DEV Community: Dakota Wu

Fail the Merge If the Diff Invents a Billable Host

Dakota Wu — Mon, 21 Sep 2026 13:59:28 +0000

A weekend API stays unbilled only if every new hostname in the diff is named before merge. The gate is static. It reads git diff, writes a receipt, and fails when a paid host, a cloud SDK import, or a secret-shaped environment variable appears without an allow line. Runtime probes help later. They do not replace an inventory of what the model just typed.

Solo founders lose money in the gap between “the agent finished” and “someone read the patch.” That gap is where card processors, telemetry exporters, and managed queues show up as helpful defaults. A one-sitting inventory keeps the bill at zero without pretending the model reviewed itself.

What the receipt must record

The receipt is a JSON file printed in CI and committed next to the patch. Four fields are enough for a solo binary.

new_hosts — hostnames and URL schemes found in added lines
new_imports — top-level names introduced by import / from
new_env — os.environ keys and .env-style assignments
signer — a local identity string the founder types, not a cloud token

Anything else is ceremony. The founder either allows a host in allow_hosts.txt or the merge dies.

Allow list, deny list, decision table

Keep the paid surface in boring text files. Update them when a vendor becomes a real milestone, not when a model suggests one.

# allow_hosts.txt — loopback and docs only
localhost
127.0.0.1
example.com

# deny_hosts.txt — billable by default
api.stripe.com
api.openai.com
*.amazonaws.com
*.googleapis.com
*.azure.com
sentry.io
api.sendgrid.com
api.twilio.com

Wildcards are suffix rules, not DNS. The parser is allowed to be crude. Obfuscated hosts are out of scope for a weekend gate.

Diff finding	Default	Solo founder action
Hostname on the deny list	Fail	Revert the hunk or postpone the paid milestone
New paid SDK import	Fail	Rewrite against stdlib, SQLite, or a local file
`KEY` / `TOKEN` / `SECRET` env	Fail	Keep secrets off the branch
`localhost` / `127.0.0.1` URL	Pass	Still bind loopback in smoke
Docs host `example.com`	Pass	Do not copy it into runtime config

The table is the contract. Code below only enforces it.

A parser the founder can read

The script is a single-file gate. It shells out to git diff against main, classifies added lines, and writes RECEIPT.json. Treat it as a local, reproducible example, not a published benchmark.

#!/usr/bin/env python3
"""inventory_diff.py — fail if a git diff invents billable surface."""
from __future__ import annotations

import json
import os
import re
import subprocess
import sys
from pathlib import Path

ROOT = Path(__file__).resolve().parent
HOST_RE = re.compile(
    r"(?:https?://|wss://)([A-Za-z0-9.-]+\.[A-Za-z]{2,})",
    re.IGNORECASE,
)
BARE_HOST_RE = re.compile(
    r"\b([A-Za-z0-9-]+\.(?:com|net|io|ai|cloud|dev))\b",
    re.IGNORECASE,
)
IMPORT_RE = re.compile(
    r"^\+\s*(?:from|import)\s+([A-Za-z0-9_\.]+)",
    re.M,
)
ENV_RE = re.compile(
    r"^\+.*(?:environ(?:\[|\.get\()['\"]([A-Z][A-Z0-9_]+))",
    re.M,
)
ASSIGN_RE = re.compile(r"^\+([A-Z][A-Z0-9_]{3,})=", re.M)

PAID_IMPORTS = {
    "boto3", "stripe", "openai", "anthropic", "sendgrid",
    "twilio", "google", "azure", "sentry_sdk",
}


def git_diff() -> str:
    base = os.environ.get("INVENTORY_BASE", "main")
    proc = subprocess.run(
        ["git", "diff", "--unified=0", base],
        check=True,
        capture_output=True,
        text=True,
    )
    return proc.stdout


def load_lines(path: Path) -> list[str]:
    if not path.exists():
        return []
    return [
        ln.strip()
        for ln in path.read_text().splitlines()
        if ln.strip() and not ln.startswith("#")
    ]


def host_denied(host: str, deny: list[str], allow: list[str]) -> bool:
    h = host.lower().rstrip(".")
    if h in {a.lower() for a in allow}:
        return False
    for rule in deny:
        rule = rule.lower()
        if rule.startswith("*.") and (h.endswith(rule[1:]) or h == rule[2:]):
            return True
        if h == rule:
            return True
    return False


def main() -> int:
    diff = git_diff()
    allow = load_lines(ROOT / "allow_hosts.txt")
    deny = load_lines(ROOT / "deny_hosts.txt")
    hosts = sorted(set(HOST_RE.findall(diff) + BARE_HOST_RE.findall(diff)))
    imports = sorted({m.split(".")[0] for m in IMPORT_RE.findall(diff)})
    env_keys = sorted(
        set(ENV_RE.findall(diff)) | set(ASSIGN_RE.findall(diff))
    )

    blocked_hosts = [h for h in hosts if host_denied(h, deny, allow)]
    blocked_imports = [i for i in imports if i in PAID_IMPORTS]
    secretish = [
        e for e in env_keys
        if any(s in e for s in ("KEY", "TOKEN", "SECRET", "PASSWORD"))
    ]

    receipt = {
        "new_hosts": hosts,
        "blocked_hosts": blocked_hosts,
        "new_imports": imports,
        "blocked_imports": blocked_imports,
        "new_env": env_keys,
        "secretish_env": secretish,
        "signer": os.environ.get("RECEIPT_SIGNER", ""),
    }
    Path("RECEIPT.json").write_text(json.dumps(receipt, indent=2) + "\n")
    print(json.dumps(receipt, indent=2))

    errors: list[str] = []
    if blocked_hosts:
        errors.append(f"billable hosts in diff: {blocked_hosts}")
    if blocked_imports:
        errors.append(f"paid SDKs in diff: {blocked_imports}")
    if secretish:
        errors.append(f"secret-shaped env in diff: {secretish}")
    if not receipt["signer"]:
        errors.append("set RECEIPT_SIGNER to a local name before merge")
    if errors:
        print("\n".join(errors), file=sys.stderr)
        return 1
    return 0


if __name__ == "__main__":
    raise SystemExit(main())

A pytest wrapper keeps the gate in the command the founder already runs.

# test_inventory.py
import os
import subprocess
import sys
from pathlib import Path


def test_diff_inventory_is_clean():
    env = os.environ.copy()
    env.setdefault("RECEIPT_SIGNER", "local-dev")
    env.setdefault("INVENTORY_BASE", "main")
    proc = subprocess.run(
        [sys.executable, "inventory_diff.py"],
        cwd=Path(__file__).resolve().parent,
        env=env,
    )
    assert proc.returncode == 0, "diff invented billable surface; read RECEIPT.json"

Makefile targets that fit a ship-today loop

Short targets beat a wiki page. One inventory, one smoke, one sign.

.PHONY: inventory smoke sign

INVENTORY_BASE ?= main
RECEIPT_SIGNER ?= $(USER)

inventory:
    INVENTORY_BASE=$(INVENTORY_BASE) RECEIPT_SIGNER=$(RECEIPT_SIGNER) python3 inventory_diff.py

smoke: inventory
    python3 -m pytest -q test_inventory.py

sign: smoke
    @test -n "$(RECEIPT_SIGNER)"
    git add RECEIPT.json allow_hosts.txt deny_hosts.txt
    git status --short

Commands stay boring on purpose.

git add inventory_diff.py test_inventory.py allow_hosts.txt deny_hosts.txt Makefile
INVENTORY_BASE=main RECEIPT_SIGNER="$USER" python3 inventory_diff.py
make smoke

If the model added import stripe, the process exits 1. That is the product.

Where a free draft loop fits

A solo founder still needs somewhere to let a model write code without parking production keys on the same machine. Free model access and a free server option cover that draft loop while the API is still a loopback service.

Disclosure: This article was prepared as part of MonkeyCode's product outreach.

MonkeyCode participates only as that draft host. The founder can generate the handler with free model access on the free server option, pull the branch, and run make smoke on the laptop that owns the deny list. The inventory does not run inside the product. It does not need extra hardware. It needs a diff and a signer. Limits apply: this article does not name models, quotas, or uptime, and it does not treat the free option as permanent.

The split is the method. Draft where keys are absent. Inventory where keys still must not appear.

Numbered workflow for one evening

Branch from main. Keep .env out of the tree. Export nothing that looks like a vendor token.
Draft the feature on a throwaway remote or a free server session. Accept incomplete types. Reject new dependencies by default.
Pull the patch onto the laptop that owns deny_hosts.txt.
Run INVENTORY_BASE=main RECEIPT_SIGNER="$USER" python3 inventory_diff.py.
Read RECEIPT.json. If blocked_hosts or blocked_imports is non-empty, revert those hunks. Do not allow a cloud SDK just to finish the evening.
Run the existing local smoke with the process bound to 127.0.0.1. Do not open a tunnel.
Commit the receipt with the patch. The receipt is evidence the founder looked. It is not a cryptographic audit.

That sequence ships a weekend binary. It also leaves a paper trail when the founder asks, three weeks later, why the repo still has no processor key.

A quick negative check belongs in the same sitting. Add a throwaway line, run the gate, then drop the line.

echo 'import stripe' >> app.py
python3 inventory_diff.py; echo exit:$?
git checkout -- app.py

Exit code 1 is the expected result. A green run after the revert means the deny list is wired. A green run with stripe still in the tree means the parser never saw the hunk and the gate is lying.

What this does not catch

Regex over a unified diff misses hosts built by concatenation, names hidden in protobuf, and binary assets. It misses a dependency that downloads a paid client at install time. It misses runtime config injected by a platform. Teams that need isolation should use OS network namespaces, egress firewalls, or a CI runner with no route to vendor APIs.

The signer field is social, not cryptographic. Anyone can export RECEIPT_SIGNER. The value is friction for a tired founder, not non-repudiation.

Do not use this gate as the only control on a multi-tenant product, a PCI workflow, or a healthcare API. Those need real policy engines and a named reviewer of record. A deny list in git is a weekend brake. It is not a compliance program.

Founders who already pay for a locked-down preview environment can skip the free draft host. The inventory still applies. The server choice is independent of the receipt.

Accept the limits, then ship

The indie constraint is not elegance. It is a bill that stays at zero until a customer exists. An inventory gate is ugly, local, and fast. It fails closed on text the model added. That is sufficient for a solo API that must leave the laptop this week without learning a paid hostname.

A founder who wants the draft half of this loop without standing up a box can run that branch through MonkeyCode’s free model access and free server option, then inventory the diff before any production secret exists.

Cap the Cassette Before an AI-Drafted Indie API Leaves the Laptop

Dakota Wu — Sun, 20 Sep 2026 11:55:52 +0000

A 200 from /health is not a ship decision. The ship decision is a cassette that names every outbound host, caps the bytes that leave the process, and still passes after the latest agent patch.

Solo founders lose weekends to pretty handlers. The model adds a translation client, an object store, and a mail vendor while the README still claims SQLite. The cassette budget is the cheap proof that none of that shipped.

AI coding tools made the demo path cheap. They also made unfinished work look finished. A generated FastAPI app can grow three paid upstreams in one turn and still return JSON that looks like a product. The founder who ships on that screenshot inherits the invoice. The founder who replays a tape with a host-and-byte cap does not.

The indie constraint

A solo founder ships today or the idea dies. Paid staging clusters do not fit that clock. The useful test on night one is not a 10k-VU soak. It is a short tape of the routes that will actually be public, replayed against a process that is forbidden to talk to anyone outside an allowlist.

That is a performance test in the only sense that matters before DNS exists. Did the handler stay cheap. Latency percentiles can wait. Host cardinality cannot. Byte caps cannot.

Keep the product on loopback until the tape is green. Raise the budget only when a real payload forces it. Never raise it because the agent asked for a “production-ready” client.

What the budget measures

Three numbers. Nothing else on the first weekend.

Distinct outbound hosts observed while the tape runs.
Total request bytes the client sent, headers included.
Count of connects that were not loopback, localhost, or an explicit fixture host.

If any number exceeds the file, the patch does not ship. The health endpoint is ignored. The cassette is the evidence folder. A dashboard without those three numbers is decoration.

Files to add this afternoon

Keep the layout boring so an agent cannot “clean it up” into a cloud folder.

api/
  app.py
cassette/
  budget.toml
  tape.json
tools/
  cassette_budget.py
Makefile

The API stays small. The tape stays in git. The outbound log stays local. That split is the whole point. Agents rewrite READMEs. They hesitate when a committed budget.toml fails a command the Makefile already names.

1. The budget file

# cassette/budget.toml
max_distinct_hosts = 1
max_outbound_bytes = 65536
max_non_local_requests = 0
allow_hosts = ["127.0.0.1", "localhost", "::1"]
allow_ports = [8000, 8080]

One allowed remote host is already generous for a laptop demo. Zero non-local requests is the default for a founder who wants the bill at zero. Raise the byte cap only after a real payload requires it. Do not raise it to silence a red run.

2. The tape

Label: example cassette. Replace bodies with the product’s real shapes before trusting a green run.

{
  "base_url": "http://127.0.0.1:8000",
  "cases": [
    {
      "name": "create_note",
      "method": "POST",
      "path": "/notes",
      "headers": {"Content-Type": "application/json"},
      "body": {"title": "ship", "body": "today"},
      "expect_status": [200, 201]
    },
    {
      "name": "read_note",
      "method": "GET",
      "path": "/notes/1",
      "expect_status": [200]
    },
    {
      "name": "health",
      "method": "GET",
      "path": "/health",
      "expect_status": [200]
    }
  ]
}

Do not put production URLs in examples. Agents copy examples into clients. The tape stays on loopback until the budget is green. Extra routes stay out of the tape until the founder is willing to support them in public.

3. The checker

The script starts the API in a subprocess, replays the tape, and records socket.connect plus socket.create_connection through a sitecustomize hook. It is a working sketch. Founders should read it before they trust it. It will not see every C extension. It will catch the usual Python HTTP clients an agent pastes in on a Saturday.

