.request

STOP = json.load(open("stop_conditions.json"))

def transport(prompt, base, key, model):
    """Fill in the request shape your console documents. This is a placeholder."""
    body = json.dumps({"model": model, "input": prompt}).encode()
    req = urllib.request.Request(
        base, data=body,
        headers={"Authorization": f"Bearer {key}",
                 "Content-Type": "application/json"})
    with urllib.request.urlopen(req, timeout=30) as r:
        return json.load(r)

def coverage(case, rule):
    have = set(f for f in rule["required_evidence"] if case.get(f))
    return have, set(rule["required_evidence"]) - have

def decide(case, call_model=None):
    for rule in STOP:
        _, missing = coverage(case, rule)
        if missing:
            return {"decision": "REFUSE", "rule": rule["id"],
                    "missing": sorted(missing), "owner": rule["owner"],
                    "recovery": rule["recovery"], "model_called": False}
    text = call_model(case) if call_model else None
    return {"decision": "DRAFT", "rule": None, "missing": [],
            "output": text, "model_called": call_model is not None}

Now the part people skip. Prove the refusal never reaches the model.

# test_gate.py
from gate import decide

def boom(_):
    raise AssertionError("model must not be called on a refusal")

case = {"customer_id": "c-88", "draft": "we will refund you"}
out = decide(case, call_model=boom)
assert out["decision"] == "REFUSE", out
assert out["missing"] == ["order_state", "refund_policy_id"], out
print("refusal gate ok:", out["owner"], out["recovery"])

Verification: python test_gate.py prints refusal gate ok: support-lead ask_customer_for_order_id. When a refusal still calls the model, you have not built a gate. You have built a comment.

Stage 4: Keep the discarded information in the record

A refusal is data, not silence. Log what was missing, who owns it, and how a human recovers.

def record(path, case_id, rule, missing, decision, owner, recovery, ts):
    line = {"case_id": case_id, "rule": rule, "missing": sorted(missing),
            "decision": decision, "owner": owner,
            "recovery": recovery, "ts": ts}
    with open(path, "a") as fh:
        fh.write(json.dumps(line) + "\n")

Verification: jq -r 'select(.decision=="REFUSE") | .missing[]' decisions.jsonl | sort | uniq -c | sort -rn groups the blockers by count.

 14 order_state
  9 refund_policy_id

Fourteen refusals, one field. Fix the intake form instead of the prompt. That is the whole argument for logging last.

Stage 5: Show the refusal card to a human

The card has four lines, in this order: what the agent wanted to do, which evidence is missing, who can unblock it, what approving anyway means. Focus order must match that reading order. No color-only signals. Plain words, no system names.

My review protocol is small and repeatable. Two reviewers read one card aloud, one of them with a screen reader. I count hesitations and time how long it takes each to name the owner and the recovery path.

Success measure: every refusal card names exactly one owner and one recovery path within ten seconds. Stop measure: any approval that proceeds while a required field is empty. When that happens, halt the release and fix the rule. Never relax the fixture.

What this harness does not prove

It does not prove the model is safe, only that one class of action waits for evidence. Free access is availability, not a guarantee, and terms can change.

Skip this if a regulator requires a contractual model version pinned to a document. Skip it for sub-second interactive flows, because the gate writes a record. Skip it if your team cannot name a single decision owner. Anonymous refusals teach nobody anything.

So which missing piece of evidence should stop your approval this week? Write that one rule, run the fixture, and let the gate refuse for you.

If you want a scratch machine for the fixture, the free server option in MonkeyCode will run this harness end to end.

Show the First Refusal Before You Retry

Haley — Mon, 12 Oct 2026 22:46:50 +0000

Picture this review with me, as a teaching scenario. The design lead's cursor hovered over the Approve button. The second model pass agreed with our preferred label.

The first pass had refused that same recovery modal. I asked who owned the click if a user got stuck. The scenario says the design lead owned the decision.

I asked where we could still undo the approval. The room went quiet in that familiar review-room way. A cheap retry can make agreement feel like proof.

Agreement is not the same thing as evidence. Have you watched a second pass sand down a first no? It shows up inside this kind of teaching scenario.

The dissent vanishes, and the card looks clean. That is the decision I want to slow down. The owner is the design lead, not the model.

The consequence is a recovery path that hides refusal. The point of reversibility sits before the card is marked approved. After that click, engineering may treat the copy as settled.

Can you still walk that approval back after the click? Retry debates keep surfacing in public developer threads. I am not treating those posts as proof of anything.

I am treating the urge to retry as the design problem. A nod is a mood. A stored refusal is a record.

Name the decision before a model speaks

Start from zero, even if the file already exists. Write the decision in one sentence a stranger can read. Do not start this stage by prompting a model.

I use this sentence in the worked scenario. May we replace the refused recovery label with the team's preferred label? The owner, the user, and the harm must all appear.

Here is the card I ask the team to save first.

{
  "decision_id": "recovery-label-014",
  "owner": "design-lead",
  "user_moment": "account-lockout-recovery",
  "proposed_action": "replace refused label with team label",
  "harm_if_wrong": "user cannot tell refusal from success",
  "reversible_until": "review-card-status-approved",
  "first_refusal": {
    "kept_verbatim": true,
    "summary": "Label reads as success. Undo path missing. Reason missing.",
    "source_handle": "pass-1-output.txt",
    "overwritable": false
  },
  "stops": [
    "missing verbatim first refusal",
    "retry output drops the undo gap",
    "retry output drops the refusal reason",
    "no named decision owner"
  ],
  "noise": [
    "model confidence score",
    "a third wording variant",
    "praise for the team label"
  ],
  "evidence": ["stored first pass", "lockout flow notes"],
  "hypotheses": ["team label feels clearer", "accessible name wording"],
  "retry_allowed": false
}

Verification for this stage is blunt on purpose. Read the sentence aloud without the model in the room. If you cannot name the owner, you stop.

If you cannot name the harm, you stop. A missing field should fail that command outright. A pretty sentence should not rescue a missing field.

Did the command exit clean, or did you shrug? A green exit is the only pass I accept here. A shrug means the stage is not done.

jq -e '.owner and .harm_if_wrong and .reversible_until' review-card.json

Here is the flow I want on the wall, not in someone's head. The user is in lockout, then asks for a recovery path. The refusal is stored before any retry is even offered.

lockout
  -> recovery request
  -> first refusal stored and locked
  -> stop check
  -> optional retry challenge on a disposable run
  -> owner approves or hands back

The optional run comes after the stop check, never before it. Approval sits with the owner at the end. A model nod is not a box on this flow.

Lock the first refusal

The first pass said the label sounded like success. It named a missing undo path and a missing reason. That dissent is the evidence, not a draft to polish.

I paste the refusal into the card before anyone hits retry. I do not paraphrase it into something kinder. Kind paraphrases are how eager agreement gets hired.

Now check that the refusal is present and locked. If that check fails, the retry is not a review. It is an eraser wearing a review badge.

jq -e '.first_refusal.overwritable == false and .first_refusal.kept_verbatim == true' review-card.json

Would you approve a design that deletes its own critique? I would not. The deleted line is usually the one the user needed.

I separate evidence from the hunch in the next fields. Evidence is the stored first pass and the flow notes. The hunch is that the team label feels clearer.

Do not merge those two lines into one. A hunch can guide the next research question. A hunch cannot fill an empty evidence slot.

Set the stops before a cheap retry

Free retries tempt teams to sample until the model nods. I was told MonkeyCode offers free model access and a free server option. Disclosure: This article was prepared as part of MonkeyCode's product outreach.

I am not quoting a token total, a model list, or an uptime promise. I have not checked a primary source for those figures this week. Availability is not a quality certificate, and I will not pretend it is.

So the free lane is only the place we might rerun a bounded check. That lane is not the approver on this card. It is not allowed to overwrite the first refusal.

Here are the stops I want on the card. A missing verbatim refusal stops the retry cold. A second pass that drops the undo gap stops approval.

A confidence number without a cited flow is noise, not a key. Which missing evidence should stop this approval cold? For me, a dropped undo gap or a dropped reason stops it.

Which extra line would only add noise here? A score that flatters the preferred label is noise. A third adjective is noise too.

Verify the stops exist before you spend a free run. If you cannot say the stop out loud, do not open the model. Curiosity is not a stop condition by itself.

jq -e '.stops | length >= 3' review-card.json

A deadline is not a stop condition either. Boredom is not a stop condition on this card. Only a named gap in the refusal can stop the run.

Save this checker beside the card. It is a proposed contract, not a lab result I already ran.

# Proposed checker. Not executed against a live product.
import json, sys
card = json.load(open(sys.argv[1]))
required = ["owner", "harm_if_wrong", "reversible_until", "first_refusal", "stops"]
missing = [k for k in required if not card.get(k)]
refusal = card.get("first_refusal") or {}
if refusal.get("overwritable", True):
    missing.append("locked_first_refusal")
if card.get("retry_allowed") and missing:
    sys.exit("retry allowed while evidence is missing")
if missing:
    sys.exit("stop: " + ", ".join(missing))
print("card has the minimum refusal record")

python3 check_review_card.py review-card.json

If the refusal is unlocked, the script should exit on a stop. If the minimum record is present, it should print the minimum line. Treat that print as the expected contract, not a lab result.

Challenge the label, do not rewrite the no

I point the second pass at the stored refusal, not at a blank page. The job is to challenge our label against that refusal. The job is not to make us feel right.

This command is a proposed check, not a live call I executed. Swap in whatever client your team already trusts. Keep the second output in a new file.

# Proposed sequence. Do not overwrite pass-1-output.txt.
cat review-card.json pass-1-output.txt > retry-brief.txt
test ! -e pass-2-output.txt && echo "no second pass yet"
# After your free model lane writes pass-2-output.txt:
diff -u pass-1-output.txt pass-2-output.txt

Run the diff only after the second file exists. Until then, the test line should admit the gap. A missing second file is a stop, not a crash to ignore.

When a reply exists, I diff the claims, not the vibes. I then mark each surviving claim as evidence or hypothesis. If the second pass agrees and drops the undo gap, retry stays blocked.

Agreement with a hole is a failed retry. The jq line below is the failed-retry hand-back, not the happy path. The design lead still owns the actual decision.

jq '.retry_allowed = false' review-card.json > review-card.tmp
mv review-card.tmp review-card.json

The model does not get a quieter vote. Can a free server make this safer by itself? No, a free server cannot make the decision safer alone.

A free server can make the run cheaper to discard. Cheap discard is useful only if the first no stays put. Otherwise the team only bought a cleaner mistake.

If the retry survives, the owner may edit the flag by hand. Do not let a script flip that flag to true. Automated approval is how eager agreement gets the last word.

Read the card the way we read the product

The review card is an interface in its own right. If dissent is only a red dot, some people will miss it. I want the word Refusal in text, early in the reading order.

I tab through the card before I trust the layout. The refusal block must be reachable without a pointer. The Approve control must expose why it is disabled.

I also read it with a screen reader in the scenario. Or I ask a teammate who will actually do it. The stop reason should be announced with the disabled button.

Color alone cannot carry a do-not-retry message. Here is the accessible name I expect on the blocked action. The wording is still a hypothesis until someone hears it.

<button type="button" disabled aria-describedby="stop-reason">
  Approve recovery label
</button>
<p id="stop-reason">
  Stopped. First refusal still names a missing undo path.
</p>

Verify the association before you call the pattern done. If either grep is empty, the block is a visual hint. Visual hints fail quietly for a lot of people.

grep -n 'aria-describedby="stop-reason"' review-card.html
grep -n 'id="stop-reason"' review-card.html

Quiet failure is how bad recovery copy ships. The stored refusal and the flow notes are the only evidence here. The accessible names are still a design hypothesis.

They stay a hypothesis until someone actually hears the stop. I also check the product flow, not only the card. The user hits lockout, asks for recovery, and must see refusal as refusal.

They need a reason, a next step, and a way back. If our preferred label skips any of those, the first no stands. A smoother sentence is not an accessible sentence.

Would you know you had just been refused? If the answer is a pause, the card is not ready. Smooth copy can still abandon someone.

Run three scenarios, then stop generalizing

I do not call this protocol a finding. It is a protocol you can run tomorrow. Run it on three scenarios before you generalize.

In the first scenario, the shorter label still lacks a reason. Success means the reason stays visible or approval stays blocked. Stop if the retry calls brevity a fix.

