DEV Community: Dakota Wu

Keep Health Probes Off the Model on a Free Host

Dakota Wu — Sun, 11 Oct 2026 22:16:59 +0000

A free host probes and restarts. The health route has to answer from local memory, with no model call and no disk state. That split is what lets a solo founder ship one route today and keep the bill at zero.

An AI draft often does the opposite. It puts a "model is reachable" check inside /health, adds a retry, and stores the last success in a global. The chat result looks careful. On a free server the probe runs far more often than any user request, and a restart wipes the global so the next probe fails or calls out again.

Model quality and host constraints are different problems. A sharper draft can still put a network call on the probe path. The host will not forgive that just because the draft read well in a chat window. The workflow below refuses that shape before the host starts.

The rule, in one table

The table is a local policy. It is not a vendor quota and it is not a benchmark.

Check	Ship	Stop
Health body	Fixed JSON from memory	Any fetch, SDK call, or retry
Imports in `health.py`	No network or model-SDK imports	`socket`, `urllib`, `requests`, `httpx`, or a model SDK
State	No file and no global required for a 200	Token caches, lock files, last-probe timestamps
Restart drill	Same body after kill and start	Different body, hang, or a new dependency
Model use	One draft of the business route, off the probe path	A model call inside the probe or on import

Tighten the table if the host is smaller. Do not loosen it so the probe can "just verify" the assistant.

Step 1: Put the probe in its own module

Create health.py before asking any model to draft the business route. The probe module stays hand-written. The model may touch route.py later. It does not get to edit health.py.

"""Probe handler. Unexecuted example: review before running."""

def health() -> dict:
    return {"ok": True, "deps": "none"}

Three fields would already be too many if one of them required a lookup. ok says the process is up. deps records that this ship has none.

A future route can grow. This file should not.

What the model may change

Allowed changes sit in route.py and nowhere else.

A single handler for one business path.
Pure functions that take arguments and return values, with no client construction.
Comments that restate the frozen probe rule.

Forbidden changes are a stop, even when the code compiles.

Any edit to health.py or scan_health_imports.py.
A retry, a sleep loop, or a helper whose job is to ping a model.
A new file whose name contains worker, queue, or cron.
A README line that tells the founder to add a database so the probe can look complete.

That list is the review. It takes less time than reading a generated diff that has no boundary.

Step 2: Fail the build when the probe grows a client

A source scan is blunt and useful. It reads health.py as syntax and rejects network imports. The usual generated patch adds a normal import at the top of the file, and this scan catches that shape.

Dynamic imports can slip through. That hole is listed under limits. Do not treat a green scan as a proof of isolation.

"""Import boundary for health.py. Unexecuted example."""

import ast
import pathlib
import sys

BANNED = {"socket", "urllib", "requests", "httpx", "model_sdk"}

def main() -> int:
    tree = ast.parse(pathlib.Path("health.py").read_text(encoding="utf-8"))
    bad = []
    for node in ast.walk(tree):
        if isinstance(node, ast.Import):
            names = [alias.name for alias in node.names]
        elif isinstance(node, ast.ImportFrom) and node.module:
            names = [node.module]
        else:
            continue
        for name in names:
            if name.split(".")[0] in BANNED:
                bad.append(name)
    if bad:
        print("banned imports: " + ", ".join(bad))
        return 1
    print("health imports ok")
    return 0

if __name__ == "__main__":
    raise SystemExit(main())

Replace model_sdk with the import root of whatever client the draft actually used. The placeholder is not a product name.

python3 scan_health_imports.py

A nonzero exit stops the ship. Do not add the banned name to an allow list in the same hour the draft suggested it. That is the patch asking for a second design.

Step 3: Assert that a call does not touch the network

The scan cannot see a helper, imported from route.py, that opens a socket. A tiny test covers the runtime path. The example expects pytest and monkeypatch. It stays an unexecuted example until it runs in a clean virtualenv.

"""Runtime boundary. Unexecuted example."""

import socket
import urllib.request

import health

def test_health_makes_no_network(monkeypatch):
    def boom(*_args, **_kwargs):
        raise AssertionError("health opened the network")

    monkeypatch.setattr(socket, "socket", boom)
    monkeypatch.setattr(urllib.request, "urlopen", boom)
    assert health.health() == {"ok": True, "deps": "none"}

python3 -m pytest -q test_health.py

The assertion is the contract. If a later edit needs a database check before it can return 200, this test should fail and the ship should wait. A solo free host is the wrong place to invent a dependency probe.

Step 4: Kill the process and demand the same body

Free hosts restart. Some sleep when traffic stops. This draft claims neither a sleep timer nor a memory cap nor an uptime figure, because none of those were measured here. The local drill proves a weaker fact: the probe does not need a global that the process just lost.

"""Local probe server. Unexecuted example."""

import json
from http.server import BaseHTTPRequestHandler, HTTPServer

import health

class Handler(BaseHTTPRequestHandler):
    def do_GET(self):
        if self.path != "/health":
            self.send_response(404)
            self.end_headers()
            return
        body = json.dumps(health.health()).encode()
        self.send_response(200)
        self.send_header("Content-Type", "application/json")
        self.send_header("Content-Length", str(len(body)))
        self.end_headers()
        self.wfile.write(body)

    def log_message(self, *_args):
        return

if __name__ == "__main__":
    HTTPServer(("127.0.0.1", 8080), Handler).serve_forever()

python3 probe_server.py &
PID=$!
sleep 0.3
curl -fsS --max-time 2 http://127.0.0.1:8080/health > /tmp/h1.json
kill "$PID"
wait "$PID" 2>/dev/null || true
python3 probe_server.py &
PID=$!
sleep 0.3
curl -fsS --max-time 2 http://127.0.0.1:8080/health > /tmp/h2.json
kill "$PID"
cmp /tmp/h1.json /tmp/h2.json

cmp is the promotion check. A mismatch means the route rebuilt state, called something, or changed shape across a restart. Fix that on the laptop. Do not debug it after the host has started probing.

Step 5: Read the failure, then stop

Each failed check has one repair. A second repair in the same pass usually means the design grew a new service.

Exit signal	Meaning	Next action
Scan exit 1	`health.py` imported a banned root	Delete the import. Do not wrap it in a helper
Pytest failure	`health()` reached `socket` or `urlopen`	Remove the call. The monkeypatch is doing its job
Curl timeout	Nothing accepted connections on `127.0.0.1:8080`	Fix the bind. Do not raise `--max-time`
`cmp` difference	The body depends on process lifetime	Return the constant dict again

Write the failing signal into the commit message, then stop for the day if the repair is not the one in that row. Shipping around a red check is how a free host starts a bill.

Step 6: Use a free model on the route, never on the probe

Disclosure: This article was prepared as part of MonkeyCode's product outreach.

The operator describes MonkeyCode as an open-source coding assistant with free model access and a free server option. Those availability claims are operator-supplied. This draft does not name a model, state a token quota, describe hardware, or treat either option as permanent.

Confirm the project page on ship day. If either claim is gone, keep the health split and skip the product. The three local commands still decide the ship.

Use the free model, when it is actually available, for one draft of route.py only. Paste a line that health.py is frozen. Discard a reply that edits the probe, adds a retry, or imports a client into the health module. Then run the scan, the test, and the restart drill again. The model does not promote the ship. The commands do.

The free server, when it is actually available, is where the already-tested process runs. Copy the probe module, the app entry, and the business route. Leave add-ons, cron, and a database toggle off.

A probe that stays local is what keeps that host from calling a model on every platform check. Point the host health setting at /health only after the local cmp succeeded.

Limits, and who should ignore this

The scan misses importlib and clients hidden behind a string. The test misses a network call that happens only when a host environment variable is set. The restart drill uses localhost and a short sleep. It does not reproduce disk quotas, TLS, or a real idle policy.

No latency number in this article is a measurement. No token total is stated, because none was verified for this draft. Founders who need a current quota should read the project page themselves and treat this workflow as the constraint, not as a pricing page.

A team whose health check must fail closed when a database is down should not adopt this probe. Their users need a dependency signal. A product that already has a paid host and a scheduler should not pretend a three-command drill is an operations platform.

This pattern is for a solo founder shipping one route, accepting a dull health body, and refusing extra moving parts until a bill is a choice. Run the scan, the test, and the restart cmp in that order. Ship only if all three pass, and leave the probe file out of the model session.

Pin a Solo Waitlist to a Local Byte and Time Ceiling

Dakota Wu — Sat, 10 Oct 2026 18:54:27 +0000

A solo waitlist can ship today and still keep the bill at zero. That result holds only when the handler, the store, and a local request-budget harness agree before any public host exists. A free model may draft the next check. It may not widen the response, add a client, or invent a second process.

The method is small on purpose. One POST, one append-only file, one command that fails closed. Everything else waits.

The constraint that makes the route shippable

MonkeyCode's free model access and a free server option are the two availability claims this workflow relies on. Disclosure: This article was prepared as part of MonkeyCode's product outreach.

Neither claim is a hardware spec, a duration, or a numeric token quota. This article does not treat quota, region, disk, or uptime figures as stable, because those numbers go stale faster than a tutorial can be corrected. The founder reads the current console before counting on either option.

The local ceiling stays stricter than any assumed platform limit. If the console no longer shows a free path, the harness still stops a quiet dependency from landing in the tree.

Where the second edit usually breaks the bill

The first generated handler is often short. The second prompt is the risky one. Asked to make a waitlist nicer, a model will echo the stored email, wrap the write in a retry, or pull in a helper that opens a socket.

The diff can look harmless. The response gets fatter, the call gets slower, or a new import appears below the fold. A ceiling on bytes and milliseconds catches the first two failures. It does not catch every import, which is why the founder still reads the diff after the command goes green.

Files that are allowed to exist

The layout is the policy. Extra services do not get a folder.

waitlist/
  handler.py
  budget.env
  fixtures/ok.json
  fixtures/fat.json
  harness.sh

store.ndjson is created at runtime and is never committed. budget.env is committed. It records founder policy, not a measured host SLA.

# budget.env — local policy, not a vendor measurement
MAX_RESPONSE_BYTES=1024
MAX_HANDLER_MS=200
ALLOWED_METHOD=POST
ALLOWED_PATH=/waitlist

Two hundred milliseconds is a laptop ceiling. It forces the handler to stay cheap before a cold remote process is involved. It is not a claim about any free server timeout, and this article publishes no host timing because none was measured here.

Step 1. Pin the handler to the standard library

The handler checks the method, the path, and one email field. It appends one JSON line and returns a tiny body. No framework, no mail client, and no socket of its own.

# handler.py — proposal, not executed for this article
import json
from pathlib import Path

STORE = Path("store.ndjson")

def handle(method, path, raw, budget):
    if method != budget["ALLOWED_METHOD"] or path != budget["ALLOWED_PATH"]:
        return 405, b'{"error":"method_or_path"}\n'
    try:
        body = json.loads(raw)
    except json.JSONDecodeError:
        return 400, b'{"error":"json"}\n'
    email = body.get("email")
    if not isinstance(email, str) or "@" not in email or len(email) > 120:
        return 400, b'{"error":"email"}\n'
    if len(raw) > 512:
        return 400, b'{"error":"size"}\n'
    line = json.dumps({"email": email}, separators=(",", ":")) + "\n"
    with STORE.open("a", encoding="utf-8") as fh:
        fh.write(line)
    return 201, b'{"ok":true}\n'

The snippet is a proposal. It does not hash the address, rate-limit callers, or prove the mailbox exists. Those omissions are deliberate. A day-one route that adds them usually reaches for a paid API before the first real signup arrives.

Step 2. Add fixtures that stand in for a bad edit

Two fixtures are enough for the first gate. The good one is a short object. The fat one is a large object that must be rejected before the store grows.

mkdir -p fixtures
printf '%s\n' '{"email":"ada@example.com"}' > fixtures/ok.json
printf '%s' '{"email":"ada@example.com","pad":"' > fixtures/fat.json
python3 -c 'print("x" * 800, end="")' >> fixtures/fat.json
printf '%s\n' '"}' >> fixtures/fat.json

The fat fixture is not a fuzz corpus. It stands in for the edit that echoes user input into a long error body, or that accepts a blob because a prompt said to store the raw request. If that edit lands, the gate should fail before any copy to a host.

Step 3. Run the budget command on the laptop

The harness imports the handler in-process. It does not bind a port, and it does not call a network. Startup noise stays out of the ceiling, which keeps the gate readable. Values in budget.env must not contain spaces around =, because the shell sources the file directly.

#!/bin/sh
# harness.sh — local gate, not a load test
set -eu
set -a
. ./budget.env
set +a
rm -f store.ndjson

python3 - <<'PY'
import os, time, pathlib, importlib.util
spec = importlib.util.spec_from_file_location("handler", "handler.py")
mod = importlib.util.module_from_spec(spec)
spec.loader.exec_module(mod)
budget = {
    "ALLOWED_METHOD": os.environ["ALLOWED_METHOD"],
    "ALLOWED_PATH": os.environ["ALLOWED_PATH"],
}
max_bytes = int(os.environ["MAX_RESPONSE_BYTES"])
max_ms = int(os.environ["MAX_HANDLER_MS"])
cases = [
    ("POST", "/waitlist", pathlib.Path("fixtures/ok.json").read_bytes(), 201),
    ("POST", "/waitlist", pathlib.Path("fixtures/fat.json").read_bytes(), 400),
    ("GET", "/waitlist", b"{}", 405),
]
for method, path, raw, expect in cases:
    t0 = time.perf_counter()
    status, body = mod.handle(method, path, raw, budget)
    elapsed = (time.perf_counter() - t0) * 1000
    if status != expect or len(body) > max_bytes or elapsed > max_ms:
        raise SystemExit(
            "fail method=%s status=%s bytes=%s ms=%.1f"
            % (method, status, len(body), elapsed)
        )
print("budget-ok")
PY

The release command is short.

chmod +x harness.sh
./harness.sh

The script prints budget-ok only when every case matches. In this proposal that string is the release token, not a measurement from a live host. Any other output means the files stay on the laptop.

The founder does not repair a red run by raising MAX_RESPONSE_BYTES inside the same edit that grew the body. The ceiling moves in a separate commit, with a one-line reason, or it does not move.

Step 4. Let the model draft, then restore on red

The free model earns its place as a drafter inside this fence, not as the reviewer of record. The prompt includes budget.env, handler.py, and one requested change, such as rejecting a missing source label without new imports. The reply is pasted over a copy of the handler by hand. Nothing is applied by a tool.

cp handler.py handler.py.bak
# paste the drafted handler over handler.py, then:
./harness.sh || mv handler.py.bak handler.py

There is no second model call in the loop. A green harness is necessary and not sufficient. The founder still scans the import block. A new network client can be fast and small, so the byte ceiling will not save a route that starts calling out.

Step 5. Copy the green tree, and stop there

Upload is a copy of handler.py and budget.env. It is not a database create, a queue bind, or a domain purchase. If the free server option wants a start command, that command should import the same module the harness imported. A framework entrypoint suggested in a model comment is a new service, and it stays off the host.

# DEST comes from the current panel, not from this article
test -n "${DEST}"
cp handler.py budget.env "${DEST}/"

This article names no region, disk size, or process limit. A copied number would be worse than a blank. Consoles change, and a stale limit gets treated as permission.

How to judge the second edit

Suggested edit	What the gate sees	Action
Tighter email check, no new import	`budget-ok`	Keep
Error body echoes the stored line	Byte ceiling fails	Revert
Retry wrapped around the file write	Time ceiling fails, or the gate hangs	Revert
New HTTP client import	Often still green	Reject in the diff read
Paid mail API for confirmation	Out of policy even if fast	Reject before the harness

The last two rows are the honest limit of a local timer. Speed is not the same thing as a zero bill. A fast call to a paid API is still a bill.

