DEV Community: Morgan Xu

Stamp a Scope Ribbon Before Practice Shifts

Morgan Xu — Sat, 10 Oct 2026 18:48:44 +0000

A practice shift without a roster becomes shared debt. Free model access lowers the cost of a draft. It does not lower the cost of a bad merge.

Teams can now sketch an interface before lunch ends. Those sketches still touch repos, logs, and keys. Speed without a named owner creates quiet drift.

The useful fix is a one-page shift sheet. Three seats sign it before the first prompt. The sheet lives in the team wiki, not in chat.

This playbook fits small product teams with shared repos. It also fits platform groups that keep a sandbox. It does not fit a solo weekend experiment.

Name the failure before any tool

A generated patch can look finished and still be wrong. The wrong part is often scope, not syntax. A button works while the data path leaks.

Reviewers then argue about taste instead of bounds. The draft already sits on a shared host. Rollback talk starts after other people see it.

A roster slip stops that sequence one step earlier. It names who prompts, who checks, and who discards. It also names what the shift must never touch.

Public talk about easy generated sites makes this failure common. A portfolio draft and a service draft share one risk. Both can escape the practice lane if nobody owns the close.

Keep free capacity on a practice lane

Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode offers free model access for this kind of practice. It also offers a free server option for throwaway hosts.

Both claims come from the operator, not a lab test. Quotas, model names, and uptime are not assumed here. A free option can change without a team vote.

The lane stays practice, and never becomes a promise. The team uses that access only after the slip is complete. Prompts stay on a practice branch, not on main.

The host name must not look like production. Live tokens stay out of the brief and the prompt. Customer rows stay out of the prompt as well.

Synthetic fixtures are the only safe sample for this shift. The team stores fixtures in the practice repo only. A real data export never enters this shift.

Three seats and one clock

The prompter writes the task in one short brief. The checker owns diffs, tests, and secret scans. The discarder owns shutdown, branch delete, and the note.

One person may hold two seats on a tiny team. One person must not hold all three seats. A missing discarder is how practice becomes production.

The clock is wall time, not a feeling. Ninety minutes is a suggested cap, not a benchmark. When the cap hits, the discarder closes the host.

The cap is a team rule, not a product limit. An extension needs a new slip and a new deadline. A silent extension is the same as no clock.

Handoffs stay short on purpose

The prompter hands a brief with inputs and forbidden paths. The checker hands a pass, a fail, or a block. The discarder hands a closed host and a deleted branch.

Each handoff must fit inside four short lines. Chat history must never replace the wiki page. A missing line means the shift is still open.

The prompter does not declare the draft done. The checker does not declare the host closed. Those sentences belong to different seats for a reason.

A pass means the diff matches the ribbon. A fail means the diff missed the brief. A block means the diff touched a forbidden path.

Paste this page, then fill blanks

The artifact below is a proposal, not a captured log. The team copies it into the wiki before the shift. Every blank stays filled, or the shift does not start.

Practice shift slip
Shift id: PS-____
Date: ____
Prompter: ____
Checker: ____
Discarder: ____
Scope ribbon: ____
Forbidden: prod hosts, customer data, live tokens, main
Branch: practice/____
Host label: ____
Deadline UTC: ____
Fixture rule: synthetic only
Prompter line: brief filed, inputs listed, forbidden copied
Checker line: pass | fail | block - note ____
Discarder line: host closed, branch deleted, time ____
Stop: blank seat means no prompt
Stop: second fail means discard
Stop: any block means discard, plus a note if secrets appeared

A checker that fails closed

A small script guards the slip before any prompt. It does not call a model or a remote API. It only reads a local env file on disk.

This script is an unexecuted example for local use. The team runs it on a throwaway clone first. It does not belong on a release repository.

#!/usr/bin/env bash
# Proposal only. Unexecuted example for a throwaway repo.
set -euo pipefail

SLIP="${1:-shift-slip.env}"
test -f "$SLIP" || { echo "missing slip: $SLIP"; exit 2; }

set -a
# shellcheck disable=SC1090
source "$SLIP"
set +a

require() {
  local name="$1"
  local value="${!name-}"
  if [[ -z "${value}" ]]; then
    echo "blank field: ${name}"
    exit 3
  fi
}

require PROMPTER
require CHECKER
require DISCARDER
require SCOPE
require FORBIDDEN
require BRANCH
require HOST
require DEADLINE

if [[ "$PROMPTER" == "$CHECKER" && "$CHECKER" == "$DISCARDER" ]]; then
  echo "one person holds every seat"
  exit 4
fi

case "$BRANCH" in
  practice/*) ;;
  *) echo "branch must start with practice/"; exit 5 ;;
esac

case "$HOST" in
  *prod*|*production*|*live*)
    echo "host label looks like production"
    exit 6
    ;;
esac

if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
  git check-ignore -q .env || echo "warn: .env is not ignored"
fi

echo "slip ok: ${BRANCH} until ${DEADLINE}"

A matching example file holds names only. Tokens and customer rows never belong in that file. The filled copy stays untracked.

# shift-slip.env.example — proposal template, no secrets
PROMPTER="ava"
CHECKER="sam"
DISCARDER="rui"
SCOPE="readme draft for the practice repo only"
FORBIDDEN="prod hosts, customer data, live tokens, main branch"
BRANCH="practice/readme-draft"
HOST="practice-host.example"
DEADLINE="2026-10-10T16:30:00Z"

Commands for open, check, and close

The commands below are examples, not a captured session. Each one assumes a throwaway clone with no secrets. A failed command stops the shift until a human reads it.

The prompter creates the practice branch before any prompt. The filled slip stays next to that work. The checker runs the script before any editor opens.

git checkout -b practice/readme-draft
cp shift-slip.env.example shift-slip.env
bash check-slip.sh shift-slip.env

The checker records a short line without pasting secrets. A stat line is enough for this handoff note. Raw diffs that may hold secrets stay out of chat.

git diff --stat
printf '%s\n' "checker: pass" "note: readme only" >> handoff.txt

The discarder closes with local git commands and a stamp. Host shutdown still happens in the provider console. The stamp only proves the local half is finished.

git checkout main
git branch -D practice/readme-draft
printf '%s\n' "host: closed in console" "branch: deleted" "time: $(date -u +%FT%TZ)" >> handoff.txt

Filled slip files stay out of the git history. The team commits the example, not the filled file. A filled file can hold names that should stay internal.

printf '%s\n' "shift-slip.env" "handoff.txt" >> .gitignore
git check-ignore -q shift-slip.env && echo "filled slip ignored"

Read the three marks as policy

When the checker marks fail, the prompter may revise once. A second fail ends the shift at once. The discarder still closes the host that day.

When the checker marks block, nobody pushes code. A block means secrets, prod names, or scope creep. The brief returns to the wiki, not the model.

When the checker marks pass, work may enter normal review. That review uses the team's ordinary release pipeline. The practice host never becomes the release host.

A pass is not a deploy approval by itself. A pass is only a match against the ribbon. Release still needs the team's existing review gates.

Limits of the sheet and the script

The checker script cannot judge real product sense. It cannot prove a free server is isolated. It cannot see a secret typed into a prompt.

Free model access can shift without prior notice. Free server capacity can shift in the same way. This page claims no quota, chip type, or duration.

No benchmark result sits behind these process steps. No customer count sits behind these steps either. The value is a cleaner handoff, not a miracle.

String checks on the host label are shallow. A host can be dangerous without the word prod. Humans still read the name before the first prompt.

The script trusts the slip file on purpose. A liar can type a fake discarder name. Social trust sits outside what bash can prove.

Who should leave this playbook unused

Teams skip this approach when the data is regulated. They skip it when the only host is production. They skip it when nobody can stay for the discard.

They skip it for a silent overnight agent. Unattended prompts break the three-seat rule every time. A human discarder must remain awake for the close.

They skip it for a demo that cannot be deleted. Practice means the artifact can die without ceremony. A launch candidate needs the normal release train.

They skip it when counsel owns the prompt text. This sheet is an engineering habit, not legal advice. Regulated text still needs the team's counsel path.

Rehearse the failure before the real brief

The rehearsal starts on an empty practice repo. The slip gets real names and only fake data. The checker expects a short ok line from the script.

The rehearsal script below is also an unexecuted proposal. It expects the checker file in the same folder. It never contacts a model or a remote host.

#!/usr/bin/env bash
# Proposal only. Local rehearsal. No model calls.
set -euo pipefail

tmp="$(mktemp -d)"
cp check-slip.sh shift-slip.env.example "$tmp/"
cd "$tmp"
cp shift-slip.env.example shift-slip.env
bash check-slip.sh shift-slip.env | grep -q "slip ok"

sed 's/^DISCARDER=.*/DISCARDER=""/' shift-slip.env > shift-slip.blank
if bash check-slip.sh shift-slip.blank; then
  echo "expected failure on blank discarder"
  exit 1
fi

echo "rehearsal ok"

The next run blanks the discarder field on purpose. The script should exit on that blank field. The name returns before any further prompt work.

The host field then uses a name that contains prod. The script should refuse that unsafe host string. The host label changes before the shift continues.

The prompter supplies a diff that touches only the readme. The checker reads the stat line, not the tone. A pass still waits for human eyes on the diff.

The close deletes the practice branch and writes the time. The slip stays in the wiki as history. Practice notes do not enter the main readme.

The ribbon outranks the model

Scope works like a ribbon tied around the task. Outside that ribbon, the shift has no authority. Inside the ribbon, the checker may say no.

A stronger model does not replace that ribbon. A cheaper server does not replace it either. The ribbon is a social control with a small script.