# tools/cassette_budget.py
"""Replay a cassette and fail if outbound traffic exceeds budget.toml.

Unexecuted on this machine as published. Treat as a working sketch.
"""
from __future__ import annotations

import json
import os
import socket
import subprocess
import sys
import time
import urllib.error
import urllib.request
from pathlib import Path

try:
    import tomllib
except ImportError:  # pragma: no cover
    import tomli as tomllib  # type: ignore

ROOT = Path(__file__).resolve().parents[1]
BUDGET = tomllib.loads((ROOT / "cassette" / "budget.toml").read_text())
TAPE = json.loads((ROOT / "cassette" / "tape.json").read_text())
LOG = ROOT / "cassette" / "outbound.jsonl"
HOOK_DIR = ROOT / "cassette"


class BudgetError(RuntimeError):
    pass


HOOK_SRC = r'''
import json, os, socket
from pathlib import Path
LOG = Path(os.environ["CASSETTE_LOG"])
_real_connect = socket.socket.connect
_real_create = socket.create_connection

def _connect(self, addr, *a, **k):
    host = addr[0] if isinstance(addr, tuple) else str(addr)
    port = addr[1] if isinstance(addr, tuple) and len(addr) > 1 else None
    with LOG.open("a") as fh:
        fh.write(json.dumps({"host": str(host), "port": port}) + "\n")
    return _real_connect(self, addr, *a, **k)

def _create(address, timeout=None, source_address=None):
    host, port = address[0], address[1]
    with LOG.open("a") as fh:
        fh.write(json.dumps({"host": str(host), "port": port}) + "\n")
    return _real_create(address, timeout=timeout, source_address=source_address)

socket.socket.connect = _connect
socket.create_connection = _create
'''


def install_hook() -> None:
    (HOOK_DIR / "sitecustomize.py").write_text(HOOK_SRC)
    os.environ["CASSETTE_LOG"] = str(LOG)
    os.environ["PYTHONPATH"] = str(HOOK_DIR) + os.pathsep + os.environ.get("PYTHONPATH", "")


def start_api() -> subprocess.Popen:
    LOG.write_text("")
    env = os.environ.copy()
    proc = subprocess.Popen(
        [sys.executable, "-m", "uvicorn", "api.app:app", "--host", "127.0.0.1", "--port", "8000"],
        cwd=ROOT,
        env=env,
        stdout=subprocess.DEVNULL,
        stderr=subprocess.PIPE,
    )
    deadline = time.time() + 8
    while time.time() < deadline:
        try:
            with socket.create_connection(("127.0.0.1", 8000), timeout=0.2):
                return proc
        except OSError:
            if proc.poll() is not None:
                err = proc.stderr.read().decode() if proc.stderr else ""
                raise BudgetError(f"api exited early: {err}") from None
            time.sleep(0.1)
    proc.kill()
    raise BudgetError("api did not bind 127.0.0.1:8000")


def replay() -> int:
    sent = 0
    base = TAPE["base_url"].rstrip("/")
    for case in TAPE["cases"]:
        url = base + case["path"]
        data = None
        headers = dict(case.get("headers") or {})
        if "body" in case:
            data = json.dumps(case["body"]).encode()
            headers.setdefault("Content-Type", "application/json")
            sent += len(data)
        req = urllib.request.Request(url, data=data, headers=headers, method=case["method"])
        sent += sum(len(k) + len(str(v)) for k, v in headers.items())
        try:
            with urllib.request.urlopen(req, timeout=5) as resp:
                status = resp.status
                sent += len(resp.read())
        except urllib.error.HTTPError as exc:
            status = exc.code
        if status not in case["expect_status"]:
            raise BudgetError(f"{case['name']} status {status}")
    return sent


def evaluate(sent_bytes: int) -> None:
    rows = []
    if LOG.exists() and LOG.read_text().strip():
        rows = [json.loads(line) for line in LOG.read_text().splitlines() if line.strip()]
    allow = set(BUDGET["allow_hosts"])
    hosts = sorted({r["host"] for r in rows})
    foreign = [r for r in rows if r["host"] not in allow]
    if len(hosts) > BUDGET["max_distinct_hosts"]:
        raise BudgetError(f"hosts {hosts} exceed max_distinct_hosts")
    if sent_bytes > BUDGET["max_outbound_bytes"]:
        raise BudgetError(f"bytes {sent_bytes} exceed cap")
    if len(foreign) > BUDGET["max_non_local_requests"]:
        raise BudgetError(f"non-local connects: {foreign}")
    print(json.dumps({"hosts": hosts, "bytes": sent_bytes, "foreign": len(foreign)}, indent=2))


def main() -> int:
    install_hook()
    proc = start_api()
    try:
        sent = replay()
        evaluate(sent)
    finally:
        proc.terminate()
        try:
            proc.wait(timeout=3)
        except subprocess.TimeoutExpired:
            proc.kill()
    return 0


if __name__ == "__main__":
    raise SystemExit(main())

The hook is coarse on purpose. Weekend APIs die from httpx.AsyncClient pointed at a tutorial host, not from a custom libc shim. Read the diff when the log is empty and the handler still smells like a vendor SDK. Empty logs are a signal to inspect, not a blessing.

Run order

Do this in order. Skipping a step is how a paid SDK lands in the lockfile after the demo.

Freeze the cassette paths to the routes the founder actually wants public this week. Extra routes stay commented in the OpenAPI file.
Start from a clean venv. Install only what api/app.py imports today.
Run python tools/cassette_budget.py. A BudgetError means the patch is not done.
If the agent added a helper module, re-run before committing. Do not batch five agent turns and then test.
Keep budget.toml and tape.json in git. Leave outbound.jsonl as a local artifact.
Point DNS at anything other than loopback only after step 3 is green on a second machine.

Makefile glue keeps the command short enough for a tired Sunday.

.PHONY: cassette
cassette:
    python tools/cassette_budget.py

A founder who cannot run make cassette on a train is not ready to take the API public. The command has to fit in a small terminal. The failure has to name the host that broke the budget.

Failure modes the tape usually catches

The first red run is rarely exotic. An agent adds httpx and a base URL from a README. The hook records that host. The budget fails. The founder deletes the client and the extra settings block.

The second red run is a “just in case” object-store helper. The create-note case never needed a bucket. The tape still trips because import-time setup opened a session. Move I/O to the request path, then delete the helper if the path does not need it this week.

The third red run is a chatty list endpoint. Byte counts in this sketch include response bodies. A 2 MB welcome payload blows a 64 KB cap even when every host is local. That is intended on week one. Pagination is cheaper than a dump.

Where a free model and a free server fit

Local green is the bar. A second machine is the confirmation. After the laptop cassette passes, the same tape can be pointed at a throwaway process on a free server so the founder is not the only host that has ever run the handler.

Disclosure: This article was prepared as part of MonkeyCode's product outreach.

MonkeyCode is relevant here only as a place with free model access for drafting extra cassette cases from an OpenAPI file, and a free server option for that second-hop replay. It does not replace the budget file. It does not prove the hook saw every socket. Treat both the free model access and the free server option as capacity that can change; keep the cassette runner in the repo so the gate still works offline.

Drafting extra cases is mechanical. Paste the path list. Require JSON cases that stay on 127.0.0.1 and never invent vendor URLs. Reject any case whose path is not already in the public set. Then re-run the checker. A generated tape that mentions a paid host is a failed draft, not a starting point.

What this does not prove

The cassette does not prove authentication is correct. It does not prove SQL injection is absent. It does not prove the handler meets a latency SLO. It does not see traffic from a sidecar the process did not spawn.

Agents can cheat the budget by writing files instead of calling HTTP, or by shelling out to curl. Add a later gate if that shows up: a denylist of subprocess binaries. Until then, read the patch. The cassette is a filter. It is not a substitute for a founder who still opens the diff.

Realistic API tests still need production-shaped payloads, think times, and failure injection. This tape is not that suite. It is the gate that keeps the suite from running against a process that already called a vendor.

Who should skip this

Skip the cassette budget if the product already has a real staging bill and a load suite. Skip it if the API handles payments, medical data, or anyone else’s secrets. Skip it if the team needs multi-region failover. Those products need contracts and reviews this workflow does not provide.

Skip it if nobody will maintain tape.json. A stale tape is worse than no tape. It blesses a demo path while the agent rewires /export to a paid encoder. A founder who will not edit the tape when a route changes should not publish the route.

Ship rule

The ship rule is one line. If make cassette is red, the API stays on the laptop. If it is green, the founder may take a second hop on a free server, then publish. The demo 200 is not evidence. The cassette is.

If the tape needs more cases than a tired evening allows, draft them against the OpenAPI file with free model access, keep every URL on loopback, and re-run the budget before anyone else hits the process.

A Runtime Host Permit for Vibe-Coded Indie APIs

Dakota Wu — Sat, 19 Sep 2026 09:59:52 +0000

A solo founder can vibe-code a weekend backend and still keep the bill at zero. The handlers can be messy. The outbound host list cannot. In this lane, engineering is a runtime host permit that fails closed before any paid hostname is resolved.

Generated code is good at looking complete. It is bad at respecting a bootstrapped budget. A draft that compiles is not a draft that stays free. The difference is not taste. It is whether the process is allowed to resolve the public internet.

The leak that import pinning misses

Import scanners catch branded SDKs. They miss a one-line urllib.request.urlopen aimed at a vendor the model remembered from training data. They also miss background “health” pings the agent added while being helpful. Those calls do not need a new dependency. They need a name.

Name resolution is the cost event. After DNS succeeds, the bill is a matter of time. A permit file that wraps getaddrinfo is the cheapest in-process control a solo operator can keep. It is not a service mesh. It is a lock on the laptop.

Vibe-coded features can ship today under that lock. Calling the result a platform is the mistake. The permit is the engineering. The generated route handlers are the draft.

Permit classes for a zero-bill demo

Three classes are enough for a weekend ship. Extra classes become prompt fodder. Keep the table small enough to hash in CI.

Class	Meaning	Typical members	Default
LOCAL	Loopback only	`localhost`, `127.0.0.1`, `::1`	allow
FREE_REMOTE	One operator-chosen free host	a single explicit hostname	deny until listed
PAID	Everything else	`*`	deny

LOCAL is the demo. FREE_REMOTE is optional. PAID is never an accident. A founder who needs a second remote has left the zero-bill lane and should say so in the permit diff, not in chat.

1. Write a boring permit file

Keep the file next to the app, not in a prompt. Models rewrite prompts. They are slower to rewrite a path that CI hashes. First match wins. The wildcard deny is required, not decorative.

# egress.permit
# format: ALLOW|DENY <host-or-ip>
# comments start with #
ALLOW localhost
ALLOW 127.0.0.1
ALLOW ::1
DENY *

A founder who later opts into a free server adds one ALLOW line for that hostname. Nothing else changes. The wildcard deny stays last. Treat a growing file as an incident, not as product iteration.

Hash it so an agent cannot silently widen the net.

sha256sum egress.permit > egress.permit.sha256
git add egress.permit egress.permit.sha256

2. Install a process-wide resolver guard

The guard below is a compact example, not a security product. It wraps socket.getaddrinfo and refuses unmatched hosts before a TCP handshake. Load it before the ASGI app. A late import is an open window.

# permit_guard.py
from __future__ import annotations

import ipaddress
import socket
from pathlib import Path

PERMIT_PATH = Path(__file__).with_name("egress.permit")
_DENIED = object()


class PermitDenied(RuntimeError):
    pass


def _parse(path: Path) -> list[tuple[str, str]]:
    rules: list[tuple[str, str]] = []
    for raw in path.read_text(encoding="utf-8").splitlines():
        line = raw.strip()
        if not line or line.startswith("#"):
            continue
        action, _, target = line.partition(" ")
        action = action.upper()
        target = target.strip().lower()
        if action not in {"ALLOW", "DENY"} or not target:
            raise ValueError(f"invalid permit line: {raw!r}")
        rules.append((action, target))
    if not rules or rules[-1] != ("DENY", "*"):
        raise ValueError("egress.permit must end with DENY *")
    return rules


RULES = _parse(PERMIT_PATH)


def _host_key(host: str) -> str:
    host = host.strip().lower().rstrip(".")
    if host.startswith("[") and host.endswith("]"):
        host = host[1:-1]
    return host


def decide(host: str) -> str:
    key = _host_key(host)
    try:
        ipaddress.ip_address(key)
        identities = {key}
    except ValueError:
        identities = {key}
    for action, target in RULES:
        if target == "*" or target in identities:
            return action
    return "DENY"


_orig_getaddrinfo = socket.getaddrinfo


def _guarded_getaddrinfo(host, port, *args, **kwargs):
    if host is None:
        return _orig_getaddrinfo(host, port, *args, **kwargs)
    if decide(str(host)) != "ALLOW":
        raise PermitDenied(f"egress denied for host={host!r} port={port!r}")
    return _orig_getaddrinfo(host, port, *args, **kwargs)


socket.getaddrinfo = _guarded_getaddrinfo

The wrapper is English-simple on purpose. It does not log denied hosts to a remote sink. Logging is another egress path. Print locally or fail the test. Do not phone home about a deny.

3. Add a hostile test the agent cannot charm

The suite must call a public hostname the permit does not list. If the suite is green without that failure, the guard is not installed. A loopback-only happy path is a false calm.

# test_egress_permit.py
import permit_guard
import socket
import urllib.error
import urllib.request

import pytest


def test_loopback_still_resolves():
    infos = socket.getaddrinfo("127.0.0.1", 9, type=socket.SOCK_STREAM)
    assert infos


def test_public_host_is_denied():
    with pytest.raises(permit_guard.PermitDenied):
        socket.getaddrinfo("example.com", 443, type=socket.SOCK_STREAM)


def test_stdlib_http_cannot_bypass_the_resolver():
    with pytest.raises((permit_guard.PermitDenied, urllib.error.URLError)):
        urllib.request.urlopen("https://example.com/", timeout=2)

Run it on every agent session, not once per release fantasy.

python -m pytest -q test_egress_permit.py
python -c "import permit_guard, hashlib; print(hashlib.sha256(open('egress.permit','rb').read()).hexdigest())"

Pin the hash check next to pytest. A permit that drifted is a failed build. A model that “simplified” DENY * into a comment is a failed build.

4. Draft with a free model; list a free server only if it is real

A solo operator can draft handlers with a free coding model and still treat that model as untrusted for network policy. Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode is an open-source project with free model access and a free server option. Those are availability claims. They are not a default ALLOW rule.

If a free server is used, it belongs on one explicit ALLOW line under the operator’s control. The permit does not infer it from marketing copy. The model does not get a second remote “for retries.” CI should fail when egress.permit grows without a human diff. Indie operators who want that draft lane can try MonkeyCode against this permit workflow. The wildcard deny stays the last line either way.

The rest of the method does not depend on any vendor. Remove the product and the guard still compiles. That is the point of putting policy in a file the process loads first.

5. Ship with the guard in the process, not in the README

README policy is not policy. Export one entry point that imports the guard before the app. A tired 01:00 restart should not discover a second, unguarded script.

# Makefile
.PHONY: demo test freeze

demo:
    python -c "import permit_guard, app; app.main()"

test:
    python -m pytest -q test_egress_permit.py

freeze:
    sha256sum -c egress.permit.sha256

Keep app.py boring. Bind the demo server to loopback. Refuse 0.0.0.0 unless the founder is doing that on purpose and has already left the laptop-only contract.

# app.py — labeled example, not a framework
from http.server import BaseHTTPRequestHandler, HTTPServer

class Handler(BaseHTTPRequestHandler):
    def do_GET(self):
        body = b'{"ok": true, "lane": "local"}\n'
        self.send_response(200)
        self.send_header("Content-Type", "application/json")
        self.send_header("Content-Length", str(len(body)))
        self.end_headers()
        self.wfile.write(body)

def main() -> None:
    httpd = HTTPServer(("127.0.0.1", 8080), Handler)
    httpd.serve_forever()

Debugging a false deny without opening the net

False denies happen. IPv6 forms, trailing dots, and bracketed literals are the usual three. Fix the comparer, not the permit. Do not “temporarily” comment out DENY * to see if the demo boots. That is how a weekend API grows a bill.

Work the failure in this order.

Print the raw host the stack passed into getaddrinfo. Use a local print, not a webhook.
Normalize once in _host_key. Do not add fuzzy suffix matching. Fuzzy matching is how evil.localhost.paid-vendor.example sneaks through a careless endswith.
If the app needs an IP literal, list that literal. Do not allow every IPv4 address because one health check used 127.0.0.1.
Re-run the hostile test after every comparer change. A comparer fix that makes example.com resolve is a regression, not a cleanup.

# labeled debug helper — keep it off by default
DEBUG_EGRESS = False

def decide(host: str) -> str:
    key = _host_key(host)
    for action, target in RULES:
        if target == "*" or target == key:
            if DEBUG_EGRESS:
                print(f"egress {action} {key} via {target}")
            return action
    return "DENY"

What this does not cover

The wrapper cannot see a subprocess that shells out to curl. It cannot see a C extension that opens its own sockets. It cannot see raw IPs unless those IPs are listed or denied. It is not a replacement for unshare, a host firewall, or an allowlist at the edge. It also does not prove the handlers are correct. It only proves the process was not allowed to resolve a stranger.

Do not use this approach for payment traffic, health data, or multi-tenant production. Do not use it as evidence that a vibe-coded service is engineered. The permit keeps a demo unbilled. It does not make the demo true.

Solo founders who need guaranteed uptime, questionnaires, or vendor SLAs should pick a paid stack on purpose. Skip the theater of a laptop permit. Everyone else can ship today, accept the limits, and leave the wildcard deny in place.

Fail Closed at Socket Time: A Loopback Probe for Zero-Bill Indie APIs

Dakota Wu — Fri, 18 Sep 2026 08:21:14 +0000

A weekend API stays free only if the process cannot leave the machine. Agent-written patches still compile when they import a billed SDK and open a TCP session on the first request. A fail-closed egress probe at boot lets a solo founder ship today, keep the wallet closed, and defer every third-party host until a human edits an allowlist.

Vibe-coded backends fail as engineering when the network is implicit. The model is not the leak. The first outbound socket is.