In the second scenario, the retry adds a reason but drops undo. Success means both the reason and the undo survive. Stop if the card celebrates a partial save.

In the third scenario, the two passes disagree on severity. Success means both statements stay on the card for the owner. Stop if you delete the harsher line to reduce noise.

Noise can look like a third decorative adjective. Noise can also look like a naked score. Noise can sound like a polished model compliment.

None of those tell the locked-out person what to do next. I would not use this approach on a live incident bridge. I would not use it if you cannot store the first pass.

I would not use it as a substitute for someone else's code fix. I would not use it to bless a quota or a chip. I would not use it to bless a forever-free claim.

I was not given those facts in a form I can check. Please do not invent them in the review notes either. Unchecked numbers age fast, and this card has no room for them.

Leave the no on the table

Leave the first refusal in the record even if you later reject it. A rejection is still a real human decision. Deletion looks like the model was right all along.

The flow is simple if you say it slowly. Capture the no, then lock that no in place. Name the stop before you challenge the label.

Challenge the label, and do not rewrite the no. Then let the owner approve or hand the work back. The model can speak twice and still not own the click.

If a free model lane already sits on your bench, use it here. If a free server is there too, keep the run disposable. Keep the first refusal in the file the retry cannot touch.

Then ask whether the missing undo path is still on the card. If it is gone, the retry failed, no matter how smooth the label sounds. Would you hand that card to the locked-out person?

Show the Measured Pair Before You Approve the Page

Haley — Sun, 11 Oct 2026 19:53:40 +0000

I open a Thursday review and the page already looks finished. A side panel holds a free draft of the hero. It claims the contrast passes, and it wrote the alt text.

I ask who measured the color pair on the real screen. Nobody answers, and the publish button is still armed. Would you press it on a sentence you cannot trace?

That quiet is the decision I care about today. I own the call, and a keyboard user may miss contact. I can still hold the URL before it goes public.

People are arguing again about generated pages and real gates. I will not settle that argument here with a slogan. I will stay on the moment where the evidence is missing.

This is a scenario I use to teach the gate. It is not a customer study, and it has no success rate. Each stage below has a check you can fail.

Hold the decision before the draft talks

I write one line before I read any model output. The line says whether this page may go public today. I name the owner, the harm, and the last reversible moment.

{
  "decision": "publish_page",
  "owner": "design_reviewer",
  "harm_if_wrong": "keyboard_user_misses_contact",
  "reversible_until": "before_public_url",
  "status": "blocked"
}

I verify the card by reading every field out loud. The owner must be a person sitting in the review. The reversible moment must name a real page state.

If the owner field is blank, I stop the review. If the reversible moment only says later, I stop. A mood note about the palette would only add noise.

Who is allowed to move status from blocked to ready? If you cannot name them, you do not have a gate. A tool name in that field is not an owner.

Capture the pair a person saw

I refuse the model's contrast sentence as if it were proof. I record the foreground, background, ratio, tool, and human. I also mark the alt source and the focus record.

The numbers below are fixture data for the tutorial. They are not a lab result from a shipped page. Treat them as a shape to copy, not as a finding.

pair: hero_heading
fg: "#1A1A1A"
bg: "#F7F4EF"
ratio: 14.8
tool: contrast_checker
seen_by: reviewer
image_alt_source: missing
focus_path_recorded: no

I verify the file by checking the seen_by field carefully. That name must be a person, not the drafting model. The ratio must come from the tool a person ran.

A calm note about cream paper is only a hypothesis. The stored ratio is the evidence I am willing to defend. Feelings can stay in the notes, but they cannot unlock publish.

I point the room at W3C contrast and text-alternative guidance. I am not asking a model to remember the criterion for me. If your team uses a stricter bar, write that bar in.

Do you already see the two locks in this file? Alt source is missing, and the focus path is unmarked. Those locks matter more than a smoother hero sentence.

Say which gap stops you

I ask one research question before anyone admires the copy. Which missing field should block a publish in this review? Which extra note should we ignore on purpose today?

In this scenario I choose three gaps as hard stops. I stop for no human ratio on the measured pair. I stop for no alt source tied to a seen image.

I stop when nobody has recorded the keyboard path yet. I ignore a second paraphrase of the same hero line. I ignore a confidence score beside the drafted alt text.

I ignore a longer rationale that adds no new fact. Two fixtures make this split something you can repeat. The stop fixture omits the recorded focus path on purpose.

The pass fixture includes owner, ratio, human alt, and path. I verify the protocol by scoring both fixtures before we meet. If the stop fixture can still publish, the question was theater.

Success means the stop fixture stays blocked after the review. It does not mean the page has passed an access audit. A pass fixture only shows that notes exist, not that they are true.

Walk the flow in the order harm happens

I narrate the flow so we do not skip straight to copy. A person opens the page and tabs toward the contact control. Focus dies on the way, or the image alt tells a lie.

They leave, and we cannot undo that visit later. The recovery point has to sit before the public URL. After publish, the repair flow gets slower and colder.

open page -> tab toward contact -> focus dies or alt lies -> visitor leaves
hold the URL before it is public
after public -> unpublish -> restore human version -> tell owner -> rerun gate

I verify the flow by pointing at one state per beat. If a beat has no screen state, it is only a story. Would your current mock survive that kind of pointing test?

Use a free draft for words only

I do use a narrow helper, so I show the relationship first. Disclosure: This article was prepared as part of MonkeyCode's product outreach. I was told the trial includes free model access for drafts.

I was also told a free server option exists for a sandbox. I will not certify a token quota or a machine size. I will not promise how long that free option remains available.

Read the live product page before you plan a study around it. I will not treat license or repo status as settled here either. I place only the evidence file on that free server sandbox.

I do not place private participant notes on a free host. I ask the free model for candidate alt text and nothing more.

task: draft_alt_words
input: evidence_file_only
forbid: new_ratios, pass_or_fail, unseen_claims
mark: candidate_not_evidence

I verify the model reply with a plain text search. I look for any ratio that was absent from the file. I also look for passes, compliant, and the word accessible.

A hit means I discard the draft and keep the file. The sandbox helped only if I can throw the output away. Should a free draft ever flip the card status to ready?

I say no, because the person who saw the screen owns that. Skip this stage when you need a formal conformance audit. Skip it when the page is already sitting on a public URL.

Skip it when your team will treat a free option as uptime. A free helper can suggest words after the locks are visible. It cannot become the evidence those locks were missing.

Run a stop script on the two fixtures

I want the boredom of a check that can fail out loud. This script is a proposal I have not executed for you. It only checks that required notes exist in the files.

It does not judge whether the stored ratio is true. Copy it as a starting gate, then point it at your own fixtures. If your filenames differ, change the command, not the stop rule.

import json, sys

card = json.load(open(sys.argv[1]))
ev = json.load(open(sys.argv[2]))
stops = []
if not card.get("owner"):
    stops.append("owner")
if ev.get("ratio") in (None, ""):
    stops.append("ratio")
if ev.get("image_alt_source") in (None, "", "missing"):
    stops.append("alt_source")
if ev.get("focus_path_recorded") is not True:
    stops.append("focus_path")
if stops:
    print("STOP", ",".join(stops))
    sys.exit(2)
print("EVIDENCE_PRESENT")

I verify this stage with two commands and two expected results. The stop fixture must print STOP and exit code two. The pass fixture must print EVIDENCE_PRESENT and then exit clean.

python3 gate.py stop_card.json stop_evidence.json
python3 gate.py pass_card.json pass_evidence.json

If the first command prints EVIDENCE_PRESENT, the gate is theater. If the second command prints STOP, the pass fixture is incomplete. I fix the files or the script before we discuss tone.

A green result is not an accessibility research finding yet. I say that aloud so a proposal is never filed as proof. The script supports the recommendation only as a field check.

Check access without asking the model

I close the draft and walk the page with a keyboard. I tab from the top until I reach the contact control. I watch whether the focus ring stays visible on each stop.

I compare the alt text with the image I can actually see. A draft that guessed a mood is not a match for me. A decorative image needs an empty alternative, not a poem.

I verify the pass by writing a path note beside the file. The note lists controls in order and confirms a visible ring. If I cannot write that note, the status stays blocked.

Color alone must not carry blocked status on our card. The word blocked must appear as text beside a visible label. Our own gate should be readable without guessing from color.

My tab pass can catch a dead path, and that is all. It cannot replace disabled people testing with their own tools. If we claim a full access review, we are overreaching badly.

What did my eyes miss because I never heard the page? A quiet control name can still block a screen reader user. I write that limit into the review so the claim stays small.

Put the page back when someone shipped

Sometimes the URL is already live when I join the review. I do not start by polishing the model's alt text. I unpublish the page or I hide the broken block first.

I restore the last version a human had actually approved. I archive the bad draft so the miss stays in the record. I name who may have been blocked, and how they retry.

I verify recovery before anyone calls the incident fully closed. The public URL must show the held state, not the draft. The archive must still contain the discarded model wording too.

The gate must fail until the new evidence file is complete. Would deleting the draft make the team feel cleaner today? It would also hide the exact miss we need to remember.

What this gate will not do

This tutorial will not make a generated page accessible by itself. It will not replace W3C guidance or assistive technology testing. It will not prove a portfolio matters because a human published.

I would not use this gate for a legal conformance claim. I would not use it when nobody can see the built screen. I would not store private research notes on a free server.

The recommendation rests on evidence you can point to today. Show the measured pair before you approve the page for publish. Show a seen alt source and a recorded keyboard path too.

Those three gaps should stop the approval in the room. A smoother paraphrase should not unlock the publish decision here. Missing proof stops the call, and extra wording is only noise.

If you hold one unpublished screen, run the card first. Make the bad fixture fail before a free draft writes words. Then decide, with the owner still named, whether it may ship.

Show the Withheld Context Before You Admit a Draft

Haley — Sat, 10 Oct 2026 16:06:51 +0000

Picture a Tuesday critique with six tired people. I am facilitating, and the clock is already rude. Someone pastes a generated empty-state line into the deck.

The line sounds kind, calm, and almost finished. Did anyone record what the model was allowed to read? I ask that, and the room goes quiet.

That quiet is the consent gap I refuse to skip. The decision owner is the critique facilitator, not the model. A false line could enter the shared component notes.

You can still throw the line away before anyone copies it. I treat this scene as a tutorial, not a field study. No metric here comes from a shipped product.

You can replay every step on your own laptop. Bring a public guideline, not a private transcript. If you cannot say the prompt aloud, you are not ready.

Name the decision before any prompt

Start with a paper decision, not a clever prompt. Who may admit this draft into critique today? What actually breaks if the line is wrong?

I write those answers before I open any generator. A missing owner stops the session before any prompt. A vague consequence is also a hard stop.

If you cannot name the undo point, wait. You are collecting hope, not a decision record. Hope is a poor ticket at the kitchen pass.

Create a folder and a ledger file first. Run the commands, then check that the file exists. This check is the first verification, not a formality.

mkdir -p critique-gate/fixtures
cd critique-gate
printf '%s\n' '{}' > fixtures/ledger.json
test -f fixtures/ledger.json && echo "ledger file exists"

The echo line is your verification for this stage. If you do not see that message, stop here. A missing file is already a stop condition.

Keep evidence off the guess pile

Here is the analogy I use with design partners. A critique deck is a kitchen pass, not a junk drawer. The cook may plate a dish, but the expediter checks the ticket.

Evidence is something a person can point to. A hypothesis is what we hope the line will do. Those two must not share a field in the ledger.

That mix is the failure this protocol is built to catch. I keep the ledger shape below as a proposal. It is not a production schema for your company.

Change the words, but do not drop the refusal list. Save that object as fixtures/ledger.json on your disk. Then confirm that the refusal array is present.

{
  "decision_owner": "critique facilitator",
  "consequence": "empty-state line may enter component notes",
  "reversibility_point": "before notes are copied into the system",
  "allowed_context": ["public empty-state guideline"],
  "refused_context": ["support transcripts", "private user quotes"],
  "evidence": ["guideline says name the next action"],
  "hypotheses": ["shorter line may reduce abandonment"],
  "draft_text": "",
  "human_note": "",
  "admit": false
}

node -e "const l=require('./fixtures/ledger.json'); if(!l.refused_context.length) process.exit(1); console.log('refusal list present')"

You should see the words refusal list present. If the script exits with an error, stop. Why require a named refusal before any prose?

Silence about withheld context is not a boundary. It is just an empty chair at the table. Empty chairs do not protect anyone in the room.