The slip covers one shift, not the whole quarter. It expires when the discarder writes the close line. The next shift starts from a blank page.

Old notes stay as evidence, not as a prompt seed. Fresh scope stops yesterday's exception from growing again. That habit matters more than any single draft.

A boring close is a feature of this playbook. The discarder stops the host and deletes the branch. No victory speech belongs on the shift slip.

A team that wants those free options starts on a throwaway repo. The team pastes the sheet and runs the checker first. That order keeps the experiment smaller than the codebase.

Seal an Envelope Before Free Bench Time

Morgan Xu — Fri, 09 Oct 2026 15:11:29 +0000

Free model seats never replace a written handoff. A free server never replaces a named owner. Teams should seal an envelope before the first prompt.

Many teams now generate code faster than they review it. Speed feels like progress until a shared bench mixes secrets. The quiet failure is an unlabeled run with no exit.

Generated code can look finished before anyone owns the result. A portfolio demo and a shared bench fail in different ways. The bench fails when the next person cannot see the stop rule.

Treat free compute like a borrowed bench

This playbook treats free compute like a borrowed lab bench. The bench stays useful only while the log stays attached. That log is a one-page envelope inside the team wiki.

The envelope holds purpose, data class, stop time, and a close stamp. A missing field keeps the bench dark until someone fills it. A filled field still needs a human name beside it.

Keep a named relay

The Desk Editor accepts or refuses the job before any prompt. The Run Witness watches the session and records what changed. The Closer stamps keep, hold, or discard after the diff.

A small team may let one person wear two hats. The same person must not edit, witness, and close one run. Split the close onto a second engineer when headcount is thin.

Work starts only after the editor files the envelope. Work moves when the witness links the diff and the log. Work ends when the closer stamps that same envelope.

Handoffs fail when chat threads become the only record. Chat scrolls away, while a wiki page stays searchable. Paste the envelope under a stable wiki slug before the run.

The one-page run has four beats and no extra ceremony. The beats are file, check, prompt, and stamp, with names attached. If any beat lacks a name, the relay stops and the bench stays dark.

The witness handoff can read: diff linked, data class unchanged, clock intact. The closer handoff can read: tests rerun, secrets absent, stamp is keep. Hold means the diff stays unmerged until a named person returns.

Stop when the data class drifts

The next scene is a composite failure, not a measured incident. A parser spike starts public, then an internal log gets pasted. The free server then holds data the envelope never allowed.

The witness should stop the moment the data class changes. A class change is a new job, not a quiet continuation. The editor must refile the envelope before the next prompt.

Some teams reach this bench through MonkeyCode. Disclosure: This article was prepared as part of MonkeyCode's product outreach. The operator reports free model access and a free server option.

Those two claims are availability notes, not a capacity contract. This article does not name models, quotas, hardware, or duration. Copy any live limit the product shows into the envelope.

If the product shows no number, write unknown and cap locally. A local cap is a team rule, not a vendor promise. Stop the run when the cap or the clock hits first.

Free access can change without a long public notice. A free server can be shared, slow, reset, or withdrawn. The envelope should say what the team will do if access ends.

Pick a throwaway repository for the first sealed run. Keep production secrets and customer data off that repository. Treat the free server like a hallway whiteboard, not a vault.

Data class belongs on the first line a stranger will read. Use public, internal, or forbidden as the only three labels. Forbidden means the editor refuses the job before any prompt.

Purpose should fit in one sentence a stranger can audit. A bare try-the-model line is not a purpose and should fail. A purpose like rewrite the parser and keep tests green can pass.

Stop time is a clock, not a mood. Write an absolute timestamp in UTC plus a maximum minute count. The witness closes the session when either bound is reached.

Local work and free-server work are not the same risk. Use local mode when the sample never leaves the laptop. Use the free server only when the card names that mode.

A shared server adds neighbors, restarts, and unclear retention. The witness should record restart, timeout, and empty response. Those notes belong on the envelope before the closer stamps it.

Paste a gate, not a slogan

The artifact below is an unexecuted example for a wiki page. Adapt names and paths before anyone trusts the checker. It refuses a run when required envelope fields are blank.

The card format is a flat key file, not a full YAML parser. Values may contain spaces, but each key stays on one line. Do not wrap values in quotes, because this parser keeps them.

#!/usr/bin/env python3
'''Unexecuted example: refuse a free-bench run with a blank envelope.'''

import sys
from datetime import datetime, timezone

REQUIRED = [
    'purpose',
    'data_class',
    'vendor',
    'server_mode',
    'owner_editor',
    'owner_witness',
    'owner_closer',
    'stop_at_utc',
    'max_minutes',
    'repo',
    'secret_policy',
    'fallback_if_access_ends',
]

ALLOWED_CLASS = {'public', 'internal', 'forbidden'}
ALLOWED_SERVER = {'local', 'free_server', 'unset'}


def load_flat_card(path):
    data = {}
    with open(path, encoding='utf-8') as handle:
        for raw in handle:
            line = raw.strip()
            if not line or line.startswith('#') or ':' not in line:
                continue
            key, value = line.split(':', 1)
            data[key.strip()] = value.strip()
    return data


def refuse(message):
    print('REFUSE:', message)
    return 1


def main(path):
    card = load_flat_card(path)
    missing = [key for key in REQUIRED if not card.get(key)]
    if missing:
        return refuse('missing ' + ','.join(missing))
    if card['data_class'] not in ALLOWED_CLASS:
        return refuse('data_class must be public, internal, or forbidden')
    if card['data_class'] == 'forbidden':
        return refuse('forbidden data never reaches the bench')
    if card['server_mode'] not in ALLOWED_SERVER:
        return refuse('server_mode must be local, free_server, or unset')
    if card['owner_editor'] == card['owner_closer']:
        return refuse('editor and closer must be different people')
    if card['secret_policy'] != 'no_secrets_in_prompt_or_repo':
        return refuse('secret_policy must block prompts and the repo')
    if len(card['purpose'].split()) < 6:
        return refuse('purpose is too thin to audit')
    try:
        stop = datetime.fromisoformat(card['stop_at_utc'].replace('Z', '+00:00'))
    except ValueError:
        return refuse('stop_at_utc must be ISO-8601')
    if stop.tzinfo is None:
        return refuse('stop_at_utc must include a timezone')
    if stop <= datetime.now(timezone.utc):
        return refuse('stop_at_utc is already past')
    try:
        minutes = int(card['max_minutes'])
    except ValueError:
        return refuse('max_minutes must be an integer')
    if minutes < 10 or minutes > 90:
        return refuse('max_minutes must stay between 10 and 90')
    stamp = card.get('close_stamp', 'open')
    if stamp != 'open':
        return refuse('a new run must start with close_stamp open')
    print('PASS: envelope is complete; a human closer is still required')
    return 0


if __name__ == '__main__':
    if len(sys.argv) != 2:
        print('usage: python3 check_envelope.py envelope.card')
        sys.exit(2)
    sys.exit(main(sys.argv[1]))

purpose: Rewrite the sample parser and keep the tests green
data_class: public
vendor: MonkeyCode
server_mode: free_server
owner_editor: desk.editor
owner_witness: run.witness
owner_closer: close.reviewer
stop_at_utc: 2026-10-10T18:00:00Z
max_minutes: 40
repo: example/throwaway-parser
secret_policy: no_secrets_in_prompt_or_repo
fallback_if_access_ends: stop and finish locally or wait
close_stamp: open

date -u +%Y-%m-%dT%H:%M:%SZ
python3 check_envelope.py envelope.card
cat > blank.card << 'EOF'
# empty on purpose
EOF
python3 check_envelope.py blank.card
echo blank_exit:$?
sed 's/^data_class: .*/data_class: forbidden/' envelope.card > forbidden.card
python3 check_envelope.py forbidden.card
echo forbidden_exit:$?

Save the checker beside the wiki export or inside the repo. Run it in trusted CI before a shared bench job starts. A failing check is a hard stop, not a note for later.

The minute bounds in the checker are team policy, not a product limit. Change 10 and 90 if the team already has a tighter rule. Do not treat those integers as a vendor quota or a promise.

The first test uses a blank card and expects a non-zero exit. The second test uses a full card and a future stop time. That complete card should return a zero exit from the checker.

The third test marks data class forbidden and expects refusal. A past stop time should fail even when the other fields look fine. These checks are the minimum before a shared bench opens.

The sample card uses a fake repo and fake owner names. Replace both before the first real session on a free server. Edit the stop time so it still sits in the future.

Read the checker output as a gate, not as a score. Pass means the envelope is complete, not that the code is safe. A human closer still reads the diff before any merge.

The sample commands stay small so a new teammate can audit them. Python 3 is enough for the field check shown here. No network call belongs inside this local checker.

A checker that phones home can leak the envelope itself. Keep validation on the laptop or in the trusted runner. Do not paste live keys into the card or the script.

Build the stop clock with a UTC command before the edit. Paste that timestamp into stop_at_utc and then add the minute cap. If the date command is missing, take UTC from a trusted clock.

Leave these jobs outside the envelope

Limitations sit next to the benefit, not in a buried footnote. The card cannot detect a prompt that smuggles a secret later. The card cannot prove a free server isolated the workload.

Reviewers can rubber-stamp a close after a long day. Rotate the closer when the same pair ships every shared run. A weekly sample of closed envelopes keeps the habit honest.

Skip this playbook for a solo notebook with no shared server. Skip it when legal counsel already owns the data path. Skip it if a public wiki would leak the card contents.