The cost path is a hostname, not a feature flag

Indie stacks accrue charges in three boring ways. A generated client calls a hosted model. A “temporary” object store lands on a public bucket. A logging snippet posts traces to a vendor. None of those require a product decision. They require create_connection.

A committed host allowlist is smaller than a cloud policy engine. It is also dumber, which is the point. The process starts only if every resolved peer is loopback. Anything else raises before the ASGI server binds.

This is not a security product. It is a wallet latch for a one-person repo that must ship this week.

Artifact: a fail-closed connector wrap

The working unit is three files. allowlist.json is the policy. egress_guard.py installs the wrap before routers import. test_egress_guard.py proves both the allow path and the deny path. No cloud account is required to run them.

1. Commit a loopback-only policy

Keep the file tiny. Review it in the same PR as any new dependency.

{
  "allowed_hosts": ["127.0.0.1", "localhost", "::1"],
  "allowed_ports": [8000, 8080],
  "deny_message": "egress blocked: host not on loopback allowlist"
}

Ports are optional. A stricter operator allows any port on loopback and zero ports elsewhere. The JSON exists so an agent cannot “helpfully” add api.stripe.com inside a Python literal without a file diff.

2. Wrap name lookup and TCP connect before app import

socket.create_connection is the common path for urllib, requests, and many SDKs. getaddrinfo is the earlier path. Both get wrapped. The original functions stay on the module so tests can still bind a local server.

# egress_guard.py
from __future__ import annotations

import json
import socket
from pathlib import Path
from typing import Any

POLICY_PATH = Path(__file__).with_name("allowlist.json")

class EgressBlocked(RuntimeError):
    """Raised when a peer is outside the committed allowlist."""


def load_policy() -> dict[str, Any]:
    data = json.loads(POLICY_PATH.read_text(encoding="utf-8"))
    hosts = frozenset(data["allowed_hosts"])
    ports = frozenset(int(p) for p in data.get("allowed_ports", []))
    return {"hosts": hosts, "ports": ports, "message": data["deny_message"]}


_POLICY = load_policy()
_orig_getaddrinfo = socket.getaddrinfo
_orig_create_connection = socket.create_connection


def _check(host: str, port: int | None) -> None:
    if host not in _POLICY["hosts"]:
        raise EgressBlocked(f"{_POLICY['message']}: host={host!r}")
    if port is not None and _POLICY["ports"] and port not in _POLICY["ports"]:
        raise EgressBlocked(f"{_POLICY['message']}: port={port}")


def guarded_getaddrinfo(host, port, *args, **kwargs):
    _check(str(host), int(port) if port else None)
    return _orig_getaddrinfo(host, port, *args, **kwargs)


def guarded_create_connection(address, *args, **kwargs):
    host, port = address[0], address[1]
    _check(str(host), int(port) if port is not None else None)
    return _orig_create_connection(address, *args, **kwargs)


def install() -> None:
    socket.getaddrinfo = guarded_getaddrinfo
    socket.create_connection = guarded_create_connection

Call install() in a boot module, not in a router. Routers are what the agent edits. The boot module should be listed in a one-line code-owner rule or a CODEOWNERS file so it does not drift.

# boot.py
from egress_guard import install

install()

from app import create_app  # local import after the wrap

app = create_app()

if __name__ == "__main__":
    import uvicorn

    uvicorn.run(app, host="127.0.0.1", port=8000, log_level="info")

Bind 127.0.0.1, not 0.0.0.0. A loopback allowlist is worthless if the public interface is already advertised.

3. Keep the app itself on local adapters

The sample service stores a waitlist in SQLite. No Redis. No hosted queue. The handler never constructs an HTTP client. That is the product for week one: an endpoint that works on a laptop and on a single free process.

# app.py
from __future__ import annotations

import sqlite3
from pathlib import Path

from fastapi import FastAPI
from pydantic import BaseModel, EmailStr

DB_PATH = Path(__file__).with_name("waitlist.db")

class Signup(BaseModel):
    email: EmailStr


def create_app() -> FastAPI:
    app = FastAPI(title="local-waitlist")
    conn = sqlite3.connect(DB_PATH, check_same_thread=False)
    conn.execute(
        "CREATE TABLE IF NOT EXISTS waitlist (email TEXT PRIMARY KEY, created_at TEXT DEFAULT CURRENT_TIMESTAMP)"
    )
    conn.commit()

    @app.get("/health")
    def health() -> dict[str, str]:
        return {"status": "ok", "store": "sqlite"}

    @app.post("/signup")
    def signup(body: Signup) -> dict[str, str]:
        conn.execute("INSERT OR IGNORE INTO waitlist(email) VALUES (?)", (body.email,))
        conn.commit()
        return {"email": body.email, "stored": "local"}

    return app

4. Prove deny and allow with pytest

The deny test must not depend on the public internet being up. The assertion is the exception type, not a timeout. The allow test binds a tiny local server on an allowlisted port.

# test_egress_guard.py
import socket
import threading
from http.server import BaseHTTPRequestHandler, HTTPServer

import pytest

import egress_guard
from egress_guard import EgressBlocked


@pytest.fixture(autouse=True)
def _install_guard():
    egress_guard.install()
    yield
    socket.getaddrinfo = egress_guard._orig_getaddrinfo
    socket.create_connection = egress_guard._orig_create_connection


def test_blocks_public_hostname():
    with pytest.raises(EgressBlocked):
        socket.create_connection(("example.com", 443), timeout=1)


def test_blocks_literal_public_ip():
    with pytest.raises(EgressBlocked):
        socket.create_connection(("1.1.1.1", 443), timeout=1)


def test_allows_loopback_http():
    server = HTTPServer(("127.0.0.1", 8080), BaseHTTPRequestHandler)
    thread = threading.Thread(target=server.handle_request, daemon=True)
    thread.start()
    sock = socket.create_connection(("127.0.0.1", 8080), timeout=2)
    sock.close()
    thread.join(timeout=2)

Run the loop the same way every time. Fail closed means CI red is the success case for a sneaky host.

python -m pip install fastapi pydantic uvicorn pytest
python -m pytest -q test_egress_guard.py
python boot.py

A second check belongs in the shell before a public bind. If allowlist.json grows a non-loopback host, the command exits non-zero.

python - <<'PY'
import json, sys
from pathlib import Path
allowed = {"127.0.0.1", "localhost", "::1"}
data = json.loads(Path("allowlist.json").read_text())
bad = [h for h in data["allowed_hosts"] if h not in allowed]
if bad:
    print("non-loopback hosts:", bad)
    sys.exit(1)
print("allowlist: loopback only")
PY

Decision table: ship local or open a host

Need this week	Local substitute	Open the allowlist?
Persist signups	SQLite file next to the app	No
Background work	In-process queue or a thread	No
Auth for a demo	Signed cookies, one secret in env	No
File uploads	Disk under `./data`	No
Transactional email	Log the payload, send by hand	Not yet
Card capture	Do not ship the route	Not this week
Hosted inference	Defer; keep the handler offline	Only after a human review

The table is the product spec. If a generated patch needs a row that says “yes”, the patch waits. Shipping today means the left column, not a vendor SDK.

Where a free model endpoint fits

Drafting the guard does not require a paid coding seat. MonkeyCode is an open-source coding assistant with free model access and a free server option, which is enough for a solo founder to generate the interceptor and run the API without attaching a card. Disclosure: This article was prepared as part of MonkeyCode's product outreach.

The probe does not depend on that tooling. It is ordinary CPython. A free server is useful only after test_egress_guard.py is green and boot.py still binds loopback. Treat the remote process like another laptop: same allowlist, same SQLite file, same refusal to add hosts.

Operators who already draft against a free model endpoint can paste egress_guard.py into that repo and run the tests before the next bind.

What this does not catch

The wrap is a latch, not a sandbox. socket.socket().connect() can still be called directly on some paths. asyncio openers, httpx with a custom transport, subprocess to curl, and HTTP_PROXY environment variables sit outside this file. IPv4-mapped IPv6 literals such as ::ffff:1.1.1.1 need an extra normalize step if the runtime accepts them. Docker --network host and Kubernetes sidecars ignore a process-level wrap.

SQLite will not survive multi-instance writes. Loopback binding will not satisfy a mobile client on another device without an explicit tunnel. Those are accepted limits for a zero-bill week, not defects to paper over with a paid queue.

Reload the policy only from disk at process start. Hot reload invites an agent to widen the list after tests pass.

Who should skip this

Skip the probe if the product must talk to a payment processor, an email provider, or a third-party webhook on day one. Skip it if the team already runs shared staging with managed identity. Skip it if the operator needs this wrap to stop data exfiltration; use an OS-level network policy or an isolated VM instead.

Solo founders who can accept a local store, a loopback bind, and a human-owned allowlist can ship the waitlist today. The wallet stays closed until someone edits JSON on purpose.

Capability Tickets That Keep an AI-Drafted Indie API on Local Adapters

Dakota Wu — Thu, 17 Sep 2026 06:37:56 +0000

Solo founders can ship an AI-drafted API this week without opening a cloud bill. The constraint has to be mechanical. Every runtime capability is spent from a ticket file that only lists local adapters, and the process refuses to boot when a patch tries to spend a ticket that is not there.

Cloud SDKs are not a later refactor. They are a different product. A weekend MVP that already speaks Postgres, Redis, object storage, and a hosted mail API has left the free envelope even if no invoice has arrived yet.

AI coding tools make that jump cheap to type and expensive to unwind. A model asked to add password reset will reach for a hosted mailer. A model asked to make it production-ready will add a broker. Drafting is not the failure. Calling the draft engineering is the failure. For a one-person ship, engineering means proving that storage, jobs, mail, and files still resolve to adapters that run on a laptop or a single free host.

This write-up records a ticket file, a factory that fails closed, a tiny HTTP service, and a proof command that writes SHIP_PROOF.json. The method is for indie hackers who need to ship today and can accept the limits. It is not a scaling guide.

The ticket file

A capability ticket is a named adapter, not a vendor slogan. One ticket per concern. No aliases that hide a paid client.

Create capabilities.json at the repo root.

{
  "version": 1,
  "tickets": {
    "storage": "sqlite_file",
    "queue": "memory_list",
    "mail": "maildir",
    "blobs": "local_dir",
    "jobs": "inline",
    "auth": "hmac_cookie"
  },
  "data_dir": "./data",
  "listen": "127.0.0.1:8080"
}

Allowed values stay small on purpose. sqlite_file means one file under data_dir. memory_list means a process-local deque. maildir means write .eml files. local_dir means hashed files on disk. inline means the request thread runs the job. hmac_cookie means a signed cookie with a local secret file.

Anything else is a declined ticket. Declined tickets fail the process at import time, not after a customer click.

Decision table for the first week

Use the table as the review surface. An agent patch that introduces a new row without a human edit to this table is out of scope for a bill-zero ship.

Concern	Allowed ticket	Forbidden stand-in	First-week reason
storage	`sqlite_file`	Postgres, hosted MySQL	one file, zero extra host
queue	`memory_list`	Redis, SQS, Celery	dies with the process, which is acceptable
mail	`maildir`	SendGrid, SES, Postmark	founder can open the `.eml`
blobs	`local_dir`	S3, GCS, R2	hashed files next to SQLite
jobs	`inline`	Cloud scheduler, worker pool	no second process to bill
auth	`hmac_cookie`	Auth0, Cognito, Clerk	local secret file only
listen	loopback	`0.0.0.0` publish	public bind waits for a real user

The table is the product contract. Code below only enforces it.

Factory that fails closed

The application never constructs SQLite, queues, or mailers ad hoc. It asks a factory. The factory reads the ticket file once and raises BudgetError on mismatch.

# budget.py
from __future__ import annotations

import json
from dataclasses import dataclass
from pathlib import Path

ALLOWED = {
    "storage": {"sqlite_file"},
    "queue": {"memory_list"},
    "mail": {"maildir"},
    "blobs": {"local_dir"},
    "jobs": {"inline"},
    "auth": {"hmac_cookie"},
}

class BudgetError(RuntimeError):
    pass

@dataclass(frozen=True)
class Tickets:
    storage: str
    queue: str
    mail: str
    blobs: str
    jobs: str
    auth: str
    data_dir: Path
    listen: str

def load_tickets(root: Path) -> Tickets:
    raw = json.loads((root / "capabilities.json").read_text(encoding="utf-8"))
    tickets = raw["tickets"]
    for key, allowed in ALLOWED.items():
        got = tickets.get(key)
        if got not in allowed:
            raise BudgetError(f"ticket {key}={got!r} is not in {sorted(allowed)}")
    data_dir = (root / raw["data_dir"]).resolve()
    if not str(data_dir).startswith(str(root.resolve())):
        raise BudgetError("data_dir escapes the repo")
    data_dir.mkdir(parents=True, exist_ok=True)
    return Tickets(
        storage=tickets["storage"],
        queue=tickets["queue"],
        mail=tickets["mail"],
        blobs=tickets["blobs"],
        jobs=tickets["jobs"],
        auth=tickets["auth"],
        data_dir=data_dir,
        listen=raw["listen"],
    )

The path check matters. An agent that sets data_dir to /var/lib/postgresql or a remote mount should not boot. The factory is the spend desk. Application code is not allowed to argue with it.

Local adapters only

Keep adapters boring. Boring is the point.

# adapters.py
from __future__ import annotations

import hashlib
import sqlite3
import time
from collections import deque
from pathlib import Path
from typing import Any, Callable, Deque, Dict, Tuple

from budget import BudgetError, Tickets

class Store:
    def __init__(self, tickets: Tickets) -> None:
        if tickets.storage != "sqlite_file":
            raise BudgetError("storage adapter refused")
        self.path = tickets.data_dir / "app.sqlite"
        self._db = sqlite3.connect(self.path, check_same_thread=False)
        self._db.execute(
            "CREATE TABLE IF NOT EXISTS notes "
            "(id INTEGER PRIMARY KEY, body TEXT NOT NULL, created_at REAL NOT NULL)"
        )
        self._db.commit()

    def add_note(self, body: str) -> int:
        cur = self._db.execute(
            "INSERT INTO notes(body, created_at) VALUES (?, ?)",
            (body, time.time()),
        )
        self._db.commit()
        return int(cur.lastrowid)

    def list_notes(self) -> list[tuple[int, str, float]]:
        rows = self._db.execute(
            "SELECT id, body, created_at FROM notes ORDER BY id DESC LIMIT 50"
        )
        return list(rows)

class MailDir:
    def __init__(self, tickets: Tickets) -> None:
        if tickets.mail != "maildir":
            raise BudgetError("mail adapter refused")
        self.dir = tickets.data_dir / "maildir"
        self.dir.mkdir(exist_ok=True)

    def send(self, to: str, subject: str, body: str) -> Path:
        name = f"{int(time.time() * 1000)}_{hashlib.sha256(to.encode()).hexdigest()[:8]}.eml"
        path = self.dir / name
        path.write_text(
            f"To: {to}\nSubject: {subject}\n\n{body}\n",
            encoding="utf-8",
        )
        return path

class MemoryQueue:
    def __init__(self, tickets: Tickets) -> None:
        if tickets.queue != "memory_list":
            raise BudgetError("queue adapter refused")
        self._q: Deque[Tuple[str, Dict[str, Any]]] = deque()

    def push(self, kind: str, payload: Dict[str, Any]) -> None:
        self._q.append((kind, payload))

    def drain(self, handler: Callable[[str, Dict[str, Any]], None]) -> int:
        n = 0
        while self._q:
            kind, payload = self._q.popleft()
            handler(kind, payload)
            n += 1
        return n

class BlobDir:
    def __init__(self, tickets: Tickets) -> None:
        if tickets.blobs != "local_dir":
            raise BudgetError("blob adapter refused")
        self.dir = tickets.data_dir / "blobs"
        self.dir.mkdir(exist_ok=True)

    def put(self, raw: bytes) -> str:
        digest = hashlib.sha256(raw).hexdigest()
        (self.dir / digest).write_bytes(raw)
        return digest

Jobs stay inline. The HTTP handler pushes to the memory queue and drains it before the response returns. That is slower under load. It is also free, inspectable, and enough for a first cohort of users who do not exist yet.