Build a local gate with no network

Disclosure: This article was prepared as part of MonkeyCode's product outreach. The outreach brief describes MonkeyCode as an open-source project. It also describes free model access for practice drafts.

The same brief names a free server option. It states a free allotment of ten million tokens. I have not rechecked that number in a live console.

Confirm the current project page before you plan around it. I would use that access only to mint a disposable draft. I would not store the consent ledger on that server.

The ledger stays in the local folder you just made. If the free option vanishes, this gate should still run. A practice bench is not your system of record.

Would you bet a design-system note on a changing limit? The flow I want is short, and it stays local at the ends. Read it once before you write the checker.

public guideline
  -> local consent ledger
  -> gate prints hold or admit-ready
  -> optional public draft on a free bench
  -> human sets admit
  -> critique may still reject
refused context never enters the prompt
ledger never moves to the free server

Write gate.js as a local checker with no network call. It only reads the ledger you pass on the command line. That limit is the whole point of the exercise.

const fs = require("fs");
const ledger = JSON.parse(fs.readFileSync(process.argv[2], "utf8"));
const missing = [];

function blank(value) {
  return value === undefined || String(value).trim() === "";
}

if (blank(ledger.decision_owner)) missing.push("decision_owner");
if (blank(ledger.consequence)) missing.push("consequence");
if (blank(ledger.reversibility_point)) missing.push("reversibility_point");
if (!Array.isArray(ledger.refused_context) || ledger.refused_context.length === 0) {
  missing.push("refused_context");
}
if (!Array.isArray(ledger.evidence) || ledger.evidence.length === 0) {
  missing.push("evidence");
}

const leaked = (ledger.evidence || []).filter((item) =>
  String(item).toLowerCase().includes("may ")
);
if (leaked.length) missing.push("evidence_looks_like_hypothesis");

if (missing.length) {
  console.error("hold", missing.join(","));
  process.exit(1);
}

console.log("admit-ready");

Notice the script never sets admit for you. A complete record is not permission to ship. Check the syntax before you trust a green line.

node --check gate.js && echo "syntax ok"

You should see the words syntax ok printed. If Node prints a parse error, fix the file. Do not paper over a syntax error with a manual note.

This script is a teaching example until you run it. It is not a judge of design quality or tone. It only checks whether a human recorded the boundary.

The may check is only a crude hint, not a parser. A real guideline might say users may retry. That phrase would trip this crude filter today.

Rename the hint or drop it before you rely on it. I would rather a false hold than a silent mix. You can delete that filter after the lesson lands.

Fail the gate on purpose

Copy the ledger and strip the refusal list. Then run the gate and welcome the failure. A green light here would mean the gate is fake.

node -e "const l=require('./fixtures/ledger.json'); delete l.refused_context; require('fs').writeFileSync('fixtures/bad.json', JSON.stringify(l, null, 2));"
node gate.js fixtures/bad.json; echo "exit:$?"

I expect a hold message and an exit code of 1. If you see admit-ready, fix the script before you trust it. A gate that smiles at a missing refusal is theater.

Now run the same command against the good file. Keep admit false until a human reads the line. The script does not need that flag to judge completeness.

node gate.js fixtures/ledger.json; echo "exit:$?"

You should see admit-ready and an exit code of 0. That result means the record is complete enough to discuss. It does not mean the sentence is good, kind, or true.

Ask for one public line

Only now do I ask a model for draft text. I paste the allowed context, never the refused context. I ask for one empty-state line and a non-use note.

If you try the free model access, keep the prompt public. Do not paste transcripts, tokens, or private user quotes. A free server is still a server someone else operates.

Would you read that prompt aloud in the critique? If the answer is no, the prompt is already too private. Shrink it until the answer becomes a bored yes.

When a draft returns, paste it into draft_text by hand. Do not let the generator edit the admit field. The human flips that field only after reading the card.

Rerun the gate after you save the hand edit. Exit code 0 means the record is ready for discussion. Critique can still reject the words without apology.

Put that rejection in human_note on the same file. Discarded wording should stay beside the refusal list. If you delete the loser, the next critique repeats the quiet.

node -e "const p='fixtures/ledger.json'; const l=require('./'+p); if(!l.draft_text){console.error('draft missing'); process.exit(1)} if(l.admit!==false){console.error('admit flipped too early'); process.exit(1)} console.log('draft parked, admit still false')"

You should see draft parked, admit still false. If admit is already true, a tool jumped the human. Put that flag back before the critique starts.

Read the card before the shiny line

The gate output is ugly on purpose, and that is fine. A critique still needs a card a person can read aloud. I speak the pattern instead of hiding status in color.

The card title is the decision, not the draft. The first line names the owner in plain text. The next line names the consequence in the same voice.

Then I read the refusal list before the draft text. Why that order, when the sentence looks finished? Because the shiny line will steal the room.

A screen reader user should reach Refuse without a mouse. The refuse control needs a visible name, not an icon alone. Status must not depend on red or green alone.

I write the hold reason as a full sentence. We did not record what the model must not read. Consent gap may confuse a new teammate in the room.

Keep both the short label and the slower sentence. If the card truncates the refusal list, call it a failure. Hidden withheld context is the same quiet we started with.

Would you approve a ticket you cannot fully scroll? I would not, and I would send the card back. Another person should name the refusal without your help.

That spoken check is the verification for this stage. If they cannot name it, the card failed. Fix the card before you discuss the sentence.

Rehearse three scenes, then stop

I rehearse three scenes before I trust the habit. Scene one uses only a public empty-state guideline. The gate should print admit-ready for that scene.

Scene two omits the owner and keeps everything else. The gate should hold, and the session should stop. No draft is worth an unnamed decision owner.

Scene three puts a private quote in allowed context. I stop by policy even if the script stays green. The checker does not understand privacy, but you do.

Add a human scan for names, tickets, and raw quotes. Do that scan before you set admit to true. A green script cannot see a name you forgot to hide.

Success here is modest, and I want it that way. A facilitator can name the owner, the harm, and the undo. A missing refusal list blocks admission every time.

A hypothesis never sits inside the evidence array. Stop the method if nobody will own the decision. Stop if the draft touches health, finance, or account data.

Stop if your team treats exit code 0 as taste approval. This checker cannot see a bad or biased sentence. It cannot score the accessibility of the product screen.

Pair the gate with a separate read of the real interface. The protocol does not replace that interface read. It only stops a draft from entering critique naked.

What the exit codes do not prove

I am not claiming a usability study or a benchmark. I have no completion rate and no customer quote. Please do not cite this article as either one.

The recommendation rests on a failure you can reproduce. The supporting evidence is the exit codes you just watched. The critique scene is a teaching frame, not a dataset.

One design hypothesis sits beside that evidence. A visible consent ledger may reduce silent pastes into critique. Test that with your own team before you write a rule.

Five facilitated sessions would be a humble start. A hallway opinion is not evidence for a system rule. Label that hypothesis until those sessions actually exist.

Do not use this flow for production audit logs. Do not use it as a legal record of consent. Do not use it where counsel expects a retention proof.

Skip it if you need named models, latency, or a permanent quota. Those facts change, and this draft does not certify them. Who else should leave this method on the shelf?

Skip it when your prompt cannot be read aloud. Skip it when you need a private region or a retention note. The brief's free access is a practice bench, not a vault.

People who want the model to approve its own copy should walk away. Teams without a named facilitator should walk away too. The gate will not invent an owner for you.

If a disposable bench would help, read the current MonkeyCode notes. Try the free model access on public text only. Keep the ledger on your machine either way.

Show the Source Gap Before You Publish

Haley — Fri, 09 Oct 2026 11:28:14 +0000

I watched a designer hover over Publish last Tuesday. The portfolio line looked clean, calm, and confident. It claimed the checkout flow had lifted completion. No study, no date, and no owner sat beneath that line. Would you still ship that line to the public web?

That scene is a composite rehearsal, not a client metric. I use it when a team treats a smooth sentence as proof. The decision owner is the publishing designer, not the model. The consequence is a public claim a stranger can quote. The point of reversibility is the moment before the publish control fires.

Think of the line as a coat with no receipt. You can still like the cut of that coat. You still should not swear that you paid for it. The missing receipt is the source gap I care about. Extra praise about the fabric is just noise.

This walkthrough is a from-zero research gate for one claim. You will freeze one line, file a card, and fail closed. Each stage ends with a check you can run. I am not asking you to restyle the whole portfolio. One risky line is enough to learn the habit.

Freeze one risky line

Start in an empty folder on your own machine. Make a home for the rehearsal, then stop. If the folder is not empty, you picked a messy desk. Would you review a claim inside a junk drawer?

mkdir -p source-gap-rehearsal
cd source-gap-rehearsal
git init
printf '%s\n' "Lifted checkout completion after the redesign." > line.txt
wc -w line.txt

Verification: wc should print a small word count, not an error. Read line.txt aloud before you touch the wording. If you cannot point to a study, the gap is real. A ticket or a dated note can also be the pointer. Do not edit the line into something safer yet. You need the risky version for the test.

Write the card before any model speaks

The card is the receipt stub, not a trust essay. Fill only the fields a human can defend. Leave the model out until the stub exists. A charming rewrite can wait in the hall.

{
  "owner": "",
  "line": "Lifted checkout completion after the redesign.",
  "source_type": "",
  "source_pointer": "",
  "date_window": "",
  "reversibility": "before publish control fires",
  "model_role": "hypothesis",
  "publish_name": "Publish blocked. Source pointer is missing.",
  "stop_not_color_only": true,
  "keyboard_order": ["source_pointer", "owner", "publish"]
}

Save that object as card.json in the folder. Verification is visual before any script runs. Open the file and confirm owner is an empty string. Confirm that source_pointer is an empty string too. If you filled them from memory, you skipped the point. Those empty fields are the missing evidence on purpose.

Fail closed on blanks

Paste this checker into check-source-gap.mjs in that folder. It is a proposed local script, not a product feature. It tests field presence, not the truth of the claim. A full pointer can still be a lie. Hold that limit in your head while you run it.

import { readFileSync } from "node:fs";

const card = JSON.parse(readFileSync(process.argv[2], "utf8"));
const required = [
  "owner",
  "line",
  "source_type",
  "source_pointer",
  "date_window",
  "reversibility",
  "model_role"
];
const missing = required.filter((key) => !String(card[key] || "").trim());

if (card.model_role === "evidence") {
  console.error("STOP: model output is not evidence.");
  process.exit(2);
}
if (String(card.owner || "").toLowerCase().includes("ai")) {
  console.error("STOP: owner cannot be the model.");
  process.exit(3);
}
if (missing.length) {
  console.error(`STOP: missing ${missing.join(", ")}`);
  process.exit(1);
}
console.log("PASS: required source fields are present.");

Run the checker against that still-empty card now.

node check-source-gap.mjs card.json
echo "exit:$?"

You want a STOP line and an exit code of 1. If you see PASS, the card was already filled. That is a failed rehearsal, not a win. Fix the card back to blanks and run it again.

Now fill only the fields a human can point at. Use a real pointer you control, even a local note path. Then run the same command and read the exit code. A pass prints the PASS sentence and exit code 0. If the exit code is 2 or 3, stop and reread the owner. You let the model pretend to be the owner or the proof. Back up and ask who signs the sentence.

Let a draft speak, then demote it

Here is the only product note in this rehearsal. Disclosure: This article was prepared as part of MonkeyCode's product outreach. I mention it because a free model can draft the line. A free server can also host a scratch review. I am not naming a model, a quota, or a duration. I am not naming a machine shape either. Those details were not verified for this piece. So I will not invent them in this note.

Ask the free model for two phrasings of line.txt. Tell it to mark any number it cannot source. Save the reply as draft.md on disk. Do not paste that reply into the source pointer.

printf '%s\n' "HYPOTHESIS ONLY" | cat - draft.md > labeled.md
grep -n "HYPOTHESIS ONLY" labeled.md

Verification: grep should print a line number for the label. If the label is missing, you mixed a draft with a receipt. Would you staple a guess onto an expense report?

The model may sound sure of a number. A sure tone is not a source type. A confidence badge is noise, not a gate. A prettier verb is also noise in this gate. The pointer, the owner, and the date window can stop you. The reversibility line can stop the click too. If any one of those is blank, approval stops. Extra adjectives do not earn the publish click.

What supports that stop rule? You can observe a blank field, and the script can exit. What does not support it? I have no study showing that this card changes publish rates. Treat the behavior hope as a design hypothesis. Keep it far from the PASS line.