Limits that stay even after a green run

The timer measures the laptop. A free server can be slower when the process is cold, and no cold-start figure is claimed here. A local pass does not prove a remote pass.

The store is one append-only file. Two overlapping writes can tear a line. That is tolerable for a solo list with tiny traffic. It is the wrong store for a paid signup, or for two people sharing a host.

The email check is a length cap plus an @ sign. Junk will get in. Mail will not go out. Confirmation mail, abuse controls, and a privacy review are a different system, and that system should be expected to cost money.

The harness does not watch DNS, TLS, or an idle policy on the host. A route can pass locally and still sleep after upload. The founder opens the public URL once. If the panel asks for a card, the upload stops.

Who should leave this pattern alone

More than one writer should not share store.ndjson. A product that takes payment should not keep emails this way. A founder who will not read a diff should not aim a free model at the handler, because quiet imports slip past the timer.

Anyone who needs a stated uptime target should not treat a free server option as capacity. The option is a way to put one route on the public internet today, with the limits written in budget.env. It is not a promise that the option remains.

After the command prints budget-ok

A founder who already keeps this fence can draft the next tiny check with MonkeyCode's free model access, and can use the free server option as the only copy target, if the console still shows both. The release rule does not change with the editor. ./harness.sh prints budget-ok, or the files stay on the laptop.

A Cold-Start Ledger for Shipping One Indie Route on a Free Server

Dakota Wu — Thu, 08 Oct 2026 10:53:05 +0000

A solo API earns a free-server deploy only when process startup does no network I/O, starts no thread, and writes nothing that must survive the process. That rule is the shipping decision. A warm laptop hides violations, because the process never sleeps and the disk never disappears. This ledger fails the ship on the founder's machine before a free host or a free-model retry pays for the mistake.

The check is local and cheap. It reads Python files, walks the syntax tree, and returns a non-zero status when module-level code calls a network client, starts a worker, or opens a path outside an allowed temp prefix. The script in this article is an unexecuted example. The founder should run it, read every hit, and keep judgment over lines the scanner cannot see.

Where the free path actually breaks

Indie drafts often import a client and call it at the top of the file so a sample looks ready. The first request on a laptop is fast, because that import already happened an hour ago. A free server that sleeps must import again on wake, and the import now sits inside the visitor's timeout.

Disk is the second break. A SQLite file beside the source tree looks like a zero-cost database until the platform discards the filesystem. The repair loop is the third break. A timed-out route sends the founder back to a coding assistant, and the easiest patch is a paid broker, a hosted queue, or a box that never sleeps.

None of those patches belong in a ship-today plan. The ledger exists so the route stays small enough that a free path is still an honest choice.

1. Freeze the budget in a file

Policy stays in coldstart-budget.json at the project root. The values are local choices for this app, not a vendor quota and not a measured latency.

{
  "scan_roots": ["app"],
  "forbidden_import_roots": ["requests", "httpx", "socket", "urllib", "boto3", "stripe"],
  "forbidden_suffixes": ["Thread", "Popen", "create_connection"],
  "allowed_write_prefixes": ["/tmp/", "./tmp/"]
}

A listed root may be imported. Calling that root while the module loads is the defect the ledger rejects. Importing requests is ordinary, while calling requests.get at import time is not. The scan root stays on app, not on a virtualenv, or third-party packages will flood the report.

2. Keep one bad file and one good file

The bad module calls the network while Python is still loading it. A sleeping host repeats that call on every wake.

# app/bad_health.py — should fail the ledger
import requests

READY = requests.get("https://example.invalid/health", timeout=2).status_code

The good module binds a function and stops. Work starts only after a request handler calls that function.

# app/health.py — should pass the ledger
import requests

def health():
    response = requests.get("https://example.invalid/health", timeout=2)
    return response.status_code

example.invalid is a reserved documentation name, not a live host. The samples exist so the scanner has one file to reject and one file to accept. They are not a production probe, and the founder should not point them at a customer domain.

3. Scan import-time calls

Save the following as coldstart_ledger.py. It uses the Python standard library only, so a fresh laptop can run it without a package install. Treat it as an unexecuted example until the founder has run it on a copy of the tree.

#!/usr/bin/env python3
"""Unexecuted example: flag import-time network, thread, and unsafe file writes."""

import ast
import json
import sys
from pathlib import Path

def dotted(node):
    if isinstance(node, ast.Name):
        return node.id
    if isinstance(node, ast.Attribute):
        head = dotted(node.value)
        return f"{head}.{node.attr}" if head else node.attr
    return ""

def inside_function(stack):
    kinds = (ast.FunctionDef, ast.AsyncFunctionDef, ast.Lambda)
    return any(isinstance(item, kinds) for item in stack)

class Ledger(ast.NodeVisitor):
    def __init__(self, path, budget, findings):
        self.path = path
        self.budget = budget
        self.findings = findings
        self.stack = []

    def generic_visit(self, node):
        self.stack.append(node)
        super().generic_visit(node)
        self.stack.pop()

    def visit_Call(self, node):
        if not inside_function(self.stack):
            name = dotted(node.func)
            root = name.split(".")[0]
            suffix = name.split(".")[-1]
            blocked_root = root in self.budget["forbidden_import_roots"]
            blocked_suffix = suffix in self.budget["forbidden_suffixes"]
            if blocked_root or blocked_suffix:
                line = f"{self.path}:{node.lineno}: import-time call {name}"
                self.findings.append(line)
            self._check_open(node, suffix)
        self.generic_visit(node)

    def _check_open(self, node, suffix):
        if suffix != "open" or not node.args:
            return
        arg = node.args[0]
        if not isinstance(arg, ast.Constant) or not isinstance(arg.value, str):
            self.findings.append(f"{self.path}:{node.lineno}: non-literal open() at import")
            return
        prefixes = tuple(self.budget["allowed_write_prefixes"])
        if not arg.value.startswith(prefixes):
            self.findings.append(f"{self.path}:{node.lineno}: write outside temp ({arg.value})")

def main():
    budget_path = Path("coldstart-budget.json")
    budget = json.loads(budget_path.read_text(encoding="utf-8"))
    findings = []
    for root in budget["scan_roots"]:
        base = Path(root)
        if not base.exists():
            findings.append(f"missing scan root: {root}")
            continue
        for path in base.rglob("*.py"):
            source = path.read_text(encoding="utf-8")
            tree = ast.parse(source, filename=str(path))
            Ledger(path, budget, findings).visit(tree)
    if findings:
        print("\n".join(findings))
        return 1
    print("cold-start ledger: no import-time calls flagged")
    return 0

if __name__ == "__main__":
    sys.exit(main())

Function bodies are ignored on purpose. A call inside health is request work, and request work is allowed. A call in the module body, including a call hiding in __init__.py, is startup work. Startup work is what a cold free server repeats for every wake.

4. Run the ledger before any host is chosen

The ledger must run as its own process. Importing the app inside the same interpreter would pay the cold-start cost the check is meant to catch. From the project root, with app/bad_health.py still present, the expected result is a failure.

python3 -m py_compile coldstart_ledger.py
python3 coldstart_ledger.py
echo "ledger_exit=$?"

A failing run prints a path, a line number, and the call name, then exits 1. Moving the call into a function, or removing bad_health.py from app/, should print cold-start ledger: no import-time calls flagged and exit 0. If the status stays 1, the founder reads the printed line instead of guessing. A syntax error aborts with a traceback, so that file gets fixed locally and the ledger runs again before any deploy command exists.

5. Spend free model access on one flagged file

Disclosure: This article was prepared as part of MonkeyCode's product outreach.

MonkeyCode fits this workflow in two optional places, and nowhere else. Free model access can rewrite a single flagged file so the network call moves inside a handler and keeps a timeout. The free server option is a destination for the route after the ledger exits 0, not a reason to skip the ledger. This draft treats those two availability claims as operator-supplied and current. It names no model, no token allowance, no machine size, and no duration, because those facts move and a post should not freeze them.

The same-day read is part of the method. Before either free option is used, the founder opens the current plan notes and checks that model access is still free, that a no-charge server plan is still offered, and that sleep, disk, and request limits still match this route. If the notes disagree with this article, the notes win.

The assistant prompt stays narrow. It asks for the import-time call to move into a function, for a timeout on the outbound request, and for no new host, queue, or database. After the edit, the ledger runs again. A green scan plus a new paid hostname is still a failed ship. The scanner does not understand pricing. The founder does.

6. Map the exit status to a ship decision

The table is the deploy policy for the day. It assumes nothing about a vendor's future pricing.

Ledger result	Same-day action
Exit 0, and the diff adds no external host	Deploy that one route and watch the first cold request
Exit 1, with one import-time call	Rewrite that call, re-run, then decide
Exit 0, but the route needs a worker or durable disk	Keep the route off the free server
Assistant patch adds a broker or SMTP host	Reject the patch and stay on the laptop
Scanner raises SyntaxError	Fix the file locally; do not deploy around the crash

The first cold request remains a manual check. The ledger cannot see the platform's real wake time. The founder calls the route once after an idle period, confirms a response, and only then shares the URL.

Limits, and who should leave the free path

The scanner is a syntax screen, not a proof of safety. It misses exec, string-built imports, and calls assembled with getattr. A non-literal open() is reported as review work, not classified as safe. A green run is not a load test, not a secret scan, and not evidence that a free tier will still exist next month.

Some products should not use this approach at all. A websocket that must stay connected, a billing job that must run while nobody is browsing, and any personal-data store that lives only on local disk do not fit a host that may sleep or wipe files. A team that needs a stated uptime commitment needs a plan that actually states one. This ledger will not create that commitment.

Another assisted rewrite will not repair those mismatches. Spending a free model turn to paper over a sleeping host burns the allowance and leaves the route wrong. The honest outcome is a smaller route, or a paid host chosen in the open.

Close the loop on one route

The founder selects one read-only route, runs the ledger, and ships that route only when startup stays quiet. Every other route waits. That restraint is what keeps today's bill at zero.

A founder who wants help with the rewrite can point MonkeyCode's free model access at the single flagged file, re-run the ledger, and confirm the free-server notes before any deploy command. The ledger, not the assistant, decides whether the route may leave the laptop.

One Model Call Per Delivery With a File Outbox

Dakota Wu — Thu, 08 Oct 2026 08:33:52 +0000

A solo webhook ships today only when the retry path cannot create a bill. One process and a local file can hold a demo. An AI patch that adds a broker, a hosted cache, or a fresh model call on every timeout cannot.

Cap the work in the repo first. Then publish the route. That order is the method, and it is stricter than a prompt that says "keep it cheap."

A public demo page is cheap to generate. The signup webhook behind it is where cost and retries hide. Host allowlists and recorded fixtures solve different failures. This note covers one delivery, one model call, and a file that remembers both after a restart.

Where the draft spends money

Generated handlers fail in a predictable shape. The route accepts a POST, a timeout fires, and a loop calls the model again. A second edit imports a queue client so the loop can be "more reliable." A third edit reads a region variable that a single process never needed.

Short patches. Large bills. The shape is the same even when the wording changes.

Three checks catch it before merge.

The HTTP handler writes an event file and returns. It does not call a model.
A later step may call the model once, then stores the result beside the event.
A retry loads the stored result. It does not get another model call, and it does not require a broker, a hosted cache, or a worker fleet.

If a draft cannot pass those checks, the feature waits. The founder does not upgrade hosting to rescue the draft.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. Free model access is relevant only as a drafting aid on the founder's laptop. The free server is relevant only as a place to run the fixture-backed process after the tests pass. Quotas, hardware, duration, model names, and permanence are omitted on purpose. No primary source for those figures was attached to this draft, and an unchecked numeric allowance should not be published as current fact.

Day-one decision table

Read the table before opening the generated diff. The Allow column is the cost class for today. The Reject column is what a helpful draft will often suggest. Take the Allow cell, or cut the job.

Job	Allow on day one	Reject on day one	Why
Accept a signed POST	One process, one port	Managed gateway	A single host can bind a port
Survive restart	Append-only JSON files	Paid queue or hosted cache	A file is enough for a solo demo
Stop double effects	Idempotency key in the file	External lock service	The key travels with the event
Classify the payload	One model call, then store it	Model call per retry	Retries must stay free
Prove the route	Fixture double, no socket	Live model calls in CI	CI must not drain an allowance
Notice failure	Log line and non-zero exit	Paid paging vendor	A founder can read a log today

A row that cannot be done in the Allow column is out of scope for this ship. That is a product cut, not a hosting upgrade.

Five steps, in order

The steps are mechanical. A comment in the pull request is not a substitute for any of them. Run them on the laptop before the free server sees the tree.

1. Pin the cost class

Write a one-line file and commit it. The preflight fails if that line changes.

printf 'zero\n' > cost_class.txt
git add cost_class.txt

The pin is dull on purpose. Dull controls survive a rushed afternoon better than a paragraph of review notes.

2. Split accept from classify

accept hashes the body, writes JSON, and returns. classify runs later. It increments a counter only when the result is empty, and it refuses to pass a budget of one.

# Proposal. Not run against a live host for this article.
import hashlib
import json
from pathlib import Path

ROOT = Path("outbox")
BUDGET = 1

def event_id(raw: bytes) -> str:
    return hashlib.sha256(raw).hexdigest()[:16]

def accept(raw: bytes) -> dict:
    ROOT.mkdir(exist_ok=True)
    eid = event_id(raw)
    path = ROOT / f"{eid}.json"
    if path.exists():
        return json.loads(path.read_text())
    record = {
        "id": eid,
        "body": raw.decode("utf-8"),
        "model_calls": 0,
        "result": None,
    }
    path.write_text(json.dumps(record))
    return record

def classify(eid: str, model) -> dict:
    path = ROOT / f"{eid}.json"
    record = json.loads(path.read_text())
    if record["result"] is not None:
        return record
    if record["model_calls"] >= BUDGET:
        raise RuntimeError("model budget exhausted")
    record["model_calls"] += 1
    record["result"] = model(record["body"])
    path.write_text(json.dumps(record))
    return record

The HTTP route may import accept only. A draft that calls classify inside the request function has already broken the budget, even if the import scanner is quiet.

3. Scan the diff for brokers

Keep the banned list local and short. Add a word only after a real draft uses it. The CLI below is the merge gate.

# Proposal scanner and CLI. Unexecuted example.
import sys
from pathlib import Path

BANNED = ("boto3", "sqs", "redis", "amqp", "celery", "kafka", "pubsub")

def scan(diff_text: str) -> list[str]:
    hits = []
    for line in diff_text.splitlines():
        if not line.startswith("+") or line.startswith("+++"):
            continue
        low = line.lower()
        for word in BANNED:
            if word in low:
                hits.append(word)
    return sorted(set(hits))

def cost_ok(text: str) -> bool:
    return text.strip() == "zero"

def main(argv: list[str]) -> int:
    if "--diff" not in argv or "--cost-class" not in argv:
        return 2
    diff_path = argv[argv.index("--diff") + 1]
    class_path = argv[argv.index("--cost-class") + 1]
    hits = scan(Path(diff_path).read_text())
    if hits or not cost_ok(Path(class_path).read_text()):
        print("rejected", ",".join(hits))
        return 2
    print("accepted")
    return 0

if __name__ == "__main__":
    raise SystemExit(main(sys.argv[1:]))

python preflight.py --diff changes.diff --cost-class cost_class.txt
echo "preflight_exit=$?"

Exit 0 means no banned import and a zero cost class. Exit 2 stops the merge. Do not override that exit because the patch looks small.

4. Prove the retry with a double

The test model counts calls. The second classify must not increment that count. Any drafting session, including one that uses MonkeyCode's free model access, stays outside this process. The test should pass on a laptop with the network disabled.