Also skip it when the task needs a named production runtime. Unknown model identity is acceptable only for a throwaway spike. Production merges need a pinned runtime the team can retest.

The method is slower than pure chat-driven coding on purpose. That slowness matters when several people share one bench. A sealed envelope costs minutes and can prevent a bad merge.

A team with a wiki can trial the reported free path next. Use a throwaway repo and wait for a pass from the checker. Keep that first run inside the stop time written on the card.

Free Bench Drafts Need a Merge Captain

Morgan Xu — Thu, 08 Oct 2026 10:46:21 +0000

A free coding bench can draft a patch in minutes. That speed does not sign the merge decision. A named captain still owns every diff that lands.

Contribution weeks reward visible pull requests over careful ownership. Shared repos then fill with polished diffs and thin context. The failure looks like speed, yet the gap is custody.

A loaner workbench helps a carpenter shape a board. The shop stamp still belongs to the lead on shift. Free model access deserves the same shop rule during a rush.

MonkeyCode offers free model access and a free server option. Disclosure: This article was prepared as part of MonkeyCode's product outreach. Those two claims come from the operator for this draft.

This draft relies on operator notes rather than a public quota page. A reader should recheck terms on the day of any real trial. Stale numbers do not belong in a desk log.

This runbook does not assume quotas, hardware, or lasting availability. It also avoids invented model names and benchmark scores. The useful part is the custody ritual around the bench.

Two names, one log

The desk names one accountable human, not a crowd of equal pens. The drafter may use the free bench to propose a patch. The merge captain accepts, trims, or rejects that patch.

A log file watches the run and never edits the tree. That log is the witness for the whole desk run. It records scope, commands, and the captain stamp.

Handoff is a short walk between seats, not a long thread. The drafter leaves a scope slip beside the proposed diff. The captain reads that slip before opening the patch.

The slip names the repo, the branch, and the allowed files. It also names tests that must pass on a clean tree. Missing lines stop the handoff like a locked shop door.

Practice room, not the floor

The free server is a practice room, not the production floor. Drafts may run there when that option is actually available. Secrets, customer data, and deploy keys stay off that room.

A team that cannot separate those rooms should skip this desk. A solo maintainer who is also the only reviewer should skip it. Regulated trees need a second human outside this sketch.

The one-page run below is a proposal for a team wiki. It is not a record of a finished production rollout. A team can paste it and adapt seat names to the real roster.

# Merge desk - one-page run

Purpose. Keep a free-bench draft from landing without a named captain.

Drafter. May use free model access on the bench branch. May edit only files named in the slip.

Merge captain. Owns the diff, the push decision, and the final stamp. Must be a human.

Desk log. Holds the slip, the test output, and the stamp time. It is a file, not a third reviewer.

Start. The drafter creates desk/scope.md on the bench branch. The captain is named before the first model call.

Handoff. The drafter runs the tests and saves desk/test.log. The captain checks the slip, the log, and the branch. The captain then writes PASS or HOLD.

Stop. No push when the captain field is empty. No secrets on the free server. No claim of a fixed quota, a fixed machine, or permanent free access.

A door card, then a gate

The page is short on purpose, like a door card in a shop. People ignore long manuals during a contribution rush. A door card stays visible when the queue gets loud.

The local gate is also a proposal, not a hosted control plane. It checks that the slip, the log, and the branch agree. It does not judge code quality or license risk.

#!/usr/bin/env bash
# Proposal only. Does not push, and does not call a remote API.
set -euo pipefail

slip="desk/scope.md"
log="desk/test.log"

test -f "$slip" || { echo "missing scope slip"; exit 2; }
test -f "$log" || { echo "missing test log"; exit 2; }

captain=$(awk -F': ' '/^captain: /{print $2}' "$slip")
branch=$(awk -F': ' '/^branch: /{print $2}' "$slip")

if [ -z "${captain}" ] || [ "${captain}" = "UNSET" ]; then
  echo "captain unset; hold the diff"
  exit 3
fi

current=$(git rev-parse --abbrev-ref HEAD)
if [ "${current}" != "${branch}" ]; then
  echo "branch mismatch: ${current} != ${branch}"
  exit 4
fi

echo "desk ready for captain review on ${branch}"

The gate runs from the repository root after the tests finish. A missing slip exits with code two and a plain message. An unset captain exits with code three and holds the diff.

The slip exists before the first model call on the branch. The captain field stays UNSET until a human accepts the seat. That empty field is the lock, not a decorative label.

ticket: BENCH-104
repo: example/widgets
branch: bench/BENCH-104
captain: UNSET
allowed_files:
  - src/widgets/parse.py
  - tests/test_parse.py
forbidden:
  - secrets
  - deploy keys
  - production urls
tests:
  - python -m unittest tests/test_parse.py

Allowed files should stay narrow, like a marked cutting area. A parser fix does not need a license edit in the same slip. Wide slips hide drive-by changes inside a friendly diff.

A dry-run helper

The captain can check the diff against that file list. The helper below is pseudocode for a local dry run. It was not executed against a live remote in this draft.

#!/usr/bin/env python3
"""Proposed dry-run helper. Unexecuted in this article."""
from pathlib import Path
import subprocess
import sys

def allowed_paths(slip: Path) -> set[str]:
    paths = set()
    in_list = False
    for line in slip.read_text().splitlines():
        if line.startswith("allowed_files:"):
            in_list = True
            continue
        if in_list and line.startswith("  - "):
            paths.add(line[4:].strip())
            continue
        if in_list and line and not line.startswith(" "):
            break
    return paths

def changed_paths() -> list[str]:
    out = subprocess.check_output(
        ["git", "diff", "--name-only", "HEAD"],
        text=True,
    )
    return [p for p in out.splitlines() if p]

def main() -> int:
    slip = Path("desk/scope.md")
    if not slip.exists():
        print("HOLD missing slip")
        return 2
    allow = allowed_paths(slip)
    extra = [p for p in changed_paths() if p not in allow]
    if extra:
        print("HOLD outside slip")
        for path in extra:
            print(path)
        return 3
    print("READY for captain review")
    return 0

if __name__ == "__main__":
    sys.exit(main())

The helper prints HOLD when a changed path leaves the slip. It prints READY only when every path stays inside the list. READY still means the captain must read the diff.

The helper sees tracked diffs and misses untracked files. A captain still lists the working tree before PASS. Running git status remains part of the human read.

A sample command sequence keeps the ritual concrete. The sequence below assumes a toy repo that already has that test module. Nothing in the sample is a customer result or a measured score.

git switch -c bench/BENCH-104
mkdir -p desk
cp docs/scope.example.yaml desk/scope.md
python -m unittest tests/test_parse.py | tee desk/test.log
bash desk/merge-desk.sh
python3 desk/check_slip.py

The tee line saves the test log beside the slip. The gate then refuses to bless a mismatched branch. That refusal is a pause, not a verdict on the patch.

A sample walk

A sample ticket shows the walk without pretending it shipped. The ticket is BENCH-104 on a toy parser in a sample repo. Nothing in that sample is a customer result or a benchmark.

The drafter asks the free model only about the listed parser bug. The prompt stays inside the slip, like a work order above the bench. The model may suggest a fix, and the drafter may edit it.

The drafter copies the command line into the desk log. The log names the test module and the exit status text. The captain then opens the diff and looks for extra files.

If the diff touches a changelog outside the slip, the stamp is HOLD. The drafter trims the extra file or widens the slip with a reason. Widening after the call is allowed only before any push.

Push remains a human command, not a hook this page installs. The bash gate prints a ready line and then stops. It does not call git push, and it should stay that way.

That limit matters on a shared machine with stored credentials. A ready line can tempt a tired captain to ship too fast. The page tells the captain to read the diff anyway.

Quiet failures

Failure usually starts when the drafter skips the slip. The diff looks complete, so the captain trusts the polish. Later the tree holds a change nobody meant to own.

Another failure is a captain named after the push. The stamp then records history instead of controlling it. The captain is named before the bench spends any model call.

A third failure is treating the free server as a vault. Availability is not the same thing as a security boundary. Tokens and production URLs stay on an approved secret store.

Free model access can still emit insecure or unlicensed code. The captain reads for both behavior and license fit. The captain records the license read in the desk log.

This desk is not a cover for bulk generated changes. The desk is not a tool for private repos or private data. Ordinary maintenance on a permitted tree is the whole scope.

Who should wait

Teams without a second reviewer should not adopt the page. Teams that need a fixed token quota should not invent one here. Teams that cannot keep secrets off the bench should wait.

The script can be wrong if the slip uses a loose glob. A glob that matches the whole tree defeats the cutting area. Explicit paths are safer until the team has reviewed the helper.

Time on the free server is not described in this runbook. Hardware shape and model choice are also left unnamed. Those facts belong to current product terms before any trial.

This page is a merge custody run, not a shift schedule. It does not assign on-call hours or batch quiet times. Those topics belong in other notes if the team needs them.

The captain stamp is a short line in the desk log. PASS means the captain read the diff and accepts the push. HOLD means the diff stays on the bench branch overnight.

Overnight is a figure of speech, not a measured service level. The team sets its own review delay outside this page. The page only insists that delay happens before the push.

Other tools can fill the drafter seat if the team prefers them. The custody rule does not depend on a single vendor name. The vendor mention here only marks where the free option fits.

Readers who already keep a wiki can paste the one-page run. They can trial the gate on a throwaway branch this week. That small trial teaches the custody gap better than a slogan.

File a Lane Card Before Sprint Drafts

Morgan Xu — Thu, 08 Oct 2026 08:19:38 +0000

A contribution sprint stays orderly only when a lane card exists first. Free model time is a shared bench, not a private shortcut. The card names the branch, the host, and the closer.