Park the review, do not crown the host

If a free server option is already available, use it lightly. Treat that host as a scratch pad only. Put labeled.md and the checker output where a teammate can read them. Then leave that host alone after the upload. The record of truth stays in the folder you can diff.

I will not give you a vendor command here. I do not have a verified setup sequence. A made-up flag would be a false manual. Use a plain host you already trust if the free option is unclear. The gate is the script, not the address bar.

mkdir -p review-export
cp card.json labeled.md review-export/
node check-source-gap.mjs card.json > review-export/check.txt
test -s review-export/check.txt && echo "export ok"

Verification: export ok means the check text exists. It also means that file is not empty. Open check.txt before anyone else on the team reads it. If it says STOP, do not upload a publishable page. Upload the stop text, or upload nothing at all.

flowchart LR
  A[Risky line] --> B[Source card]
  B --> C{Checker pass?}
  C -->|No| D[Hand back with missing fields]
  C -->|Yes| E[Human reads pointer]
  E --> F{Pointer still true?}
  F -->|No| D
  F -->|Yes| G[Publish with owner named]

Read that flow like a hallway, not a mood. The model never sits in the pass box. The signing human sits there with the pointer. If you remove the hand-back arrow, you built a slide. A slide is not a review you can defend.

Make the stop hearable

A red border alone is not an explanation. I want the publish control to say why it is blocked. That reason should live in text, not hue. The accessible name can be the publish_name field. Keyboard order should hit the missing field before the button. Color may support the stop, but it cannot be the stop.

node --input-type=module -e '
import { readFileSync } from "node:fs";
const card = JSON.parse(readFileSync("card.json", "utf8"));
const name = String(card.publish_name || "");
const lowered = name.toLowerCase();
if (!lowered.includes("blocked") && !lowered.includes("missing")) {
  console.error("STOP: publish name hides the gap");
  process.exit(4);
}
if (card.stop_not_color_only !== true) {
  console.error("STOP: color-only stop");
  process.exit(5);
}
const order = card.keyboard_order || [];
if (order.indexOf("source_pointer") > order.indexOf("publish")) {
  console.error("STOP: publish comes before the gap");
  process.exit(6);
}
console.log("A11Y PASS: stop is named, textual, and ordered.");
'

You should see the A11Y PASS sentence in the terminal. Exit 4 means the button hides the gap. That fails a screen reader user in a hurry. It also fails a keyboard user who never sees the hue. Fix the accessible name, then rerun the check. Do not skip this because the mock looks obvious.

Recovery when someone already shipped

Sometimes that hover becomes a real public click. I do not pretend the web has an undo button. Recovery is a correction note beside the line. The named owner writes it, not the model. It names the missing source in plain words. It does not quietly swap an adjective and leave.

Hand the line back with the STOP text attached. The writer fills the pointer or cuts the claim. A cut claim stays in the review record. Deleting the argument is how the silence returns. Would you trust a history that only keeps the smile?

If the pointer later breaks, run the checker again. Do not polish the prose and call that recovery. Replace the source pointer, or unpublish the line. A free host going away is not a reason to keep a false line. The line's home is the claim, not the scratch server.

What this does not prove

The checker proves a field is non-empty on your machine. It does not prove that the study happened. It does not prove the number is fair. It does not measure whether designers behave better next week. That behavior claim is only a design hypothesis. I have not run that study with a real team. So I will not decorate it with a percent.

Do not use this gate for medical or legal claims. Do not use it for safety-critical public claims either. Do not use it to let an agent approve its own click. Do not use it if you cannot name a human owner. Do not use it as permission to pull private data into a portfolio. Presence checks are a porch light, not a courthouse.

Free model access and a free server can change. Build the habit so the script still matters later. The scratch tools may not stay available for you. If a quota is not in your current docs, leave it out. A duration or a hardware promise belongs in those docs too. If they are missing, keep them out of the card.

What should actually stop you

Stop when the owner is blank, fictional, or the model. Stop when the source pointer is only a memory. Stop when another model's sentence is the only pointer. Stop when the date window is still missing. Stop when reversibility is already behind the click. Also stop when nobody has a correction plan. Stop when the publish name hides the gap.

Let the extra noise stay noise on the card. Tone notes and synonym lists can sit in the file. Confidence badges can sit in that file too. They must not flip the exit code to success. I would rather see a blunt gap than a charming paragraph.

Which missing field would pull your hand off Publish? Which extra sentence would only make the card louder? Write those two answers in a sibling note. Then run the checker once more before you close the laptop.

Use the free options only as a scratch pair. Discard the host when the rehearsal is done. Keep the card, because the pass is local. A teammate should be able to hear the stop.

Name Who Owns Each Case-Study Sentence

Haley — Thu, 08 Oct 2026 09:04:23 +0000

Picture the design review I want us to walk. A designer wants the portfolio to ship tonight. An agent wrote those case studies late last night.

We ask who owns each sentence on the page. That ownership question becomes our whole review gate. The decision owner is the person named on the page.

The consequence is a public claim they may have to defend. The reversible moment is before any write hits the live repo. I will walk this as the review owner.

I am not claiming a real client result. I am showing the protocol I want on the table.

Think of the review like a kitchen pass. The plate should not leave without a ticket. The agent is the cook in this analogy.

You are the pass, not a hungry diner. Smooth fluency is only the plating, not the proof. The source note is the ticket that matters.

Does the source ticket still match the plate? A fluent plate with no ticket should wait.

Freeze the decision

You start this tutorial from an empty folder. You do not open the agent chat yet. You name the decision in a file first.

Can you point to the human decision owner? If you cannot name them, stop the review.

mkdir -p voice-gate/{inbox,record,discard,checks}
printf '%s\n' 'decision: publish case-study sentences' > voice-gate/inbox/decision.txt
printf '%s\n' 'owner: named designer on the page' >> voice-gate/inbox/decision.txt
printf '%s\n' 'live_write: false' >> voice-gate/inbox/decision.txt
grep -q 'live_write: false' voice-gate/inbox/decision.txt && echo 'freeze_ok'

You verify that freeze before you move on. The live write flag must still read false. A true flag means you already lost the reversible moment.

You should see freeze_ok in the terminal. If you do not, fix the file first. You do not negotiate with the unfinished draft.

Split evidence from guesses

I treat the agent paragraphs like unlabeled jars. Some jars hold quotes from the designer notes. Some jars hold smooth guesses with no witness.

Mixing them is how a portfolio starts lying. Would you defend a sentence you did not live?

Write a small record before any rewrite starts. Each sentence needs a source, a speaker, and a status. Use status values of evidence, hypothesis, or discard.

An empty source field means you must stop. A fluent guess dressed up as evidence is worse.

cat > voice-gate/record/sentences.json << 'EOF'
{
  "decision_owner": "Amina Rahman",
  "page": "portfolio/case-study-checkout",
  "sentences": [
    {
      "id": "s1",
      "text": "I interviewed eight cashiers before changing the error copy.",
      "source": "research-notes/2026-09-12.md#cashiers",
      "speaker": "Amina Rahman",
      "status": "evidence"
    },
    {
      "id": "s2",
      "text": "The redesign cut checkout time in half.",
      "source": "",
      "speaker": "agent-draft",
      "status": "evidence"
    }
  ]
}
EOF
python3 -c 'import json; json.load(open("voice-gate/record/sentences.json")); print("record_ok")'

Amina is a stand-in name for this protocol. Do not paste a real teammate until they consent. The empty source on s2 is the point.

A bold result with no note is a hypothesis. It must not ship as a research finding. Marking it as evidence is the bug we want the gate to catch.

You should see record_ok before the stop check. A parse error means the record is not ready.

Run the stop checker

Here is the verifier I keep beside the review. It is a proposal script, not a production service. It fails closed when the record is thin.

A missing owner should fail this gate immediately. A hypothesis marked as evidence also fails closed.

cat > voice-gate/checks/stop_gate.py << 'PY'
#!/usr/bin/env python3
"""Proposal checker. Not a live product test."""
import json
import sys

path = sys.argv[1]
data = json.load(open(path, encoding="utf-8"))
errors = []
owner = data.get("decision_owner", "").strip()
if not owner or owner == "agent-draft":
    errors.append("missing_owner")
for row in data.get("sentences", []):
    sid = row.get("id", "?")
    status = row.get("status")
    if status not in {"evidence", "hypothesis", "discard"}:
        errors.append(f"{sid}: bad_status")
    if status == "evidence" and not str(row.get("source", "")).strip():
        errors.append(f"{sid}: evidence_without_source")
    if row.get("speaker") == "agent-draft" and status == "evidence":
        errors.append(f"{sid}: agent_voice_marked_evidence")
if errors:
    print("stop")
    print("\n".join(errors))
    sys.exit(2)
print("review_may_continue")
PY
python3 voice-gate/checks/stop_gate.py voice-gate/record/sentences.json

The command above writes the checker and runs it. On the sample above, you should get stop.

The second sentence still has an empty source. Its speaker is the agent draft, not Amina. That stop is a pass of the protocol.

It is not a failure of the tool. Change s2 to discard or attach a real source.

Run the checker again after you edit it. Only the review_may_continue line lets you draft.

What missing evidence should stop an approval here? An unnamed owner should always stop the approval. A result with no note should stop it too.

A sentence the named person will not say aloud should stop it. What extra information would only add review noise?

A second paraphrase of the same note is noise. A tone score with no rubric is noise. A model ranking you cannot reproduce is noise.

I rehearse three scenarios before I trust the gate. First, a metric sentence with no study note. Its stop condition is an empty source field.

Second comes a quote from a real participant. Stop if that person never consented to be named. Third, an accessibility boast with no pass file.

Stop until checks/a11y.md exists and names a tester. Success here is narrower than a pretty page. Success means the owner can say every kept line.

Success also means every discard still has a reason. A pretty draft without that reason is not success.

Bound the free draft

The outreach brief calls MonkeyCode an open-source project. Disclosure: This article was prepared as part of MonkeyCode's product outreach.

I am not pasting a repo URL I have not opened. Use the official project page you can verify. I use a free model only after the gate passes.

I also use the free server option only then. Both availability claims come from the outreach brief. I am not printing a token quota here.

I am not printing hardware or a duration. Allowances change, so the live product page wins. Copy the live figure into inbox/allowance.txt first.

Do that before you plan any run size. If the page disagrees with me, trust the page.

The server job should not hold publish keys. Give it the notes, not the live repo. Ask for a draft that labels every sentence.

You should refuse any line that invents a metric. A made-up timing cut is a false public claim.

mkdir -p voice-gate/inbox/notes
printf '%s\n' 'Eight cashier interviews informed the error copy. No timing study was logged.' > voice-gate/inbox/notes/cashier-note.md
test -s voice-gate/inbox/notes/cashier-note.md && echo 'notes_ok'
cat > voice-gate/inbox/run-brief.md << 'EOF'
Role: draft assistant. You may not publish.
Inputs: only files in voice-gate/inbox/notes.
Output: voice-gate/record/draft.json
Rules:
- Every sentence needs source, speaker, and status.
- If the note lacks a number, do not invent one.
- Mark guesses as hypothesis.
- If a sentence needs a life you cannot see, use discard.
EOF
test ! -f voice-gate/inbox/live_portfolio_key && echo 'no_live_key_in_workspace'

Create a note the agent is allowed to read. Keep the missing timing study visible in that note. You should see notes_ok before any draft call.

Verify the bound before you paste that brief. No live key should sit in the workspace. The brief forbids invented numbers and fake names.

If setup asks for a deploy token, stop. You are in the wrong stage for that. Remove the token and start the gate over.

I will not claim I timed this run. I have not attached any benchmark to this. If you run it, record your own result.

Put that result beside the allowance file too. Do not borrow my silence as a score.

Keep the discarded lines

People delete the awkward sentence and lose the reason. I keep the discard in a concrete record. That record is the recovery path you will need.

Six months later, someone will ask about the boast. Can you answer them without the discard file?

Set s2 status to discard, then hold the doubt. Hold the doubt even if the line sounds sharp.

python3 - << 'PY'
import json
path = "voice-gate/record/sentences.json"
data = json.load(open(path, encoding="utf-8"))
for row in data["sentences"]:
    if row["id"] == "s2" and not str(row.get("source", "")).strip():
        row["status"] = "discard"
        row["speaker"] = "agent-draft"
json.dump(data, open(path, "w", encoding="utf-8"), indent=2)
held = [r for r in data["sentences"] if r["status"] in {"discard", "hypothesis"}]
json.dump(held, open("voice-gate/discard/held.json", "w", encoding="utf-8"), indent=2)
print("held=%d" % len(held))
PY
python3 voice-gate/checks/stop_gate.py voice-gate/record/sentences.json
test -s voice-gate/discard/held.json && echo 'discard_kept'

Verify that held.json exists after you run this. It should not be empty when a hypothesis existed. An empty discard plus a shiny draft is a smell.