# Proposal test. Unexecuted example.
def test_second_classify_is_free(tmp_path, monkeypatch):
    monkeypatch.chdir(tmp_path)
    calls = {"n": 0}

    def model(body: str) -> str:
        calls["n"] += 1
        return "ok"

    payload = "{'type':'signup'}"
    rec = accept(payload.encode("ascii"))
    classify(rec["id"], model)
    again = classify(rec["id"], model)
    assert calls["n"] == 1
    assert again["result"] == "ok"

python -m unittest test_outbox.py -v

A failure here is a stop. Do not deploy a red tree to the free server to see what happens.

5. Boot fixtures, then one manual POST

Start with fixtures on. Confirm the health payload. Then send one real body from the founder's machine and read the outbox file. A missing file, a second model call, or a new import means roll back the process. It does not mean rewrite the cost class.

# Proposal health payload. Unexecuted example.
def health() -> dict:
    klass = Path("cost_class.txt").read_text().strip()
    return {"cost_class": klass, "model_calls": 0, "fixtures": True}

FIXTURES=1 python app.py
curl -fsS http://127.0.0.1:8080/health

Health should report a zero cost class and zero model calls before that manual POST. After the POST, the matching JSON file should show a model call count of 0 or 1, never 2.

Failure analysis

Four breaks are worth drilling before the route is public. Each one has the same response. Name it, keep the cost class, and cut scope.

Disk wipe comes first. A free server may drop local files on restart or redeploy. The outbox then forgets idempotency keys. Treat the demo as disposable, or wait until a durable disk is actually available. Do not fix a wipe by adding a hosted cache in the same patch.

Two processes are the second break. They will race on one directory. This design allows one process. A second instance is a new design, not a config flag, and it is outside the day-one table.

The truncated id is the third break. Sixteen hex characters are enough for a solo demo, not for a high-volume bus. If volume grows, lengthen the id. A paid lock service is not the first response to a short hash.

The fourth break is a crash after the counter increments and before the result is stored. The sample spends the budget and stores nothing. That is fail-closed. A founder who needs to retry a failed call must add an explicit error field and a separate rule. Silent re-entry into another model route is not that rule.

The free server is not a puzzle to outsmart. When a break shows up, the ship gets smaller.

Who should not use this

Skip the file outbox when more than one instance must run, when the payload is regulated data, or when a missed file is an unacceptable loss. Also skip it when the side effect cannot be stored and replayed. A zero-bill demo is not a compliance design, and free model access is not a throughput commitment.

Operators who need fan-out, multi-region delivery, or a retention guarantee should buy the queue and write that choice into the cost class file. Pretending a free process can imitate that stack wastes the afternoon this method is meant to save.

The next patch

Run the scanner on the diff before reading the generated explanation. If the scanner is empty and the unit test still shows one model call, the tree can move to the free server in fixture mode. If a broker import appears, delete the import and keep the file. Hosting does not get a vote until those two checks agree.

Founders who draft with MonkeyCode's free model access can run that same unittest on the laptop tree and again on the free-server checkout. Ship only when both call counts match. That comparison is the check worth keeping. Whatever the allowance is this week, it is not a design input.

Reject Remote Schema Refs Before a Solo API Ships

Dakota Wu — Thu, 24 Sep 2026 22:05:03 +0000

A solo founder can ship an AI-drafted HTTP API on the same day the idea appears and still keep the infrastructure bill at zero. The gate is local. It rejects remote schema references, rejects any servers host outside a loopback allowlist, and rejects documented examples that exceed a fixed byte cap. The check ends before a process opens a socket, and before a free-tier prompt is spent proving what a file already knows.

Surprise cost starts in the contract, not in the cloud console. A drafting session asked to complete the API will often insert an https:// $ref, a hosted mock, or a bulky example copied from a vendor page. The editor still looks offline. The next resolver does not.

The bill hides in three fields

Remote $ref values fail in two directions. Offline, the laptop cannot fetch the schema, so the build breaks on a train. Online, the fetched host can add a key, a quota wall, or a paid tier without any change to application code. A root-local #/components/... reference stays inside one file. That is the reproducible choice.

servers is the second leak. One URL aimed at a metered mock, a gateway, or a vendor sandbox invents a host the founder never priced. Loopback is enough to ship today. A public base URL can live in a second file that is not the cost boundary this gate enforces.

Example payloads are the third leak. Large samples burn time, context, and any free request allowance long before the handler exists. A hard cap on example bytes keeps the contract small enough to reread. The 2048-byte number in the proposal is local policy. It is not a measured limit of any hosted plan.

Clear failures matter more than clever ones. Each error line names the JSON path and the rule that fired. A founder debugging at midnight should not have to infer whether the gate disliked a host, a ref, or a missing operationId.

Decision table

Spec signal	Gate	Why it matters on a zero bill
`$ref` starts with `http://`, `https://`, or `//`	Reject	Resolution can bill or break offline
`$ref` starts with `#/`	Allow	Stays inside the same JSON file
Any other `$ref`	Reject	File-relative refs wander across directories
`servers[].url` is `http` on `127.0.0.1` or `localhost`	Allow	Same-day loopback only
Any other server host or scheme	Reject	Stops an invented paid host
JSON size of an `example` over 2048 bytes	Reject	Keeps samples small enough to reread
Path operation missing `operationId`	Reject	Fixtures need a stable name
URL mentioned only in `description`	Allow	Prose is not a fetch

Steps

1. Freeze the allowlist before any draft

Write allowed hosts into the checker, not into a chat log. Two names are enough on day one: 127.0.0.1 and localhost. A longer list is a product decision. It should arrive as a reviewed diff, not as a model suggestion that a sandbox would be more realistic.

2. Demand OpenAPI JSON

The Python standard library parses JSON. It does not parse YAML. A zero-install gate should refuse a spec that needs a third-party parser before it can be trusted. Ask the drafting session for JSON only. Treat a YAML blob as unfinished, even if the prose is polished.

3. Run the budget gate

Save the proposal as spec_budget.py. Exit status 0 means the file may stay in the repo. Any other status means the spec does not leave the laptop. Do not override the gate to unblock a demo.

4. Bind one fixture to each operationId

Coverage here is a name check, not a live call. A fixture file maps operationId to a path and a status code. Missing names fail the binder. Recording fixtures by clicking a hosted mock would spend the budget this workflow refuses to open.

5. Smoke-test loopback, or stop

Start the founder's own process on 127.0.0.1 when that process exists. Cap the probe at two seconds. If the handler is not written yet, ship the spec, the gate, and the fixture binder. Those three files are a complete same-day result. A staging cluster is not part of the definition of done.

Same-day file set

A same-day ship, under this method, is four files and two commands. openapi.json holds the contract. spec_budget.py enforces the table. bind_fixtures.py checks names. fixtures.json stores path and status only. No container registry, no remote state, and no secret store is required to call the work finished.

That definition will feel small to a team with a platform group. It is the point. A solo founder who adds a hosted log drain just for the demo has already left the zero-bill path. Add that drain later, in a diff that names the host on purpose.

Proposal checker

This script is an unexecuted proposal. It was not run against a live account, and it claims no timing result. Python 3.9 or newer is assumed. No third-party package is imported.

#!/usr/bin/env python3
'''Local OpenAPI budget gate. Proposal only; not executed for this article.'''

import json
import sys
from urllib.parse import urlparse

ALLOWED_HOSTS = {'127.0.0.1', 'localhost'}
MAX_EXAMPLE_BYTES = 2048
HTTP_METHODS = {
    'get', 'post', 'put', 'patch', 'delete', 'head', 'options', 'trace',
}

def fail(errors):
    for item in errors:
        print(f'spec-budget: {item}', file=sys.stderr)
    return 1 if errors else 0

def walk(node, path, errors):
    if isinstance(node, dict):
        ref = node.get('$ref')
        if isinstance(ref, str):
            if ref.startswith(('http://', 'https://', '//')):
                errors.append(f'{path}: remote $ref blocked: {ref}')
            elif not ref.startswith('#/'):
                errors.append(
                    f'{path}: only root-local #/ refs are allowed: {ref}'
                )
        if 'example' in node:
            try:
                encoded = json.dumps(
                    node['example'], separators=(',', ':')
                ).encode('utf-8')
            except TypeError:
                errors.append(f'{path}: example is not JSON-serializable')
            else:
                size = len(encoded)
                if size > MAX_EXAMPLE_BYTES:
                    errors.append(
                        f'{path}: example is {size} bytes; cap is {MAX_EXAMPLE_BYTES}'
                    )
        for key, value in node.items():
            walk(value, f'{path}.{key}', errors)
    elif isinstance(node, list):
        for index, value in enumerate(node):
            walk(value, f'{path}[{index}]', errors)

def check_servers(doc, errors):
    servers = doc.get('servers')
    if not isinstance(servers, list) or not servers:
        errors.append('servers: at least one loopback URL is required')
        return
    for index, server in enumerate(servers):
        url = server.get('url') if isinstance(server, dict) else None
        parsed = urlparse(url or '')
        if parsed.scheme != 'http' or parsed.hostname not in ALLOWED_HOSTS:
            errors.append(
                f'servers[{index}]: only http loopback is allowed, got {url!r}'
            )

def check_operation_ids(doc, errors):
    paths = doc.get('paths')
    if not isinstance(paths, dict) or not paths:
        errors.append('paths: at least one path is required')
        return
    for path, item in paths.items():
        if not isinstance(item, dict):
            errors.append(f'paths.{path}: expected an object')
            continue
        for method, op in item.items():
            if method.lower() not in HTTP_METHODS or not isinstance(op, dict):
                continue
            if not op.get('operationId'):
                errors.append(f'paths.{path}.{method}: missing operationId')

def main():
    if len(sys.argv) != 2:
        print('usage: spec_budget.py openapi.json', file=sys.stderr)
        return 2
    with open(sys.argv[1], encoding='utf-8') as handle:
        doc = json.load(handle)
    if not isinstance(doc, dict):
        print('spec-budget: root must be an object', file=sys.stderr)
        return 1
    errors = []
    check_servers(doc, errors)
    check_operation_ids(doc, errors)
    walk(doc, '$', errors)
    return fail(errors)

if __name__ == '__main__':
    raise SystemExit(main())

The illustration below should fail. It is synthetic. It is not a captured third-party document.

{
  "openapi": "3.0.3",
  "info": {"title": "demo", "version": "0.0.1"},
  "servers": [{"url": "https://mock.example.test/v1"}],
  "paths": {
    "/health": {
      "get": {
        "responses": {
          "200": {
            "description": "ok",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "https://schemas.example.test/Health.json"
                }
              }
            }
          }
        }
      }
    }
  }
}

Commands to keep next to the script:

python3 spec_budget.py openapi.json
printf 'gate_exit=%s\n' "$?"
curl --fail --silent --show-error --max-time 2 http://127.0.0.1:8080/health

The curl line assumes a local process the founder already chose to start. Nothing in this article records a live response from that command.

Proposal fixture binder

The binder is also unexecuted. It only checks that every operationId has a row. It does not send HTTP.

#!/usr/bin/env python3
'''Fixture name binder. Proposal only; not executed for this article.'''

import json
import sys

HTTP_METHODS = {
    'get', 'post', 'put', 'patch', 'delete', 'head', 'options', 'trace',
}

def main():
    if len(sys.argv) != 3:
        print('usage: bind_fixtures.py openapi.json fixtures.json', file=sys.stderr)
        return 2
    with open(sys.argv[1], encoding='utf-8') as handle:
        spec = json.load(handle)
    with open(sys.argv[2], encoding='utf-8') as handle:
        fixtures = json.load(handle)
    missing = []
    for path, item in (spec.get('paths') or {}).items():
        if not isinstance(item, dict):
            continue
        for method, op in item.items():
            if method.lower() not in HTTP_METHODS or not isinstance(op, dict):
                continue
            op_id = op.get('operationId')
            if op_id and op_id not in fixtures:
                missing.append(op_id)
    if missing:
        print('missing fixtures: ' + ', '.join(missing), file=sys.stderr)
        return 1
    print('fixtures cover every operationId')
    return 0

if __name__ == '__main__':
    raise SystemExit(main())

A matching fixture file for a spec that already passed the host and ref rules:

{
  "getHealth": {"path": "/health", "status": 200}
}

python3 spec_budget.py openapi.json && python3 bind_fixtures.py openapi.json fixtures.json

Run the binder only after the budget gate exits 0. A spec with a remote ref should never reach fixture review.

Where free model access fits

Disclosure: This article was prepared as part of MonkeyCode's product outreach.

The operator describes MonkeyCode as an open-source coding project and states that free model access and a free server option are available. Those two availability claims are operator-supplied for this draft. No model name, token quota, hardware shape, or end date is stated here, because those details were not checked against a primary source dated 2026-09-25. Confirm current terms on the project site before treating the free path as a plan.

Free model access belongs at a single step: turn the decision table into a first JSON spec and a first patch against the checker. Put the allowlist and the byte cap in the prompt. Forbid remote $ref values in that same prompt. Once the files exist, stop the session. Re-running the scripts costs nothing and does not require the model to stay up.

A free server is optional, and it is manual. Use it only as a click-through after the local gate has passed. Do not copy its hostname into the gated servers array. The build should still pass with the network off. If capacity, fairness rules, or signup terms are unclear, skip the hosted click-through. The local files remain the ship.

Readers who want that draft pass can paste the decision table into MonkeyCode's free model access, require OpenAPI JSON, and run spec_budget.py before opening any hosted demo. The checker never calls the product.

Who should skip this gate

A team that vendors public JSON Schema through a pinned internal mirror needs a mirror policy, not a blanket ban. A product that must publish a public base URL in the same document CI validates should split the public file from the gated file, rather than weakening the allowlist. Founders who need full semantic lint, OAuth flow coverage, or a formal uptime target should not pretend a standard-library walk is that system. Anyone who cannot accept free-tier variance should not put a launch date on the free path. The checker does not need the product in order to be useful.

Limits

The walker is structural. A URL that appears only in a description is allowed, because the gate does not fetch prose. A sloppy implementation can still call a host the spec never named. This file check does not watch sockets. Add a separate runtime host allowlist if the process might drift from the contract. The byte cap is local policy, not a provider fair-use ceiling. Nested examples are visited, but format, nullable, and discriminators are not evaluated. Literal ::1 is outside the day-one allowlist until a founder adds it on purpose. WebSocket, gRPC, and GraphQL contracts are out of scope. No pass rate is claimed. The proposals were not executed for this article.

Ship the contract on loopback. Fail remote schema imports in the file itself. Spend a free model pass on the first draft only, then let the scripts keep the bill at zero.

Score Tool-Call Origins Before the Indie API Opens a Socket

Dakota Wu — Wed, 23 Sep 2026 17:23:32 +0000

A solo founder can keep an agent-drafted API at a zero bill by scoring every host inside tool-call arguments before the process is allowed to open a socket. Function-calling JSON is not a comment. It is an origin list, and unpaid SaaS hostnames show up there first.

The rest of this article is a concrete ledger: a small classifier, a fixture, and a fail-closed exit code. Remove any later product mention and the method still works.

Tool calls leak origins

Most coding agents emit a stable shape when they call an API. A name. A JSON object. Sometimes a base_url. Sometimes a full https:// string buried in a header map.

That is enough to create a metered invoice once a demo is left running. The founder who needs to ship today should treat the dump as the source of truth. Logs after the fact are late. DNS after the fact is late. The arguments are available before the TCP handshake.

The dump shape matches common tool-calling records used by hosted model APIs. Field names name and arguments are documented in OpenAI's function calling guide. A typical two-line dump looks like this.

{"id":"call_01","name":"http.request","arguments":{"method":"POST","url":"https://api.stripe.com/v1/payment_intents","json":{"amount":499}}}
{"id":"call_02","name":"http.request","arguments":{"method":"GET","url":"http://127.0.0.1:8787/health"}}

Call 01 is a paid origin. Call 02 is local. The ledger's only job is to say so, in a way a shell can fail.

Origin classes

Keep three classes. Do not add a fourth until a real need appears.