HTTP surface that spends tickets

Stdlib is enough for the first route set. No ASGI stack is required to prove the budget.

# app.py
from __future__ import annotations

import json
from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
from pathlib import Path
from urllib.parse import urlparse

from adapters import MailDir, MemoryQueue, Store
from budget import load_tickets

ROOT = Path(__file__).resolve().parent
TICKETS = load_tickets(ROOT)
STORE = Store(TICKETS)
MAIL = MailDir(TICKETS)
QUEUE = MemoryQueue(TICKETS)

def run_jobs(kind: str, payload: dict) -> None:
    if kind == "note_mail":
        MAIL.send(payload["to"], "Note saved", payload["body"])

class Handler(BaseHTTPRequestHandler):
    def _json(self, code: int, payload: dict) -> None:
        raw = json.dumps(payload).encode("utf-8")
        self.send_response(code)
        self.send_header("Content-Type", "application/json")
        self.send_header("Content-Length", str(len(raw)))
        self.end_headers()
        self.wfile.write(raw)

    def do_GET(self) -> None:
        if urlparse(self.path).path != "/notes":
            self._json(404, {"error": "not_found"})
            return
        rows = [
            {"id": i, "body": body, "created_at": ts}
            for i, body, ts in STORE.list_notes()
        ]
        self._json(200, {"listen": TICKETS.listen, "notes": rows})

    def do_POST(self) -> None:
        if urlparse(self.path).path != "/notes":
            self._json(404, {"error": "not_found"})
            return
        length = int(self.headers.get("Content-Length", "0"))
        data = json.loads(self.rfile.read(length) or b"{}")
        body = str(data.get("body", "")).strip()
        to = str(data.get("notify", "")).strip()
        if not body:
            self._json(400, {"error": "body_required"})
            return
        note_id = STORE.add_note(body)
        if to:
            QUEUE.push("note_mail", {"to": to, "body": body})
            QUEUE.drain(run_jobs)
        self._json(201, {"id": note_id})

    def log_message(self, fmt: str, *args) -> None:
        return

def main() -> None:
    host, port_s = TICKETS.listen.split(":")
    if host not in {"127.0.0.1", "localhost"}:
        raise SystemExit("listen host is not loopback; ticket refused")
    httpd = ThreadingHTTPServer((host, int(port_s)), Handler)
    httpd.serve_forever()

if __name__ == "__main__":
    main()

Loopback is part of the ticket. Binding 0.0.0.0 is a later decision, made after a real user exists, not after a model suggests a Docker publish port.

Proof command

A ship is not a feeling. It is a file. The proof script boots the app, writes a note, and checks that SQLite plus a maildir file appeared on disk.

# prove_ship.py
from __future__ import annotations

import json
import socket
import subprocess
import sys
import time
import urllib.request
from pathlib import Path

ROOT = Path(__file__).resolve().parent

def wait_port(host: str, port: int, timeout: float = 5.0) -> None:
    deadline = time.time() + timeout
    while time.time() < deadline:
        try:
            with socket.create_connection((host, port), timeout=0.2):
                return
        except OSError:
            time.sleep(0.05)
    raise SystemExit("server did not bind loopback in time")

def main() -> None:
    tickets = json.loads((ROOT / "capabilities.json").read_text(encoding="utf-8"))
    host, port_s = tickets["listen"].split(":")
    port = int(port_s)
    proc = subprocess.Popen([sys.executable, str(ROOT / "app.py")], cwd=ROOT)
    try:
        wait_port(host, port)
        req = urllib.request.Request(
            f"http://{host}:{port}/notes",
            data=json.dumps(
                {"body": "ship today", "notify": "founder@localhost"}
            ).encode(),
            headers={"Content-Type": "application/json"},
            method="POST",
        )
        with urllib.request.urlopen(req, timeout=2) as resp:
            created = json.loads(resp.read().decode())
        with urllib.request.urlopen(f"http://{host}:{port}/notes", timeout=2) as resp:
            listed = json.loads(resp.read().decode())
    finally:
        proc.terminate()
        proc.wait(timeout=3)

    sqlite_path = ROOT / "data" / "app.sqlite"
    mails = list((ROOT / "data" / "maildir").glob("*.eml"))
    proof = {
        "ok": True,
        "note_id": created["id"],
        "listed": len(listed["notes"]),
        "sqlite_bytes": sqlite_path.stat().st_size,
        "mail_files": len(mails),
        "listen": tickets["listen"],
        "tickets": tickets["tickets"],
    }
    if proof["listed"] < 1 or proof["mail_files"] < 1:
        raise SystemExit("ship proof failed")
    out = ROOT / "SHIP_PROOF.json"
    out.write_text(json.dumps(proof, indent=2), encoding="utf-8")
    print(out.read_text(encoding="utf-8"))

if __name__ == "__main__":
    main()

Run the proof from the repo root.

python prove_ship.py

A green run writes SHIP_PROOF.json. Commit that file with the ticket file. The next agent session has to treat both as inputs, not as suggestions.

Guard the ticket file in tests

Add a unit check so a model cannot silently widen ALLOWED without breaking CI.

# test_budget.py
from pathlib import Path
import json
import tempfile
import unittest

from budget import BudgetError, load_tickets

class TicketTests(unittest.TestCase):
    def write(self, tickets, data_dir="./data"):
        td = Path(tempfile.mkdtemp())
        payload = {
            "version": 1,
            "tickets": tickets,
            "data_dir": data_dir,
            "listen": "127.0.0.1:8080",
        }
        (td / "capabilities.json").write_text(json.dumps(payload), encoding="utf-8")
        return td

    def test_accepts_local_set(self):
        root = self.write({
            "storage": "sqlite_file",
            "queue": "memory_list",
            "mail": "maildir",
            "blobs": "local_dir",
            "jobs": "inline",
            "auth": "hmac_cookie",
        })
        loaded = load_tickets(root)
        self.assertEqual(loaded.storage, "sqlite_file")

    def test_rejects_postgres(self):
        root = self.write({
            "storage": "postgres",
            "queue": "memory_list",
            "mail": "maildir",
            "blobs": "local_dir",
            "jobs": "inline",
            "auth": "hmac_cookie",
        })
        with self.assertRaises(BudgetError):
            load_tickets(root)

    def test_rejects_escaped_data_dir(self):
        root = self.write({
            "storage": "sqlite_file",
            "queue": "memory_list",
            "mail": "maildir",
            "blobs": "local_dir",
            "jobs": "inline",
            "auth": "hmac_cookie",
        }, data_dir="../outside")
        with self.assertRaises(BudgetError):
            load_tickets(root)

if __name__ == "__main__":
    unittest.main()

python -m unittest test_budget.py

Keep this test next to the ticket file. A patch that only edits app.py is cheap to review. A patch that edits budget.py is a spend request.

Where a free coding session fits

Disclosure: This article was prepared as part of MonkeyCode's product outreach.

A solo founder still has to generate the first handlers somehow. MonkeyCode's free model access and free server option can host that generation-and-proof loop without opening a paid cloud account for the coding environment itself. The ticket file and prove_ship.py remain the product. The environment is only a place to run them.

The method does not depend on any one vendor. If the same files run on a laptop, they are doing the job. Use a hosted free session when the laptop is inconvenient, not because a prompt asked for extra capacity.

Limits, and who should skip this

The memory queue vanishes on process restart. Maildir is not deliverability. SQLite will not like multiple writers across machines. Loopback is not a public launch. HMAC cookies are not an identity platform.

Do not use this approach when the product already has paying users who need multi-instance failover. Skip it when mail must leave the box, when blobs must be geo-replicated, or when a compliance review requires a named cloud vendor. Those are different tickets. Buy them after revenue, not after a prompt.

AI-assisted drafts still need a human to keep ALLOWED small. A model can edit budget.py as easily as app.py. The defense is social as well as technical. The ticket file is reviewed like a spend request. The proof file is the receipt.

Ship the local adapters this week. Seal the tickets before the first paid client is discussed. If a free model session is already generating the handlers, run python prove_ship.py in that same tree before any adapter row is widened.

Pin the Runtime Imports Before an Agent Adds a Paid Client

Dakota Wu — Wed, 16 Sep 2026 04:40:37 +0000

A weekend API stays at zero bill when the process cannot import a paid client. Language models still reach for redis, boto3, stripe, and celery because those names look like “production.” An import allowlist, hashed in git and failed in CI, blocks that class of patch before a card is attached.

Solo founders do not need a mesh. They need one file an agent cannot enlarge without a human. The rest of this article is a worked example: a JSON allowlist, an AST scanner, a stdlib HTTP server on SQLite, and a pytest that treats a new top-level import as a ship-blocker. It is a layout, not a measured production run.

The failure mode that lockfiles miss

A frozen pyproject.toml stops silent version drift. It does not stop an agent from adding a package and then “helpfully” updating the lockfile in the same patch. The bill appears later, when the new client opens a socket to a hosted broker, object store, or payment API.

Runtime imports are the narrower contract. If app/ may import sqlite3 and http.server and may not import redis, the process cannot grow a second datastore by accident. Dependencies can stay larger than the allowlist. The allowlist is the thing a human reviews.

This gate does not claim to see every side channel. Dynamic imports, C extensions, and raw HTTP remain out of scope. Those need other controls. The point here is cheaper: make the obvious paid SDK a red build.

Artifact: a hashed allowlist

Keep the contract in import_allowlist.json at the repo root. Start from the standard library plus the app package. Add a third-party root only when the founder already runs it on the free machine.

{
  "modules": [
    "asyncio",
    "collections",
    "contextlib",
    "datetime",
    "hashlib",
    "hmac",
    "http",
    "json",
    "logging",
    "os",
    "pathlib",
    "secrets",
    "sqlite3",
    "sys",
    "time",
    "typing",
    "uuid",
    "app"
  ],
  "scan": ["app"],
  "ban_dynamic": ["importlib", "runpy"]
}

The ban_dynamic list is intentional. importlib.import_module("stripe") would otherwise walk around the allowlist. The scanner below treats those roots as violations even if they appear in modules by mistake. A founder who truly needs them should delete the ban in a reviewed commit, not in an agent loop.

Scanner the CI can run cold

The following script is a complete, stdlib-only checker. Save it as scan_imports.py. It walks AST nodes, records top-level module roots, and exits 1 on extras.

#!/usr/bin/env python3
"""Fail CI when app code imports a root outside import_allowlist.json."""
from __future__ import annotations

import ast
import json
import sys
from pathlib import Path

ROOT = Path(__file__).resolve().parent
ALLOW = json.loads((ROOT / "import_allowlist.json").read_text())
ALLOWED = set(ALLOW["modules"])
BANNED = set(ALLOW.get("ban_dynamic", []))
SCAN = ALLOW.get("scan", ["app"])
SKIP_DIR = {".git", ".venv", "venv", "__pycache__", "node_modules"}


def root_name(mod: str) -> str:
    return mod.split(".")[0]


def file_imports(path: Path) -> set[str]:
    tree = ast.parse(path.read_text(encoding="utf-8"), filename=str(path))
    found: set[str] = set()
    for node in ast.walk(tree):
        if isinstance(node, ast.Import):
            for alias in node.names:
                found.add(root_name(alias.name))
        elif isinstance(node, ast.ImportFrom) and node.module:
            found.add(root_name(node.module))
        elif isinstance(node, ast.Call):
            func = node.func
            if isinstance(func, ast.Name) and func.id == "__import__":
                found.add("__import__")
    return found


def py_files(base: Path):
    for path in base.rglob("*.py"):
        if any(part in SKIP_DIR for part in path.parts):
            continue
        yield path


def main() -> int:
    violations: list[str] = []
    for rel in SCAN:
        base = ROOT / rel
        if not base.exists():
            print(f"missing scan dir: {rel}", file=sys.stderr)
            return 2
        for path in py_files(base):
            names = file_imports(path)
            extra = (names - ALLOWED) | (names & BANNED) | (names & {"__import__"})
            for name in sorted(extra):
                loc = path.relative_to(ROOT)
                violations.append(f"{loc}: disallowed import root `{name}`")
    if violations:
        print("import allowlist violations:")
        print("\n".join(violations))
        return 1
    print(f"ok: {len(ALLOWED)} allowed roots, scan={SCAN}")
    return 0


if __name__ == "__main__":
    raise SystemExit(main())

Run it with python3 scan_imports.py. No extra packages. No container. A dirty agent patch that inserts import redis fails in under a second.

Numbered workflow for a solo ship week

Create app/ with one process, one SQLite file, and no package installer step beyond the language runtime.
Commit import_allowlist.json before any generated routes exist. Hash it. Do not let the agent own that file.
Put scan_imports.py on the same commit. Wire make gate so local runs and CI share one command.
Generate or paste handlers only under app/. If a patch needs boto3, the build goes red and the founder decides in daylight.
Add a pytest that shells out to the scanner. Do not re-implement the rules in the test. One implementation stays honest.
After a human merge, freeze the allowlist again. New roots are a product decision, not a refactor leftover.

The order matters. An allowlist written after the agent has already imported a queue client is a changelog, not a gate.

A stdlib server that should pass

The server below is labeled as an example. It listens on one port, stores rows in ./data/app.sqlite3, and never leaves the standard library. That is the ship-today shape for an indie MVP that can wait on email, search, and cards.

# app/server.py
from __future__ import annotations

import json
import sqlite3
from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
from pathlib import Path

DB = Path(__file__).resolve().parent.parent / "data" / "app.sqlite3"


def connect() -> sqlite3.Connection:
    DB.parent.mkdir(parents=True, exist_ok=True)
    conn = sqlite3.connect(DB)
    conn.execute(
        "CREATE TABLE IF NOT EXISTS notes (id INTEGER PRIMARY KEY, body TEXT NOT NULL)"
    )
    conn.commit()
    return conn


class Handler(BaseHTTPRequestHandler):
    def _send(self, code: int, payload: dict) -> None:
        raw = json.dumps(payload).encode("utf-8")
        self.send_response(code)
        self.send_header("Content-Type", "application/json")
        self.send_header("Content-Length", str(len(raw)))
        self.end_headers()
        self.wfile.write(raw)

    def do_GET(self) -> None:  # noqa: N802
        if self.path != "/notes":
            self._send(404, {"error": "not found"})
            return
        conn = connect()
        rows = conn.execute("SELECT id, body FROM notes ORDER BY id").fetchall()
        conn.close()
        self._send(200, {"notes": [{"id": i, "body": b} for i, b in rows]})

    def do_POST(self) -> None:  # noqa: N802
        if self.path != "/notes":
            self._send(404, {"error": "not found"})
            return
        length = int(self.headers.get("Content-Length", "0"))
        if length <= 0 or length > 4096:
            self._send(413, {"error": "body limit"})
            return
        data = json.loads(self.rfile.read(length))
        body = str(data.get("body", "")).strip()
        if not body:
            self._send(400, {"error": "empty"})
            return
        conn = connect()
        cur = conn.execute("INSERT INTO notes(body) VALUES (?)", (body,))
        conn.commit()
        note_id = cur.lastrowid
        conn.close()
        self._send(201, {"id": note_id})


def main() -> None:
    server = ThreadingHTTPServer(("127.0.0.1", 8080), Handler)
    server.serve_forever()


if __name__ == "__main__":
    main()

A patch that “improves” this with import stripe is a failed make gate, not a debate in a chat log. The founder can still add billing later. The difference is a reviewed allowlist edit, not an unattended Friday merge.

Makefile and pytest

.PHONY: gate test

gate:
    python3 scan_imports.py

test: gate
    python3 -m pytest -q

# tests/test_import_allowlist.py
import subprocess
import sys
from pathlib import Path

ROOT = Path(__file__).resolve().parents[1]


def test_import_allowlist_clean():
    proc = subprocess.run(
        [sys.executable, str(ROOT / "scan_imports.py")],
        cwd=ROOT,
        capture_output=True,
        text=True,
        check=False,
    )
    assert proc.returncode == 0, proc.stdout + proc.stderr

pytest is the only likely extra tool. If even that is too much for a given weekend, make gate alone is enough to reject a bad import graph. Add the test when the repo grows a second contributor or a second machine.