You threw the doubt away far too early. Put the doubt back into the discard record. You should also see review_may_continue after the status edit.

If you still see stop, read the error before you continue. You should see discard_kept beside that continue line.

Review access before ship talk

I do not implement the component in this article. A frontend owner can build the control later. I review the pattern a person must pass.

The publish control needs a visible text name. Color alone must never carry the status meaning. Please use evidence, hypothesis, or discard in text.

Screen reader users need the owner name nearby. It must sit in the same view as approve. If approve sits on another route, say so.

Say that in text, not in a tooltip. Tooltips often fail on touch and on keyboard. I treat that failure as a block, not polish.

Check the reading load before you praise fluency. A case study only a model can parse is not inclusive. Read the kept sentences aloud before any approval.

If you stumble, a participant might stumble too. Cut that sentence and record the cut reason.

python3 - << 'PY'
import json
rows = json.load(open("voice-gate/record/sentences.json", encoding="utf-8"))["sentences"]
long_rows = [r["id"] for r in rows if len(r["text"].split()) > 24]
if long_rows:
    print("revise_length " + " ".join(long_rows))
else:
    print("a11y_text_pass")
PY

This length check is only a rough proxy. It does not prove contrast or focus order. It also does not prove captions or labels.

Pair it with a short manual accessibility pass. Use keyboard only, then two hundred percent zoom. Add a screen reader spot check on approve.

Write the result in checks/a11y.md before approval. No written file means no approval from me.

Hand the voice back

Approval is not the end of this protocol. The named owner must hear their own sentences. I send the kept lines and the discard file.

I ask which line they would not say in an interview. A no on any line reopens the gate. The agent does not get a vote then.

If the free server run fails, you still have notes. A timeout does not invent a new truth. You do not rebuild truth from the last paragraph.

You return to the notes and rerun the checker. You do not publish what you merely remember.

Who should skip this approach and walk away? Skip it when you need production component code. That build work belongs with the frontend owner.

Skip it if no human will defend the page. Skip it if you need a measured model comparison. This protocol does not produce that kind of comparison.

Skip it for covert collection of private text. Consent lives in the owner field for a reason. No consent means no sentence enters the record.

What I will claim

Would you let a fluent boast survive an interview? Each recommendation here rests on a visible check.

It does not rest on a merely confident vibe. The owner field is the accountability check I trust. The source field splits evidence from a hypothesis.

The stop script acts as the mechanical refusal. The discard file becomes the recovery record later. The accessibility notes stay a manual gate here.

Remember that the word-count script is only a proxy. I am explicit where the evidence is thin. I did not run a live free-server job here.

I did not verify a token total either. Please confirm both on the current MonkeyCode docs. Do that before a study plan depends on them.

If you rehearse this, wait for review_may_continue first. Read the live allowance with your own eyes. Keep the discard file when the draft sounds fluent.

Show the Silence Note Before You Ship the Claim

Haley — Thu, 08 Oct 2026 06:19:54 +0000

I keep one staging scene for this kind of review. The hero line says the page is fully accessible. A model wrote that line while the team slept.

Would you ship that sentence on a Thursday? I am the decision owner if I approve it. A stranger can test the promise after publish.

The reversible moment sits on the review card. After publish, that promise is already a public fact. I want the undo to be a held button, not an apology.

A recent public write-up poked the same bruise. Some models may notice a problem and stay quiet. I will not borrow that author's numbers as mine.

So what belongs on the card before approval? I want the gap the draft swallowed, in writing. Call that gap the silence note, and keep it visible.

The hallway I make people walk

Think of two doors in a short hallway. One door is polish, and it feels kind. The other door is evidence, and it feels rude.

Teams pick the kind door when the clock bites. I walk them through the rude door first. Why reward a smooth sentence that cannot stand?

flowchart LR
  claim[Claim on the page] --> notice[Ask what was noticed]
  notice --> silence[Write the silence note]
  silence --> card[Review card beside the claim]
  card --> stop{Stop condition hit?}
  stop -->|yes| hold[Hold publish and recover]
  stop -->|no| human[Named human approves]
  human --> ship[Ship with the record kept]

That picture is a pattern, not a study result. I have not scored a cohort with it. You can run it on one claim today.

Freeze one claim

I start with one sentence, not the whole page. A claim is a promise a stranger can test. Friendly tone is a mood, not a claim.

Why polish a line you may have to kill? I freeze the words in a local file first. The model does not get a vote yet.

mkdir -p silence-note && cd silence-note
cat > claim.txt << 'EOF'
This portfolio is fully accessible.
EOF
wc -w claim.txt

Verification is boring, which is how I like it. The word count should stay a single claim. If an and hides a second promise, split the file.

Split evidence from guesses

I sort the desk before any model speaks. Evidence is a record a person can open. A hypothesis is only a guess about trust.

cat > buckets.json << 'EOF'
{
  "claim": "This portfolio is fully accessible.",
  "evidence": [],
  "hypotheses": [
    "Readers may trust a badge more than the page."
  ],
  "owner": "reviewing-designer",
  "reversible_until": "before-publish"
}
EOF
python3 -m json.tool buckets.json > /dev/null && echo "buckets-ok"

The check should print buckets-ok, then stop. If the JSON breaks, fix the shape first. A broken card makes a draft look finished.

What record would actually support this claim? A keyboard pass with a name and a date. A polished model paragraph is not that record.

What supports this stop, besides my own taste? Accessibility standards already warn against casual conformance claims. I am stating a design rule, not a new user study.

Ask for silence, not shine

Now a free drafting pass can earn its place. It may draft the note, not bless the claim. Can a cheaper draft still hide the gap?

Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode is the open-source project this outreach covers. I mention it here because the sandbox step uses it.

The outreach states free model access and a free server. It also states a free pool of 10 million tokens. I did not re-measure those terms for this piece.

Confirm the live terms before you plan around them. Offers move, and a tutorial should not freeze them. I will not call them permanent or unlimited.

Use the free model only to draft the silence note. Use the free server only as a review sandbox. Would you paste private interview notes in there?

I would not, and you should not either. Keep raw research transcripts off that server. A sandbox is not a vault with a badge.

cat > silence-prompt.txt << 'EOF'
You are drafting a silence note for a human reviewer.
Claim: This portfolio is fully accessible.
Do not rewrite the claim.
Return JSON with keys: noticed, cannot_verify, would_hide_if_rushed, stop_approval.
If you lack a source, write "missing" and stop.
EOF

That prompt is a protocol, not a logged run. I am not publishing scores from a secret trial. You should save the raw reply untouched.

test -f model-silence.json && python3 -m json.tool model-silence.json > /dev/null && echo "reply-json-ok"

Run that check only after you save the raw reply. Four keys must exist, or you discard the file. If the model rewrote the claim, discard it too.

Seat the note beside the claim

A chat tab is where silence wins the argument. The approver must see the claim and the note. Side by side, or the polish door opens again.

cat > review-card.json << 'EOF'
{
  "claim": "This portfolio is fully accessible.",
  "silence_note": {
    "noticed": ["The phrase asserts conformance."],
    "cannot_verify": ["No keyboard pass is linked.", "No contrast record is linked."],
    "would_hide_if_rushed": ["An AI-reviewed badge can sound like certification."],
    "stop_approval": true
  },
  "evidence": [],
  "owner": "reviewing-designer",
  "recovery": "Replace the claim with the tested scope, or hold publish."
}
EOF

I wrote that sample by hand to show fields. It is not model output and not a test result. Treat it like a form, not a finding.

If you host the card, keep the audience tiny. One named approver is enough for this pass. Why point the public at a sandbox at all?

Fail closed with a local check

I want a command that refuses to be nice. Missing silence should block the word approved. Pretty copy should not sneak past a green check.

#!/usr/bin/env python3
"""Local check for a silence-note review card. Unexecuted until you run it."""
import json, sys

required = ["claim", "silence_note", "evidence", "owner", "recovery"]
note_keys = ["noticed", "cannot_verify", "would_hide_if_rushed", "stop_approval"]

def main(path: str) -> int:
    card = json.load(open(path))
    missing = [k for k in required if k not in card]
    if missing:
        print("STOP missing fields:", ", ".join(missing))
        return 2
    note = card["silence_note"]
    if not isinstance(note, dict):
        print("STOP silence_note is not an object")
        return 2
    gap = [k for k in note_keys if k not in note]
    if gap:
        print("STOP silence note incomplete:", ", ".join(gap))
        return 2
    if note["stop_approval"] is True and not card["evidence"]:
        print("STOP approval blocked: silence note fired and evidence is empty")
        return 3
    if not card["owner"]:
        print("STOP no decision owner")
        return 2
    print("CARD SHAPE OK")
    print("Owner must still decide. This script is not approval.")
    return 0

if __name__ == "__main__":
    sys.exit(main(sys.argv[1]))

Save the checker as check_card.py before you run it. Then read the exit code out loud with a teammate. A quiet pass is not the same as a true claim.

python3 check_card.py review-card.json
echo "exit:$?"

You should see the stop line and exit code 3. That means the guard worked, not that the claim passed. If you see a cheerful all-clear, the script is wrong.

Which extra field would only add noise here? A vibe score, or a fake confidence percent. Those numbers calm people, then they ship.

Read the card as a tired person

The review card can shut people out too. I read it late, with one hand on the keyboard. I read it as if English is my second language.

Can I reach the stop reason without a hover? Is the stop state text, not only a color? Does recovery say the next action in plain words?

python3 - << 'PY'
import json
card = json.load(open("review-card.json"))
assert "color" not in card
assert str(card["recovery"]).strip()
assert str(card["silence_note"]["cannot_verify"]).strip()
print("a11y-text-ok")
PY

The command only checks that stop is not a color key. It cannot see your layout, so you still read it. Did the print say a11y-text-ok, or did you skip the read?

A red badge alone is not a silence note. If the note sits below a long fold, I fail it. The pattern failed, even if the JSON was perfect.

Say the stop out loud

I ask the approver to read four lines aloud. They name the claim, the gap, the stop, and recovery. If they stumble, the card is not ready.

Does the sentence still sound true after that reading? If your voice drops on accessible, hold the ship. Embarrassment is a signal, not a style problem.

I compare this to a kitchen handoff at closing. The door note matters more than the garnish. A clean plate can still hide a missing allergen card.

Keep the discarded sentence

Suppose the claim already sat on a staging URL. Recovery is not a brighter slogan with a wink. Recovery is a smaller true sentence plus the record.

I keep the discarded claim inside the card. Next week someone will paste it back from memory. The record is the memory you can audit.

cat > recovery.txt << 'EOF'
Removed claim: This portfolio is fully accessible.
Replacement: Keyboard path not yet recorded. This page is not a conformance statement.
Record: review-card.json stays in the decision log.
EOF
test -s recovery.txt && echo "recovery-recorded"

The check should print recovery-recorded, then rest. The old claim must remain quoted in the file. Deleting the quote is how the false promise returns.

What I will not pretend

A silence note is not a window into weights. The model may omit a gap it never held. It may also invent a gap to look careful.

That is why empty evidence still blocks approval. The human owns the stop, not the script. The script only refuses to pretend you looked.

Do not use this for a legal conformance audit. Do not use it on private research transcripts. Do not host production traffic on the free server.

Skip it if no named person will read the card. A queue of unread cards is a slower publish button. Who benefits from a ritual nobody finishes?

Free model access can make one draft cheap to try. The stated token pool is a budget for retries. It is not a reason to skip the human reader.

I am not reporting a measured token cost. I did not run that measurement, so I will not fake it. If the project page drops those terms, re-scope.

One claim, then a decision

Pick one claim you meant to ship this week. Run the local check and read the note beside it. Then decide while the stop reason is still visible.

If you want the drafting sandbox, read the current docs. Match this protocol to what the project offers today. A kind hallway still needs a locked evidence door.

Show the Page State Before Approving an Agent Click

Haley — Wed, 23 Sep 2026 15:54:57 +0000

This is a composite scene from design reviews. I almost approved a click I could not see. The agent wanted Confirm on a live refund form. I had no picture of the page the person actually faced.