Class	Meaning	Action
allow	loopback, localhost, explicit local hostname	keep
deny	known metered product hosts	fail the session
unknown	everything else	fail closed, then stub

The deny list is a text file the founder edits. It is not a market map. It is the set of hostnames that have already surprised this project.

# allow_origins.txt
127.0.0.1
localhost
::1
api.local.test

# deny_origins.txt
api.stripe.com
api.openai.com
api.sendgrid.com
hooks.slack.com
*.amazonaws.com
*.googleapis.com

Wildcards are suffix matches. They are crude. Crude is the point. A solo ship does not need a full public-suffix parser on day one.

Workflow

Follow the steps in order. Skip none.

Capture the dump. Configure the agent, or a thin proxy in front of it, to append every tool call as one JSON object per line. Save the file as agent_tools.jsonl. Keep one object per line so later diffs stay small.
Freeze the two lists. Commit allow_origins.txt and deny_origins.txt next to the API. A later agent patch that adds a hostname must also change a list, which makes the change visible in review.
Run the ledger. python3 toolcall_ledger.py --dump agent_tools.jsonl --allow allow_origins.txt --deny deny_origins.txt. Exit 0 means every extracted origin is on the allow list. Exit 2 means deny or unknown.
Read the table, not the prose. The script prints call_id, origin, and class. The founder decides whether an unknown origin is a missed allow entry or a stub candidate. Guessing is not a class.
Stub unknowns. Replace the live URL in the tool arguments with http://127.0.0.1:8787/... and implement the smallest JSON response the demo needs. Re-run the ledger. Repeat until exit 0.
Only then start the API process. If a new tool call appears at runtime, append it to the dump and run the ledger again. The demo does not get a special case.

The ledger

The script below is standard-library Python 3. A founder can run it as-is on a laptop. It does not execute tool calls. It only classifies origins already present in the dump.

#!/usr/bin/env python3
"""Classify hosts found in agent tool-call arguments. Exit 2 on deny/unknown."""

from __future__ import annotations

import argparse
import ipaddress
import json
import re
import sys
from pathlib import Path
from urllib.parse import urlparse

URL_RE = re.compile(r"https?://[^\s'<>]+", re.I)
HOSTISH_KEYS = {"url", "uri", "base_url", "baseurl", "host", "hostname", "endpoint"}


def load_list(path: Path) -> list[str]:
    if not path.exists():
        return []
    lines = []
    for raw in path.read_text(encoding="utf-8").splitlines():
        line = raw.strip()
        if not line or line.startswith("#"):
            continue
        lines.append(line.lower())
    return lines


def walk(obj, bag: list[str]) -> None:
    if isinstance(obj, dict):
        for key, val in obj.items():
            if str(key).lower() in HOSTISH_KEYS and isinstance(val, str):
                bag.append(val)
            walk(val, bag)
    elif isinstance(obj, list):
        for item in obj:
            walk(item, bag)
    elif isinstance(obj, str):
        bag.extend(URL_RE.findall(obj))


def origin_of(value: str) -> str | None:
    text = value.strip()
    if not text:
        return None
    if "://" not in text:
        text = "http://" + text
    parsed = urlparse(text)
    host = (parsed.hostname or "").lower().rstrip(".")
    return host or None


def suffix_match(host: str, pattern: str) -> bool:
    if pattern.startswith("*"):
        root = pattern[2:] if pattern.startswith("*.") else pattern.lstrip("*")
        return host == root or host.endswith("." + root)
    return host == pattern


def is_loopback(host: str) -> bool:
    if host in {"localhost", "localhost.localdomain"}:
        return True
    try:
        return ipaddress.ip_address(host).is_loopback
    except ValueError:
        return False


def classify(host: str, allow: list[str], deny: list[str]) -> str:
    if is_loopback(host) or any(suffix_match(host, p) for p in allow):
        return "allow"
    if any(suffix_match(host, p) for p in deny):
        return "deny"
    return "unknown"


def main() -> int:
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument("--dump", required=True, type=Path)
    parser.add_argument("--allow", required=True, type=Path)
    parser.add_argument("--deny", required=True, type=Path)
    args = parser.parse_args()

    allow = load_list(args.allow)
    deny = load_list(args.deny)
    worst = 0
    print("call_id\torigin\tclass")

    for line_no, raw in enumerate(args.dump.read_text(encoding="utf-8").splitlines(), 1):
        if not raw.strip():
            continue
        rec = json.loads(raw)
        call_id = str(rec.get("id") or rec.get("tool_call_id") or f"line-{line_no}")
        bag: list[str] = []
        walk(rec.get("arguments", rec), bag)
        origins = []
        seen = set()
        for item in bag:
            host = origin_of(item)
            if host and host not in seen:
                seen.add(host)
                origins.append(host)
        if not origins:
            print(f"{call_id}\t-\tno-origin")
            continue
        for host in origins:
            klass = classify(host, allow, deny)
            print(f"{call_id}\t{host}\t{klass}")
            if klass != "allow":
                worst = 2
    return worst


if __name__ == "__main__":
    sys.exit(main())

Save the earlier two-line dump as agent_tools.jsonl and run the classifier.

python3 toolcall_ledger.py \
  --dump agent_tools.jsonl \
  --allow allow_origins.txt \
  --deny deny_origins.txt
echo "ledger_exit:$?"

Expected rows: api.stripe.com classified deny, 127.0.0.1 classified allow, process exit 2. That is the correct failure for a ship-today demo that must not touch a card network.

Replace the Stripe URL with http://127.0.0.1:8787/v1/payment_intents in the dump. Run the command again. Exit 0 is the only green light.

A local stub the demo can hit

The stub is deliberately small. It is not a processor emulator. It is a single POST that returns the JSON the UI already expects.

#!/usr/bin/env python3
from http.server import BaseHTTPRequestHandler, HTTPServer
import json

class Handler(BaseHTTPRequestHandler):
    def do_POST(self):
        if self.path != "/v1/payment_intents":
            self.send_error(404)
            return
        body = json.dumps({"id": "pi_local_0", "status": "succeeded"}).encode()
        self.send_response(200)
        self.send_header("Content-Type", "application/json")
        self.send_header("Content-Length", str(len(body)))
        self.end_headers()
        self.wfile.write(body)

    def log_message(self, fmt, *args):
        return

if __name__ == "__main__":
    HTTPServer(("127.0.0.1", 8787), Handler).serve_forever()

Bind loopback only. Binding 0.0.0.0 turns a laptop stub into an accidental public service. Start it in a second terminal, then point the rewritten tool call at it.

python3 local_intent_stub.py
curl -sS -X POST http://127.0.0.1:8787/v1/payment_intents -d '{}'

The founder who needs a shareable demo URL can put the same handler on a free server later. The ledger still has to pass against that hostname. That means the hostname must be added to allow_origins.txt on purpose, not because an agent invented it.

Optional rewrite with a free coding model

Unknown origins still need a human decision. A free coding model can propose the stub path. It cannot be trusted to classify.

Disclosure: This article was prepared as part of MonkeyCode's product outreach.

MonkeyCode offers free model access and a free server option. Those two facts are the only product claims used here. A founder can paste the unknown rows plus the local handler into a free model and ask for a drop-in URL rewrite. The answer is a proposal. Feed the rewritten dump through toolcall_ledger.py again. If the model invents a new hostname, the ledger fails. That second pass is the control.

The free server option is useful only after exit 0, when someone else must hit the stub without a paid VPS. It is not a substitute for the allow list. Metered origins remain deny.

Founders who already have the ledger going green on a laptop can try that rewrite-and-serve path on MonkeyCode. No other step in this article depends on it.

Labeled prompt for the rewrite step, unexecuted until a human pastes it:

The ledger printed unknown or deny rows. Rewrite each tool-call URL
to http://127.0.0.1:8787/<same-path> and keep JSON field names.
Do not add hosts. Return only the rewritten jsonl lines.

Limits

The classifier does not see hosts hidden in base64, protobuf, or a second hop after an HTTP redirect. It does not expand environment variables. A tool argument of "url": "$BILLING_BASE" will look origin-free and print no-origin. That is a gap. Put real URLs in the dump, or extend walk() to resolve a documented env file.

Suffix rules mis-handle some public suffixes. foo.s3.amazonaws.com matches *.amazonaws.com. A research hostname that happens to share a suffix will be denied. For a solo demo that is acceptable. For a platform company it is not.

The method also does not measure token spend, latency, or correctness of the stub. It answers one question: did this tool-call dump name a host the founder did not allow.

Who should not use this

Skip the ledger if the product already has an approved vendor list and a paid egress proxy. Skip it if the traffic is regulated health, card processing, or anything that needs a real processor rather than pi_local_0. Skip it if several services must share origins. A text file per repo will drift.

The approach is for a single founder who will ship a demo today, keep the bill at zero, and accept that the payment intent is fake until a later, deliberate integration. A green ledger is not production hardening. It is a gate that stops an agent from choosing a metered origin while the founder is still on a laptop.

Freeze the Agent Tool Catalog at Cost Class Zero

Dakota Wu — Tue, 22 Sep 2026 15:37:50 +0000

A solo founder can ship an agent-backed indie API the same day if every tool the model is allowed to invoke is classified as local or free before the process starts. Vendor SDKs, managed queues, and “temporary” paid search calls do not belong in that catalog. The workflow below freezes the catalog in a file the merge cannot ignore, dispatches every call through a dry-run ledger, and rejects a build when a new tool arrives without a zero-cost class.

This is not a host allowlist and not a socket probe. It is a catalog contract for tool calling: names, cost classes, call budgets, and a local timing bound. The agent may propose helpers. The process only runs the ones that already sit in the freeze file.

The constraint an indie agent actually has

Tool calling is how an AI-drafted handler reaches the rest of the world. A model that can register charge_card, embed_via_vendor, or publish_to_managed_queue will do so with confident names and tidy type hints. The founder who needs a bill of zero cannot review that as style. The founder has to treat the tool list as a billing surface.

Local functions are cheap. In-process SQLite is cheap. A static JSON file on disk is cheap. A second cloud account is not. The catalog freeze makes that ranking explicit so an agent patch cannot grow a side effect by adding one more @tool decorator.

Accept the limits up front. A frozen catalog will refuse useful paid APIs. That is the point for a same-day indie ship. Teams whose product is the paid vendor should not use this pattern.

Cost classes, not vibes

Three classes are enough for a laptop-scale API.

local — pure Python or SQLite, no outbound network, no subprocess.
free_net — an operator-named endpoint that the founder has already confirmed carries no invoice. The name is allowlisted in the freeze file, not inferred from a hostname heuristic at runtime.
forbidden — anything else, including “we will swap it later.”

A fourth informal class, unknown, is treated as forbidden. Silence is not a discount.

The freeze file is the source of truth. Code that registers a tool missing from the file is a failed build, even if the function body looks harmless.

# tools.freeze.toml — commit this; do not generate it in CI
[meta]
api = "indie-agent-api"
max_tools = 12
max_calls_per_request = 8

[tools.now_iso]
cost_class = "local"
max_calls = 4
max_ms = 20

[tools.lookup_plan]
cost_class = "local"
max_calls = 2
max_ms = 40

[tools.fetch_public_status]
cost_class = "free_net"
allow_url = "https://status.example.invalid/health"
max_calls = 1
max_ms = 200

Keep max_tools small. An indie agent that needs thirty tools is usually a disguised integration platform. Ship the twelve that close the demo. Leave the rest unregistered.

Step 1 — Load the freeze before the app object exists

The catalog must load in a module that imports no vendor SDK. Parse TOML, then refuse to boot if the file is missing, if two tools share a name, or if any free_net row lacks an exact allow_url.

# catalog.py
from __future__ import annotations

import tomllib
from dataclasses import dataclass
from enum import Enum
from pathlib import Path
from typing import Mapping

class CostClass(str, Enum):
    LOCAL = "local"
    FREE_NET = "free_net"
    FORBIDDEN = "forbidden"

@dataclass(frozen=True)
class ToolRow:
    name: str
    cost_class: CostClass
    max_calls: int
    max_ms: int
    allow_url: str | None

class CatalogError(RuntimeError):
    pass

def load_freeze(path: Path) -> Mapping[str, ToolRow]:
    raw = tomllib.loads(path.read_text(encoding="utf-8"))
    rows: dict[str, ToolRow] = {}
    for name, spec in raw["tools"].items():
        cost = CostClass(spec["cost_class"])
        if cost is CostClass.FORBIDDEN:
            raise CatalogError(f"{name} is frozen as forbidden")
        url = spec.get("allow_url")
        if cost is CostClass.FREE_NET and not url:
            raise CatalogError(f"{name} needs an exact allow_url")
        if cost is CostClass.LOCAL and url:
            raise CatalogError(f"{name} is local and must not carry a URL")
        rows[name] = ToolRow(
            name=name,
            cost_class=cost,
            max_calls=int(spec["max_calls"]),
            max_ms=int(spec["max_ms"]),
            allow_url=url,
        )
    if len(rows) > int(raw["meta"]["max_tools"]):
        raise CatalogError("freeze exceeds max_tools")
    return rows

Boot order matters. Load the freeze, then import handlers. The reverse order lets a decorator register a tool the freeze never saw.

Step 2 — Register implementations against named rows only

Handlers do not self-register. A tiny registry maps freeze names to callables. An extra function on disk is fine. An extra name in the running map is not.

# registry.py
from collections.abc import Callable
from typing import Any

from catalog import CatalogError, ToolRow

Impl = Callable[..., Any]

class Registry:
    def __init__(self, freeze: dict[str, ToolRow]) -> None:
        self.freeze = freeze
        self._impls: dict[str, Impl] = {}

    def bind(self, name: str, fn: Impl) -> None:
        if name not in self.freeze:
            raise CatalogError(f"refusing unbound tool {name!r}")
        if name in self._impls:
            raise CatalogError(f"duplicate bind for {name!r}")
        self._impls[name] = fn

    def ready(self) -> None:
        missing = sorted(set(self.freeze) - set(self._impls))
        extra = sorted(set(self._impls) - set(self.freeze))
        if missing or extra:
            raise CatalogError(f"catalog skew missing={missing} extra={extra}")

The ready() call sits next to app = FastAPI(...) or the Flask factory. If it raises, the process does not listen. A half-wired agent is worse than a crash at import time.

Step 3 — Dispatch through a dry-run ledger

Live tool calling burns retries. Models repeat a failing call with a slightly different payload. An indie process needs a per-request ledger: which tool, how many times, whether the call was a dry run, and whether the timing bound broke.

Label the following as a proposed in-process dispatcher, not a measured production runtime.

# dispatch.py
from __future__ import annotations

import time
from dataclasses import dataclass, field
from typing import Any

from catalog import CostClass, ToolRow
from registry import Registry

@dataclass
class LedgerEntry:
    name: str
    dry_run: bool
    elapsed_ms: float
    ok: bool
    detail: str

@dataclass
class RequestLedger:
    max_calls: int
    entries: list[LedgerEntry] = field(default_factory=list)

    def count(self, name: str) -> int:
        return sum(1 for e in self.entries if e.name == name)

class DispatchError(RuntimeError):
    pass

class Dispatcher:
    def __init__(self, registry: Registry, *, dry_run: bool) -> None:
        self.registry = registry
        self.dry_run = dry_run

    def call(self, ledger: RequestLedger, name: str, **kwargs: Any) -> Any:
        if len(ledger.entries) >= ledger.max_calls:
            raise DispatchError("request call budget exhausted")
        row: ToolRow = self.registry.freeze[name]
        if ledger.count(name) >= row.max_calls:
            raise DispatchError(f"{name} exceeded max_calls")
        if self.dry_run:
            ledger.entries.append(
                LedgerEntry(name, True, 0.0, True, "dry-run skip")
            )
            return {"dry_run": True, "tool": name, "kwargs": kwargs}
        started = time.perf_counter()
        try:
            result = self.registry._impls[name](**kwargs)
        except Exception as exc:  # local tools must fail visible
            elapsed = (time.perf_counter() - started) * 1000
            ledger.entries.append(
                LedgerEntry(name, False, elapsed, False, type(exc).__name__)
            )
            raise
        elapsed = (time.perf_counter() - started) * 1000
        ok = elapsed <= row.max_ms
        ledger.entries.append(
            LedgerEntry(name, False, elapsed, ok, "slow" if not ok else "ok")
        )
        if not ok:
            raise DispatchError(f"{name} took {elapsed:.1f}ms > {row.max_ms}ms")
        if row.cost_class is CostClass.FREE_NET:
            url = kwargs.get("url") or kwargs.get("endpoint")
            if url != row.allow_url:
                raise DispatchError(f"{name} url is not the frozen allow_url")
        return result

Dry-run is the default in unit tests and in any “agent proposed a plan” path. Live dispatch is opt-in behind an environment flag the founder sets on the laptop, not a flag an agent patch can flip in source.

export INDIE_TOOL_LIVE=0   # dry-run ledger only
# export INDIE_TOOL_LIVE=1  # set by the founder, never by a generated .env

Step 4 — Keep implementations boring

Local tools should look like this: no httpx, no SDK import, no subprocess.