Where a free coding loop still fits

The allowlist is the product of this workflow. An agent is optional filling for app/ after the contract exists. Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode is an open-source project with free model access and a free server option, which can draft handlers against this layout without opening a cloud bill for the coding loop itself. The scanner still runs on the founder’s laptop. A hosted session that cannot pass scan_imports.py is not a release session.

Keep the allowlist file read-only in the agent’s instructions. If the model rewrites JSON to include celery, that is the same class of failure as rewriting production Terraform. Humans own the contract. Models own the boring handlers inside it.

Limits that should stay visible

AST misses importlib.import_module if the scanner is weakened, and it misses __import__ if the Call-walker is deleted. It does not see imports inside eval, extension modules, or a subprocess that runs python -c. It does not block urllib.request from posting to a paid API using only stdlib. Founders who need that layer already know they want an outbound host allowlist, which is a different artifact.

The JSON file also cannot encode intent. Allowing http permits both the local server and a future outbound client. If that becomes a problem, split the app into app/http_server.py and deny other files from importing urllib or http.client. Do not pretend one list replaces design.

SQLite will not survive every workload. Multi-writer analytics, regional failover, and compliance export jobs outgrow a single file. The allowlist then changes in a priced milestone, not in a vibe pass.

Who should not use this

Teams that already run Redis, Postgres, and a worker fleet should not shrink their import graph to prove a point. The gate is for a solo founder who can ship a notes API, a waitlist, or a file-upload toy this week and can accept missing search, mail, and cards.

Anyone selling a multi-tenant billing surface this month should design the paid client in the open, with a human-owned commit that adds stripe to the allowlist on purpose. Hiding that import behind an agent is how surprise invoices start.

Regulated workloads that require managed identity, hosted audit logs, or vendor BAAs are outside this pattern. Stdlib HTTP on loopback is not a control framework.

Close the loop

Ship the scanner first. Generate routes second. Add paid roots only when a real invoice is an acceptable outcome. The import graph is small enough to read. That is the entire advantage a solo backend still has.

A Degradation Ladder for Solo Backends: Ship This Week, Seal Before You Pay

Dakota Wu — Mon, 14 Sep 2026 21:57:57 +0000

A solo backend rarely dies from a missing feature. It dies from a polite retry loop that keeps calling a paid path after a free allowance is gone, and the invoice arrives before the bug report does.

The fix is not a bigger free tier. It is a degradation ladder: every capability declares a free rung, a capped rung, and a truthful user-visible result for the capped rung. The app then loses features in a known order instead of losing your weekend to a billing console.

The artifact below is about sixty lines of standard-library Python: a policy table, a rung selector, a test that proves a sealed capability never touches the network, and a local rehearsal command that simulates a cap without burning real allowance. It targets one-person projects that must ship this week. It is not a quota system, and it will not turn a limited plan into an unlimited product.

Much of the recent AI-agent debate on DEV, including the argument that most agents are branching control flow in disguise, is orthogonal to a solo product. If the loop really is control flow, then control flow is exactly where the budget policy belongs.

The failure mode, stated precisely

Free tiers usually fail in three ways: a hard cap on requests or units, a rate limit with a retry window, and a quiet change to the terms. Only the first is visible from inside the code.

Model-written handlers make all three worse. Generated retry logic often falls back to the paid endpoint "just once", and that single fallback is where a zero-cost plan ends. A ladder removes the decision from the retry path and moves it into a table a human can review in one sitting.

The three-rung model

Three rungs are enough for an indie MVP.

FULL — the capability runs as designed on the free path.
REDUCED — the capability runs with cheaper input: shorter context, a cached answer, a smaller batch.
SEALED — the capability refuses, returning a prepared message and a pointer to a free alternative.

SEALED carries the weight. A sealed capability must never return a fabricated result, and it must never open a socket. If a degraded answer would mislead the user, sealing is correct even when a reduced path is technically possible.

Step 1 — Declare capabilities, not vendors

Policy should name what the user wants, not which service provides it. Provider names belong in configuration, because they are the part that changes without notice.

# ladder.py — standard library only, runs as-is on Python 3.10+
from __future__ import annotations

import os
from dataclasses import dataclass
from enum import IntEnum


class Rung(IntEnum):
    FULL = 0
    REDUCED = 1
    SEALED = 2


@dataclass(frozen=True)
class Capability:
    name: str
    free_rung: Rung
    capped_rung: Rung
    sealed_message: str


POLICY: dict[str, Capability] = {
    "answer.question": Capability(
        "answer.question", Rung.FULL, Rung.REDUCED,
        "Answers are paused while the free allowance refills.",
    ),
    "summarize.doc": Capability(
        "summarize.doc", Rung.FULL, Rung.SEALED,
        "Summaries need a paid path; they are disabled on this plan.",
    ),
}

Two entries are enough to start. Each new capability added later forces the same three questions: what is free, what happens when free runs out, and what does the user actually read.

Step 2 — Make the ladder the only entry point

Nothing in the app should call a paid or free endpoint directly. Everything goes through one selector, so the cap logic exists in a single place that can be tested.

class Ladder:
    """Picks a rung per call. Units are your own accounting, not vendor quota."""

    def __init__(self, units_left: int, policy: dict[str, Capability] | None = None) -> None:
        self.units_left = units_left
        self.policy = policy or POLICY

    def rung_for(self, capability: str) -> Rung:
        cap = self.policy[capability]
        return cap.free_rung if self.units_left > 0 else cap.capped_rung

    def run(self, capability: str, full_path, reduced_path=None, cost: int = 1):
        cap = self.policy[capability]
        rung = self.rung_for(capability)
        if rung is Rung.FULL:
            self.units_left -= cost
            return full_path(), rung
        if rung is Rung.REDUCED and reduced_path is not None:
            return reduced_path(), rung
        return cap.sealed_message, Rung.SEALED

The reduced path deliberately costs nothing in this model. That is a design choice, not a measurement: a cached or truncated answer that still hits a metered endpoint should decrement units_left too. Keep the accounting conservative, and the worst case is an early seal rather than a surprise charge.

Step 3 — Prove the seal in a test

The seal is the only rung that protects both the user and the bill, so it deserves an explicit assertion. The test below fails if a capped capability reaches either implementation.

# test_ladder.py — pytest
from ladder import Ladder, Rung, POLICY


def test_capped_capability_calls_nothing():
    calls = []
    ladder = Ladder(units_left=0)

    value, rung = ladder.run(
        "summarize.doc",
        full_path=lambda: calls.append("full"),
        reduced_path=lambda: calls.append("reduced"),
    )

    assert rung is Rung.SEALED
    assert calls == []
    assert value == POLICY["summarize.doc"].sealed_message

Run it with pytest -q test_ladder.py. A second assertion worth adding later checks that every capability in POLICY has a non-empty sealed_message, which prevents the most common shipping mistake: a correct refusal that says nothing useful.

Step 4 — Rehearse the cap locally

Simulating a cap should not require waiting for a real one. The demo entry point reads the unit count from the environment so the transition is reachable in one command.

if __name__ == "__main__":
    ladder = Ladder(units_left=int(os.environ.get("UNITS_LEFT", "2")))
    for _ in range(4):
        value, rung = ladder.run(
            "answer.question",
            full_path=lambda: "full answer",
            reduced_path=lambda: "short answer",
        )
        print(f"{rung.name:8} {value!r} units_left={ladder.units_left}")

Expected output, deterministic and offline:

$ python ladder.py
FULL     'full answer' units_left=1
FULL     'full answer' units_left=0
REDUCED  'short answer' units_left=0
REDUCED  'short answer' units_left=0

UNITS_LEFT=0 python ladder.py jumps straight to the capped rung. Wiring that environment variable into the nightly CI job means every future commit is exercised against the capped state, not just the happy path.

Step 5 — Keep the repair loop on free compute

The ladder protects runtime behavior. Something still has to write the reduced paths and the sealed messages, and that authoring pass is itself a model loop with a cost. Running it on free model access and a free server option keeps the authoring pass from consuming the same budget the ladder is protecting.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. The operator states that free model access and a free server option are available; plan terms change, so confirm the current details on the project before depending on them for anything scheduled. For a solo builder, the practical pattern is to do the ladder work in one short session on free compute, then commit the policy table as reviewed code that no unattended agent may edit.

Decision table

Capability	Full path cost	Capped rung	User-visible result	Acceptable for a paid user?
Answer a question	1 unit	Reduced, free, cached	"Short answer, may be dated"	Yes
Summarize a document	1 unit	Sealed	"Disabled on this plan"	Yes
Search the web	1 unit	Sealed	"Search unavailable; paste a link"	Yes
Send a notification	0 units	Reduced	"Digest instead of instant"	Yes

Fill the last column honestly. If the answer is "no", the capability should not exist on the free build at all.

What breaks anyway

Caps can arrive mid-request, so the rung must be evaluated per call rather than once at process start. Long-running workers that cached a rung in memory will keep using it after the allowance is gone.

Local unit accounting drifts from the provider's accounting. Treat units_left as a conservative estimate, refresh it from the provider where an API allows it, and never treat it as authoritative.

Sealed messages are a product surface. A message that implies the feature is broken rather than paused generates support mail that costs more time than the tokens saved.

Finally, the policy table is a review boundary. Letting an unattended agent add capabilities and sealed messages is how a truthful refusal becomes a confident wrong answer.

Who should not use this

Projects with legal or safety obligations, such as anything resembling medical, legal, or financial advice, should not serve degraded output at all; either the full path is available or the request should fail loudly. Teams with a funded budget should skip the ladder entirely and pay for the correct path, because degradation adds a branch to every capability.

Anyone whose free tier is genuinely unlimited does not need a capped rung either, though the seal test remains a cheap way to prove that no capability silently reaches a paid endpoint.

A rung table plus one assertion is roughly an hour of work. It converts an unpredictable bill into a list of features your users can see disappearing in a known order, which is a trade most solo products should take.

Freeze pyproject.toml Before the Model Opens a Weekend API

Dakota Wu — Sun, 13 Sep 2026 20:50:35 +0000

A same-day indie API stays at a zero invoice when pyproject.toml is frozen before any model is allowed to edit application code. Paid SDKs almost never arrive as architecture decisions. They arrive as new lines in a dependency file. The freeze is a hash, a read-only bit, and a boot checker that refuses to start.

Solo founders now let models write handlers for an evening slice. The model cannot see a card statement. It can see a missing package. Cache clients, object storage, mail kits, and error vendors show up as ordinary imports. The tree still looks small. The bill does not.

The workflow below is for a single operator who must ship today and accept limits. It stays useful if the generation tool is swapped. SQLite, one process, no mailer, and no worker are the intended ceiling.

The failure the freeze targets

AI-assisted patches optimize for a green import. They do not optimize for next month's invoice. A session store "should be shared" pulls a hosted cache client. A confirm flow "should be real" pulls a mail SDK. Each step is locally reasonable. The stack that results is not the stack the founder chose.

Grep after the fact is late. The cheaper move is to stop the dependency file from changing, then stop imports that sit outside the frozen wheel list. The two checks belong on the boot path, not in a weekly review.

Artifact: seal, allowlist, boot wrapper

Four files sit beside the app. They are small on purpose.

pyproject.toml — the only declared dependencies.
lock.sha256 — the committed digest of that file.
allowed_modules.txt — top-level import names recorded from a known-good boot.
tools/check_seal.py — hash check plus an AST walk.

The dependency list is a proposal for a Friday slice, not a measured benchmark.

# pyproject.toml — proposal for a zero-invoice notes API
[project]
name = "weekend-notes"
version = "0.1.0"
requires-python = ">=3.12"
dependencies = [
  "fastapi",
  "uvicorn",
]

sqlite3 stays in the stdlib. No driver package. No cloud kit. The application may import framework code and the standard library. Everything else waits for a human to unseal the file.

Numbered workflow

1. Install once, then seal the file

The founder installs the tiny list on a clean interpreter. The digest is recorded next. The file is then marked read-only in the workspace.

python -m pip install -e .
sha256sum pyproject.toml > lock.sha256
chmod a-w pyproject.toml
git add pyproject.toml lock.sha256

A model can still propose handler patches. It cannot quietly restack the product if the editor honors the write bit. The checker does not trust the write bit. It trusts the hash.

2. Record the real import surface from a cold boot

An allowlist written from memory will be wrong. Frameworks import transitive modules. The honest list is sys.modules after importing the application once on the sealed environment.

# tools/record_allowlist.py — run only on a known-good tree
from __future__ import annotations

import sys
from pathlib import Path

import weekend_notes.main  # noqa: F401

ROOT = Path(__file__).resolve().parents[1]
STDLIB = set(sys.stdlib_module_names)
LOCAL = {"weekend_notes", "tools"}

names = sorted(
    {
        mod.split(".")[0]
        for mod in sys.modules
        if mod.split(".")[0] not in STDLIB
        and mod.split(".")[0] not in LOCAL
        and not mod.split(".")[0].startswith("_")
    }
)
(ROOT / "allowed_modules.txt").write_text("\n".join(names) + "\n", encoding="utf-8")
print("\n".join(names))

python tools/record_allowlist.py
git add allowed_modules.txt

Re-run this script only when a human upgrades the framework. Do not let a model regenerate it during the same session that writes features. An allowlist that updates itself is not a freeze.

3. Fail boot when the seal or the imports drift

AST beats grep. Comments and string literals do not count as imports. The checker walks every .py file outside virtualenv directories, then compares top-level names to stdlib plus the recorded allowlist.

# tools/check_seal.py
from __future__ import annotations

import ast
import hashlib
import sys
from pathlib import Path

ROOT = Path(__file__).resolve().parents[1]
SEAL = ROOT / "lock.sha256"
PYPROJECT = ROOT / "pyproject.toml"
ALLOW = {
    line.strip()
    for line in (ROOT / "allowed_modules.txt").read_text(encoding="utf-8").splitlines()
    if line.strip() and not line.startswith("#")
}
STDLIB = set(sys.stdlib_module_names)
SKIP_DIRS = {".git", ".venv", "venv", "__pycache__", "tools"}


def digest(path: Path) -> str:
    return hashlib.sha256(path.read_bytes()).hexdigest()


def check_hash() -> list[str]:
    expected = SEAL.read_text(encoding="utf-8").split()[0].strip()
    actual = digest(PYPROJECT)
    if actual != expected:
        return [f"pyproject.toml hash {actual} != sealed {expected}"]
    return []


def top_module(name: str | None) -> str | None:
    if not name:
        return None
    return name.split(".")[0]


def imports_in(path: Path) -> set[str]:
    tree = ast.parse(path.read_text(encoding="utf-8"), filename=str(path))
    found: set[str] = set()
    for node in ast.walk(tree):
        if isinstance(node, ast.Import):
            for alias in node.names:
                top = top_module(alias.name)
                if top:
                    found.add(top)
        elif isinstance(node, ast.ImportFrom):
            top = top_module(node.module)
            if top:
                found.add(top)
    return found


def check_imports() -> list[str]:
    errors: list[str] = []
    for path in ROOT.rglob("*.py"):
        if any(part in SKIP_DIRS for part in path.parts):
            continue
        for mod in sorted(imports_in(path)):
            if mod in STDLIB or mod in ALLOW:
                continue
            errors.append(f"{path.relative_to(ROOT)}: disallowed import {mod}")
    return errors


def main() -> int:
    problems = check_hash() + check_imports()
    if problems:
        print("seal check failed:")
        print("\n".join(problems))
        return 1
    print("seal check passed")
    return 0


if __name__ == "__main__":
    raise SystemExit(main())

Wire it in front of the process. A checker that is optional will be skipped on the night it is needed.

# Makefile
.PHONY: run check

check:
    python tools/check_seal.py

run: check
    uvicorn weekend_notes.main:app --host 127.0.0.1 --port 8000

make run

4. Keep the coding loop off a billed account

The freeze is wasted when the generation environment already holds cloud keys. Models copy whatever credentials they can see. Empty env is part of the seal.

Disclosure: This article was prepared as part of MonkeyCode's product outreach.