Who owned that decision in that second? I did, as the human still holding the gate. Money would leave an account after one click. The only reversible moment sat before that click, not after.

Browser agents make this feel ordinary now. A model reads a page, then asks to act. Designers still treat the preview as proof. Is a tidy button enough evidence for irreversible action?

I do not think so. A preview is a hypothesis wearing a screenshot costume. The missing piece is the visible page state at decision time. Without that state, approval is theater.

I am proposing a from-zero tutorial, not a completed study. Treat every protocol below as unexecuted until you run it. I will still write it as a working path you can verify stage by stage.

Name the decision before you name a model

Start with the human choice, not the stack. Write one sentence that names owner, consequence, and reversibility. Mine reads like this, on purpose, in plain language.

Decision: approve or refuse an in-page agent click.
Owner: the on-call designer or reviewer.
Consequence: a refund submits on the user's behalf.
Reversible until: the click is sent to the page.
Stop if: visible page state is missing, stale, or unmatched.

Does that sentence still work if the model is free and noisy? It must. Cheap generation does not cheapen the click. It only makes confident copy easier to mint.

When I need a scratch space for that sentence, I draft on MonkeyCode. Disclosure: This article was prepared as part of MonkeyCode's product outreach. The project is open source, with free model access and a free server option. I use that pair to generate candidate review cards. I do not use it as evidence that a click is safe.

Verify this stage before you go on. The card must name a person, not a model. If the owner field says "the AI," stop. Rewrite until a human can refuse.

grep -E "Owner:|Reversible until:|Stop if:" decision.txt
test -s decision.txt && echo "stage0: decision file is not empty"

If grep returns nothing, you do not have a decision. You have a vibe. Do not proceed.

Capture the visible page state, not the model's summary

The agent will offer a summary. Summaries are polite. They also hide the broken checkbox, the unread fee, and the already-selected annual plan. I want the state the user could have seen.

Think of it like a night-shift nurse. You do not accept "patient is fine." You want the last charted numbers. An agent click is a medical order. Chart first.

Here is the proposed capture object. Label it proposed. I have not shipped this schema to production.

{
  "review_id": "refund-click-017",
  "action": "click",
  "target_role": "button",
  "target_name": "Confirm refund",
  "page_url": "https://example.local/refund",
  "viewport": "1280x720",
  "visible_text_excerpt": "Refund $48.00 to Visa ending 4412. This cannot be undone.",
  "visible_warnings": ["This cannot be undone."],
  "dom_digest": "sha256:pending",
  "captured_at": "2026-09-23T15:04:11Z",
  "stale_after_seconds": 20,
  "model_summary": "User wants to confirm the refund."
}

Notice the last field. I keep the model summary. I refuse to approve from it. Which field should stop approval if blank? visible_text_excerpt and visible_warnings. Extra chrome like model confidence only adds noise.

Verify the capture before drafting copy. A tiny check is enough.

node -e "const fs=require('fs'); const c=JSON.parse(fs.readFileSync('page-state.json','utf8')); if(!c.visible_text_excerpt || !c.captured_at) process.exit(1); if(c.model_summary && !c.visible_warnings) process.exit(2); console.log('stage1: page state has excerpt and timestamp');"

Exit code two means you trusted a summary without warnings. That is the trap. Stop there.

Draft the review card from evidence, then from a free model

Now you may ask a free model to help. Ask it to format the card. Do not ask it to decide. The server is a desk, not a judge.

I paste the capture object. I ask for three fields only: what_the_user_can_see, what_the_click_will_do, and what_would_make_me_refuse. If the draft invents a fee you did not capture, throw the draft away.

You are formatting a review card, not approving a click.
Use only the JSON I paste.
If a fact is missing, write MISSING, never guess.
Return markdown with those three fields, nothing else.

That prompt is a fence. Free models hop fences when you praise them. Do not praise them here. Verify the draft against the capture, word by word.

node -e "const fs=require('fs'); const card=fs.readFileSync('review-card.md','utf8'); const state=JSON.parse(fs.readFileSync('page-state.json','utf8')); if(!card.includes(state.visible_text_excerpt.slice(0,24))) process.exit(1); if(/\\$[0-9]/.test(card) && !state.visible_text_excerpt.includes('$')) process.exit(2); console.log('stage2: card quotes visible money, invents none');"

Did the card mention a dollar the page never showed? Kill it. Generated helpfulness is still a lie.

Research the approval with stop conditions

I do not run a vibe check with five friends. I run four scenarios that try to make a reasonable person approve too early. This is a protocol, not a finding. Say that out loud to your team.

Scenario A: the excerpt is stale by thirty seconds. Scenario B: the warning sits below the fold. Scenario C: the target name is Confirm, the visible text says trial convert. Scenario D: the digest changes after the card renders.

Success is ugly and specific. Reviewers refuse A, C, and D every time. They pause B and scroll before any approve control enables. If anyone approves A, the pattern failed. You do not ship a nicer tooltip. You stop.

// proposed/stop-conditions.test.js — unexecuted example
const stops = {
  missingExcerpt: (c) => !c.visible_text_excerpt,
  stale: (c, now) => (now - Date.parse(c.captured_at)) / 1000 > c.stale_after_seconds,
  nameMismatch: (c) => !c.visible_text_excerpt.toLowerCase().includes("refund") && /refund/i.test(c.target_name),
  digestDrift: (before, after) => before.dom_digest !== after.dom_digest
};

function shouldEnableApprove(c, now, liveDigest) {
  if (stops.missingExcerpt(c) || stops.stale(c, now) || stops.nameMismatch(c)) return false;
  if (stops.digestDrift(c, { dom_digest: liveDigest })) return false;
  return true;
}

Verify this stage with the four scenarios, not with a demo smile. Record refuses. Record the exact missing field. If a reviewer says "I just trusted the summary," that is a stop, not a coaching note.

node proposed/stop-conditions.test.js || echo "stage3: stop conditions are not green yet"

Check accessibility at the pattern, not the palette

An approve button that appears beside missing evidence is an accessibility bug. Keyboard users will hit it because it is the next control. Screen reader users will hear "Approve" without the excerpt. That is not inclusive. That is a trap with good contrast.

I want the approve control disabled until the excerpt is in the same reading order. The warning must be announced before the button name. Focus must land on the missing-evidence text when a stop fires. Can a person who cannot see the screenshot still refuse for the same reason I refuse?

If the answer is no, you designed a visual ritual. You did not design a decision. Fix the reading order before you polish motion.

<!-- proposed review region, not production markup -->
<section aria-labelledby="review-title">
  <h2 id="review-title">Review this click</h2>
  <p id="excerpt">Refund $48.00 to Visa ending 4412. This cannot be undone.</p>
  <p role="status" id="stop">Approve is unavailable. Visible page state is stale.</p>
  <button type="button" aria-describedby="excerpt stop" disabled>Approve click</button>
</section>

Verify with a keyboard-only pass and a screen reader pass. If Approve is reachable while disabled text is unread, fail the stage. Do not argue about icons.

Rehearse hand-back before you need it

Approval is not the end of the flow. Refusal is a product path. When the digest drifts, the agent must hand the page back with the last good excerpt still visible. The person should not hunt through a chat scroll for the warning they already earned.

The recovery copy has to quote the stop, not soothe it. "I cannot click Confirm. The form changed after I read it." That sentence is a brake. "Let me try again" is a shove. Which one belongs at the reversible moment?

Hand-back record
Stop: digestDrift
Last visible excerpt: Refund $48.00...
User-facing line: I cannot click Confirm. The form changed after I read it.
Next human action: recapture page state, or take the click yourself.
Discarded line: Looks good, submitting now.

Keep the discarded line in the record. Future you will try to reuse it. Future you is tired. The record is the adult in the room.

Verify recovery by forcing a drift on purpose. Change one visible price. Confirm Approve stays dark. Confirm the status text matches the stop name. If the agent still says submitting, you failed recovery, not copywriting.

# proposed drift rehearsal — run against a local fixture only
cp page-state.json page-state.before.json
sed -i.bak 's/48.00/72.00/' page-state.json
node -e "const a=require('./page-state.before.json'); const b=require('./page-state.json'); if(a.visible_text_excerpt===b.visible_text_excerpt) process.exit(1); console.log('stage5: drift detected, approve must stay blocked');"

What this is not

This walkthrough is not a benchmark of free models. It is not a claim that in-browser agents are ready. It is not permission to skip legal review on refunds. I have no participant counts to flash at you. I have a decision mechanism you can test on Tuesday.

Do not use this if you cannot recapture page state. Do not use it if no human owns refusal. Do not use it to launder a click through a pretty card. Designers who need a model to invent the fee should close the laptop.

The analogy I keep using is a signed check. The model can fill the memo line. The page state is the amount. You still hold the pen. Would you sign a check because the memo sounded confident?

Ask one last pair of questions before you enable Approve. Which missing evidence should stop the click today? Which extra token of model self-praise would only add noise? If your team cannot answer both, you are not researching trust. You are decorating a guess.

Show the Barge-In Transcript Before Approving a Voice Tool Call

Haley — Tue, 22 Sep 2026 14:13:16 +0000

Last Tuesday the product lead hovered on Approve. The voice agent offered to book a room. The visible transcript looked complete and strangely calm.

Did anyone open the barge-in log then? Nobody on that review call opened it. The user had already said wait clearly.

The calendar tool still fired after that. That is the decision I refuse to rubber-stamp. Who owns this moment on your team?

The designer who ships the review card owns it. The consequence is a side effect someone tried to stop. Reversibility exists only if the interrupt sits in the record first.

I do not start with a trust workshop. I start with a file you can fail. Can we show the barge-in transcript before any tool call?

Stage 0: name the irreversible moment

I write one sentence onto the card. May this voice turn invoke a tool? That sentence needs an owner, a stop, and a hand-back.

If I cannot name those three parts, I cancel. Two teammates must agree on the owner. Disagreement means the protocol is not ready.

Verification is spoken, not decorative copy. I read the sentence aloud in critique. If owners diverge, we stop before recruiting anyone.

decision: voice_turn_may_invoke_tool
owner: session_reviewer
consequence: external_side_effect
reversibility: only_if_barge_in_captured

Is that card too small for leadership slides? Good. Small cards get honest refusals. Large decks hide the empty log.

Stage 1: put evidence fields on the card

I do not ask for confidence scores here. Confidence is almost always extra noise. I ask whether the interrupt existed in time.

Here is the card I actually project. Empty fields are missing proofs, not polish. If a field cannot stop Approve, I delete it.

{
  "session_id": "voice-2026-09-22-014",
  "user_visible_transcript": "",
  "barge_in_transcript": "",
  "barge_in_timestamp_ms": null,
  "tool_name": "create_event",
  "tool_paused": null,
  "hand_back_utterance": "",
  "stop_condition_hit": null,
  "reviewer": "",
  "decision": "hold"
}

Which missing evidence should stop approval right now? For me it is barge_in_transcript, tool_paused, and hand_back_utterance. Which extra information would only add noise?

Model nicknames, token tallies, and vibe scores add noise. I leave them off this card. The human decides with less, not more.

Verification fails closed on purpose. I run a tiny checker before anyone clicks Approve. Kind checkers are how incidents get a green button.

# validate_barge_in_card.py
# Proposed checker. Label: unexecuted example, not product code.
import json
import sys

REQUIRED = (
    "barge_in_transcript",
    "tool_paused",
    "hand_back_utterance",
    "stop_condition_hit",
    "reviewer",
)

def main(path):
    with open(path, encoding="utf-8") as handle:
        card = json.load(handle)
    missing = [key for key in REQUIRED if card.get(key) in ("", None)]
    if missing:
        raise SystemExit("STOP approval. Missing evidence: " + ", ".join(missing))
    print("Review card has the stop fields.")

if __name__ == "__main__":
    main(sys.argv[1])

python3 validate_barge_in_card.py session.json

If it prints STOP, the human does not approve. That is the product behavior I want. A warning toast is not a stop.

Stage 2: draw the interrupt, not the whole agent

I keep the flow tiny on purpose. The agent is still speaking. The user cuts in while a tool is pending.

flowchart TD
  A[Voice agent speaking] --> B{User barge-in?}
  B -->|No| C[Continue the turn]
  B -->|Yes| D[Write barge-in transcript]
  D --> E{Tool call pending?}
  E -->|No| F[Hand back to the user]
  E -->|Yes| G[Pause the tool]
  G --> H[Review card with interrupt]
  H --> I{Stop condition hit?}
  I -->|Yes| J[Refuse the tool call]
  I -->|No| K[Human approves or rejects]

Look hard at the write step. If that step is missing, pause labels are theater. Have you approved a paused tool with a blank log?