Unowned drafts collide on the same files before review starts. A practice server then holds stale builds from three people. The closer cannot tell which run still matters.

The card works like a relay baton on a short track. Only the person holding it may advance the branch. A missing baton means the sprint stops, not that someone improvises.

Name the lane before the prompt

MonkeyCode can fill the free model lane and the free server option. Disclosure: This article was prepared as part of MonkeyCode's product outreach. Those two options are availability claims, not a fixed size or span.

The team rechecks both options on the day the sprint opens. A help page can change without a wiki edit. The card stores the check time, not a guessed quota.

Seats for one sprint only

Four seats sit on the card, and none of them is optional. The charter keeper writes the card before any prompt is sent. The draft runner may call the model lane only after the card passes.

The server steward owns the practice host and its cleanup window. The merge reader is the only person who may open the pull request. A runner who also merges has skipped the handoff on purpose.

This card is not a generic role sheet for every coding hour. It binds one sprint, one branch prefix, and one practice host. When the sprint ends, the card is archived with the branch name.

Paste the card, then block the draft

A useful card is short enough to paste above the fold. Long policy text hides the fields that actually gate the run. The fields in the template are the whole contract.

# lane-card.env — proposed template, not a live record
sprint_id=2026-10-contrib-01
branch_prefix=sprint/contrib-01
practice_host=practice.example.internal
model_lane=free-model-access
server_option=free-server
charter_keeper=NAME
draft_runner=NAME
server_steward=NAME
merge_reader=NAME
checked_at=YYYY-MM-DDThh:mmZ
scope=docs-and-tests
forbidden=production-hosts,secrets,force-push
handoff_state=draft

The template above is a proposal, not a record from a finished sprint. Names stay blank until a person accepts the seat. A filled card with invented names is worse than an empty one.

Scope stays narrow on the first run of this playbook. Docs and tests are enough to prove the handoff. Feature work can wait until the card has survived one archive.

The local check is the gate, not a chat reminder. A script reads the card and refuses a draft when a field is blank. The example below is unexecuted proposal code for a wiki.

#!/usr/bin/env bash
# check-lane-card.sh — proposed, not executed in this article
set -euo pipefail
card="${1:-lane-card.env}"
test -f "$card"
set -a
# shellcheck disable=SC1090
source "$card"
set +a
required=(
  sprint_id branch_prefix practice_host model_lane
  server_option charter_keeper draft_runner
  server_steward merge_reader checked_at scope
)
for key in "${required[@]}"; do
  val="${!key:-}"
  if [[ -z "$val" || "$val" == NAME || "$val" == YYYY-MM-DDThh:mmZ ]]; then
    echo "block: $key is unset" >&2
    exit 2
  fi
done
case "$practice_host" in
  *prod*|*production*)
    echo "block: practice host looks production" >&2
    exit 3
    ;;
esac
if [[ "$draft_runner" == "$merge_reader" ]]; then
  echo "block: runner and reader must differ" >&2
  exit 4
fi
echo "pass: ${sprint_id} may draft on ${branch_prefix}"

The runner executes that check from the repository root before the first prompt. A non-zero exit blocks the runner even when the lane is idle. Silence from the script is not a successful gate.

The keeper treats the card as trusted local text, not as model output. Sourcing a file can run shell code if someone tampers with it. A model must never be allowed to rewrite the card.

A passing check still does not grant a production login. The practice host is a rehearsal bench with disposable state. The steward wipes that state when the handoff reaches review.

The runner creates the branch only after the check prints pass. The commands below are examples for a local clone. They assume git is already configured for that clone.

./check-lane-card.sh lane-card.env
git switch -c sprint/contrib-01
git status --short

The draft runner then sends a bounded prompt to the free model lane. The prompt cites the card scope and forbids secrets and production hosts. A prompt wider than the card is a process bug, not a model win.

MonkeyCode enters here only as the lane named on the card. Removing that name leaves the same gate for any other lane. The playbook is about the handoff, not about a vendor ritual.

The runner pastes the model diff onto the branch and does not merge it. The steward then deploys that branch to the practice host. The host name must match the card or the deploy stops.

# Proposed rehearsal commands. Unexecuted example.
test "$practice_host" = "practice.example.internal"
git push origin "$branch_prefix"
ssh "$practice_host" -- 'cd /srv/rehearsal && git fetch origin && git switch sprint/contrib-01 && ./rehearse.sh'

Prove the branch on the practice host

The rehearsal script should prove the branch, not the whole product. It can run tests already in the repo and print the commit. It should refuse to run when the working tree is dirty.

#!/usr/bin/env bash
# rehearse.sh — proposed, not executed in this article
set -euo pipefail
git diff --quiet
git rev-parse --abbrev-ref HEAD | grep -q '^sprint/'
if [[ -f package.json ]]; then
  npm test --silent
elif [[ -f pyproject.toml ]]; then
  python -m pytest -q
else
  echo "block: no known test entrypoint" >&2
  exit 5
fi
git rev-parse --short HEAD

Those entrypoints are illustrations, not a claim about a specific repository. A team replaces them with the command its maintainers already trust. A missing entrypoint is a block, not a cue to skip tests.

The steward records the rehearsal result on the card before leaving the host. A failed rehearsal returns the card to draft, with the error line attached. A passing rehearsal moves the state from draft to ready.

commit: abc1234
practice_host: practice.example.internal
checked_at: 2026-10-08T09:00Z
result: rehearse.sh exited 0
handoff_state: ready

That note is an example shape, not evidence from a completed run. No timing numbers in this article come from a measured sprint. Teams should keep their own notes if they need proof later.

A ready state does not mean the branch is merged. The merge reader reads the diff, the rehearsal note, and the card. Only that reader may open the pull request for the sprint branch.

The handoff note stays short, not a novel. It names the commit, the practice host, and the check time. The reader rejects a note that lacks any of those three.

The card moves through three states, and a later check can guard them. Draft allows a model call on the named branch only. Ready allows the pull request, and closed allows only the archive.

Stop on a boring failure

Failure has a short path, and the path is boring on purpose. A blank seat, a production-looking host, or a shared merge identity stops the script. The runner does not negotiate around an exit code in chat.

Exit codes stay stable so a wiki can document them once. Exit two means a required field is still blank.

Exit three means the host string looks like production. Exit four means the runner and the reader are the same person. A wiki page lists those codes next to the script.

A stale check time is also a failure, even when every name is filled. The keeper refreshes the availability note, then reruns the script. Yesterday's free lane is not authority for today.

This limit matters because free access can shrink, pause, or change terms. The card never stores a token count, a hardware size, or a forever flag. Those figures were not verified for this draft, so they stay out.

Who should leave this card unused

Who should skip this playbook is equally clear. A solo experiment with no second reader does not need a four-seat card. An incident on a production host needs the incident channel, not a sprint template.

Teams that cannot name a human merge reader should not start the lane. People chasing a badge with no repository owner should not invent seats. The card is a coordination tool, not a costume for missing ownership.

Security testing sits outside this sprint lane card. The practice host must already be a host the team may use. Nothing here grants access or covers a system the team does not own.

Review remains human even when the draft came from a model. The reader looks for secret leaks, license mistakes, and scope drift. A green rehearsal script does not replace that read.

License and contribution rules still come from the target repository. The card does not override a maintainer guide or a code of conduct. If those documents conflict with the card, the repository wins.

A model draft can copy code the team may not ship. The reader checks license headers before the pull request opens. The lane card does not grant a copyright exception.

The archive step is part of the run, not an afterthought. The keeper sets the state to closed and stores the card. A later sprint starts a new card instead of editing the old one.

One rehearsal, then stop

A wiki team can paste this card beside its review checklist. One rehearsal branch can try the free model lane without a wide rollout. The same page should state that availability was rechecked that morning.

The closing rule for this playbook stays strict. No lane card means no free draft and no practice deploy. A passed card means one branch, one host, and one closer.

File a Three-Role Sheet Before Shared Coding

Morgan Xu — Thu, 24 Sep 2026 22:00:26 +0000

Shared coding stays safe only when three seats stay named. The owner, the scribe, and the closer must not share one chat. A one-page wiki run shows that split before any model call.

Teams lose hours when a draft arrives with no named owner. The diff looks finished, yet nobody may merge it. Treat that gap as a process bug, not a model bug.

Why the sheet comes first

A clean patch still fails when the handoff stays vague. Review needs a sealed brief, a bounded draft, and a verdict. Those three artifacts belong to three roles, even on a small team.

The sheet is a gate, not a status meeting. The next person should read it in one minute. A blank required field means the run has not started.

The three seats

The brief owner writes the task and the acceptance checks. That person also writes the out-of-scope list. The owner does not paste model output onto the branch.

The draft scribe runs the agent and posts the diff. The scribe records the prompt, the files, and the commands. The scribe does not approve the merge under any case.

The merge closer reads the diff against the checks. The closer may accept, return, or reject the draft. A missing closer means the ticket stays open.

One person may hold two seats on a tiny team. That person still signs both lines on the sheet. Hidden overlap is how a bad merge slips through.

Where a free lane fits

Practice work should not touch production hosts or live secrets. A separate server lane keeps a bad draft cheap to drop. Keep that lane off the production path while the brief stays soft.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. The brief states that free model access and a free server option exist. This playbook uses both only as a practice lane.

It assumes no fixed quota, named model, or hardware size. It also assumes no lasting price and no uptime promise. Recheck both options before any long batch of tickets.