MonkeyCode provides free model access and a free server option. Those two availability claims are operator-supplied. No model names, quotas, hardware, or duration are stated here. For this workflow the value is placement: the model and tools/check_seal.py can run on the same machine with vendor keys unset. A founder who wants that loop without attaching a cloud invoice can run the session there.

env -i HOME="$HOME" PATH="$PATH" PYTHONPATH=. \
  python tools/check_seal.py

If a patch requires AWS_SECRET_ACCESS_KEY at import time, the API has already left the zero-invoice path. Do not export the key to make the import succeed. Delete the import.

5. Ship a handler that cannot grow a vendor

Notes live in SQLite. Bodies are capped. There is no object store and no mailer. The handler is a proposal for a same-day demo, not a production design.

# weekend_notes/main.py
from __future__ import annotations

import sqlite3
from pathlib import Path

from fastapi import FastAPI, HTTPException
from pydantic import BaseModel, Field

DB = Path("notes.db")
app = FastAPI()
MAX_BODY = 500


def connect() -> sqlite3.Connection:
    conn = sqlite3.connect(DB)
    conn.execute(
        "CREATE TABLE IF NOT EXISTS notes (id INTEGER PRIMARY KEY, body TEXT NOT NULL)"
    )
    return conn


class NoteIn(BaseModel):
    body: str = Field(min_length=1, max_length=MAX_BODY)


@app.post("/notes")
def create_note(payload: NoteIn) -> dict[str, int | str]:
    with connect() as conn:
        cur = conn.execute("INSERT INTO notes(body) VALUES (?)", (payload.body,))
        note_id = int(cur.lastrowid)
    return {"id": note_id, "body": payload.body}


@app.get("/notes/{note_id}")
def read_note(note_id: int) -> dict[str, int | str]:
    with connect() as conn:
        row = conn.execute("SELECT id, body FROM notes WHERE id = ?", (note_id,)).fetchone()
    if row is None:
        raise HTTPException(status_code=404, detail="missing")
    return {"id": int(row[0]), "body": str(row[1])}

Bind to 127.0.0.1. A public bind is a different product. Attachments, background thumbnails, and "just email me the note" are out of scope for the freeze.

6. Wire a test so the seal is not decoration

One passing test on the current tree is not enough. A second test should prove the checker fails on a banned import.

# tests/test_seal.py
import subprocess
import sys
from pathlib import Path

from tools.check_seal import imports_in

ROOT = Path(__file__).resolve().parents[1]


def test_seal_passes_on_this_tree() -> None:
    proc = subprocess.run(
        [sys.executable, str(ROOT / "tools" / "check_seal.py")],
        check=False,
        capture_output=True,
        text=True,
    )
    assert proc.returncode == 0, proc.stdout + proc.stderr


def test_seal_flags_stripe(tmp_path: Path) -> None:
    sample = tmp_path / "evil.py"
    sample.write_text("import stripe\n", encoding="utf-8")
    assert "stripe" in imports_in(sample)

python -m pytest tests/test_seal.py

Label both tests as unexecuted examples until they are run on the operator's tree. The point is the hook, not a published coverage number.

Decision table

Signal in the patch	Action	Bill risk if ignored
`pyproject.toml` hash changes	Fail boot; human unseals only	High
Import of `stripe`, `boto3`, `redis`, `celery`	Fail boot	High
New stdlib module (`hmac`, `pathlib`)	Allow	None
New transitive framework module	Human re-runs `record_allowlist.py`	Low
Extra worker or queue process	Reject; stay request-scoped	Medium
Env var for a cloud key	Do not export; fail the session	High
Dynamic `importlib` of a vendor name	Out of scope; see limitations	High

Limitations

The AST walk does not catch dynamic imports built from strings. importlib.import_module("st" + "ripe") bypasses it. A patch can also shell out to pip. The seal assumes the model is sloppy about vendors, not adversarial.

sys.stdlib_module_names is a convenience set, not a security boundary. Some stdlib modules still open sockets. The freeze does not replace a network policy. It only blocks the common path where a paid SDK is added as a normal dependency.

Transitive allowlists drift when the framework is upgraded. Upgrades are a human event. They require a new hash and a new allowed_modules.txt. Do not let the model bump versions during a Friday session.

The notes API stores plaintext on a local file. That is unacceptable for secrets, identity documents, or multi-tenant data. Same-day indie scope only.

Free model access and a free server option are availability claims with unspecified capacity and duration. They can change. Do not plan payroll, quotas, or an SLA around them.

Who should not use this

Teams with a real billing account, a shared cache, and a compliance mailer should not freeze the lockfile this hard. Multi-service products that already pay for vendors gain little from a weekend seal.

Founders who need guaranteed uptime, signed production artifacts, or isolated CI runners need a stronger pipeline than a hash file in git. If the model must install packages to finish the task, the task is not a same-day zero-invoice slice. Split the task.

The seal does not make the model a senior engineer. It does not prove the API is correct. It proves the tree did not grow a vendor between the last human decision and the next local boot. For a solo founder who wants to ship today and read an empty invoice tomorrow, that proof is the whole point.

A Clean-Room Replay for AI-Shipped Indie Backends

Dakota Wu — Sat, 12 Sep 2026 18:51:02 +0000

A weekend MVP that only runs inside an AI chat session is not shipped. It is a transcript. Solo founders who keep the bill at zero still need a second proof: the same repo boots in a clean directory, with no leftover keys, no billed hosts, and one command.

This article describes a clean-room replay for AI-generated indie backends. The replay is a shell script, a definition-of-done file, and a boot test. The loop is deterministic. It does not need an agent framework.

Why chat-only ships fail on Monday

AI coding sessions hide environment. The model remembers a .env file that never landed in git. A package was installed globally. A tunnel was left open. Monday, the founder clones the repo on a second machine and the process dies on a missing secret.

The failure is not always “the model wrote bad Python.” The failure is missing replay. A paid stack often papers over that gap with managed secrets and always-on hosts. An indie weekend app cannot.

A clean-room replay treats git clone && ./replay.sh as the ship gate. If that gate is red, the product is not public. The bill stays at zero because the test refuses paid dependencies before they boot.

What the replay must prove

The harness checks four claims. Each claim is a process exit code, not a sentence in a README.

The app starts with an empty environment except PORT and DATABASE_PATH.
The only datastore is a local SQLite file created at runtime.
HTTP health and one write path succeed on localhost.
An import scan finds no billed SDK names the founder did not allow.

The list is short on purpose. Weekend scope dies when the gate grows into a platform checklist.

Files in the repo

Keep the harness next to the app. Do not hide it in an infra/ folder the model can skip.

mvp/
  app.py
  requirements.txt
  done.yml
  replay.sh
  boot_test.py
  allow_imports.txt

done.yml is the contract. The model may edit application code. It does not get to delete the contract.

# done.yml
name: weekend-mvp
port: 8080
database_path: ./data/app.db
required_routes:
  - GET /health
  - POST /items
max_boot_seconds: 8
forbidden_env:
  - AWS_ACCESS_KEY_ID
  - STRIPE_SECRET_KEY
  - OPENAI_API_KEY
allow_imports_file: allow_imports.txt

allow_imports.txt is equally boring. Boring is the point.

flask

Add a library only when the founder types it. AI patches that add a billed client fail the replay.

Step 1: Isolate a clean tree

replay.sh copies the repo into a temp directory, drops env files, and installs into a fresh virtualenv. The copy is the Monday machine.

#!/usr/bin/env bash
set -euo pipefail

ROOT="$(cd "$(dirname "$0")" && pwd)"
STAGE="$(mktemp -d /tmp/mvp-replay.XXXXXX)"
trap 'rm -rf "$STAGE"' EXIT

rsync -a --exclude '.git' --exclude '.venv' --exclude '.env*' \
  --exclude 'data' --exclude '__pycache__' \
  "$ROOT/" "$STAGE/"

cd "$STAGE"
test ! -f .env
test ! -d data

python3 -m venv .venv
# shellcheck disable=SC1091
source .venv/bin/activate
pip install -q -r requirements.txt

export PORT=8080
export DATABASE_PATH="$STAGE/data/app.db"
unset AWS_ACCESS_KEY_ID STRIPE_SECRET_KEY OPENAI_API_KEY || true

python boot_test.py
echo "replay ok"

The script unsets common paid-provider variables. A process that still demands them is not a zero-bill MVP. The trap removes the stage directory even when the boot test fails.

Step 2: Scan imports before bind

boot_test.py reads the allow-list and walks application modules. A single extra import fails the run. The scan is AST-based and conservative. That is acceptable for a weekend gate.

# boot_test.py — labeled example, not a published benchmark
from __future__ import annotations

import ast
import os
import socket
import subprocess
import sys
import time
from pathlib import Path
import urllib.error
import urllib.request

ROOT = Path(__file__).resolve().parent
ALLOW = {
    line.strip()
    for line in (ROOT / "allow_imports.txt").read_text().splitlines()
    if line.strip() and not line.startswith("#")
}
STDLIB_HINTS = {
    "json", "os", "sys", "pathlib", "typing", "sqlite3", "datetime"
}


def fail(msg: str) -> None:
    print(f"replay fail: {msg}", file=sys.stderr)
    raise SystemExit(1)


def scan_imports() -> None:
    for path in ROOT.glob("*.py"):
        if path.name == "boot_test.py":
            continue
        tree = ast.parse(path.read_text(), filename=str(path))
        for node in ast.walk(tree):
            names: list[str] = []
            if isinstance(node, ast.Import):
                names = [a.name.split(".")[0] for a in node.names]
            elif isinstance(node, ast.ImportFrom) and node.module:
                names = [node.module.split(".")[0]]
            for name in names:
                if name in STDLIB_HINTS or name in ALLOW:
                    continue
                fail(f"import {name!r} in {path.name} is not allow-listed")


def wait_port(port: int, timeout: float) -> None:
    deadline = time.time() + timeout
    while time.time() < deadline:
        with socket.socket() as sock:
            sock.settimeout(0.2)
            if sock.connect_ex(("127.0.0.1", port)) == 0:
                return
        time.sleep(0.1)
    fail(f"port {port} did not open")


def json_req(method: str, url: str, data: bytes | None = None) -> None:
    req = urllib.request.Request(url, data=data, method=method)
    if data is not None:
        req.add_header("Content-Type", "application/json")
    try:
        with urllib.request.urlopen(req, timeout=2) as resp:
            if resp.status >= 400:
                fail(f"{method} {url} -> {resp.status}")
    except urllib.error.URLError as exc:
        fail(f"{method} {url} -> {exc}")


def main() -> None:
    scan_imports()
    port = int(os.environ.get("PORT", "8080"))
    db = os.environ.get("DATABASE_PATH", "./data/app.db")
    Path(db).parent.mkdir(parents=True, exist_ok=True)

    proc = subprocess.Popen(
        [sys.executable, "app.py"],
        cwd=ROOT,
        env={
            "PATH": os.environ.get("PATH", ""),
            "PORT": str(port),
            "DATABASE_PATH": db,
            "PYTHONUNBUFFERED": "1",
        },
    )
    try:
        wait_port(port, timeout=8)
        json_req("GET", f"http://127.0.0.1:{port}/health")
        json_req(
            "POST",
            f"http://127.0.0.1:{port}/items",
            data=b'{"name":"replay"}',
        )
        if not Path(db).is_file():
            fail("sqlite file was not created")
    finally:
        proc.terminate()
        try:
            proc.wait(timeout=3)
        except subprocess.TimeoutExpired:
            proc.kill()
    print("boot test ok")


if __name__ == "__main__":
    main()

The child process environment is explicit. No inherited cloud credentials. No leftover VIRTUAL_ENV tricks. If app.py reads a secret from the parent shell, the test goes red.

Step 3: Keep the app inside the contract

The application under test is a short Flask example. It is a template, not a product.

# app.py — example weekend slice
import os
import sqlite3
from pathlib import Path

from flask import Flask, request

PORT = int(os.environ["PORT"])
DB = os.environ["DATABASE_PATH"]

app = Flask(__name__)


def db() -> sqlite3.Connection:
    Path(DB).parent.mkdir(parents=True, exist_ok=True)
    conn = sqlite3.connect(DB)
    conn.execute(
        "CREATE TABLE IF NOT EXISTS items (id INTEGER PRIMARY KEY, name TEXT)"
    )
    return conn


@app.get("/health")
def health():
    return {"ok": True}


@app.post("/items")
def create_item():
    payload = request.get_json(force=True, silent=True) or {}
    name = str(payload.get("name", "")).strip()
    if not name:
        return {"error": "name required"}, 400
    conn = db()
    conn.execute("INSERT INTO items(name) VALUES (?)", (name,))
    conn.commit()
    conn.close()
    return {"name": name}, 201


if __name__ == "__main__":
    app.run(host="127.0.0.1", port=PORT)

Runtime calls stay on loopback. Persistence stays in one file. There is no object store, no managed queue, and no third-party auth. Those can wait for a paying user.

Pin the dependency so the replay cannot silently float onto a different Flask major.

# requirements.txt
flask==3.0.3

Step 4: Run the gate on every AI patch

Founders who let a model edit the tree should run replay after each patch, not after the session feels done.

chmod +x replay.sh
./replay.sh

A red replay means the patch is not merged. The founder pastes the stderr block back into the coding session. The model then has a mechanical target: make replay.sh print replay ok.

That feedback is cheaper than a cloud preview environment. It also blocks the usual weekend leak: a new import of a billed SDK “just for now.”

Wrap the gate in git if the repo already uses hooks. The hook is optional. The script is not.

# .git/hooks/pre-commit — optional local hook
#!/usr/bin/env bash
set -euo pipefail
./replay.sh

Step 5: Treat the decision table as the agent

Most weekend “agents” are if-statements with extra ceremony. The table below is enough. No planner. No tool-calling loop that can buy a queue.

Situation	Action
Patch only touches copy or CSS	Skip replay
Patch adds a Python import	Run the import scan in `boot_test.py`
Patch touches `app.py` or `requirements.txt`	Run full `./replay.sh`
Need a machine without founder dotfiles	Run `replay.sh` on a second clean host
Model asks for Stripe, S3, or a hosted LLM at runtime	Reject the patch; keep the allow-list frozen
Replay passes and `/items` writes SQLite	Ship the slice; stop the session

Ship today. Keep the bill at zero. Accept the limits. The table encodes that policy in six rows.

Where a second clean host fits

Local replay is enough when the laptop is the only runtime. Some solo founders still want a second machine so Monday is not “works on my leftover venv.”

Disclosure: This article was prepared as part of MonkeyCode's product outreach.

MonkeyCode provides free model access and a free server option. Those two facts are the only product claims used here. A founder can generate replay.sh and boot_test.py on the free model path, then execute the same scripts on the free server as the clean room. The server is a second clone, not a production fleet.

The product is optional. The scripts run with stock Python 3 and Flask. Remove the product mention and the gate still holds. Founders who want that second machine without standing up a billed VPS can run ./replay.sh there and inspect the exit code.

One pass is enough for a weekend ship. Do not turn a free host into an always-on agent loop. Empty env, no founder dotfiles, no globally installed packages. If replay passes in that room, the chat session is no longer the runtime.

Limits

The import scan does not understand dynamic imports or importlib. A determined patch can hide a billed client behind a string loader. The boot test does not packet-filter the child. A process that talks to the network after /health returns can still surprise the founder.

SQLite is not a multi-tenant product database. max_boot_seconds: 8 will fail slow laptops. The harness does not measure cost in currency. It only fails closed when the tree looks like it will need a credit card.

None of the snippets are load-test results. They are a ship gate. Flask’s development server is also not a production server. Replace app.run with a pinned WSGI runner only after the replay still passes.

Who should not use this

Teams with a real staging cluster and a secrets manager do not need a temp-dir replay as their primary control. Apps that must call a paid API on day one cannot pass the empty-env rule. Founders who already know the MVP is a prototype inside one notebook should not pretend this gate makes it a company.

The method is for a solo founder who will publish a URL today and refuse surprise invoices tomorrow. The replay is the definition of done. Everything else waits. The ship decision still belongs to the founder.