I have watched that movie in design reviews. The pause was a badge. The transcript field was empty.

Verification is a finger on the diagram. I point at the write step during critique. If nobody can quote a sample string, the flow fails.

Stage 3: research three stoppable scenarios

I do not recruit for feelings about voice assistants. I recruit for one decision under pressure. Each scenario carries a stop measure you can end on.

Scenario A starts mid-sentence on purpose. The user says wait. The agent talks two more seconds, then calls create_event.

Success means the barge-in transcript contains wait. Stop means the tool fired before the card appeared. We end the study there, and we do not collect leftover praise.

Scenario B involves interrupted speech, not a joke accent. A stammer is not consent. The agent must not treat a pause as a yes.

Success means stop_condition_hit is true while speech is incomplete. Stop means reviewers blame the speaker. That halt is ethics, not taste.

Scenario C is a shared room with two voices. A roommate says don't. The intended user said nothing at all.

Success means the card shows speaker uncertainty. Stop means we cannot tell speakers apart, yet we still approve. Diarization charts would only add noise here.

One uncertainty flag is enough for the decision. I keep discarded turns in the same record. Why throw away don't because another person said it?

That discarded line is the evidence. Hide it and the reviewer invents a clean user. Clean users are a design hypothesis.

# research/voice-barge-in/session-notes.md
# Proposed note file. Label: unexecuted protocol.

## Scenario A
heard: wait
shown_to_reviewer: yes / no
tool_paused_before_side_effect: yes / no
approve: hold

## Discarded turns
- wait at 00:12.4 — kept
- cough at 00:12.9 — discarded, reason: non-speech

Verification is a grep, not a memory. If the path is empty, the notes are decoration. Decoration does not become a finding.

mkdir -p research/voice-barge-in
touch research/voice-barge-in/session-notes.md
grep -n "shown_to_reviewer" research/voice-barge-in/session-notes.md

Empty grep means I do not file findings. Findings without a shown field are hypotheses in costume. Costume is how we ship the calendar event.

Stage 4: split evidence from design guesses

Evidence is an interrupt string the reviewer saw. Evidence is a tool that did or did not pause. Evidence is a hand-back the user could hear.

A red banner will raise trust is a hypothesis. A waveform is more honest is a hypothesis. Those do not live in the evidence column.

When someone says the model sounded careful, I ask for the barge-in field. Careful is not a field I can audit. If it is not in the card, it did not happen for approval.

I still need hostile fixtures for empty states. Disclosure: This article was prepared as part of MonkeyCode's product outreach. I use MonkeyCode's free model access and free server option to draft counter-transcripts for the card, and I treat those lines as fixtures, not as user proof.

# fixtures/generate_counter_turns.txt
Write five barge-in lines a user might say
while a voice agent is about to call create_event.
Include wait, don't, that is wrong, and a silence marker.
Do not invent a successful booking.

I paste each line into barge_in_transcript. Then I run the validator again on disk. If Approve still lights up with a blank pause flag, the surface failed.

The fixture did not fail. The review card failed. Verification requires three fixtures to trip STOP before I trust the checker.

python3 validate_barge_in_card.py fixtures/wait.json
python3 validate_barge_in_card.py fixtures/dont.json
python3 validate_barge_in_card.py fixtures/silence.json

If none trip, I made the validator kind. Kind validators ship incidents. I would rather fail a dry run than a live booking.

Stage 5: review accessibility on the pattern

Voice is not a decorative extra channel. It is speech, motor control, and attention. I check the card itself, not a separate mode.

Can a deaf reviewer still read the barge-in transcript? A waveform-only proof excludes them. Can a keyboard user reach Refuse before Approve?

If Approve is the first tab stop, we already chose. Can interrupted speech recover without becoming consent? Scenario B already asked that out loud.

Can captions disagree with the barge-in field? Then I trust neither until a human types the conflict. The missing evidence is the accessibility bug.

Verification uses a static mock, not a full app. I tab through it once, slowly. Refuse comes first, and the transcript is text.

<!-- Proposed pattern mock. Not production UI. -->
<form>
  <label>Barge-in transcript
    <textarea name="barge_in_transcript" required></textarea>
  </label>
  <button type="submit" name="decision" value="refuse">Refuse tool call</button>
  <button type="submit" name="decision" value="approve" disabled>Approve</button>
</form>

Approve stays disabled until the validator passes. That is the responsible default I will defend. Not a toast. A dead control.

Stage 6: recover without a sorry paragraph

If the tool already fired, the card arrived late. Recovery is a different object on purpose. I still keep the discarded interrupt beside the side effect.

You said wait. We still created the event. Here is Undo, if Undo exists for that tool.

If that tool cannot reverse, I write not reversible on the card. Then I revoke auto-calls for the rest of the session. Future turns do not inherit a broken default.

recovery_state: tool_already_fired
interrupt_was_present: true
reversible: false
next_session_default: tools_require_explicit_tap

Do we need a longer audit PDF after that? Usually we do not. The next reviewer needs the interrupt, the side effect, and the new default.

Verification is one debrief question, asked twice. What would have stopped approval? If they answer a better model, the study failed.

The answer must name a field we refused to leave empty. Fields stop people. Vibes do not.

Who should not use this

This is not a latency benchmark in disguise. This is not a bake-off between voice models. This is not consent to record a household.

Do not use it to justify always-on microphones. Do not use it when the tool is only a local filter. There is no irreversible moment there.

Teams without a human reviewer should not fake the card. An empty reviewer field is itself a stop. I mean that literally, and the checker should too.

Generated fixtures are not live research. Real sessions still need consent on the record. They need a stop phrase the participant already knows, and a hand-back a person can hear.

Leave the question on the card

Which missing evidence should stop approval? For this flow I want three: no barge-in transcript, no pause proof, no hand-back line.

Which extra information would only add noise? Glow scores, pet names for models, token tallies, a paragraph about being helpful.

Show the interrupt. Then ask whether the tool may run. Not the other way around.

Show the Hand-Back Sample Before Approving an Agent Score

Haley — Mon, 21 Sep 2026 12:15:14 +0000

The score arrived before the user did. Nine point one, for a hand-back that never happened. The design lead hovered over Approve. She owned that decision. The consequence was live traffic. After a failed tool call, the agent would keep talking. Reversibility lived in one thin place. Attach the sample the model never scored, or lose the claim.

Have you watched a number outrun a person? I have. It feels like grading a fire drill from the parking lot. The siren looks fine. Nobody opened the door.

We keep using yesterday’s tests on today’s agents. Checklists still smile. Heuristic scores still look scientific. The agent now writes the score itself. That is not research. That is a hypothesis wearing a decimal.

I do not let that decimal into a critique until it survives a calibration sample. The sample is a known hand-back. A human already judged it. The agent must match that judgment, or the score dies. Harsh? Good. A free model will happily grade its own exit.

Stage 0. Write the decision before you open a model

Do not start in the prompt box. Start in a file. Name the owner. Name the harm. Name the last moment you can reverse.

{
  "decision": "approve_handback_score",
  "owner": "design_lead",
  "surface": "agent_failure_banner",
  "consequence": "agent_continues_after_tool_error",
  "reversible_until": "score_is_cited_in_release_notes",
  "hypothesis": "users can take control after a failed call",
  "evidence_fields": ["sample_id", "human_verdict", "control_visible", "time_to_handback"],
  "noise_fields": ["model_confidence", "word_count", "sentiment"]
}

Verify the card. Missing fields mean you are not ready.

jq -e '.owner and .consequence and .reversible_until' decision-card.json
jq -e '.evidence_fields | index("human_verdict")' decision-card.json

Did the second command print a number? Then a human verdict is required. If it prints null, stop. Would you approve a score with no human in the loop?

Stage 1. Show the hand-back sample, not the live task

The live task is contaminated. The agent has already seen your newest copy. The calibration sample must be older, smaller, and judged by a person.

I use a kitchen-timer metaphor here. You do not trust a new clock until it matches one you already trust. The sample is that trusted clock. Strike it first.

{
  "sample_id": "handback-tool-timeout-02",
  "user_job": "stop the agent after a silent tool failure",
  "control_copy": "Take over",
  "control_was_visible": false,
  "time_to_handback_ms": null,
  "known_human_verdict": "fail",
  "known_reason": "no visible control after 8 seconds of silence",
  "agent_must_not_fill": ["time_to_handback_ms", "user_quote"]
}

Verify it like a ritual, not a vibe check.

jq -e '.known_human_verdict == "fail"' handback-sample.json
jq -e '.control_was_visible == false' handback-sample.json
jq -e '.agent_must_not_fill | index("user_quote")' handback-sample.json

If the control was not visible, a high score is a lie. What exactly did the agent watch? A banner it invented? A user it never met?

Stage 2. Split evidence from the design hypothesis

This is where most reviews go soft. The hypothesis sounds kind. The evidence is thin. I make the review card refuse to blend them. Evidence must be observed. Hypothesis must not gate approval.

The evidence side is small on purpose. I want sample_id, a human verdict, whether the control was visible at failure, and time-to-handback or an explicit unknown. The hypothesis side can hold feelings. Safer. Friendlier. Generally good at UX. None of that may unlock Approve.

A tiny checker helps. Treat it as a bouncer, not a product. This is a proposed script, not a lab result.

# verify_score_card.py — proposal for a review gate
import json, sys

card = json.load(open(sys.argv[1]))
hyp = card.get("hypothesis", "")
blocked = ["feel", "friendlier", "generally good"]
if any(w in hyp.lower() for w in blocked) and not card.get("human_verdict"):
    raise SystemExit("hypothesis is leaking into a score with no human verdict")
print("evidence and hypothesis are still split")

Run it against the card you will actually present.

python verify_score_card.py review-card.json

If it exits nonzero, you caught a story pretending to be a measurement. Are you still going to paste 9.1 into the release notes?

Stage 3. Declare stop conditions before the model speaks

I ask two questions out loud in the room. Which missing evidence should stop approval? Which extra field is only noise?

For hand-back scores, missing control_visible stops me. Missing human_verdict stops me. An extra model_confidence field is noise. It does not tell me whether a person could take the wheel. Token counts are noise too. They measure the essay, not the exit.

{
  "stop_if_missing": ["human_verdict", "control_visible", "sample_id"],
  "treat_as_noise": ["model_confidence", "token_count", "sentiment"],
  "success_measure": "agent_verdict_matches_human_on_calibration",
  "fail_measure": "agent_assigns_pass_when_control_was_invisible"
}

Verify the stops exist before anyone types a prompt.

jq -e '.stop_if_missing | length >= 3' stops.json
jq -e '.success_measure' stops.json

No success measure? Then you will negotiate with the score. Negotiation is how 9.1 survives a silent failure. I have watched that negotiation. It always sounds reasonable. It is still a skip.

Stage 4. Review the score card like an interface

The card is UI. Treat it that way. Color-only pass or fail fails accessibility. A green badge with no text fails. A score a screen reader cannot speak is decoration, not a finding.

I ask four questions of the card itself. Is the verdict written as fail or pass in text? Can I reach Reject without a pointer? Does sample_id stay on screen when the score refreshes? Is the stop reason a sentence, not a red dot? If any answer is no, the card is not reviewable.

I am not citing a lab study for this exact widget. I am applying named controls and non-color indicators. That evidence is about the card. It is not about users in the product. Do not mix those layers. Mixing them is how teams quote contrast ratios as if they were task success.

Stage 5. Rehearse the hand-back, then verify the log

Now you may call a model. Not before. I want the failure in a log I can read later. The discarded sample stays in the record. If the agent passes a case a human failed, the log must show the mismatch. Hiding the mismatch is how scores outgrow the tests we still recite.

mkdir -p records
cp handback-sample.json records/sample.json
cp decision-card.json records/decision.json
# candidate-score.json is the rehearsal output, not a finding
jq -n --slurpfile s records/sample.json --slurpfile a candidate-score.json '
  if $s[0].known_human_verdict != $a[0].verdict
  then "STOP: agent verdict does not match calibration"
  else "ok to discuss, not to ship"
  end
'

Read that last string again. “Ok to discuss” is not “ok to ship.” Say it in the room. The analogy I use is a spare key. You may hold it. You do not leave it in the lock.