The scribe starts only after the owner seals the brief. The free server holds the workspace for that draft. The closer still decides what may leave the lane.

The one-page run

Paste the block below into the team wiki before work starts. Fill every required field before the scribe opens a session. A TBD on a required line means the run waits.

# Shared coding run

- Run id:
- Date:
- Repo:
- Ticket:
- Brief owner:
- Draft scribe:
- Merge closer:
- Practice lane:
- Model access:
- In scope:
- Out of scope:
- Acceptance checks:
- Secrets allowed: none
- Prompt summary:
- Files touched:
- Commands run:
- Draft link:
- Closer verdict:
- Verdict note:
- Promoted commit:

That page is the whole SOP for this lane. Roles sit at the top and the verdict sits at the bottom. A new teammate can follow it without a meeting.

Handoff from owner to scribe

The owner seals scope before any prompt is sent. In-scope lines name files or behaviors the draft may touch. Out-of-scope lines name what the agent must not touch.

Acceptance checks are commands or observable results, not opinions. A good check reads like a test command. The words looks fine do not count as a check.

The scribe may refuse a brief that has no command. The owner posts the sheet link in the ticket. The scribe replies with the run id before work starts.

Handoff from scribe to closer

The scribe keeps the agent inside the practice lane. Live credentials stay off that lane for the whole run. The draft link points at a branch or a patch file.

The prompt summary stays short and skips secret dumps. Files touched must match the diff a closer will read. Commands run must be ones a closer can repeat.

If a command failed, the sheet says so in plain text. The scribe does not write the closer verdict. A verdict filled by the scribe is a process miss.

Handoff from closer to the branch

The closer reruns the acceptance checks on the practice lane. A green guess on a laptop is not enough. The closer also compares the diff with the out-of-scope list.

Extra files mean a return, not a long debate. Accept means a promoted commit hash lands on the sheet. Reject means the branch stays unmerged and the ticket stops.

Return means the scribe gets a note and a new draft link. The closer owns the merge button on the shared branch. Neither the agent nor the scribe may press it.

A checker for the sheet

Prose rules fade after a busy week on the team. A small script does not fade in the same way. The checker fails when a required field is empty or TBD.

It does not score the patch or call a model. It only guards the handoff before the scribe starts. The script below is an unexecuted example, not a measured result.

#!/usr/bin/env python3
"""Validate a shared-coding role sheet before the scribe starts."""

from pathlib import Path
import sys

REQUIRED = [
    "Run id",
    "Brief owner",
    "Draft scribe",
    "Merge closer",
    "In scope",
    "Out of scope",
    "Acceptance checks",
    "Secrets allowed",
]

def fields(text):
    found = {}
    for line in text.splitlines():
        if not line.startswith("- ") or ":" not in line:
            continue
        key, value = line[2:].split(":", 1)
        found[key.strip()] = value.strip()
    return found

def main():
    path = Path(sys.argv[1] if len(sys.argv) > 1 else "run-sheet.md")
    data = fields(path.read_text())
    missing = []
    for key in REQUIRED:
        if data.get(key, "") in ("", "TBD"):
            missing.append(key)
    if data.get("Secrets allowed", "") != "none":
        missing.append("Secrets allowed must be none")
    if missing:
        print("sheet blocked:")
        for item in missing:
            print("  - " + item)
        return 1
    print("sheet ready for scribe")
    return 0

if __name__ == "__main__":
    raise SystemExit(main())

Keep the filled sheet as docs/run-sheet.md in the repo. Run the check from that folder before the session opens. A zero exit means the scribe may start.

python3 check_sheet.py docs/run-sheet.md
echo "exit=$?"

A non-zero exit means the owner still owes a field. Do not bypass the script with a chat message. Update the sheet and run the check again.

The secrets rule is strict on purpose for this lane. Practice code may enter, and keys may not. A ticket that needs a secret does not belong here.

A dry run on fake fields

Use a sample sheet before the real ticket lands. The sample proves the field rules, not the model. Replace the names with people who will sign the run.

cat > /tmp/run-sheet.md << 'EOF'
# Shared coding run

- Run id: RUN-2041
- Date: 2026-09-25
- Repo: example/widgets
- Ticket: WID-88
- Brief owner: Avery Chen
- Draft scribe: Jordan Hale
- Merge closer: Sam Ortiz
- Practice lane: free server
- Model access: free practice access
- In scope: add a retry cap in client.py
- Out of scope: billing, auth, migrations
- Acceptance checks: python3 -m unittest tests.test_client
- Secrets allowed: none
- Prompt summary: TBD
- Files touched:
- Commands run:
- Draft link:
- Closer verdict:
- Verdict note:
- Promoted commit:
EOF
python3 check_sheet.py /tmp/run-sheet.md

Read against the required list, that sample meets the start rule. Prompt summary may stay TBD until the scribe writes it. The required set covers roles, scope, checks, and secrets.

Add a second check before merge if the team wants one. Require the draft link, the commands, and the verdict then. Keep the first check small so empty end fields do not block.

MERGE_REQUIRED = ["Draft link", "Commands run", "Closer verdict"]

def ready_to_merge(data):
    bad = []
    for key in MERGE_REQUIRED:
        if data.get(key, "") in ("", "TBD"):
            bad.append(key)
    verdict = data.get("Closer verdict", "")
    if verdict not in ("accept", "return", "reject"):
        bad.append("Closer verdict must be accept, return, or reject")
    return bad

Label that helper as a proposal until a real sheet is tested. It reads fields and does not open a server. That split keeps the SOP testable on a laptop.

What this playbook will not do

The sheet does not turn a weak brief into a good patch. It only stops an unnamed merge from landing quietly. A vague check still wastes the scribe session.

Write the check before blaming the model for a miss. Free model access is not a capacity plan for the queue. This page states no token count, rate, or end date.

If the free lane is gone, keep the same three roles. Any other practice host can hold the same sheet. The seats matter more than the vendor name on the lane.

The free server option is not a production stand-in. Do not point it at customer data or long-lived credentials. A green practice run is not a release approval.

The checker trusts the sheet text a human typed. A lying field can still pass this small script. Pair the script with a human closer, not with blind trust.

Who should skip it

Skip this playbook during a live incident response. Incident command already has roles and a clock. A wiki sheet will slow the first fix.

Write the sheet after the service is stable again. Use it then only if a follow-up patch needs an agent. The incident channel is the wrong home for this page.

Skip the lane when work touches regulated or payment data. Customer secrets are also out of scope for this sheet. The practice rule assumes secrets allowed stays none.

Skip it for a solo experiment with no shared branch. Three signatures are wasted motion in that case. Use the sheet when a second person must trust the draft.

Skip it when nobody will act as closer. An agent plus a scribe is not a review. Wait until a closer is named, then start the run.

Keep the page boring

The value sits in repeated fields, not in a clever prompt. Same seats and same checker should greet every ticket. New tickets should change the scope lines only.

Store the sheet next to the ticket, not in a chat scroll. Chat fades by the next shift, and the wiki page remains. The promoted commit on that page is the receipt to trust.

Teams with a wiki can paste this page onto the next practice ticket. The free server lane stays optional for that trial. The three named seats do not stay optional.

Park Live Tool URLs Behind a Practice Host

Morgan Xu — Wed, 23 Sep 2026 17:20:27 +0000

Live tool URLs should not meet first-pass agents. A practice host should absorb that first-pass traffic instead. This playbook parks live endpoints behind a named desk, then promotes work only after a short wiki run.

Tool-calling agents behave like touring theater crews. Opening night needs lights, cues, and paid seats. Tech rehearsal needs a cheap hall and a marked floor. Many teams skip the hall. They point agents at live APIs during prompt thrash. Bills rise. Logs mix. On-call gets noise from fake failures.

The practice host is that cheap hall. Free model access can draft the agent turns. A free server can host the mock tools and the router. Live URLs stay behind a clerk. That split is the whole SOP.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode provides free model access and a free server option. Those two pieces fit this desk when a team needs a shared practice host. The playbook still works if another practice host already exists. Strip the product name and the steps remain useful.

Current agent stacks call tools in tight loops. Each loop can fan out into HTTP, SQL, or ticket writes. First drafts of those loops are unstable. Schema guesses miss fields. Retries stampede. A practice host keeps that weather off the paid coast.

This article does not claim model names, quotas, or hardware. Availability of any free lane can change. Treat the host as a named environment, not a promise. Verify the current signup path on the project page before a team depends on it.

The one-page wiki run

Paste the block below into the team wiki. Fill the four hats before any agent batch. Two people may hold two hats. Hats still need names, not vibes.

# Practice Host Run — Agent Tool Spend
Status: OPEN | PROMOTED | BLOCKED
Batch id: tool-loop-YYYYMMDD-##
Lane clerk: @name
Tool owner: @name
Spend watcher: @name
On-call reviewer: @name

Practice host: https://practice.internal.example
Live tool URLs: LOCKED until Status=PROMOTED
Model lane: practice-free (no live billed route)
Mock map: /wiki/tool-mocks/{batch id}
Receipt path: /var/log/practice-host/{batch id}.json

Go / no-go:
- [ ] Practice host healthcheck 200
- [ ] Live URLs absent from agent env
- [ ] Mock map covers every tool name
- [ ] Receipt printer writes one file
- [ ] Spend watcher signed the card

The card is the stage manager. Nobody starts a loop until Status reads OPEN. Nobody points at live URLs until Status reads PROMOTED. BLOCKED means the host is sick or the mock map is thin. Agents wait. Humans talk.

Roles that actually move

The lane clerk owns the practice host URL and the env file. That person rotates secrets for the desk, not for production. The tool owner writes one mock per live endpoint. A mock must fail in the same shape as the live API. Status codes matter more than witty body text.