# tools_local.py
from datetime import datetime, timezone
from pathlib import Path
import json

PLANS = Path(__file__).with_name("plans.json")

def now_iso() -> dict[str, str]:
    return {"now": datetime.now(timezone.utc).isoformat()}

def lookup_plan(plan_id: str) -> dict[str, object]:
    rows = json.loads(PLANS.read_text(encoding="utf-8"))
    for row in rows:
        if row["id"] == plan_id:
            return row
    return {"id": plan_id, "missing": True}

A free_net tool, if it exists at all, takes no URL from the model. It uses the frozen URL as a constant.

# tools_net.py — optional; omit entirely for a stricter ship
from catalog import ToolRow

def make_status_fetcher(row: ToolRow):
    allowed = row.allow_url

    def fetch_public_status() -> dict[str, object]:
        # urllib is used only against the freeze-file constant.
        from urllib.request import urlopen
        with urlopen(allowed, timeout=1.5) as resp:  # labeled example
            return {"status": resp.status, "url": allowed}

    return fetch_public_status

If the demo does not need a network check, delete free_net from the freeze. Zero network is easier to reason about than one “safe” URL.

Step 5 — CI that diffs the freeze, not the prose

Comments in a pull request will not stop a new tool. A job that compares the freeze file, the binds, and a static import scan will.

Proposed checks, to be run on the founder’s machine or any CI the founder already pays nothing for:

python -c "from catalog import load_freeze; load_freeze(__import__('pathlib').Path('tools.freeze.toml'))"
Bind every implementation and call registry.ready().
Fail if git diff introduces openai, stripe, boto3, google.cloud, redis, or celery in files that also import the dispatcher.
Run the dry-run test below.

# test_catalog.py
from pathlib import Path

from catalog import load_freeze
from dispatch import Dispatcher, RequestLedger
from registry import Registry
from tools_local import lookup_plan, now_iso

FREEZE = Path("tools.freeze.toml")

def build_registry() -> Registry:
    freeze = dict(load_freeze(FREEZE))
    freeze.pop("fetch_public_status", None)  # demo without net
    # A stricter test keeps only local rows.
    local = {k: v for k, v in freeze.items() if v.cost_class.value == "local"}
    reg = Registry(local)
    reg.bind("now_iso", now_iso)
    reg.bind("lookup_plan", lookup_plan)
    reg.ready()
    return reg

def test_dry_run_never_touches_lookup_disk(tmp_path, monkeypatch):
    reg = build_registry()
    disp = Dispatcher(reg, dry_run=True)
    ledger = RequestLedger(max_calls=8)
    out = disp.call(ledger, "lookup_plan", plan_id="pro")
    assert out["dry_run"] is True
    assert ledger.entries[0].dry_run is True

def test_live_lookup_stays_under_bound():
    reg = build_registry()
    disp = Dispatcher(reg, dry_run=False)
    ledger = RequestLedger(max_calls=8)
    row = disp.call(ledger, "lookup_plan", plan_id="missing")
    assert row["missing"] is True
    assert ledger.entries[0].ok is True

def test_budget_stops_retry_storm():
    reg = build_registry()
    disp = Dispatcher(reg, dry_run=True)
    ledger = RequestLedger(max_calls=3)
    for _ in range(3):
        disp.call(ledger, "now_iso")
    try:
        disp.call(ledger, "now_iso")
        raise AssertionError("budget should have tripped")
    except Exception as exc:
        assert "budget" in str(exc)

The live timing assertion is a smoke bound for in-process work. It is not an API load test and not a p95 claim about production. If lookup_plan grows into a remote call, the bound should trip, and the freeze should lose that row until the work is local again.

Decision table for a same-day ship

Agent proposal	Cost class	Action
Read `plans.json`	`local`	Bind and freeze
Write SQLite row	`local`	Bind; keep WAL on the laptop
`httpx.get` to a URL the model supplies	`forbidden`	Leave unregistered
Managed queue publish	`forbidden`	Replace with a disk spool
Operator-confirmed zero-invoice health URL	`free_net`	Freeze the exact URL
Embedding vendor	`forbidden`	Precompute a local file
Retry the same tool 30 times	n/a	Ledger `max_calls` stops it

The table is the product decision. The code only enforces it.

Where a free coding box fits

Drafting the freeze file, the dispatcher, and the tests still costs tokens and a machine. A solo founder who wants that loop without standing up a billed cloud workspace can do the drafting on MonkeyCode’s free model access and free server option, then run the same pytest on the laptop before anything listens on a public port. Disclosure: This article was prepared as part of MonkeyCode's product outreach. The catalog contract above does not depend on that environment; it runs as ordinary Python. Founders who already have a local toolchain can ignore the server and keep the freeze file anyway.

Do not treat “free” as unlimited, permanent, or fast enough for a public launch. Copy the artifact out. Run it where the founder can see the ledger.

Limitations

The freeze is a convention enforced by import order, a TOML file, and tests. It is not a sandbox. A local tool that calls os.system can still create a bill. A free_net URL can start charging if the operator’s assumption about the endpoint was wrong. Timing bounds on a quiet laptop say nothing about a noisy VPS.

DNS, redirects, and HTML meta refresh are out of scope. The allow_url check is string equality on the argument the dispatcher sees, not a proof of the bytes on the wire. Multi-tenant products, PCI flows, and anything that must call a paid vendor to exist should not pretend a cost class of local is a control boundary.

Retry budgets are per request object. They do not coordinate across processes. Two gunicorn workers can double the side effects unless the implementation is idempotent on disk.

Who should not use this

Skip the pattern if the API’s value is the paid integration. Skip it if a compliance team needs syscall isolation rather than a TOML file. Skip it if the founder cannot name every tool in one screen. Skip it for load testing of public endpoints; the max_ms field is a local tripwire, not a capacity plan.

Use it when the job is to ship a demo today, keep the invoice at zero, and make the next agent patch argue with a freeze file instead of with a credit card.

Fail the Merge If the Diff Invents a Billable Host

Dakota Wu — Mon, 21 Sep 2026 13:59:28 +0000

A weekend API stays unbilled only if every new hostname in the diff is named before merge. The gate is static. It reads git diff, writes a receipt, and fails when a paid host, a cloud SDK import, or a secret-shaped environment variable appears without an allow line. Runtime probes help later. They do not replace an inventory of what the model just typed.

Solo founders lose money in the gap between “the agent finished” and “someone read the patch.” That gap is where card processors, telemetry exporters, and managed queues show up as helpful defaults. A one-sitting inventory keeps the bill at zero without pretending the model reviewed itself.

What the receipt must record

The receipt is a JSON file printed in CI and committed next to the patch. Four fields are enough for a solo binary.

new_hosts — hostnames and URL schemes found in added lines
new_imports — top-level names introduced by import / from
new_env — os.environ keys and .env-style assignments
signer — a local identity string the founder types, not a cloud token

Anything else is ceremony. The founder either allows a host in allow_hosts.txt or the merge dies.

Allow list, deny list, decision table

Keep the paid surface in boring text files. Update them when a vendor becomes a real milestone, not when a model suggests one.

# allow_hosts.txt — loopback and docs only
localhost
127.0.0.1
example.com

# deny_hosts.txt — billable by default
api.stripe.com
api.openai.com
*.amazonaws.com
*.googleapis.com
*.azure.com
sentry.io
api.sendgrid.com
api.twilio.com

Wildcards are suffix rules, not DNS. The parser is allowed to be crude. Obfuscated hosts are out of scope for a weekend gate.

Diff finding	Default	Solo founder action
Hostname on the deny list	Fail	Revert the hunk or postpone the paid milestone
New paid SDK import	Fail	Rewrite against stdlib, SQLite, or a local file
`KEY` / `TOKEN` / `SECRET` env	Fail	Keep secrets off the branch
`localhost` / `127.0.0.1` URL	Pass	Still bind loopback in smoke
Docs host `example.com`	Pass	Do not copy it into runtime config

The table is the contract. Code below only enforces it.

A parser the founder can read

The script is a single-file gate. It shells out to git diff against main, classifies added lines, and writes RECEIPT.json. Treat it as a local, reproducible example, not a published benchmark.

#!/usr/bin/env python3
"""inventory_diff.py — fail if a git diff invents billable surface."""
from __future__ import annotations

import json
import os
import re
import subprocess
import sys
from pathlib import Path

ROOT = Path(__file__).resolve().parent
HOST_RE = re.compile(
    r"(?:https?://|wss://)([A-Za-z0-9.-]+\.[A-Za-z]{2,})",
    re.IGNORECASE,
)
BARE_HOST_RE = re.compile(
    r"\b([A-Za-z0-9-]+\.(?:com|net|io|ai|cloud|dev))\b",
    re.IGNORECASE,
)
IMPORT_RE = re.compile(
    r"^\+\s*(?:from|import)\s+([A-Za-z0-9_\.]+)",
    re.M,
)
ENV_RE = re.compile(
    r"^\+.*(?:environ(?:\[|\.get\()['\"]([A-Z][A-Z0-9_]+))",
    re.M,
)
ASSIGN_RE = re.compile(r"^\+([A-Z][A-Z0-9_]{3,})=", re.M)

PAID_IMPORTS = {
    "boto3", "stripe", "openai", "anthropic", "sendgrid",
    "twilio", "google", "azure", "sentry_sdk",
}


def git_diff() -> str:
    base = os.environ.get("INVENTORY_BASE", "main")
    proc = subprocess.run(
        ["git", "diff", "--unified=0", base],
        check=True,
        capture_output=True,
        text=True,
    )
    return proc.stdout


def load_lines(path: Path) -> list[str]:
    if not path.exists():
        return []
    return [
        ln.strip()
        for ln in path.read_text().splitlines()
        if ln.strip() and not ln.startswith("#")
    ]


def host_denied(host: str, deny: list[str], allow: list[str]) -> bool:
    h = host.lower().rstrip(".")
    if h in {a.lower() for a in allow}:
        return False
    for rule in deny:
        rule = rule.lower()
        if rule.startswith("*.") and (h.endswith(rule[1:]) or h == rule[2:]):
            return True
        if h == rule:
            return True
    return False


def main() -> int:
    diff = git_diff()
    allow = load_lines(ROOT / "allow_hosts.txt")
    deny = load_lines(ROOT / "deny_hosts.txt")
    hosts = sorted(set(HOST_RE.findall(diff) + BARE_HOST_RE.findall(diff)))
    imports = sorted({m.split(".")[0] for m in IMPORT_RE.findall(diff)})
    env_keys = sorted(
        set(ENV_RE.findall(diff)) | set(ASSIGN_RE.findall(diff))
    )

    blocked_hosts = [h for h in hosts if host_denied(h, deny, allow)]
    blocked_imports = [i for i in imports if i in PAID_IMPORTS]
    secretish = [
        e for e in env_keys
        if any(s in e for s in ("KEY", "TOKEN", "SECRET", "PASSWORD"))
    ]

    receipt = {
        "new_hosts": hosts,
        "blocked_hosts": blocked_hosts,
        "new_imports": imports,
        "blocked_imports": blocked_imports,
        "new_env": env_keys,
        "secretish_env": secretish,
        "signer": os.environ.get("RECEIPT_SIGNER", ""),
    }
    Path("RECEIPT.json").write_text(json.dumps(receipt, indent=2) + "\n")
    print(json.dumps(receipt, indent=2))

    errors: list[str] = []
    if blocked_hosts:
        errors.append(f"billable hosts in diff: {blocked_hosts}")
    if blocked_imports:
        errors.append(f"paid SDKs in diff: {blocked_imports}")
    if secretish:
        errors.append(f"secret-shaped env in diff: {secretish}")
    if not receipt["signer"]:
        errors.append("set RECEIPT_SIGNER to a local name before merge")
    if errors:
        print("\n".join(errors), file=sys.stderr)
        return 1
    return 0


if __name__ == "__main__":
    raise SystemExit(main())

A pytest wrapper keeps the gate in the command the founder already runs.

# test_inventory.py
import os
import subprocess
import sys
from pathlib import Path


def test_diff_inventory_is_clean():
    env = os.environ.copy()
    env.setdefault("RECEIPT_SIGNER", "local-dev")
    env.setdefault("INVENTORY_BASE", "main")
    proc = subprocess.run(
        [sys.executable, "inventory_diff.py"],
        cwd=Path(__file__).resolve().parent,
        env=env,
    )
    assert proc.returncode == 0, "diff invented billable surface; read RECEIPT.json"

Makefile targets that fit a ship-today loop

Short targets beat a wiki page. One inventory, one smoke, one sign.

.PHONY: inventory smoke sign

INVENTORY_BASE ?= main
RECEIPT_SIGNER ?= $(USER)

inventory:
    INVENTORY_BASE=$(INVENTORY_BASE) RECEIPT_SIGNER=$(RECEIPT_SIGNER) python3 inventory_diff.py

smoke: inventory
    python3 -m pytest -q test_inventory.py

sign: smoke
    @test -n "$(RECEIPT_SIGNER)"
    git add RECEIPT.json allow_hosts.txt deny_hosts.txt
    git status --short

Commands stay boring on purpose.

git add inventory_diff.py test_inventory.py allow_hosts.txt deny_hosts.txt Makefile
INVENTORY_BASE=main RECEIPT_SIGNER="$USER" python3 inventory_diff.py
make smoke

If the model added import stripe, the process exits 1. That is the product.

Where a free draft loop fits

A solo founder still needs somewhere to let a model write code without parking production keys on the same machine. Free model access and a free server option cover that draft loop while the API is still a loopback service.

Disclosure: This article was prepared as part of MonkeyCode's product outreach.

MonkeyCode participates only as that draft host. The founder can generate the handler with free model access on the free server option, pull the branch, and run make smoke on the laptop that owns the deny list. The inventory does not run inside the product. It does not need extra hardware. It needs a diff and a signer. Limits apply: this article does not name models, quotas, or uptime, and it does not treat the free option as permanent.

The split is the method. Draft where keys are absent. Inventory where keys still must not appear.

Numbered workflow for one evening

Branch from main. Keep .env out of the tree. Export nothing that looks like a vendor token.
Draft the feature on a throwaway remote or a free server session. Accept incomplete types. Reject new dependencies by default.
Pull the patch onto the laptop that owns deny_hosts.txt.
Run INVENTORY_BASE=main RECEIPT_SIGNER="$USER" python3 inventory_diff.py.
Read RECEIPT.json. If blocked_hosts or blocked_imports is non-empty, revert those hunks. Do not allow a cloud SDK just to finish the evening.
Run the existing local smoke with the process bound to 127.0.0.1. Do not open a tunnel.
Commit the receipt with the patch. The receipt is evidence the founder looked. It is not a cryptographic audit.