An Iteration Cap That Keeps Weekend AI Loops Off the Paid Stack

Dakota Wu — Fri, 11 Sep 2026 16:24:05 +0000

A coding agent without a stop condition does not ship an MVP. It accumulates files, SDKs, and cloud assumptions until the weekend is gone. Solo founders who need a same-day slice should cap iterations, cap files, and write a receipt before any merge. The loop can stay useful. It cannot stay unbounded.

This article treats the popular “agent loop” as a local if-statement with a clock. That is enough for an indie weekend. It is not a platform. The artifact is a three-number contract plus a small Python checker that refuses a patch when the loop overruns those numbers.

The failure mode that burns a free weekend

Unconstrained coding loops fail in a predictable order. First they touch too many files. Then they add a client library for a billed API. Then they invent environment variables the founder never agreed to fund. The product idea is still a waitlist or a single form. The repo no longer matches that idea.

Indie timelines do not survive that drift. A founder shipping today needs a halt condition that is cheaper than taste and faster than a full review board. Eight iterations. Three files. An allowlist of imports. Those three numbers are enough to keep a free box honest.

A three-number contract

The contract is a file, not a meeting. Put it at the repo root so every coding pass can read it. Keep the numbers small enough that a human can still open the diff on a phone.

# loop_budget.toml — example contract for a same-day indie slice
max_iterations = 8
max_files_changed = 3
max_new_lines = 250

[allow.imports]
python = ["sqlite3", "json", "os", "pathlib", "http.server", "html"]

[deny.imports]
python = ["boto3", "stripe", "openai", "anthropic", "redis", "psycopg2", "firebase_admin"]

[allow.env]
names = ["APP_PORT", "APP_DB_PATH", "LOOP_RECEIPT_PATH"]

[deny.env_prefixes]
prefixes = ["AWS_", "STRIPE_", "OPENAI_", "ANTHROPIC_", "GOOGLE_APPLICATION_"]

The allowlist is the product. Everything else is a patch the loop must not land. A denied import is a future invoice. A denied env prefix is the same invoice in a different font.

Artifact: a fail-closed receipt checker

The checker below is a local example. It is not a published package. Run it on the working tree after each agent iteration. Exit status 2 means the loop must stop and the founder must write the next slice by hand or start a new contract.

#!/usr/bin/env python3
"""loop_receipt.py — fail-closed budget for weekend AI coding loops."""
from __future__ import annotations

import ast
import json
import subprocess
import sys
from datetime import datetime, timezone
from pathlib import Path

ROOT = Path.cwd()
BUDGET = {
    "max_iterations": 8,
    "max_files_changed": 3,
    "max_new_lines": 250,
    "allow_imports": {"sqlite3", "json", "os", "pathlib", "http.server", "html"},
    "deny_imports": {"boto3", "stripe", "openai", "anthropic", "redis", "psycopg2", "firebase_admin"},
    "deny_env_prefixes": ("AWS_", "STRIPE_", "OPENAI_", "ANTHROPIC_", "GOOGLE_APPLICATION_"),
}
STATE_PATH = ROOT / ".loop_state.json"
RECEIPT_PATH = ROOT / "LOOP_RECEIPT.md"


def git(*args: str) -> str:
    out = subprocess.check_output(["git", *args], cwd=ROOT, text=True)
    return out.strip()


def changed_files() -> list[str]:
    raw = git("diff", "--name-only", "HEAD")
    return [line for line in raw.splitlines() if line.endswith(".py")]


def added_lines() -> int:
    numstat = git("diff", "--numstat", "HEAD")
    total = 0
    for line in numstat.splitlines():
        added, _removed, path = line.split("\t", 2)
        if path.endswith(".py") and added.isdigit():
            total += int(added)
    return total


def load_state() -> dict:
    if not STATE_PATH.exists():
        return {"iteration": 0, "halts": []}
    return json.loads(STATE_PATH.read_text())


def scan_imports(paths: list[str]) -> list[str]:
    hits: list[str] = []
    for rel in paths:
        tree = ast.parse(Path(rel).read_text(encoding="utf-8"), filename=rel)
        for node in ast.walk(tree):
            names: list[str] = []
            if isinstance(node, ast.Import):
                names = [alias.name.split(".")[0] for alias in node.names]
            elif isinstance(node, ast.ImportFrom) and node.module:
                names = [node.module.split(".")[0]]
            for name in names:
                if name in BUDGET["deny_imports"]:
                    hits.append(f"{rel}: denied import {name}")
    return hits


def scan_env_literals(paths: list[str]) -> list[str]:
    hits: list[str] = []
    for rel in paths:
        tree = ast.parse(Path(rel).read_text(encoding="utf-8"), filename=rel)
        for node in ast.walk(tree):
            if isinstance(node, ast.Constant) and isinstance(node.value, str):
                for prefix in BUDGET["deny_env_prefixes"]:
                    if node.value.startswith(prefix):
                        hits.append(f"{rel}: denied env prefix {prefix}")
    return hits


def write_receipt(state: dict, files: list[str], added: int, violations: list[str]) -> None:
    status = "HALT" if violations else "OK"
    body = [
        f"# Loop receipt ({status})",
        f"- time: {datetime.now(timezone.utc).isoformat()}",
        f"- iteration: {state['iteration']}",
        f"- files_changed: {len(files)}",
        f"- lines_added: {added}",
        "- files:",
    ]
    body.extend(f"  - {path}" for path in files or ["(none)"])
    body.append("- violations:")
    body.extend(f"  - {item}" for item in violations or ["(none)"])
    RECEIPT_PATH.write_text("\n".join(body) + "\n", encoding="utf-8")


def main() -> int:
    state = load_state()
    state["iteration"] += 1
    files = changed_files()
    added = added_lines()
    violations: list[str] = []

    if state["iteration"] > BUDGET["max_iterations"]:
        violations.append("iteration cap exceeded")
    if len(files) > BUDGET["max_files_changed"]:
        violations.append("file cap exceeded")
    if added > BUDGET["max_new_lines"]:
        violations.append("line cap exceeded")
    violations.extend(scan_imports(files))
    violations.extend(scan_env_literals(files))

    write_receipt(state, files, added, violations)
    STATE_PATH.write_text(json.dumps(state, indent=2), encoding="utf-8")
    if violations:
        print("LOOP HALT")
        print("\n".join(violations))
        print(f"see {RECEIPT_PATH}")
        return 2
    print(f"LOOP OK iteration={state['iteration']} files={len(files)} added={added}")
    return 0


if __name__ == "__main__":
    sys.exit(main())

The script is deliberately boring. Boring is the point. An agent loop that needs a vector store to know when to stop is already the wrong loop for a zero-bill slice.

Workflow: eight steps, one halt

Freeze the product slice in one sentence in SLICE.md. Example: “email capture, SQLite file, single HTML page, no accounts.” That sentence is the only feature the loop may implement.
Commit a clean tree. The checker diffs against HEAD, so a dirty baseline makes the file cap lie.
Copy loop_budget.toml values into the script or load them later. Keep max_files_changed at three until the slice is live.
Start the coding pass. One iteration equals one patch proposal, not one token stream. Apply the patch to a branch, not to main.
Run python3 loop_receipt.py. Read the exit code. Do not negotiate with a 2.
Open LOOP_RECEIPT.md. If the receipt lists a denied import, revert the patch. Do not “just this once.”
Repeat until the slice runs locally with python3 -m http.server or a single-file app module. Stop at the first green path, not at polish.
Delete .loop_state.json only after a tagged commit. The next weekend starts at iteration zero with the same caps.

Commands for that sequence stay small.

git status --short
python3 loop_receipt.py; echo $?
cat LOOP_RECEIPT.md
git restore -s HEAD -- .   # use only when the receipt says HALT

A founder who skips step 5 will rediscover billed SDKs the hard way. The receipt is the review. There is no second reviewer on a Sunday night.

Makefile pin so the loop cannot “upgrade” itself

Agents like to add tooling. Pin the only legal commands. Anything else is out of contract.

.PHONY: receipt serve halt-if-dirty

receipt:
    python3 loop_receipt.py

serve:
    python3 -m http.server 8080

halt-if-dirty:
    @test -z "$$(git status --porcelain)" || (echo "dirty tree; refuse loop start"; exit 1)

Run make halt-if-dirty receipt after every patch. The agent does not get a deploy target. Deploy is a founder action after the receipt is OK and the slice sentence still matches the UI.

Decision table for halt vs continue

Signal in the working tree	Action
Iteration count above 8	Halt. Ship or cut scope.
More than 3 Python files in the diff	Halt. Split the slice.
More than 250 added lines	Halt. The loop is rewriting, not shipping.
Import of `boto3`, `stripe`, or a hosted model SDK	Halt. That is a bill.
String literal with `AWS_`, `STRIPE_`, or `OPENAI_`	Halt. Same bill, earlier.
New markdown, HTML, and one `app.py` only	Continue if the slice sentence still holds.
Tests that need a network	Halt. Local SQLite or nothing.

The table is the agent. Founders who want a richer planner can add one later. They should not add it before the first paying user, and they should not add it on a free weekend box.

Where a free model path fits

The checker does not care which editor proposed the patch. It cares that the patch stayed inside the contract. Local inference is optional. A hosted free-model path is optional. Either path still needs the receipt, because a free endpoint can still emit a paid architecture.

Some founders prefer not to stand up local inference at all. MonkeyCode is an open-source coding assistant that currently offers free model access and a free server option for this kind of bounded weekend loop. Disclosure: This article was prepared as part of MonkeyCode's product outreach. Those two availability claims are the only product facts used here. This article does not assign model names, hardware, quotas, or duration. Founders who try a hosted path should still run loop_receipt.py on their own tree so a free server cannot smuggle a billed SDK into main.

Token burn is a separate problem from architectural drift. A free model does not make an unbounded loop safe. It only removes one invoice while the loop invents the next one. The iteration cap remains the control.

Limitations

The checker reads Python. It will not catch a shell script that curls a paid API. It will not catch a dependency pulled in a lockfile but never imported. It will not catch infrastructure clicked in a cloud console. AST allowlists are a tripwire, not a security boundary.

Git is required. A copy-paste project without commits has no HEAD and cannot count files honestly. The line cap also ignores generated HTML assets if they are not in the diff. Founders who let an agent dump a frontend bundle will sail under the Python file cap and still waste the day.

Free model access and a free server option can change. Do not plan a company on an unpublished SLA. Do not store customer PII on a shared free host. Do not treat a weekend receipt as an audit log for a regulated workload.

Who should not use this approach

Teams with more than one active committer should use real review, not a three-number file. Products that already bill through Stripe or a public cloud should encode those vendors in an allowlist on purpose, not pretend the deny list still applies. Anyone handling health, payments, or school records needs a threat model this script does not provide.

Founders chasing model quality charts should also skip this. The method optimizes for a shippable slice on a quiet machine. It does not optimize for agent autonomy, long-horizon planning, or multi-tool orchestration. Those loops are a different product. They are rarely a same-day MVP.

Ship the slice, then stop

The useful end state is a running page, a SQLite file, and a receipt that says OK. Close the editor. Tag the commit. Leave .loop_state.json in the tag so the next weekend cannot pretend it is still iteration two. An agent that still wants to “just add auth” has already lost the contract. The founder who honors the halt is the one who still has a zero bill on Monday.

A Network Tripwire for Zero-Bill Indie MVPs

Dakota Wu — Wed, 09 Sep 2026 16:37:40 +0000

The cheapest control for an AI-coded weekend product is a failed test. Any patch that opens a real socket should die on the founder’s laptop, and every invented SaaS call should land on an in-process stub. That is the whole method.

Indie backends do not usually burn money on prompts first. They burn it when a generated handler quietly talks to Stripe, Resend, Redis, or a managed queue. The agent is completing a tutorial-shaped pattern. A tripwire treats that pattern as a bug, not as a roadmap.

This workflow is for a solo founder who must ship today and keep the bill at zero. It accepts ugly limits: memory inboxes, codes printed to stdout, SQLite, one process. Those limits are the product constraint, not a prompt to argue with.

Why generated backends grow invoices

Weekend MVPs start as a process and a local database file. Then a coding agent adds “just a webhook” and a hosted mail provider. Those lines look small in a diff. They are not. They demand accounts, API keys, and a public URL the founder does not have before lunch.

Agents also assume retries, queues, and object storage. Each assumption is another vendor dashboard. The waitlist that was supposed to exist by Sunday night becomes four integrations and zero users. Prompts will not hold that line. A test that cannot see the public internet will.

Treat the agent as a fast if-statement with a large training prior. If the prior says “payments belong on a hosted API,” the patch will import that API. The tripwire does not debate the prior. It fails the connect.

The artifact

The artifact is three files in the repo root. No cloud account is required. The loop stays local.

stub_map.json — the only hosts, schemes, and env keys the process may mention.
tripwire.py — a development guard that refuses outbound sockets and records attempts.
test_tripwire.py — a reproducible check run before any AI patch is merged.

Label the snippets below as a starter kit, not as production policy. They are meant to be copied, run, and tightened.

1. Declare the stub map

Create the map first. Empty vendor lists are valid on day one. That emptiness is the point.

{
  "allowed_hosts": ["127.0.0.1", "localhost"],
  "allowed_schemes": ["http"],
  "allowed_env": ["DATABASE_URL", "SECRET_KEY"],
  "stubs": {
    "email": "memory",
    "payments": "memory",
    "queue": "memory",
    "auth_codes": "stdout"
  }
}

email: memory stores messages in a list. auth_codes: stdout prints a one-time login code in the terminal. Neither needs a vendor. Keep the file in git. A patch that adds STRIPE_SECRET_KEY without updating this map should fail in step 4.

2. Install the tripwire

The tripwire wraps socket.socket.connect. It is a fail-fast for local tests. It is not a sandbox, a firewall, or a compliance control.

# tripwire.py
from __future__ import annotations

import json
import socket
from pathlib import Path

MAP_PATH = Path(__file__).resolve().parent / "stub_map.json"
_map = json.loads(MAP_PATH.read_text())
ALLOWED = set(_map.get("allowed_hosts") or [])
LOG: list[str] = []

_real_connect = socket.socket.connect

def _guarded_connect(self, address):
    host = address[0] if isinstance(address, tuple) else address
    host = str(host)
    if host not in ALLOWED:
        LOG.append(host)
        raise RuntimeError(
            f"tripwire: blocked outbound connect to {host!r}. "
            "Add an in-process stub or update stub_map.json."
        )
    return _real_connect(self, address)

socket.socket.connect = _guarded_connect  # type: ignore[method-assign]

Load it before application code:

export PYTHONPATH=.
python -c "import tripwire; import app"

In tests, import the guard first:

import tripwire  # noqa: F401  — must import before app code

Short rule: if the test process can reach the public internet, the tripwire is not installed. Fix the import order before debugging the app.

3. Provide in-process stubs

Stubs should be boring. They exist so the agent can keep writing handlers without opening accounts. Wire them in one module. Do not let route files construct SDK clients.

# stubs.py
from __future__ import annotations

from dataclasses import dataclass, field
from datetime import datetime, timezone

@dataclass
class MemoryMailbox:
    messages: list[dict] = field(default_factory=list)

    def send(self, to: str, subject: str, body: str) -> dict:
        item = {
            "to": to,
            "subject": subject,
            "body": body,
            "sent_at": datetime.now(timezone.utc).isoformat(),
        }
        self.messages.append(item)
        return item

@dataclass
class MemoryLedger:
    charges: list[dict] = field(default_factory=list)

    def charge(self, amount_cents: int, currency: str = "usd") -> dict:
        if amount_cents <= 0:
            raise ValueError("amount_cents must be positive")
        item = {
            "id": f"stub_{len(self.charges) + 1}",
            "amount_cents": amount_cents,
            "currency": currency,
            "status": "stubbed",
        }
        self.charges.append(item)
        return item

@dataclass
class StdoutCodes:
    def issue(self, email: str) -> str:
        code = f"{abs(hash(email)) % 10**6:06d}"
        print(f"[auth-stub] {email} -> {code}")
        return code

# wiring.py
from stubs import MemoryMailbox, MemoryLedger, StdoutCodes

mailbox = MemoryMailbox()
ledger = MemoryLedger()
codes = StdoutCodes()

A route calls mailbox.send(...). The generated code still looks like a product. The invoice does not exist. That trade is the indie default until someone pays.