The spend watcher is the only hat that can flip PROMOTED. That person checks the receipt, not the prompt poetry. The on-call reviewer reads the receipt before the batch hits a shared calendar. Review is a signature, not a meeting.

Think of the four hats as a loading dock. Boxes do not walk onto the truck alone. A clerk tags them. An owner confirms contents. A watcher signs the gate. A reviewer keeps the night shift from inheriting a mess.

A router that refuses live URLs

The next script is a proposed gate, not production law. Run it on the practice host. It should refuse any live tool URL while the batch is OPEN. Label this example as unexecuted until the team pins versions.

# practice_host_gate.py — proposed env gate for OPEN batches
import json, os, sys, time, urllib.parse
from pathlib import Path

LIVE_HINTS = ("api.prod.", "billing.", "stripe.", "github.com", "api.openai.")
RECEIPT = Path(os.environ.get("PRACTICE_RECEIPT", "/tmp/practice-receipt.json"))

def host_of(url: str) -> str:
    return urllib.parse.urlparse(url).hostname or ""

def assert_practice(env: dict) -> list[str]:
    failures = []
    status = env.get("BATCH_STATUS", "")
    if status not in {"OPEN", "PROMOTED", "BLOCKED"}:
        failures.append("BATCH_STATUS missing or unknown")
    base = env.get("TOOL_BASE_URL", "")
    host = host_of(base)
    if status != "PROMOTED":
        if not host.startswith("practice."):
            failures.append(f"non-practice host while {status}: {host}")
        for hint in LIVE_HINTS:
            if hint in (host or "") or hint in base:
                failures.append(f"live hint {hint} in TOOL_BASE_URL")
    if env.get("MODEL_LANE") == "live-billed" and status != "PROMOTED":
        failures.append("billed model lane before PROMOTED")
    return failures

def write_receipt(env: dict, failures: list[str]) -> None:
    payload = {
        "ts": int(time.time()),
        "batch_id": env.get("BATCH_ID"),
        "status": env.get("BATCH_STATUS"),
        "tool_base": env.get("TOOL_BASE_URL"),
        "model_lane": env.get("MODEL_LANE"),
        "ok": not failures,
        "failures": failures,
    }
    RECEIPT.write_text(json.dumps(payload, indent=2))
    print(json.dumps(payload))

if __name__ == "__main__":
    fails = assert_practice(os.environ)
    write_receipt(os.environ, fails)
    sys.exit(1 if fails else 0)

A shell wrapper keeps humans from exporting live URLs by habit. Put it in the same wiki page as the card. The wrapper is also a proposal until the team tests it on the practice host.

#!/usr/bin/env bash
# pin-practice-host.sh — proposed wrapper, not a blessed binary
set -euo pipefail
: "${BATCH_ID:?}"
: "${BATCH_STATUS:=OPEN}"
export BATCH_STATUS TOOL_BASE_URL="${TOOL_BASE_URL:-https://practice.internal.example}"
export MODEL_LANE="${MODEL_LANE:-practice-free}"
export PRACTICE_RECEIPT="/tmp/${BATCH_ID}.json"

if [[ "$BATCH_STATUS" != "PROMOTED" ]]; then
  case "$TOOL_BASE_URL" in
    *api.prod.*|*billing.*) echo "live URL blocked"; exit 2 ;;
  esac
fi
python3 practice_host_gate.py

The receipt is the dock ticket. It records host, lane, and failures. Later debugging starts there, not in chat scrollback. If the file is missing, the batch did not start. If ok is false, the clerk left a live hint in the env.

Handoff between desks

Promotion is a file, not a vibe. The spend watcher copies the receipt into the wiki card. The tool owner pastes the mock map diff. The lane clerk rotates the practice secret if the batch leaked a token into logs. Then Status becomes PROMOTED. Only then may TOOL_BASE_URL point at a live host.

A compact handoff object keeps that story portable. Agents should not parse it. Humans and CI should.

{
  "batch_id": "tool-loop-20260923-01",
  "from": "practice",
  "to": "live",
  "status": "PROMOTED",
  "receipt": "/var/log/practice-host/tool-loop-20260923-01.json",
  "mocks_covered": ["create_ticket", "search_docs", "post_comment"],
  "live_urls_unlocked": ["https://api.internal.example/v1"],
  "watcher": "spend-watcher",
  "reviewer": "oncall"
}

Refuse promotion when mocks_covered is shorter than the tool list. Refuse promotion when the receipt says ok false. Refuse promotion when the reviewer hat is empty. Empty hats are how live URLs sneak back in.

What the practice host must mimic

A practice host is not a toy. It must speak the same content types as the live tools. JSON keys should match. Error envelopes should match. Timeouts should be injected on purpose. Agents learn from those bruises. They should not learn them on a billed endpoint.

A thin mock that always returns 200 trains a liar. The tool owner should script at least one 409, one 429, and one 5xx per tool. Keep those fixtures next to the wiki card. Name them after the batch id so leftovers do not haunt the next crew.

# proposed fixture sketch — unexecuted until pinned
FIXTURES = {
    "create_ticket": [
        {"status": 201, "body": {"id": "T-1"}},
        {"status": 409, "body": {"error": "duplicate"}},
        {"status": 429, "body": {"error": "rate"}},
    ]
}

Free model access belongs on the OPEN side of this split. The model is drafting tool arguments against mocks. It should not hold production credentials. The free server belongs there too. It holds the router, the fixtures, and the receipt printer. Live billed routes wait for PROMOTED.

Limitations

This SOP is a traffic dock, not a security boundary. A determined process can still paste a live URL. The gate only catches env mistakes and common host hints. It will not stop a tool that embeds a hardcoded production client.

Shared practice hosts are the wrong place for customer secrets. Do not load production dumps onto a free server. Do not point the practice model lane at private datasets. If the batch needs real PII, stop. Build an isolated staging account instead.

The playbook also fails when mocks lie about side effects. A mock create_ticket that never stores state will hide idempotency bugs. Those bugs then bloom after PROMOTED. The tool owner should keep a tiny store, even a JSON file, so retries collide on purpose.

Do not treat free model access as a capacity plan. Do not treat a free server as a permanent plant. Teams should re-read the current product terms before a quarter-long dependency. This article does not publish quotas, uptime, or model catalogs.

Who should not run this

Solo scripts with no billed tools do not need four hats. A local mock on localhost is enough. Air-gapped shops cannot use a shared free server. They should print the same card against an internal host.

Regulated pipelines that already forbid mixed environments should not add a new shared desk. Follow the existing promotion lane. Teams without a wiki will lose the card in chat. Start with a repo file if the wiki is theater.

If the agent never calls an HTTP tool, this dock is ceremony. Skip it. Spend the energy on tests for the actual side effect.

A short close

Park live tool URLs behind a practice host. Name the four hats. Print a receipt. Promote only on a signed card. The cheap hall exists so opening night is dull.

Teams that already keep a wiki runbook can seat MonkeyCode's free model access and free server as that hall, then keep the same clerk path when the batch finally earns a live URL.

Hang a Rehearsal Gate Before Agent Tool Calls

Morgan Xu — Tue, 22 Sep 2026 15:35:28 +0000

Shared agents should not call live APIs first. They should walk a rehearsal gate instead. The gate is a one-page wiki run with named roles.

Live tool calling looks cheap until a retry storm starts. One wrong schema can fan out across every checkout. A rehearsal gate catches that blast before customers feel it.

Think of the gate as a fire drill for tools. The drill uses a stub wall, not the real warehouse. Agents practice the motion without moving real inventory.

This playbook stays useful without any vendor in the loop. It asks for a contract, a stub, and a human closer. The closer signs the wiki card before production traffic.

The failure this card exists to stop

An agent receives a tool list and a user goal. It emits a JSON call that almost matches the schema. Production still accepts the call and charges a card twice.

The on-call thread then argues about intent versus transport. Nobody can say who approved the tool shape. The rehearsal gate makes that approval visible and boring.

Roles on the floor

Three seats matter, and they do not share a keyboard. The lane owner owns the stub and the freeze window. The tool clerk owns the JSON contract and examples.

The closer is a human reviewer with merge rights. The closer never runs the agent during the drill. That split keeps the rehearsal honest when output looks fluent.

Handoffs travel only through the wiki card below. Chat messages do not count as a handoff. If the card is stale, the gate stays shut.

The one-page wiki run

Paste this block into the team wiki. Fill every field before the first agent turn. Leave the card in the ticket until the closer signs.

# Rehearsal Gate — Tool-Call Drill
Date: YYYY-MM-DD
Service: payments-api
Lane owner: @name
Tool clerk: @name
Closer: @name
Freeze window: 14:00-15:00 UTC

Contract file: /contracts/payments.create_refund.json
Stub base URL: http://127.0.0.1:8787
Forbidden hosts: api.prod.example.com, api.staging.example.com

Goal (one sentence):
Agent may draft a refund call against the stub only.

Pass bar:
- schema validate exits 0
- stub log shows one POST /refunds
- no packet to forbidden hosts
- closer initials below

Fail bar:
any extra host, extra verb, or missing field

Closer sign-off: ____  time: ____

The wiki card stays short on purpose every time. Long runbooks tend to hide the freeze window. A one-page gate can be read in a standup.

A contract the clerk can test

The clerk checks in a JSON Schema for each tool. The file is the source of truth, not the prompt. Prompts drift while reviewed files stay pinned.