That sequence ships a weekend binary. It also leaves a paper trail when the founder asks, three weeks later, why the repo still has no processor key.

A quick negative check belongs in the same sitting. Add a throwaway line, run the gate, then drop the line.

echo 'import stripe' >> app.py
python3 inventory_diff.py; echo exit:$?
git checkout -- app.py

Exit code 1 is the expected result. A green run after the revert means the deny list is wired. A green run with stripe still in the tree means the parser never saw the hunk and the gate is lying.

What this does not catch

Regex over a unified diff misses hosts built by concatenation, names hidden in protobuf, and binary assets. It misses a dependency that downloads a paid client at install time. It misses runtime config injected by a platform. Teams that need isolation should use OS network namespaces, egress firewalls, or a CI runner with no route to vendor APIs.

The signer field is social, not cryptographic. Anyone can export RECEIPT_SIGNER. The value is friction for a tired founder, not non-repudiation.

Do not use this gate as the only control on a multi-tenant product, a PCI workflow, or a healthcare API. Those need real policy engines and a named reviewer of record. A deny list in git is a weekend brake. It is not a compliance program.

Founders who already pay for a locked-down preview environment can skip the free draft host. The inventory still applies. The server choice is independent of the receipt.

Accept the limits, then ship

The indie constraint is not elegance. It is a bill that stays at zero until a customer exists. An inventory gate is ugly, local, and fast. It fails closed on text the model added. That is sufficient for a solo API that must leave the laptop this week without learning a paid hostname.

A founder who wants the draft half of this loop without standing up a box can run that branch through MonkeyCode’s free model access and free server option, then inventory the diff before any production secret exists.

Cap the Cassette Before an AI-Drafted Indie API Leaves the Laptop

Dakota Wu — Sun, 20 Sep 2026 11:55:52 +0000

A 200 from /health is not a ship decision. The ship decision is a cassette that names every outbound host, caps the bytes that leave the process, and still passes after the latest agent patch.

Solo founders lose weekends to pretty handlers. The model adds a translation client, an object store, and a mail vendor while the README still claims SQLite. The cassette budget is the cheap proof that none of that shipped.

AI coding tools made the demo path cheap. They also made unfinished work look finished. A generated FastAPI app can grow three paid upstreams in one turn and still return JSON that looks like a product. The founder who ships on that screenshot inherits the invoice. The founder who replays a tape with a host-and-byte cap does not.

The indie constraint

A solo founder ships today or the idea dies. Paid staging clusters do not fit that clock. The useful test on night one is not a 10k-VU soak. It is a short tape of the routes that will actually be public, replayed against a process that is forbidden to talk to anyone outside an allowlist.

That is a performance test in the only sense that matters before DNS exists. Did the handler stay cheap. Latency percentiles can wait. Host cardinality cannot. Byte caps cannot.

Keep the product on loopback until the tape is green. Raise the budget only when a real payload forces it. Never raise it because the agent asked for a “production-ready” client.

What the budget measures

Three numbers. Nothing else on the first weekend.

Distinct outbound hosts observed while the tape runs.
Total request bytes the client sent, headers included.
Count of connects that were not loopback, localhost, or an explicit fixture host.

If any number exceeds the file, the patch does not ship. The health endpoint is ignored. The cassette is the evidence folder. A dashboard without those three numbers is decoration.

Files to add this afternoon

Keep the layout boring so an agent cannot “clean it up” into a cloud folder.

api/
  app.py
cassette/
  budget.toml
  tape.json
tools/
  cassette_budget.py
Makefile

The API stays small. The tape stays in git. The outbound log stays local. That split is the whole point. Agents rewrite READMEs. They hesitate when a committed budget.toml fails a command the Makefile already names.

1. The budget file

# cassette/budget.toml
max_distinct_hosts = 1
max_outbound_bytes = 65536
max_non_local_requests = 0
allow_hosts = ["127.0.0.1", "localhost", "::1"]
allow_ports = [8000, 8080]

One allowed remote host is already generous for a laptop demo. Zero non-local requests is the default for a founder who wants the bill at zero. Raise the byte cap only after a real payload requires it. Do not raise it to silence a red run.

2. The tape

Label: example cassette. Replace bodies with the product’s real shapes before trusting a green run.

{
  "base_url": "http://127.0.0.1:8000",
  "cases": [
    {
      "name": "create_note",
      "method": "POST",
      "path": "/notes",
      "headers": {"Content-Type": "application/json"},
      "body": {"title": "ship", "body": "today"},
      "expect_status": [200, 201]
    },
    {
      "name": "read_note",
      "method": "GET",
      "path": "/notes/1",
      "expect_status": [200]
    },
    {
      "name": "health",
      "method": "GET",
      "path": "/health",
      "expect_status": [200]
    }
  ]
}

Do not put production URLs in examples. Agents copy examples into clients. The tape stays on loopback until the budget is green. Extra routes stay out of the tape until the founder is willing to support them in public.

3. The checker

The script starts the API in a subprocess, replays the tape, and records socket.connect plus socket.create_connection through a sitecustomize hook. It is a working sketch. Founders should read it before they trust it. It will not see every C extension. It will catch the usual Python HTTP clients an agent pastes in on a Saturday.

# tools/cassette_budget.py
"""Replay a cassette and fail if outbound traffic exceeds budget.toml.

Unexecuted on this machine as published. Treat as a working sketch.
"""
from __future__ import annotations

import json
import os
import socket
import subprocess
import sys
import time
import urllib.error
import urllib.request
from pathlib import Path

try:
    import tomllib
except ImportError:  # pragma: no cover
    import tomli as tomllib  # type: ignore

ROOT = Path(__file__).resolve().parents[1]
BUDGET = tomllib.loads((ROOT / "cassette" / "budget.toml").read_text())
TAPE = json.loads((ROOT / "cassette" / "tape.json").read_text())
LOG = ROOT / "cassette" / "outbound.jsonl"
HOOK_DIR = ROOT / "cassette"


class BudgetError(RuntimeError):
    pass


HOOK_SRC = r'''
import json, os, socket
from pathlib import Path
LOG = Path(os.environ["CASSETTE_LOG"])
_real_connect = socket.socket.connect
_real_create = socket.create_connection

def _connect(self, addr, *a, **k):
    host = addr[0] if isinstance(addr, tuple) else str(addr)
    port = addr[1] if isinstance(addr, tuple) and len(addr) > 1 else None
    with LOG.open("a") as fh:
        fh.write(json.dumps({"host": str(host), "port": port}) + "\n")
    return _real_connect(self, addr, *a, **k)

def _create(address, timeout=None, source_address=None):
    host, port = address[0], address[1]
    with LOG.open("a") as fh:
        fh.write(json.dumps({"host": str(host), "port": port}) + "\n")
    return _real_create(address, timeout=timeout, source_address=source_address)

socket.socket.connect = _connect
socket.create_connection = _create
'''


def install_hook() -> None:
    (HOOK_DIR / "sitecustomize.py").write_text(HOOK_SRC)
    os.environ["CASSETTE_LOG"] = str(LOG)
    os.environ["PYTHONPATH"] = str(HOOK_DIR) + os.pathsep + os.environ.get("PYTHONPATH", "")


def start_api() -> subprocess.Popen:
    LOG.write_text("")
    env = os.environ.copy()
    proc = subprocess.Popen(
        [sys.executable, "-m", "uvicorn", "api.app:app", "--host", "127.0.0.1", "--port", "8000"],
        cwd=ROOT,
        env=env,
        stdout=subprocess.DEVNULL,
        stderr=subprocess.PIPE,
    )
    deadline = time.time() + 8
    while time.time() < deadline:
        try:
            with socket.create_connection(("127.0.0.1", 8000), timeout=0.2):
                return proc
        except OSError:
            if proc.poll() is not None:
                err = proc.stderr.read().decode() if proc.stderr else ""
                raise BudgetError(f"api exited early: {err}") from None
            time.sleep(0.1)
    proc.kill()
    raise BudgetError("api did not bind 127.0.0.1:8000")


def replay() -> int:
    sent = 0
    base = TAPE["base_url"].rstrip("/")
    for case in TAPE["cases"]:
        url = base + case["path"]
        data = None
        headers = dict(case.get("headers") or {})
        if "body" in case:
            data = json.dumps(case["body"]).encode()
            headers.setdefault("Content-Type", "application/json")
            sent += len(data)
        req = urllib.request.Request(url, data=data, headers=headers, method=case["method"])
        sent += sum(len(k) + len(str(v)) for k, v in headers.items())
        try:
            with urllib.request.urlopen(req, timeout=5) as resp:
                status = resp.status
                sent += len(resp.read())
        except urllib.error.HTTPError as exc:
            status = exc.code
        if status not in case["expect_status"]:
            raise BudgetError(f"{case['name']} status {status}")
    return sent


def evaluate(sent_bytes: int) -> None:
    rows = []
    if LOG.exists() and LOG.read_text().strip():
        rows = [json.loads(line) for line in LOG.read_text().splitlines() if line.strip()]
    allow = set(BUDGET["allow_hosts"])
    hosts = sorted({r["host"] for r in rows})
    foreign = [r for r in rows if r["host"] not in allow]
    if len(hosts) > BUDGET["max_distinct_hosts"]:
        raise BudgetError(f"hosts {hosts} exceed max_distinct_hosts")
    if sent_bytes > BUDGET["max_outbound_bytes"]:
        raise BudgetError(f"bytes {sent_bytes} exceed cap")
    if len(foreign) > BUDGET["max_non_local_requests"]:
        raise BudgetError(f"non-local connects: {foreign}")
    print(json.dumps({"hosts": hosts, "bytes": sent_bytes, "foreign": len(foreign)}, indent=2))


def main() -> int:
    install_hook()
    proc = start_api()
    try:
        sent = replay()
        evaluate(sent)
    finally:
        proc.terminate()
        try:
            proc.wait(timeout=3)
        except subprocess.TimeoutExpired:
            proc.kill()
    return 0


if __name__ == "__main__":
    raise SystemExit(main())

The hook is coarse on purpose. Weekend APIs die from httpx.AsyncClient pointed at a tutorial host, not from a custom libc shim. Read the diff when the log is empty and the handler still smells like a vendor SDK. Empty logs are a signal to inspect, not a blessing.

Run order

Do this in order. Skipping a step is how a paid SDK lands in the lockfile after the demo.

Freeze the cassette paths to the routes the founder actually wants public this week. Extra routes stay commented in the OpenAPI file.
Start from a clean venv. Install only what api/app.py imports today.
Run python tools/cassette_budget.py. A BudgetError means the patch is not done.
If the agent added a helper module, re-run before committing. Do not batch five agent turns and then test.
Keep budget.toml and tape.json in git. Leave outbound.jsonl as a local artifact.
Point DNS at anything other than loopback only after step 3 is green on a second machine.

Makefile glue keeps the command short enough for a tired Sunday.

.PHONY: cassette
cassette:
    python tools/cassette_budget.py

A founder who cannot run make cassette on a train is not ready to take the API public. The command has to fit in a small terminal. The failure has to name the host that broke the budget.

Failure modes the tape usually catches

The first red run is rarely exotic. An agent adds httpx and a base URL from a README. The hook records that host. The budget fails. The founder deletes the client and the extra settings block.

The second red run is a “just in case” object-store helper. The create-note case never needed a bucket. The tape still trips because import-time setup opened a session. Move I/O to the request path, then delete the helper if the path does not need it this week.

The third red run is a chatty list endpoint. Byte counts in this sketch include response bodies. A 2 MB welcome payload blows a 64 KB cap even when every host is local. That is intended on week one. Pagination is cheaper than a dump.

Where a free model and a free server fit

Local green is the bar. A second machine is the confirmation. After the laptop cassette passes, the same tape can be pointed at a throwaway process on a free server so the founder is not the only host that has ever run the handler.

Disclosure: This article was prepared as part of MonkeyCode's product outreach.

MonkeyCode is relevant here only as a place with free model access for drafting extra cassette cases from an OpenAPI file, and a free server option for that second-hop replay. It does not replace the budget file. It does not prove the hook saw every socket. Treat both the free model access and the free server option as capacity that can change; keep the cassette runner in the repo so the gate still works offline.

Drafting extra cases is mechanical. Paste the path list. Require JSON cases that stay on 127.0.0.1 and never invent vendor URLs. Reject any case whose path is not already in the public set. Then re-run the checker. A generated tape that mentions a paid host is a failed draft, not a starting point.

What this does not prove

The cassette does not prove authentication is correct. It does not prove SQL injection is absent. It does not prove the handler meets a latency SLO. It does not see traffic from a sidecar the process did not spawn.

Agents can cheat the budget by writing files instead of calling HTTP, or by shelling out to curl. Add a later gate if that shows up: a denylist of subprocess binaries. Until then, read the patch. The cassette is a filter. It is not a substitute for a founder who still opens the diff.

Realistic API tests still need production-shaped payloads, think times, and failure injection. This tape is not that suite. It is the gate that keeps the suite from running against a process that already called a vendor.

Who should skip this

Skip the cassette budget if the product already has a real staging bill and a load suite. Skip it if the API handles payments, medical data, or anyone else’s secrets. Skip it if the team needs multi-region failover. Those products need contracts and reviews this workflow does not provide.

Skip it if nobody will maintain tape.json. A stale tape is worse than no tape. It blesses a demo path while the agent rewires /export to a paid encoder. A founder who will not edit the tape when a route changes should not publish the route.

Ship rule

The ship rule is one line. If make cassette is red, the API stays on the laptop. If it is green, the founder may take a second hop on a free server, then publish. The demo 200 is not evidence. The cassette is.

If the tape needs more cases than a tired evening allows, draft them against the OpenAPI file with free model access, keep every URL on loopback, and re-run the budget before anyone else hits the process.

A Runtime Host Permit for Vibe-Coded Indie APIs

Dakota Wu — Sat, 19 Sep 2026 09:59:52 +0000

A solo founder can vibe-code a weekend backend and still keep the bill at zero. The handlers can be messy. The outbound host list cannot. In this lane, engineering is a runtime host permit that fails closed before any paid hostname is resolved.

Generated code is good at looking complete. It is bad at respecting a bootstrapped budget. A draft that compiles is not a draft that stays free. The difference is not taste. It is whether the process is allowed to resolve the public internet.

The leak that import pinning misses

Import scanners catch branded SDKs. They miss a one-line urllib.request.urlopen aimed at a vendor the model remembered from training data. They also miss background “health” pings the agent added while being helpful. Those calls do not need a new dependency. They need a name.

Name resolution is the cost event. After DNS succeeds, the bill is a matter of time. A permit file that wraps getaddrinfo is the cheapest in-process control a solo operator can keep. It is not a service mesh. It is a lock on the laptop.

Vibe-coded features can ship today under that lock. Calling the result a platform is the mistake. The permit is the engineering. The generated route handlers are the draft.

Permit classes for a zero-bill demo

Three classes are enough for a weekend ship. Extra classes become prompt fodder. Keep the table small enough to hash in CI.

Class	Meaning	Typical members	Default
LOCAL	Loopback only	`localhost`, `127.0.0.1`, `::1`	allow
FREE_REMOTE	One operator-chosen free host	a single explicit hostname	deny until listed
PAID	Everything else	`*`	deny

LOCAL is the demo. FREE_REMOTE is optional. PAID is never an accident. A founder who needs a second remote has left the zero-bill lane and should say so in the permit diff, not in chat.

1. Write a boring permit file

Keep the file next to the app, not in a prompt. Models rewrite prompts. They are slower to rewrite a path that CI hashes. First match wins. The wildcard deny is required, not decorative.