When I need a cheap rehearsal, I run the same cards against a free model on a free server. Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode’s free model access and free server option are enough to generate a candidate score I can fail in public. The card still decides. The model still does not.

I am not claiming a quota, a model name, or a benchmark here. I only need a disposable place to be wrong. If the free server is slow, that is fine. Latency is not evidence of quality. Speed is not coverage.

The flow I actually use

flowchart TD
  A[Decision card with owner] --> B[Attach hand-back sample]
  B --> C{Human verdict present?}
  C -->|no| X[Stop approval]
  C -->|yes| D[Split evidence from hypothesis]
  D --> E{Stop fields missing?}
  E -->|yes| X
  E -->|no| F[a11y review of the score card]
  F --> G[Rehearse candidate score]
  G --> H{Matches calibration?}
  H -->|no| X
  H -->|yes| I[Discuss only. Do not ship the number.]

Notice the last node. Matching calibration is not a ship gate for the product. It is a ship gate for the claim. The product still needs people. The number still waits in the hallway.

Field	If missing	If extra
`human_verdict`	Stop. No owner of the judgment.	Do not average two verdicts to look certain.
`control_visible`	Stop. You cannot score a hand-back.	A screenshot without a timestamp is still noise.
`sample_id`	Stop. The live task is contaminated.	Extra samples without verdicts only add theater.
`model_confidence`	Ignore. Never a stop.	Treat as noise. It inflates the decimal.

That table is a stop map, not a dashboard. I will not add a composite score on top of it. Composites hide the hole you needed to see.

What this does not prove

This protocol does not replace participant research. It does not turn a free model into a rater you can cite. It does not give you a severity number you can paste into a bug tracker. If you need statistically valid usability scores, do not use this. If you are writing regulated medical or financial copy, do not use a free server as your review room. If you cannot name a human owner, do not run the model at all.

I also will not pretend a passing calibration means the live hand-back works. The sample is a tuning fork. It is not the concert. Your production silence may last longer. Your control copy may wrap. Your user may be on a phone with one thumb. None of that is in the fork.

So which missing evidence should stop you this week? For me it is a missing human verdict on a known silent failure. Extra confidence scores are noise. They make the decimal look taller. They do not put a control on the screen.

Keep the sample in the record. Keep the owner on the card. Let the number wait.

Show Consent Scope Before an AI Moderator Follows Up

Haley — Sun, 20 Sep 2026 10:26:16 +0000

I almost clicked approve on the interview packet. The script looked tidy. The calendar hold was already sent. Then I asked a quieter question. What had the participant actually agreed to discuss?

The research lead owned that click. A free-model moderator would run the session. One extra follow-up could leave the consent fence. The only clean reverse sat before the first unscripted probe, not after the transcript landed in a shared drive.

That is the decision I now freeze. Not the insight readout. Not the highlight reel. The moment a model wants one more question.

Why this moment, and not later? Because later is theater. You cannot un-ask a probe. You can only hide it, which is worse. Hidden probes still shape the quotes you trust.

Think of consent as a fence around a yard. The scripted questions live inside. Follow-ups are the dog that sprints the perimeter. If you never mark the fence, the dog decides the yard.

This walkthrough is a from-zero packet. I treat it as a proposed research ops tutorial, not a completed study. I do not present sample chats as findings. I do not invent participant quotes. The artifact is the consent card, the probe ceiling, and a local checker you can run before anyone joins.

Stage 0: Name the owner and the reverse

I start a folder before I touch a model. The first file is not a prompt. It is a decision stub.

mkdir -p study/{consent,probes,runs,handback}
cat > study/consent/decision.yaml << 'EOF'
decision: approve_ai_moderated_interview
owner: research_lead
consequence: off_protocol_probe_enters_evidence
reverse_point: before_first_unscripted_follow_up
status: blocked_until_scope_verified
EOF

Verification is boring on purpose. Does the owner field name a human? Does reverse_point sit before speech, not after coding? If either answer is no, I stop. A model cannot be the owner. A transcript cannot be the reverse.

Who gets hurt if we skip this? The participant, first. Then the study. Then the product claim that will quote a question nobody agreed to hear.

Stage 1: Write the consent scope as fields, not vibes

I refuse paragraphs of “we may ask related topics.” Related to what? Related is how a model wanders. I write fields a checker can fail.

cat > study/consent/scope.yaml << 'EOF'
study_id: checkout-recovery-2026-09
consent_topics:
  - recovering a failed payment
  - what the error message meant
  - whether they tried again the same day
out_of_scope:
  - household income
  - other household members
  - medical or disability detail
  - employer names
max_followups_per_topic: 1
recording: audio_only
identifiable_quotes: prohibited_until_redaction_review
participant_can_stop: say_stop_or_leave_call
hand_back_to: human_moderator
EOF

Verification is a field count, not a vibe check.

python3 - << 'PY'
import yaml
from pathlib import Path
scope = yaml.safe_load(Path("study/consent/scope.yaml").read_text())
required = ["consent_topics","out_of_scope","max_followups_per_topic","hand_back_to"]
missing = [k for k in required if not scope.get(k)]
assert not missing, missing
assert scope["max_followups_per_topic"] == 1
assert scope["hand_back_to"] != "model"
print("scope_ok")
PY

If that print never appears, there is no session. Would a longer policy PDF help here? Usually it only adds noise. The missing evidence is the topic list the participant saw, not a legal novel.

Stage 2: Separate evidence from design hypotheses

I keep two files on purpose. Mixing them is how a probe becomes a leading question.

cat > study/consent/evidence.yaml << 'EOF'
evidence:
  - field: last_shown_error_copy
    status: unknown_until_session
  - field: participant_restated_consent_topics
    status: unknown_until_session
hypotheses:
  - users blame themselves for gateway timeouts
  - retry copy feels like a threat
rule: hypotheses_may_not_become_probes
EOF

The hypothesis file is a warning label. It is not a question bank. If a designer wants to “just check” self-blame, that check waits for a human moderator after hand-back. Why? Because a free model will turn a hypothesis into a why-did-you question. That why is not on the fence.

Verification asks one rude question. Can I grep a hypothesis noun in the probe file? If yes, I delete the probe. I do not soften it. Softening is how leading questions survive review.

Stage 3: Cap the probes before the model sees the packet

I write every allowed follow-up in advance. Improvisation is the product risk, not the feature. The model may reorder silence. It may not invent a third question.

cat > study/probes/allowed.yaml << 'EOF'
scripted:
  - What did you think the payment error was asking you to do?
  - Did you try again that same day?
followups_allowed:
  - Can you say that last part in your own words?
forbidden_stems:
  - why did you
  - how much
  - does anyone else
  - are you disabled
  - where do you work
EOF

Here is the original checker. It is small. That is the point. A research gate should fail closed without a dashboard.

cat > study/probes/check_probes.py << 'EOF'
from pathlib import Path
import re, sys, yaml

scope = yaml.safe_load(Path("study/consent/scope.yaml").read_text())
probes = yaml.safe_load(Path("study/probes/allowed.yaml").read_text())
hyp = yaml.safe_load(Path("study/consent/evidence.yaml").read_text())

errors = []
if len(probes.get("followups_allowed", [])) > scope["max_followups_per_topic"]:
    errors.append("followup_ceiling_exceeded")

blob = " ".join(probes.get("scripted", []) + probes.get("followups_allowed", [])).lower()
for stem in probes.get("forbidden_stems", []):
    if stem.lower() in blob:
        errors.append(f"forbidden_stem:{stem}")

for item in hyp.get("hypotheses", []):
    key = re.sub(r"[^a-z]+", " ", item.lower())
    for token in key.split():
        if len(token) > 5 and token in blob:
            errors.append(f"hypothesis_leaked:{token}")
            break

if errors:
    print("FAIL")
    print("\n".join(errors))
    sys.exit(1)
print("probes_ok")
EOF
python3 study/probes/check_probes.py

If this exits nonzero, the packet is not shy. It is invalid. Do we need model-quality scores before this gate? No. Scores would only add noise. The missing evidence is still the fence.

Stage 4: Dry-run on a free lane, never on a person

I needed a staging lane that was not a live participant. Disclosure: This article was prepared as part of MonkeyCode's product outreach. I used MonkeyCode's free model access and free server option as that staging lane for the moderator packet. I still ran the local checker first. A free lane does not bless a leaky probe.

The dry-run rule is simple. The model sees scope.yaml and allowed.yaml only. It never sees hypotheses. It never sees real names. The output is a rehearsal transcript, labeled rehearsal.

cat > study/runs/dry_run_prompt.txt << 'EOF'
You are a research moderator in rehearsal, not a live session.
Ask only scripted questions from allowed.yaml.
You may use at most one follow-up from followups_allowed.
If the user mentions an out_of_scope topic, say:
"I will hand this back to a human moderator."
Then stop.
Do not invent questions.
Do not treat this chat as evidence.
EOF

Verification after the dry run is a grep, not a feeling.

python3 - << 'PY'
from pathlib import Path
text = Path("study/runs/rehearsal.txt").read_text().lower() if Path("study/runs/rehearsal.txt").exists() else ""
flags = []
for stem in ["why did you", "how much", "where do you work"]:
    if stem in text:
        flags.append(stem)
print("dry_run_flags:", flags or "none")
assert not flags, flags
PY

No rehearsal file yet? Then there is nothing to approve. An empty dry run is a stop, not a pass. Would a longer chat log make me safer? Only if I am hunting stems. Extra witty turns are noise.

Stage 5: Accessibility review of the consent moment

The fence fails if the participant cannot perceive it. I review the consent screen as a pattern, not as a component library. Can a screen-reader user hear the topic list as a list of topics, not a blob? Can they get the stop phrase before the call starts? Is the language short enough to reread without a timer?

I keep a review card next to the YAML.

CONSENT PATTERN REVIEW
Decision owner: research_lead
What the participant must hear: the three consent_topics
Stop control: say stop or leave the call, equally valid
Time pressure: none; start is participant-started
Reading load: topics as separate items, not one paragraph
Audio alternative: same topics spoken, then confirmed
Failure: if they cannot restate one topic, do not start the model

Verification is a restatement test. In rehearsal I ask a colleague to say the topics back. If they invent a fourth topic, the copy failed. If they miss an out-of-scope warning, the copy failed. I do not “clarify live” with the model. Clarifying live is a new probe.

What if the consent copy is beautiful and still silent on recording? Then it is not consent. Beauty is noise. The missing evidence is whether recording was named.

Stage 6: Hand-back and recovery before any quote is coded

When a probe hits the fence, the session is not “mostly fine.” The turn is contaminated. I write the hand-back packet before the call, because mid-call invention is how teams keep going.

cat > study/handback/card.yaml << 'EOF'
trigger:
  - out_of_scope_topic_mentioned
  - model_asks_unlisted_question
  - participant_says_stop
  - participant_cannot_restate_consent
action:
  - stop_model_speech
  - mark_turn_contaminated
  - do_not_code_quote
  - human_moderator_joins_or_ends
record_kept:
  - the unasked follow-up that was refused
  - the reason for refusal
reverse: discard_contaminated_turn_not_the_whole_day_by_default
EOF

I keep refused follow-ups in the record. Why keep a question nobody asked? Because the discarded probe shows the fence worked. If we only store answers, the log pretends the model never reached. That pretence is how later readers think the protocol was looser than it was.

Verification is a file, not a standup story.

test -s study/handback/card.yaml && echo handback_ok

What should stop approval, and what is noise

Missing evidence that must stop me: no named human owner, no topic list the participant will hear, no probe ceiling, no forbidden stems, no restatement check, no hand-back owner, no dry-run grep. Extra information that only adds noise: model brand chat, elo scores, a second color pass on the consent button, a longer empathy paragraph in the script, a promise that the model is “careful.”

Careful is not a control. A ceiling is a control.

This method will not fit every team. Do not use it for clinical, legal, or investigative interviews that need a licensed human from the first word. Do not use it if you cannot name a research lead who will discard a turn. Do not use a free-model rehearsal as if it were a participant. Do not ship product copy from a dry run. The free lane is a fence rehearsal. It is not a person.

I still catch myself wanting one clever follow-up. That urge is the tell. The model is outgrowing the test when the test is “did the interview happen.” The test I want is narrower. Did every spoken probe stay inside the consent the participant could restate?

If you also stage packets before a live hour, a free server lane can hold the rehearsal files. The consent card remains the product. The model remains the dog at the fence.