{
  "$id": "payments.create_refund",
  "type": "object",
  "additionalProperties": false,
  "required": ["order_id", "amount_cents", "reason"],
  "properties": {
    "order_id": { "type": "string", "pattern": "^ord_[a-z0-9]{8,}$" },
    "amount_cents": { "type": "integer", "minimum": 1, "maximum": 50000 },
    "reason": {
      "type": "string",
      "enum": ["duplicate", "not_received", "courtesy"]
    }
  }
}

That refund contract is deliberately tight by design. Courtesy refunds still need a reason enum. Open string fields are how silent over-refunds start.

A stub the lane owner can run

The lane owner starts a local recorder, not a proxy to prod. The recorder answers 201 and writes a jsonl log. Agents must target this stub origin only.

#!/usr/bin/env python3
"""Rehearsal stub. Label: unexecuted until the lane owner starts it."""
from http.server import BaseHTTPRequestHandler, HTTPServer
import json, datetime
from pathlib import Path

LOG = Path("/tmp/rehearsal-gate.jsonl")

class Handler(BaseHTTPRequestHandler):
    def do_POST(self):
        length = int(self.headers.get("Content-Length", "0"))
        raw = self.rfile.read(length)
        try:
            body = json.loads(raw.decode() or "{}")
        except json.JSONDecodeError:
            self.send_error(400, "invalid json")
            return
        rec = {
            "ts": datetime.datetime.utcnow().isoformat() + "Z",
            "path": self.path,
            "host": self.headers.get("Host"),
            "body": body,
        }
        with LOG.open("a") as fh:
            fh.write(json.dumps(rec) + "\n")
        self.send_response(201)
        self.send_header("Content-Type", "application/json")
        self.end_headers()
        self.wfile.write(b'{"ok":true,"id":"reh_001"}')

    def log_message(self, fmt, *args):
        return

if __name__ == "__main__":
    HTTPServer(("127.0.0.1", 8787), Handler).serve_forever()

The script binds localhost on purpose for isolation. Binding 0.0.0.0 would invite other agents. Shared laptops are not a rehearsal lane.

A clerk check that fails closed

The clerk runs a validator before the agent is seated. The command must exit nonzero on extra keys. Extra keys are treated as production leaks.

#!/usr/bin/env python3
"""Validate one tool payload against the checked-in schema."""
import json, sys
from pathlib import Path

try:
    import jsonschema
except ImportError:
    sys.stderr.write("pip install jsonschema\n")
    sys.exit(2)

schema = json.loads(Path(sys.argv[1]).read_text())
payload = json.loads(Path(sys.argv[2]).read_text())
jsonschema.validate(payload, schema)
print("contract_ok")

python3 validate_tool.py contracts/payments.create_refund.json sample.json
python3 - <<'PY'
import json, pathlib
p = pathlib.Path("/tmp/rehearsal-gate.jsonl")
rows = [json.loads(l) for l in p.read_text().splitlines() if l]
assert len(rows) == 1, rows
assert rows[0]["path"] == "/refunds"
print("stub_ok")
PY

These commands are the pass bar on the wiki card. Green output is not a vague vibe check. It is two assertions and a schema.

Pin the allowlist in the agent runner

The runner must refuse any tool host outside the stub. Loose environment variables are not a real policy. Policy lives in a checked-in file beside the contract.

#!/usr/bin/env python3
"""Refuse tool URLs that escape the rehearsal gate."""
from urllib.parse import urlparse
import json, sys

ALLOWED = {"127.0.0.1:8787", "localhost:8787"}

def allowed(url: str) -> bool:
    parsed = urlparse(url)
    host = f"{parsed.hostname}:{parsed.port or 80}"
    return host in ALLOWED and parsed.scheme == "http"

call = json.loads(sys.stdin.read())
url = call.get("url", "")
if not allowed(url):
    sys.stderr.write(f"blocked:{url}\n")
    sys.exit(1)
print("allowlist_ok")

echo '{"url":"http://127.0.0.1:8787/refunds"}' | python3 allowlist.py
echo '{"url":"https://api.prod.example.com/refunds"}' | python3 allowlist.py
# second command must exit 1

The second command is the real rehearsal test. A green first command proves almost nothing alone. Blocking the production host is the rehearsal.

When the clerk hands the lane owner the baton

The clerk posts the schema hash on the wiki card. The lane owner starts the stub only after that hash appears. Starting early invites an old contract into the log.

The closer waits for both ok lines in the ticket. Silence in chat is not a passing signal. The card is the only baton the floor trusts.

sha256sum contracts/payments.create_refund.json
# paste the digest into the wiki card before the stub starts

That digest is the handoff, not a hallway nod. A mismatched hash means the gate stays shut. The lane owner does not “just run it anyway.”

Where a free rehearsal host fits

Some teams lack a spare box for the stub. They still should not point agents at staging. Staging data is often production-shaped and legally hot.

Some teams park that rehearsal on MonkeyCode. Disclosure: This article was prepared as part of MonkeyCode's product outreach.

The project is published as open source. The project offers free model access and a free server option. Those availability notes are the only product claims in this article.

The wiki card does not require that host. Any isolated server that cannot reach forbidden hosts works. The point is isolation, not a brand.

A team already evaluating that option can paste the card first. Then they point the agent at the stub origin. They keep production hostnames out of the tool allowlist.

Limitations

This gate does not prove the model chose the right tool. It only proves the call was well-shaped and well-aimed. Semantic mistakes still need a closer who reads the goal.

The current stub always returns a 201 status. Real APIs return 409, 429, and 503. A later drill should inject those codes on purpose.

The jsonl log is not a compliance archive. It lives in /tmp and will vanish. Teams with audit needs must ship the log to their own store.

Clock drift and parallel agents will break the "one POST" assert. The freeze window on the card exists for that reason. Overlapping drills share a log and lie.

Who should not use this run

Solo developers with one local process can skip the seats. The three-role split is overhead without a shared floor. A single person can still keep the schema file.

Air-gapped teams should not use a hosted rehearsal. They should run the stub on hardware they already control. The card still works in that room.

Regulated payment teams may need a legal review of even stubbed refunds. This article is not that legal review. The closer should halt if counsel has not spoken.

Close the gate

The closer initials the card only after both commands print ok. Then the freeze window ends and the stub is killed. Production tool calling stays blocked until that signature exists.

A rehearsal gate is a seatbelt, not a destination. It makes tool calling boring enough to review. Boring reviews are how shared agents survive a week.

Seat a Token Holder Before Shared Model Runs

Morgan Xu — Mon, 21 Sep 2026 13:55:04 +0000

A shared free coding server fails without a named owner. Session history turns into a junk drawer overnight. A rotating token holder and a one-page wiki keep the lane usable.

Shared model work looks cheap until the kitchen goes cold. Picture one stove in a crowded hostel kitchen. Ten cooks start soup and vanish before cleanup. The next shift tastes three dinners and calls it lunch.

This pattern appears when a team shares one assistant. Someone pastes a stack trace into the thread. Someone else pastes a refactor with no warning. The context window fills with leftovers from both. Reviewers later treat the diff as one mind.

The repair is a run token, not a clever prompt. Only the token holder may start a model session. Everyone else files a note or waits in line. The token is a wiki line plus a git stamp.

Three roles travel with that token each day. The Token Holder opens the session and records the goal. The Shadow Reviewer watches the diff without sending prompts. The Merge Steward refuses merges that lack a stamp. Rotation happens at a posted hour, never by mood.

MonkeyCode enters here as shared tooling, not magic. Disclosure: This article was prepared as part of MonkeyCode's product outreach. Teams already using its free model access still need a named holder. Its free server option does not replace a seated owner. A free lane without an owner remains a hostel stove.

The one-page wiki run belongs at a boring path. Paste it under wiki/run-token.md and keep it short. The page is the fridge note for the stove. If the page grows past one screen, process debt is hiding.

# Run token (one page)

Lane: shared free-model server (team sandbox only)
Posted hour: 16:00 local, weekdays
Live holder: (name) / Shadow: (name) / Steward: (name)

Seat rule
- Holder starts the only live session.
- Shadow reads diffs and tests. Shadow does not prompt.
- Steward merges only with a stamp id in the PR body.

Start
1. Run `scripts/seat-run-token.sh "goal text"`.
2. Paste the printed `RUN_TOKEN` into the wiki line `Live stamp`.
3. Close any leftover chat or server session first.

Handoff
1. Holder pastes stamp path plus last command in the ticket.
2. Incoming holder reruns `scripts/seat-run-token.sh --resume <id>`.
3. Incoming holder writes `seated` on the wiki line.
4. Old session must be idle before the new seat.

Stop conditions
- No stamp, no prompts.
- Prod credentials never enter the shared lane.
- Incident override needs steward initials on the stamp.

A session starts with a stamp file, not chat. The holder runs a small script before the first prompt. The script writes an id, a goal, and a timestamp. Later review reads that file instead of hallway memory.

The script below is a proposed local helper, not a production service. Teams should read it, then place it next to the wiki page. It only writes a receipt. It does not call a model.