# egress.permit
# format: ALLOW|DENY <host-or-ip>
# comments start with #
ALLOW localhost
ALLOW 127.0.0.1
ALLOW ::1
DENY *

A founder who later opts into a free server adds one ALLOW line for that hostname. Nothing else changes. The wildcard deny stays last. Treat a growing file as an incident, not as product iteration.

Hash it so an agent cannot silently widen the net.

sha256sum egress.permit > egress.permit.sha256
git add egress.permit egress.permit.sha256

2. Install a process-wide resolver guard

The guard below is a compact example, not a security product. It wraps socket.getaddrinfo and refuses unmatched hosts before a TCP handshake. Load it before the ASGI app. A late import is an open window.

# permit_guard.py
from __future__ import annotations

import ipaddress
import socket
from pathlib import Path

PERMIT_PATH = Path(__file__).with_name("egress.permit")
_DENIED = object()


class PermitDenied(RuntimeError):
    pass


def _parse(path: Path) -> list[tuple[str, str]]:
    rules: list[tuple[str, str]] = []
    for raw in path.read_text(encoding="utf-8").splitlines():
        line = raw.strip()
        if not line or line.startswith("#"):
            continue
        action, _, target = line.partition(" ")
        action = action.upper()
        target = target.strip().lower()
        if action not in {"ALLOW", "DENY"} or not target:
            raise ValueError(f"invalid permit line: {raw!r}")
        rules.append((action, target))
    if not rules or rules[-1] != ("DENY", "*"):
        raise ValueError("egress.permit must end with DENY *")
    return rules


RULES = _parse(PERMIT_PATH)


def _host_key(host: str) -> str:
    host = host.strip().lower().rstrip(".")
    if host.startswith("[") and host.endswith("]"):
        host = host[1:-1]
    return host


def decide(host: str) -> str:
    key = _host_key(host)
    try:
        ipaddress.ip_address(key)
        identities = {key}
    except ValueError:
        identities = {key}
    for action, target in RULES:
        if target == "*" or target in identities:
            return action
    return "DENY"


_orig_getaddrinfo = socket.getaddrinfo


def _guarded_getaddrinfo(host, port, *args, **kwargs):
    if host is None:
        return _orig_getaddrinfo(host, port, *args, **kwargs)
    if decide(str(host)) != "ALLOW":
        raise PermitDenied(f"egress denied for host={host!r} port={port!r}")
    return _orig_getaddrinfo(host, port, *args, **kwargs)


socket.getaddrinfo = _guarded_getaddrinfo

The wrapper is English-simple on purpose. It does not log denied hosts to a remote sink. Logging is another egress path. Print locally or fail the test. Do not phone home about a deny.

3. Add a hostile test the agent cannot charm

The suite must call a public hostname the permit does not list. If the suite is green without that failure, the guard is not installed. A loopback-only happy path is a false calm.

# test_egress_permit.py
import permit_guard
import socket
import urllib.error
import urllib.request

import pytest


def test_loopback_still_resolves():
    infos = socket.getaddrinfo("127.0.0.1", 9, type=socket.SOCK_STREAM)
    assert infos


def test_public_host_is_denied():
    with pytest.raises(permit_guard.PermitDenied):
        socket.getaddrinfo("example.com", 443, type=socket.SOCK_STREAM)


def test_stdlib_http_cannot_bypass_the_resolver():
    with pytest.raises((permit_guard.PermitDenied, urllib.error.URLError)):
        urllib.request.urlopen("https://example.com/", timeout=2)

Run it on every agent session, not once per release fantasy.

python -m pytest -q test_egress_permit.py
python -c "import permit_guard, hashlib; print(hashlib.sha256(open('egress.permit','rb').read()).hexdigest())"

Pin the hash check next to pytest. A permit that drifted is a failed build. A model that “simplified” DENY * into a comment is a failed build.

4. Draft with a free model; list a free server only if it is real

A solo operator can draft handlers with a free coding model and still treat that model as untrusted for network policy. Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode is an open-source project with free model access and a free server option. Those are availability claims. They are not a default ALLOW rule.

If a free server is used, it belongs on one explicit ALLOW line under the operator’s control. The permit does not infer it from marketing copy. The model does not get a second remote “for retries.” CI should fail when egress.permit grows without a human diff. Indie operators who want that draft lane can try MonkeyCode against this permit workflow. The wildcard deny stays the last line either way.

The rest of the method does not depend on any vendor. Remove the product and the guard still compiles. That is the point of putting policy in a file the process loads first.

5. Ship with the guard in the process, not in the README

README policy is not policy. Export one entry point that imports the guard before the app. A tired 01:00 restart should not discover a second, unguarded script.

# Makefile
.PHONY: demo test freeze

demo:
    python -c "import permit_guard, app; app.main()"

test:
    python -m pytest -q test_egress_permit.py

freeze:
    sha256sum -c egress.permit.sha256

Keep app.py boring. Bind the demo server to loopback. Refuse 0.0.0.0 unless the founder is doing that on purpose and has already left the laptop-only contract.

# app.py — labeled example, not a framework
from http.server import BaseHTTPRequestHandler, HTTPServer

class Handler(BaseHTTPRequestHandler):
    def do_GET(self):
        body = b'{"ok": true, "lane": "local"}\n'
        self.send_response(200)
        self.send_header("Content-Type", "application/json")
        self.send_header("Content-Length", str(len(body)))
        self.end_headers()
        self.wfile.write(body)

def main() -> None:
    httpd = HTTPServer(("127.0.0.1", 8080), Handler)
    httpd.serve_forever()

Debugging a false deny without opening the net

False denies happen. IPv6 forms, trailing dots, and bracketed literals are the usual three. Fix the comparer, not the permit. Do not “temporarily” comment out DENY * to see if the demo boots. That is how a weekend API grows a bill.

Work the failure in this order.

Print the raw host the stack passed into getaddrinfo. Use a local print, not a webhook.
Normalize once in _host_key. Do not add fuzzy suffix matching. Fuzzy matching is how evil.localhost.paid-vendor.example sneaks through a careless endswith.
If the app needs an IP literal, list that literal. Do not allow every IPv4 address because one health check used 127.0.0.1.
Re-run the hostile test after every comparer change. A comparer fix that makes example.com resolve is a regression, not a cleanup.

# labeled debug helper — keep it off by default
DEBUG_EGRESS = False

def decide(host: str) -> str:
    key = _host_key(host)
    for action, target in RULES:
        if target == "*" or target == key:
            if DEBUG_EGRESS:
                print(f"egress {action} {key} via {target}")
            return action
    return "DENY"

What this does not cover

The wrapper cannot see a subprocess that shells out to curl. It cannot see a C extension that opens its own sockets. It cannot see raw IPs unless those IPs are listed or denied. It is not a replacement for unshare, a host firewall, or an allowlist at the edge. It also does not prove the handlers are correct. It only proves the process was not allowed to resolve a stranger.

Do not use this approach for payment traffic, health data, or multi-tenant production. Do not use it as evidence that a vibe-coded service is engineered. The permit keeps a demo unbilled. It does not make the demo true.

Solo founders who need guaranteed uptime, questionnaires, or vendor SLAs should pick a paid stack on purpose. Skip the theater of a laptop permit. Everyone else can ship today, accept the limits, and leave the wildcard deny in place.

Fail Closed at Socket Time: A Loopback Probe for Zero-Bill Indie APIs

Dakota Wu — Fri, 18 Sep 2026 08:21:14 +0000

A weekend API stays free only if the process cannot leave the machine. Agent-written patches still compile when they import a billed SDK and open a TCP session on the first request. A fail-closed egress probe at boot lets a solo founder ship today, keep the wallet closed, and defer every third-party host until a human edits an allowlist.

Vibe-coded backends fail as engineering when the network is implicit. The model is not the leak. The first outbound socket is.

The cost path is a hostname, not a feature flag

Indie stacks accrue charges in three boring ways. A generated client calls a hosted model. A “temporary” object store lands on a public bucket. A logging snippet posts traces to a vendor. None of those require a product decision. They require create_connection.

A committed host allowlist is smaller than a cloud policy engine. It is also dumber, which is the point. The process starts only if every resolved peer is loopback. Anything else raises before the ASGI server binds.

This is not a security product. It is a wallet latch for a one-person repo that must ship this week.

Artifact: a fail-closed connector wrap

The working unit is three files. allowlist.json is the policy. egress_guard.py installs the wrap before routers import. test_egress_guard.py proves both the allow path and the deny path. No cloud account is required to run them.

1. Commit a loopback-only policy

Keep the file tiny. Review it in the same PR as any new dependency.

{
  "allowed_hosts": ["127.0.0.1", "localhost", "::1"],
  "allowed_ports": [8000, 8080],
  "deny_message": "egress blocked: host not on loopback allowlist"
}

Ports are optional. A stricter operator allows any port on loopback and zero ports elsewhere. The JSON exists so an agent cannot “helpfully” add api.stripe.com inside a Python literal without a file diff.

2. Wrap name lookup and TCP connect before app import

socket.create_connection is the common path for urllib, requests, and many SDKs. getaddrinfo is the earlier path. Both get wrapped. The original functions stay on the module so tests can still bind a local server.

# egress_guard.py
from __future__ import annotations

import json
import socket
from pathlib import Path
from typing import Any

POLICY_PATH = Path(__file__).with_name("allowlist.json")

class EgressBlocked(RuntimeError):
    """Raised when a peer is outside the committed allowlist."""


def load_policy() -> dict[str, Any]:
    data = json.loads(POLICY_PATH.read_text(encoding="utf-8"))
    hosts = frozenset(data["allowed_hosts"])
    ports = frozenset(int(p) for p in data.get("allowed_ports", []))
    return {"hosts": hosts, "ports": ports, "message": data["deny_message"]}


_POLICY = load_policy()
_orig_getaddrinfo = socket.getaddrinfo
_orig_create_connection = socket.create_connection


def _check(host: str, port: int | None) -> None:
    if host not in _POLICY["hosts"]:
        raise EgressBlocked(f"{_POLICY['message']}: host={host!r}")
    if port is not None and _POLICY["ports"] and port not in _POLICY["ports"]:
        raise EgressBlocked(f"{_POLICY['message']}: port={port}")


def guarded_getaddrinfo(host, port, *args, **kwargs):
    _check(str(host), int(port) if port else None)
    return _orig_getaddrinfo(host, port, *args, **kwargs)


def guarded_create_connection(address, *args, **kwargs):
    host, port = address[0], address[1]
    _check(str(host), int(port) if port is not None else None)
    return _orig_create_connection(address, *args, **kwargs)


def install() -> None:
    socket.getaddrinfo = guarded_getaddrinfo
    socket.create_connection = guarded_create_connection

Call install() in a boot module, not in a router. Routers are what the agent edits. The boot module should be listed in a one-line code-owner rule or a CODEOWNERS file so it does not drift.

# boot.py
from egress_guard import install

install()

from app import create_app  # local import after the wrap

app = create_app()

if __name__ == "__main__":
    import uvicorn

    uvicorn.run(app, host="127.0.0.1", port=8000, log_level="info")

Bind 127.0.0.1, not 0.0.0.0. A loopback allowlist is worthless if the public interface is already advertised.

3. Keep the app itself on local adapters

The sample service stores a waitlist in SQLite. No Redis. No hosted queue. The handler never constructs an HTTP client. That is the product for week one: an endpoint that works on a laptop and on a single free process.

# app.py
from __future__ import annotations

import sqlite3
from pathlib import Path

from fastapi import FastAPI
from pydantic import BaseModel, EmailStr

DB_PATH = Path(__file__).with_name("waitlist.db")

class Signup(BaseModel):
    email: EmailStr


def create_app() -> FastAPI:
    app = FastAPI(title="local-waitlist")
    conn = sqlite3.connect(DB_PATH, check_same_thread=False)
    conn.execute(
        "CREATE TABLE IF NOT EXISTS waitlist (email TEXT PRIMARY KEY, created_at TEXT DEFAULT CURRENT_TIMESTAMP)"
    )
    conn.commit()

    @app.get("/health")
    def health() -> dict[str, str]:
        return {"status": "ok", "store": "sqlite"}

    @app.post("/signup")
    def signup(body: Signup) -> dict[str, str]:
        conn.execute("INSERT OR IGNORE INTO waitlist(email) VALUES (?)", (body.email,))
        conn.commit()
        return {"email": body.email, "stored": "local"}

    return app

4. Prove deny and allow with pytest

The deny test must not depend on the public internet being up. The assertion is the exception type, not a timeout. The allow test binds a tiny local server on an allowlisted port.

# test_egress_guard.py
import socket
import threading
from http.server import BaseHTTPRequestHandler, HTTPServer

import pytest

import egress_guard
from egress_guard import EgressBlocked


@pytest.fixture(autouse=True)
def _install_guard():
    egress_guard.install()
    yield
    socket.getaddrinfo = egress_guard._orig_getaddrinfo
    socket.create_connection = egress_guard._orig_create_connection


def test_blocks_public_hostname():
    with pytest.raises(EgressBlocked):
        socket.create_connection(("example.com", 443), timeout=1)


def test_blocks_literal_public_ip():
    with pytest.raises(EgressBlocked):
        socket.create_connection(("1.1.1.1", 443), timeout=1)


def test_allows_loopback_http():
    server = HTTPServer(("127.0.0.1", 8080), BaseHTTPRequestHandler)
    thread = threading.Thread(target=server.handle_request, daemon=True)
    thread.start()
    sock = socket.create_connection(("127.0.0.1", 8080), timeout=2)
    sock.close()
    thread.join(timeout=2)

Run the loop the same way every time. Fail closed means CI red is the success case for a sneaky host.

python -m pip install fastapi pydantic uvicorn pytest
python -m pytest -q test_egress_guard.py
python boot.py

A second check belongs in the shell before a public bind. If allowlist.json grows a non-loopback host, the command exits non-zero.

python - <<'PY'
import json, sys
from pathlib import Path
allowed = {"127.0.0.1", "localhost", "::1"}
data = json.loads(Path("allowlist.json").read_text())
bad = [h for h in data["allowed_hosts"] if h not in allowed]
if bad:
    print("non-loopback hosts:", bad)
    sys.exit(1)
print("allowlist: loopback only")
PY

Decision table: ship local or open a host

Need this week	Local substitute	Open the allowlist?
Persist signups	SQLite file next to the app	No
Background work	In-process queue or a thread	No
Auth for a demo	Signed cookies, one secret in env	No
File uploads	Disk under `./data`	No
Transactional email	Log the payload, send by hand	Not yet
Card capture	Do not ship the route	Not this week
Hosted inference	Defer; keep the handler offline	Only after a human review

The table is the product spec. If a generated patch needs a row that says “yes”, the patch waits. Shipping today means the left column, not a vendor SDK.

Where a free model endpoint fits

Drafting the guard does not require a paid coding seat. MonkeyCode is an open-source coding assistant with free model access and a free server option, which is enough for a solo founder to generate the interceptor and run the API without attaching a card. Disclosure: This article was prepared as part of MonkeyCode's product outreach.

The probe does not depend on that tooling. It is ordinary CPython. A free server is useful only after test_egress_guard.py is green and boot.py still binds loopback. Treat the remote process like another laptop: same allowlist, same SQLite file, same refusal to add hosts.

Operators who already draft against a free model endpoint can paste egress_guard.py into that repo and run the tests before the next bind.

What this does not catch

The wrap is a latch, not a sandbox. socket.socket().connect() can still be called directly on some paths. asyncio openers, httpx with a custom transport, subprocess to curl, and HTTP_PROXY environment variables sit outside this file. IPv4-mapped IPv6 literals such as ::ffff:1.1.1.1 need an extra normalize step if the runtime accepts them. Docker --network host and Kubernetes sidecars ignore a process-level wrap.

SQLite will not survive multi-instance writes. Loopback binding will not satisfy a mobile client on another device without an explicit tunnel. Those are accepted limits for a zero-bill week, not defects to paper over with a paid queue.