4. Run the test plan

The test plan is the merge gate. Run it on every AI patch, including the manual edits that follow a stalled agent.

# test_tripwire.py
import json
import re
from pathlib import Path

import pytest

import tripwire  # noqa: F401
from stubs import MemoryMailbox, MemoryLedger

ROOT = Path(__file__).resolve().parent
MAP = json.loads((ROOT / "stub_map.json").read_text())
ENV_RE = re.compile(
    r"os\.environ\[(['\"])([A-Z0-9_]+)\1\]"
    r"|os\.getenv\((['\"])([A-Z0-9_]+)\3"
)

def test_stub_map_lists_only_local_hosts():
    for host in MAP["allowed_hosts"]:
        assert host in {"127.0.0.1", "localhost", "::1"}

def test_tripwire_blocks_public_dns():
    import socket

    with pytest.raises(RuntimeError, match="tripwire"):
        socket.socket().connect(("example.com", 443))

def test_mailbox_does_not_touch_network():
    box = MemoryMailbox()
    box.send("founder@localhost", "hello", "ship")
    assert box.messages[0]["to"] == "founder@localhost"

def test_ledger_rejects_zero():
    with pytest.raises(ValueError):
        MemoryLedger().charge(0)

def test_source_env_keys_are_declared():
    allowed = set(MAP["allowed_env"])
    undeclared: set[str] = set()
    for path in ROOT.rglob("*.py"):
        if path.name.startswith("test_") or path.name == "tripwire.py":
            continue
        text = path.read_text(encoding="utf-8")
        for match in ENV_RE.finditer(text):
            key = match.group(2) or match.group(4)
            if key and key not in allowed:
                undeclared.add(f"{path.name}:{key}")
    assert not undeclared, f"undeclared env keys: {sorted(undeclared)}"

Commands:

python -m pip install pytest
python -m pytest test_tripwire.py -q

Expected result on a clean stubbed app: all tests pass. After an agent adds os.environ["STRIPE_SECRET_KEY"], the env test fails. After a code path calls a public host, the connect test fails if that path runs under the guard.

Grep is not a parser. Dynamic os.environ.get(name) can slip through. Keep the live tripwire as the backstop when the handler actually executes.

5. Debug a red patch in order

When the gate fails, do not start by asking the model to “fix CI.” Walk the failure in this order.

Read the traceback. A tripwire: blocked outbound connect line names the host. That host is the invented vendor.
Search the diff for SDKs and URLs, not for architecture essays.
Replace the call with a function on stubs.py. Keep the route signature stable so the agent does not rewrite the rest of the file.
If a new env key is required for a later paid phase, do not add it now. Add a comment in stub_map.json only when revenue justifies the vendor.
Re-run python -m pytest test_tripwire.py -q until it is green. Then merge.

A useful extra check is a model reading the diff against the map. Static tests miss a TODO that says “switch this mailbox to a hosted provider after launch” sitting next to half-wired client code. MonkeyCode’s free model access and free server option can run that narrow pass without adding a second vendor bill. Disclosure: This article was prepared as part of MonkeyCode's product outreach.

Keep the review prompt as a checklist:

Read the diff and stub_map.json.
Fail if the patch:
- imports a payments, email, SMS, queue, or object-storage SDK
- adds env keys not listed in allowed_env
- documents a hosted provider as a follow-up in the same files as runtime code
Pass only if new I/O uses stubs.py or localhost.

Keep secrets off that server. The stub map and the diff are enough. API keys should not exist yet. Availability of free model access and a free server can change, so do not plan capacity around them.

Decision table

Signal in the patch	Day-one action	Later, with revenue
Email SDK	`MemoryMailbox`	One provider, one env key, update the map
Payments SDK	`MemoryLedger` with `status: stubbed`	Real processor behind the same `charge()`
Redis / queue	In-process list	Only after a measured backlog
Auth email	`StdoutCodes`	Email provider, still one `issue()`
Object storage	Local `./data` directory	Bucket only for real user uploads
New env key	Fail the test	Add to `allowed_env` with a comment

Ship the left column today. The right column is a product decision. It is not an agent default.

Limitations

The tripwire patches CPython socket.socket.connect. It will not wrap every HTTP stack on every interpreter. Native extensions, subprocesses, and os.system("curl ...") bypass it. A founder who needs a hard network namespace should use OS-level isolation, not this module.

The env scanner is a regular expression. Obfuscated access wins. Teams that need a real policy engine should parse AST or run the app inside a network jail.

Stubs lie. A memory mailbox cannot teach deliverability. A stub charge cannot teach disputes or refunds. That is acceptable for a waitlist. It is not acceptable for money movement.

Free model access and a free server do not make the tripwire stronger. They only add a second reader for the diff. Do not treat them as a quota, a hardware spec, or a permanent plan.

Who should not use this

Skip the tripwire if the product already depends on a paid provider. Skip it for regulated workloads, production incident response, and anything that must send a real message today.

Skip it if failing tests will be ignored. A red suite that always gets -k is theater. Multi-service staging clusters do not belong here either. This workflow assumes one process, one developer, and a bill that must stay at zero until a user pays.

The original problem remains: agents complete vendor-shaped code. The tripwire makes that completion expensive in minutes, not in dollars. Minutes are the resource a solo founder can spend before lunch.

A Single-Process Gate for AI-Generated Indie Backends

Dakota Wu — Mon, 07 Sep 2026 14:27:11 +0000

A coding agent can emit a plausible backend in one sitting and still leave a solo founder with nothing that runs on one machine. Queues, workers, and extra datastores show up as “production hygiene.” They are unpaid platform work. A single-process gate blocks that topology before the first public URL, so the weekend build can sit on a free server with a bill of zero.

This article is a worked example, not a production postmortem. The gate is a YAML pin, a Python checker, and a stdlib smoke test. It does not measure latency or conversion. It answers one operational question: can this MVP serve HTTP and persist rows inside one OS process.

Why agents invent a platform team

Agentic coding tools fill unspecified gaps. A prompt that says “ship a waitlist and an admin view” does not name a process model. The model then reaches for Redis, a mail worker, object storage, and a compose file with four services. Each piece is common in large apps. None of it is required for a first cohort.

Indie constraints are different. There is no on-call rotation. There is no budget for managed queues. A free server, when one is available, usually means one public port and one long-running process. Extra services fail that shape even when the Python or Node tests pass.

Cheap generation makes the failure mode worse. Files appear faster than the founder can operate them. Technical debt used to wait for headcount. It now arrives on Saturday afternoon as a second Dockerfile.

The rule

The weekend MVP is one process, one listen port, and one file-backed store. Background work runs in-request or not at all. Mail, webhooks, and image pipelines wait until a paying path exists. If a feature needs a second process, it is out of scope for the slice.

That rule is stricter than a cloud-vendor denylist. Redis on localhost still splits the runtime. A local worker still needs a supervisor. The gate cares about process topology, not logo choice.

Artifact: `process.lock.yml`

Keep the pin next to the repo root. The agent reads it on every turn. The checker fails CI when the tree drifts.

# process.lock.yml — pin for a solo, zero-bill slice
version: 1
process:
  count: 1
  listen_port: 8080
  store: sqlite
  store_path: ./data/app.db
allow_imports:
  - sqlite3
  - http.server
  - json
  - pathlib
  - urllib.parse
  - html
  - os
  - time
  - secrets
forbid_tokens:
  - celery
  - dramatiq
  - rq.Queue
  - redis
  - kafka
  - pika
  - boto3
  - aiobotocore
  - docker-compose
  - kubernetes
  - multiprocessing.Pool
  - background_tasks
  - APScheduler
compose:
  allowed_services: []
notes:
  - No worker containers.
  - No second datastore.
  - Email is a row in SQLite, not a mail daemon.

The allow-list is intentionally small. A later slice can add a template engine. It cannot add a broker. The empty allowed_services list means a compose file is a hard fail, not a warning.

Artifact: the checker

The script below is a complete, runnable gate. It walks *.py, *.yml, *.yaml, and *.toml under the repo, skipping virtualenvs. It is a heuristic. It will miss a clever import alias. It will catch the defaults agents actually emit.

#!/usr/bin/env python3
"""Fail the build when the tree outgrows one process."""
from __future__ import annotations

import sys
from pathlib import Path

import yaml

ROOT = Path(__file__).resolve().parents[1]
PIN = ROOT / "process.lock.yml"
SKIP_DIRS = {".git", ".venv", "venv", "node_modules", "__pycache__"}
SCAN_SUFFIX = {".py", ".yml", ".yaml", ".toml", ".md"}


def load_pin() -> dict:
    data = yaml.safe_load(PIN.read_text(encoding="utf-8"))
    if data.get("process", {}).get("count") != 1:
        raise SystemExit("process.count must be 1 for this slice")
    return data


def iter_files():
    for path in ROOT.rglob("*"):
        if not path.is_file():
            continue
        if any(part in SKIP_DIRS for part in path.parts):
            continue
        if path.suffix.lower() not in SCAN_SUFFIX:
            continue
        if path.name == "process.lock.yml":
            continue
        yield path


def main() -> int:
    pin = load_pin()
    forbidden = tuple(pin["forbid_tokens"])
    hits = []
    for path in iter_files():
        text = path.read_text(encoding="utf-8", errors="ignore")
        for token in forbidden:
            if token in text:
                hits.append(f"{path.relative_to(ROOT)}: {token}")
    compose = ROOT / "docker-compose.yml"
    if compose.exists() and not pin.get("compose", {}).get("allowed_services"):
        hits.append("docker-compose.yml: extra services are out of scope")
    if hits:
        print("process gate failed:")
        for row in hits:
            print(f"  - {row}")
        return 1
    print("process gate ok: one process, sqlite, no broker")
    return 0


if __name__ == "__main__":
    sys.exit(main())

Install PyYAML in the dev environment only. The app runtime does not need it. Run the gate before any deploy command.

python3 -m pip install pyyaml
python3 tools/check_process_gate.py

Artifact: a backend that can pass

The following server uses the standard library and SQLite. It is enough for an email capture page. It is not a framework showcase. Label it as a slice, not a platform.

#!/usr/bin/env python3
"""One-process waitlist. Unexecuted until you run it locally."""
from __future__ import annotations

import json
import sqlite3
from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
from pathlib import Path
from urllib.parse import parse_qs

DB = Path("data/app.db")
PORT = 8080
FORM = b"""<!doctype html><meta charset=utf-8>
<title>Waitlist</title>
<form method=post action=/join>
<input name=email type=email required>
<button>Join</button>
</form>"""


def init_db() -> None:
    DB.parent.mkdir(parents=True, exist_ok=True)
    with sqlite3.connect(DB) as con:
        con.execute(
            "CREATE TABLE IF NOT EXISTS waitlist("
            "id INTEGER PRIMARY KEY, email TEXT UNIQUE, created_at TEXT)"
        )


class Handler(BaseHTTPRequestHandler):
    def do_GET(self) -> None:
        if self.path != "/":
            self.send_error(404)
            return
        self.send_response(200)
        self.send_header("Content-Type", "text/html; charset=utf-8")
        self.end_headers()
        self.wfile.write(FORM)

    def do_POST(self) -> None:
        if self.path != "/join":
            self.send_error(404)
            return
        length = int(self.headers.get("Content-Length", "0"))
        body = self.rfile.read(length).decode("utf-8")
        email = (parse_qs(body).get("email") or [""])[0].strip().lower()
        if "@" not in email:
            self.send_error(400, "bad email")
            return
        with sqlite3.connect(DB) as con:
            con.execute(
                "INSERT OR IGNORE INTO waitlist(email, created_at) "
                "VALUES(?, datetime('now'))",
                (email,),
            )
        self.send_response(303)
        self.send_header("Location", "/")
        self.end_headers()

    def log_message(self, fmt: str, *args) -> None:
        sys_stderr = __import__("sys").stderr
        sys_stderr.write("%s - %s\n" % (self.address_string(), fmt % args))


def main() -> None:
    init_db()
    httpd = ThreadingHTTPServer(("0.0.0.0", PORT), Handler)
    print(json.dumps({"listen": PORT, "db": str(DB)}))
    httpd.serve_forever()


if __name__ == "__main__":
    main()

Threading inside one process is allowed. A second OS process is not. ThreadingHTTPServer keeps the gate honest: concurrency is in-process, persistence is a file.

Smoke test the founder can re-run

Do not trust the agent’s claim that the server “should work.” The test starts the process, posts one email, and checks SQLite. Stop the process afterward. This is a local check, not a load test.

#!/usr/bin/env python3
import sqlite3
import subprocess
import time
import urllib.request
from pathlib import Path

ROOT = Path(__file__).resolve().parents[1]
DB = ROOT / "data" / "app.db"

def main() -> None:
    proc = subprocess.Popen(["python3", str(ROOT / "app.py")], cwd=ROOT)
    try:
        time.sleep(0.4)
        req = urllib.request.Request(
            "http://127.0.0.1:8080/join",
            data=b"email=founder@example.com",
            method="POST",
        )
        urllib.request.urlopen(req, timeout=2)
        with sqlite3.connect(DB) as con:
            n = con.execute("select count(*) from waitlist").fetchone()[0]
        if n < 1:
            raise SystemExit("smoke failed: no row")
        print("smoke ok", n)
    finally:
        proc.terminate()
        proc.wait(timeout=3)

if __name__ == "__main__":
    main()

python3 tools/check_process_gate.py
python3 tests/smoke_waitlist.py

If either command fails, the slice is not shippable. More generated files will not fix a topology violation. Delete the extra service instead of prompting for “production hardening.”

Numbered workflow for a same-day ship

Write process.lock.yml before the first generation prompt. Paste the pin into the agent context. State that any extra process is a defect, not a stretch goal.
Generate only the HTTP handler, the schema, and the HTML form. Refuse refactors that add task queues “for later.”
Run the gate. Read every hit. Agents often hide Redis behind a cache helper. The token still appears.
Run the smoke test against 127.0.0.1. Confirm a row exists without opening a dashboard product.
Copy app.py, process.lock.yml, and data/ to a single host. Bind port 8080. Use a reverse proxy if the host already has one. Do not add a second app container to make that proxy feel official.

A coding assistant with free model access can do steps 2 and 3 if the pin is in the prompt. Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode is an open-source project that, per the operator, offers free model access and a free server option. This workflow uses those two facts only. It does not claim a quota, a model name, a hardware profile, or a durability guarantee. The gate still runs if another tool generates the files.

The free server option matters after the gate is green. A topology that needs four services will not become cheaper on a complimentary host. It will fail in a more confusing way. Keep the process count at one, then put that process on the host.

What the gate will not save

The checker is string-based. An agent can rename celery to a local module and smuggle a broker through a socket. Read the diff. The pin is a seatbelt, not a proof of correctness.

SQLite will serialize writes. That is acceptable for a first hundred signups. It is the wrong store for a write-heavy game loop. Moving to a hosted database is a later decision, made with revenue, not with an agent’s fear of “not being production ready.”

In-request work will block a thread. A burst of slow outbound HTTP will stall the waitlist form. The indie response is to drop the outbound call, not to add a worker pool on day one.

Free model access can still invent APIs that do not exist. The smoke test is the backstop. If the handler imports a package that is not on the allow-list, install nothing. Change the code.

A free server is not an SLA. Back up data/app.db with sqlite3 .dump on a schedule the founder actually runs. Treat the host as replaceable. The pin should make replacement boring: one process, one file.

Who should not use this

Skip the single-process gate when the product already has a real queue, a compliance boundary, or a traffic shape that needs more than one machine. Skip it for multi-tenant billing where a blocked writer is a contract breach. Skip it when the founder is practicing distributed systems on purpose.

Teams with platform engineers do not need this article. They already have a topology. The failure mode here is specific: one person, one weekend, an agent that wants to hire an imaginary infra team.

Close

Ship the slice that fits in one process. Keep the bill at zero by refusing services the cohort does not prove. Accept the limits: serialized writes, no mail daemon, no sidecar cache. If the gate stays green, a free server option is enough to put the handler on the internet for a first list of emails. Widen the pin only after those emails turn into a reason to pay.