Reload the policy only from disk at process start. Hot reload invites an agent to widen the list after tests pass.

Who should skip this

Skip the probe if the product must talk to a payment processor, an email provider, or a third-party webhook on day one. Skip it if the team already runs shared staging with managed identity. Skip it if the operator needs this wrap to stop data exfiltration; use an OS-level network policy or an isolated VM instead.

Solo founders who can accept a local store, a loopback bind, and a human-owned allowlist can ship the waitlist today. The wallet stays closed until someone edits JSON on purpose.

Capability Tickets That Keep an AI-Drafted Indie API on Local Adapters

Dakota Wu — Thu, 17 Sep 2026 06:37:56 +0000

Solo founders can ship an AI-drafted API this week without opening a cloud bill. The constraint has to be mechanical. Every runtime capability is spent from a ticket file that only lists local adapters, and the process refuses to boot when a patch tries to spend a ticket that is not there.

Cloud SDKs are not a later refactor. They are a different product. A weekend MVP that already speaks Postgres, Redis, object storage, and a hosted mail API has left the free envelope even if no invoice has arrived yet.

AI coding tools make that jump cheap to type and expensive to unwind. A model asked to add password reset will reach for a hosted mailer. A model asked to make it production-ready will add a broker. Drafting is not the failure. Calling the draft engineering is the failure. For a one-person ship, engineering means proving that storage, jobs, mail, and files still resolve to adapters that run on a laptop or a single free host.

This write-up records a ticket file, a factory that fails closed, a tiny HTTP service, and a proof command that writes SHIP_PROOF.json. The method is for indie hackers who need to ship today and can accept the limits. It is not a scaling guide.

The ticket file

A capability ticket is a named adapter, not a vendor slogan. One ticket per concern. No aliases that hide a paid client.

Create capabilities.json at the repo root.

{
  "version": 1,
  "tickets": {
    "storage": "sqlite_file",
    "queue": "memory_list",
    "mail": "maildir",
    "blobs": "local_dir",
    "jobs": "inline",
    "auth": "hmac_cookie"
  },
  "data_dir": "./data",
  "listen": "127.0.0.1:8080"
}

Allowed values stay small on purpose. sqlite_file means one file under data_dir. memory_list means a process-local deque. maildir means write .eml files. local_dir means hashed files on disk. inline means the request thread runs the job. hmac_cookie means a signed cookie with a local secret file.

Anything else is a declined ticket. Declined tickets fail the process at import time, not after a customer click.

Decision table for the first week

Use the table as the review surface. An agent patch that introduces a new row without a human edit to this table is out of scope for a bill-zero ship.

Concern	Allowed ticket	Forbidden stand-in	First-week reason
storage	`sqlite_file`	Postgres, hosted MySQL	one file, zero extra host
queue	`memory_list`	Redis, SQS, Celery	dies with the process, which is acceptable
mail	`maildir`	SendGrid, SES, Postmark	founder can open the `.eml`
blobs	`local_dir`	S3, GCS, R2	hashed files next to SQLite
jobs	`inline`	Cloud scheduler, worker pool	no second process to bill
auth	`hmac_cookie`	Auth0, Cognito, Clerk	local secret file only
listen	loopback	`0.0.0.0` publish	public bind waits for a real user

The table is the product contract. Code below only enforces it.

Factory that fails closed

The application never constructs SQLite, queues, or mailers ad hoc. It asks a factory. The factory reads the ticket file once and raises BudgetError on mismatch.

# budget.py
from __future__ import annotations

import json
from dataclasses import dataclass
from pathlib import Path

ALLOWED = {
    "storage": {"sqlite_file"},
    "queue": {"memory_list"},
    "mail": {"maildir"},
    "blobs": {"local_dir"},
    "jobs": {"inline"},
    "auth": {"hmac_cookie"},
}

class BudgetError(RuntimeError):
    pass

@dataclass(frozen=True)
class Tickets:
    storage: str
    queue: str
    mail: str
    blobs: str
    jobs: str
    auth: str
    data_dir: Path
    listen: str

def load_tickets(root: Path) -> Tickets:
    raw = json.loads((root / "capabilities.json").read_text(encoding="utf-8"))
    tickets = raw["tickets"]
    for key, allowed in ALLOWED.items():
        got = tickets.get(key)
        if got not in allowed:
            raise BudgetError(f"ticket {key}={got!r} is not in {sorted(allowed)}")
    data_dir = (root / raw["data_dir"]).resolve()
    if not str(data_dir).startswith(str(root.resolve())):
        raise BudgetError("data_dir escapes the repo")
    data_dir.mkdir(parents=True, exist_ok=True)
    return Tickets(
        storage=tickets["storage"],
        queue=tickets["queue"],
        mail=tickets["mail"],
        blobs=tickets["blobs"],
        jobs=tickets["jobs"],
        auth=tickets["auth"],
        data_dir=data_dir,
        listen=raw["listen"],
    )

The path check matters. An agent that sets data_dir to /var/lib/postgresql or a remote mount should not boot. The factory is the spend desk. Application code is not allowed to argue with it.

Local adapters only

Keep adapters boring. Boring is the point.

# adapters.py
from __future__ import annotations

import hashlib
import sqlite3
import time
from collections import deque
from pathlib import Path
from typing import Any, Callable, Deque, Dict, Tuple

from budget import BudgetError, Tickets

class Store:
    def __init__(self, tickets: Tickets) -> None:
        if tickets.storage != "sqlite_file":
            raise BudgetError("storage adapter refused")
        self.path = tickets.data_dir / "app.sqlite"
        self._db = sqlite3.connect(self.path, check_same_thread=False)
        self._db.execute(
            "CREATE TABLE IF NOT EXISTS notes "
            "(id INTEGER PRIMARY KEY, body TEXT NOT NULL, created_at REAL NOT NULL)"
        )
        self._db.commit()

    def add_note(self, body: str) -> int:
        cur = self._db.execute(
            "INSERT INTO notes(body, created_at) VALUES (?, ?)",
            (body, time.time()),
        )
        self._db.commit()
        return int(cur.lastrowid)

    def list_notes(self) -> list[tuple[int, str, float]]:
        rows = self._db.execute(
            "SELECT id, body, created_at FROM notes ORDER BY id DESC LIMIT 50"
        )
        return list(rows)

class MailDir:
    def __init__(self, tickets: Tickets) -> None:
        if tickets.mail != "maildir":
            raise BudgetError("mail adapter refused")
        self.dir = tickets.data_dir / "maildir"
        self.dir.mkdir(exist_ok=True)

    def send(self, to: str, subject: str, body: str) -> Path:
        name = f"{int(time.time() * 1000)}_{hashlib.sha256(to.encode()).hexdigest()[:8]}.eml"
        path = self.dir / name
        path.write_text(
            f"To: {to}\nSubject: {subject}\n\n{body}\n",
            encoding="utf-8",
        )
        return path

class MemoryQueue:
    def __init__(self, tickets: Tickets) -> None:
        if tickets.queue != "memory_list":
            raise BudgetError("queue adapter refused")
        self._q: Deque[Tuple[str, Dict[str, Any]]] = deque()

    def push(self, kind: str, payload: Dict[str, Any]) -> None:
        self._q.append((kind, payload))

    def drain(self, handler: Callable[[str, Dict[str, Any]], None]) -> int:
        n = 0
        while self._q:
            kind, payload = self._q.popleft()
            handler(kind, payload)
            n += 1
        return n

class BlobDir:
    def __init__(self, tickets: Tickets) -> None:
        if tickets.blobs != "local_dir":
            raise BudgetError("blob adapter refused")
        self.dir = tickets.data_dir / "blobs"
        self.dir.mkdir(exist_ok=True)

    def put(self, raw: bytes) -> str:
        digest = hashlib.sha256(raw).hexdigest()
        (self.dir / digest).write_bytes(raw)
        return digest

Jobs stay inline. The HTTP handler pushes to the memory queue and drains it before the response returns. That is slower under load. It is also free, inspectable, and enough for a first cohort of users who do not exist yet.

HTTP surface that spends tickets

Stdlib is enough for the first route set. No ASGI stack is required to prove the budget.

# app.py
from __future__ import annotations

import json
from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
from pathlib import Path
from urllib.parse import urlparse

from adapters import MailDir, MemoryQueue, Store
from budget import load_tickets

ROOT = Path(__file__).resolve().parent
TICKETS = load_tickets(ROOT)
STORE = Store(TICKETS)
MAIL = MailDir(TICKETS)
QUEUE = MemoryQueue(TICKETS)

def run_jobs(kind: str, payload: dict) -> None:
    if kind == "note_mail":
        MAIL.send(payload["to"], "Note saved", payload["body"])

class Handler(BaseHTTPRequestHandler):
    def _json(self, code: int, payload: dict) -> None:
        raw = json.dumps(payload).encode("utf-8")
        self.send_response(code)
        self.send_header("Content-Type", "application/json")
        self.send_header("Content-Length", str(len(raw)))
        self.end_headers()
        self.wfile.write(raw)

    def do_GET(self) -> None:
        if urlparse(self.path).path != "/notes":
            self._json(404, {"error": "not_found"})
            return
        rows = [
            {"id": i, "body": body, "created_at": ts}
            for i, body, ts in STORE.list_notes()
        ]
        self._json(200, {"listen": TICKETS.listen, "notes": rows})

    def do_POST(self) -> None:
        if urlparse(self.path).path != "/notes":
            self._json(404, {"error": "not_found"})
            return
        length = int(self.headers.get("Content-Length", "0"))
        data = json.loads(self.rfile.read(length) or b"{}")
        body = str(data.get("body", "")).strip()
        to = str(data.get("notify", "")).strip()
        if not body:
            self._json(400, {"error": "body_required"})
            return
        note_id = STORE.add_note(body)
        if to:
            QUEUE.push("note_mail", {"to": to, "body": body})
            QUEUE.drain(run_jobs)
        self._json(201, {"id": note_id})

    def log_message(self, fmt: str, *args) -> None:
        return

def main() -> None:
    host, port_s = TICKETS.listen.split(":")
    if host not in {"127.0.0.1", "localhost"}:
        raise SystemExit("listen host is not loopback; ticket refused")
    httpd = ThreadingHTTPServer((host, int(port_s)), Handler)
    httpd.serve_forever()

if __name__ == "__main__":
    main()

Loopback is part of the ticket. Binding 0.0.0.0 is a later decision, made after a real user exists, not after a model suggests a Docker publish port.

Proof command

A ship is not a feeling. It is a file. The proof script boots the app, writes a note, and checks that SQLite plus a maildir file appeared on disk.

# prove_ship.py
from __future__ import annotations

import json
import socket
import subprocess
import sys
import time
import urllib.request
from pathlib import Path

ROOT = Path(__file__).resolve().parent

def wait_port(host: str, port: int, timeout: float = 5.0) -> None:
    deadline = time.time() + timeout
    while time.time() < deadline:
        try:
            with socket.create_connection((host, port), timeout=0.2):
                return
        except OSError:
            time.sleep(0.05)
    raise SystemExit("server did not bind loopback in time")

def main() -> None:
    tickets = json.loads((ROOT / "capabilities.json").read_text(encoding="utf-8"))
    host, port_s = tickets["listen"].split(":")
    port = int(port_s)
    proc = subprocess.Popen([sys.executable, str(ROOT / "app.py")], cwd=ROOT)
    try:
        wait_port(host, port)
        req = urllib.request.Request(
            f"http://{host}:{port}/notes",
            data=json.dumps(
                {"body": "ship today", "notify": "founder@localhost"}
            ).encode(),
            headers={"Content-Type": "application/json"},
            method="POST",
        )
        with urllib.request.urlopen(req, timeout=2) as resp:
            created = json.loads(resp.read().decode())
        with urllib.request.urlopen(f"http://{host}:{port}/notes", timeout=2) as resp:
            listed = json.loads(resp.read().decode())
    finally:
        proc.terminate()
        proc.wait(timeout=3)

    sqlite_path = ROOT / "data" / "app.sqlite"
    mails = list((ROOT / "data" / "maildir").glob("*.eml"))
    proof = {
        "ok": True,
        "note_id": created["id"],
        "listed": len(listed["notes"]),
        "sqlite_bytes": sqlite_path.stat().st_size,
        "mail_files": len(mails),
        "listen": tickets["listen"],
        "tickets": tickets["tickets"],
    }
    if proof["listed"] < 1 or proof["mail_files"] < 1:
        raise SystemExit("ship proof failed")
    out = ROOT / "SHIP_PROOF.json"
    out.write_text(json.dumps(proof, indent=2), encoding="utf-8")
    print(out.read_text(encoding="utf-8"))

if __name__ == "__main__":
    main()

Run the proof from the repo root.

python prove_ship.py

A green run writes SHIP_PROOF.json. Commit that file with the ticket file. The next agent session has to treat both as inputs, not as suggestions.

Guard the ticket file in tests

Add a unit check so a model cannot silently widen ALLOWED without breaking CI.

# test_budget.py
from pathlib import Path
import json
import tempfile
import unittest

from budget import BudgetError, load_tickets

class TicketTests(unittest.TestCase):
    def write(self, tickets, data_dir="./data"):
        td = Path(tempfile.mkdtemp())
        payload = {
            "version": 1,
            "tickets": tickets,
            "data_dir": data_dir,
            "listen": "127.0.0.1:8080",
        }
        (td / "capabilities.json").write_text(json.dumps(payload), encoding="utf-8")
        return td

    def test_accepts_local_set(self):
        root = self.write({
            "storage": "sqlite_file",
            "queue": "memory_list",
            "mail": "maildir",
            "blobs": "local_dir",
            "jobs": "inline",
            "auth": "hmac_cookie",
        })
        loaded = load_tickets(root)
        self.assertEqual(loaded.storage, "sqlite_file")

    def test_rejects_postgres(self):
        root = self.write({
            "storage": "postgres",
            "queue": "memory_list",
            "mail": "maildir",
            "blobs": "local_dir",
            "jobs": "inline",
            "auth": "hmac_cookie",
        })
        with self.assertRaises(BudgetError):
            load_tickets(root)

    def test_rejects_escaped_data_dir(self):
        root = self.write({
            "storage": "sqlite_file",
            "queue": "memory_list",
            "mail": "maildir",
            "blobs": "local_dir",
            "jobs": "inline",
            "auth": "hmac_cookie",
        }, data_dir="../outside")
        with self.assertRaises(BudgetError):
            load_tickets(root)

if __name__ == "__main__":
    unittest.main()

python -m unittest test_budget.py

Keep this test next to the ticket file. A patch that only edits app.py is cheap to review. A patch that edits budget.py is a spend request.

Where a free coding session fits

Disclosure: This article was prepared as part of MonkeyCode's product outreach.

A solo founder still has to generate the first handlers somehow. MonkeyCode's free model access and free server option can host that generation-and-proof loop without opening a paid cloud account for the coding environment itself. The ticket file and prove_ship.py remain the product. The environment is only a place to run them.

The method does not depend on any one vendor. If the same files run on a laptop, they are doing the job. Use a hosted free session when the laptop is inconvenient, not because a prompt asked for extra capacity.

Limits, and who should skip this

The memory queue vanishes on process restart. Maildir is not deliverability. SQLite will not like multiple writers across machines. Loopback is not a public launch. HMAC cookies are not an identity platform.

Do not use this approach when the product already has paying users who need multi-instance failover. Skip it when mail must leave the box, when blobs must be geo-replicated, or when a compliance review requires a named cloud vendor. Those are different tickets. Buy them after revenue, not after a prompt.

AI-assisted drafts still need a human to keep ALLOWED small. A model can edit budget.py as easily as app.py. The defense is social as well as technical. The ticket file is reviewed like a spend request. The proof file is the receipt.

Ship the local adapters this week. Seal the tickets before the first paid client is discussed. If a free model session is already generating the handlers, run python prove_ship.py in that same tree before any adapter row is widened.