#!/usr/bin/env bash
# scripts/seat-run-token.sh — proposed helper, unexecuted here
set -euo pipefail

ROOT="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
DIR="${ROOT}/.run-tokens"
mkdir -p "${DIR}"

RESUME=""
GOAL=""
while [[ $# -gt 0 ]]; do
  case "$1" in
    --resume) RESUME="${2:-}"; shift 2 ;;
    *) GOAL="$*"; break ;;
  esac
done

if [[ -n "${RESUME}" ]]; then
  FILE="${DIR}/${RESUME}.md"
  if [[ ! -f "${FILE}" ]]; then
    echo "missing stamp ${RESUME}" >&2
    exit 1
  fi
  {
    echo
    echo "## resume $(date -u +%Y-%m-%dT%H:%M:%SZ)"
    echo "holder: ${USER}"
  } >> "${FILE}"
  echo "RUN_TOKEN=${RESUME}"
  echo "FILE=${FILE}"
  exit 0
fi

if [[ -z "${GOAL}" ]]; then
  echo "usage: $0 \"goal text\"" >&2
  exit 1
fi

STAMP="$(date -u +%Y%m%dT%H%M%SZ)-${USER}"
FILE="${DIR}/${STAMP}.md"
cat > "${FILE}" <<EOF
# run token ${STAMP}

- holder: ${USER}
- seated_at: $(date -u +%Y-%m-%dT%H:%M:%SZ)
- goal: ${GOAL}
- lane: shared-free-model
- shadow:
- steward:
EOF

echo "RUN_TOKEN=${STAMP}"
echo "FILE=${FILE}"

The holder then records the same id on the wiki line. That double write is the point. Git keeps the receipt. The wiki keeps the living name. If those two disagree, the steward treats the lane as dirty and sits nobody until they match.

A dirty lane feels like a cutting board left wet. The next cook still uses it. The food still leaves the kitchen. Nobody can say which knife made the nick. Shared model output has the same nick when two people typed.

The merge steward can reject unmarked work in CI. A tiny check looks for RUN_TOKEN= in the pull request body. Missing tokens fail the job with a short message. The check does not grade model output at all. It only proves a human claimed the shared lane.

# scripts/require_run_token.py — proposed CI check, unexecuted here
import os
import re
import sys
from pathlib import Path

body = os.environ.get("PR_BODY", "")
match = re.search(r"RUN_TOKEN=([A-Za-z0-9._-]+)", body)
if not match:
    print("no RUN_TOKEN= in pull request body")
    sys.exit(1)

token = match.group(1)
stamp = Path(".run-tokens") / f"{token}.md"
if not stamp.is_file():
    print(f"stamp missing: {stamp}")
    sys.exit(1)

text = stamp.read_text(encoding="utf-8")
if "goal:" not in text or "holder:" not in text:
    print("stamp incomplete")
    sys.exit(1)

print(f"run token seated: {token}")

Wire that check through a short workflow. The workflow only needs the pull request body. It should not scrape chat logs. Chat logs rot. Stamp files stay in git.

# .github/workflows/run-token.yml — proposed, unexecuted here
name: run-token
on:
  pull_request:
    types: [opened, edited, synchronize]
jobs:
  seated:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: require stamp
        env:
          PR_BODY: ${{ github.event.pull_request.body }}
        run: python3 scripts/require_run_token.py

Handoff is a written comment, not a standup speech. The outgoing holder pastes the stamp path and last command. The incoming holder reruns the log script and writes seated. If the free server still holds a live session, close it first. Abandoned sessions are yesterday's onion in today's soup.

A good handoff comment is dull on purpose. It names the stamp, the goal, and the last file touched. It does not retell the model chat. The next holder should rebuild intent from the stamp and the diff. If intent lives only in chat, the token already failed.

Handoff 2026-09-21T15:58Z
RUN_TOKEN=20260921T120003Z-mxu
FILE=.run-tokens/20260921T120003Z-mxu.md
LAST: src/billing/retry.go tests/billing/retry_test.go
STATUS: tests green locally; shadow has not signed
NEXT: incoming holder seats, then steward reviews stamp

The shadow reviewer works like a second cook who never touches the pan. That person reads the diff against the stamped goal. If the diff wanders, the shadow stops the holder. Stopping is the job. Polite silence is how hostel kitchens stay filthy.

Incident override exists because production pages do not wait. The steward initials the stamp and writes override. The holder still seats a token. The team still closes the live session after the fire. Override without a stamp is just another abandoned soup.

Current AI coding talk keeps circling measurement and pretend work. Shared lanes make both problems cheaper to hide. A green test suite can still come from a mixed session. The run token does not prove the code is right. It proves one named person owned the hour.

Limitations sit in plain view. This SOP does not score model quality or latency. It does not replace unit tests, design review, or secret scanning. It adds friction on purpose. Teams that skip the stamp during a rush will watch the wiki rot in a week.

Solo developers should not run this theater. One person already owns the stove. Two-person pairs can share a stamp without three role names. Huge orgs with private model contracts may need ticket queues instead. The hostel-kitchen analogy breaks when every cook has a private kitchen.

Keep credentials off the shared server. The token holder is not a vault. Paste samples, failing tests, and redacted logs only. If the work needs production data, leave the free lane. Move that work to an isolated environment with its own owner.

The method stays useful if the product name is removed. Any shared assistant needs a seated holder. The wiki page, the stamp script, and the CI check are the artifact. MonkeyCode is only one place that lane can live, including its free model access and free server option.

Teams that already keep a clean wiki can try that shared lane after the page exists. Seat the holder first. Then start the session. The stove stays usable when the fridge note is true.

Clock a Quiet Window Before Shared Agent Batches

Morgan Xu — Sun, 20 Sep 2026 11:52:29 +0000

Shared agent batches fail during quiet hours, not compile time. Teams that skip a named window leak work into on-call. A one-page quiet-hours card stops that leak.

The failure looks ordinary from the outside at first. An agent starts a long refactor on Friday evening. Shared free compute keeps running without a human owner.

Monday morning holds a half-applied diff and a dead session. The on-call engineer inherits a job nobody can replay. Chat logs then become the only map of intent.

A kitchen closes with a last-ticket time each night. Burners stay hot, but cooks refuse a new roast. Agent compute needs the same last-ticket rule.

The card is that rule, written once for the wiki. Anyone can reject a batch that lacks a live card. The ritual is short, and it survives tool changes.

Ownership is a clock

Long prompts do not create ownership on a shared box. Ownership lives in a named person and a clock. When those two are missing, the batch becomes unattended work.

Unattended work collides with change freezes and half-reviewed diffs. It also collides with pages that fire after midnight. The missing artifact is operational, not statistical.

Recent talk about AI evals skips this floor entirely. Teams argue about scores while jobs run past freeze. A duty officer can reject a card in thirty seconds.

The duty officer owns the quiet window for one calendar day. That person may abort any shared agent job on sight. The batch owner files the card before the first request.

The reviewer reads the card before any agent diff lands. The on-call engineer does not hunt for a missing owner. Handoff stays boring on purpose, and that is the point.

The wiki holds the canonical card for the day. The job directory holds a copy beside the prompt pack. The ticket holds a receipt hash of the same text.

A missing receipt hash is a failed handoff, not a style issue. Reviewers should bounce the ticket until the digest appears. The bounce is cheaper than a Monday autopsy.

The wiki card

Paste the block below into the team wiki. Keep the pasted card to one wiki screen. Do not grow that card into a process novel.

# quiet-hours-card.yaml — sample only, adapt names
schema: quiet-hours-card/v1
date: "2026-09-20"
timezone: "America/Los_Angeles"
window_start: "09:00"
window_end: "17:00"
duty_officer: "alex"
batch_owner: "sam"
reviewer: "riley"
repo: "billing-api"
goal: "rename invoice status enum without behavior change"
freeze_overlap: false
data_class: "no-prod-secrets"
stop_condition: "first failing test or window_end"
abort_contact: "pagerduty://agent-batch"

Stamp a copy into the run directory before launch. Hash the file and paste the digest into the ticket. The commands below keep that stamp cheap.

mkdir -p .agent-run
cp "$WIKI_EXPORT/quiet-hours-card.yaml" .agent-run/quiet-hours-card.yaml
git hash-object .agent-run/quiet-hours-card.yaml | tee .agent-run/receipt.sha
gh issue comment "$TICKET" --body "quiet-hours $(cat .agent-run/receipt.sha)"

Those commands do not start the agent process yet. They only create an auditable trail for the ticket. The wrapper in the next section is the gate that reads the trail.

A wrapper that refuses closed windows

The sample checker below is a starting wrapper. Teams should adapt paths and timezones before use. It is not a security boundary, and it will not stop a raw curl.

#!/usr/bin/env python3
"""Sample quiet-hours wrapper. Adapt before use. Unexecuted until a team wires it."""
from __future__ import annotations

import datetime as dt
import sys
from pathlib import Path
from zoneinfo import ZoneInfo

try:
    import yaml
except ImportError:
    sys.exit("install pyyaml before running this sample wrapper")

CARD = Path(".agent-run/quiet-hours-card.yaml")


def fail(msg: str) -> None:
    print(f"quiet-hours refuse: {msg}", file=sys.stderr)
    raise SystemExit(2)


def load_card() -> dict:
    if not CARD.exists():
        fail("missing .agent-run/quiet-hours-card.yaml")
    data = yaml.safe_load(CARD.read_text())
    if not isinstance(data, dict):
        fail("card is not a mapping")
    return data


def parse_window(card: dict) -> tuple[dt.datetime, dt.datetime, dt.datetime]:
    tz = ZoneInfo(str(card["timezone"]))
    day = dt.date.fromisoformat(str(card["date"]))
    start = dt.datetime.combine(
        day, dt.time.fromisoformat(str(card["window_start"])), tz
    )
    end = dt.datetime.combine(
        day, dt.time.fromisoformat(str(card["window_end"])), tz
    )
    now = dt.datetime.now(tz)
    return now, start, end


def main() -> None:
    card = load_card()
    for key in (
        "duty_officer",
        "batch_owner",
        "reviewer",
        "repo",
        "goal",
        "abort_contact",
        "data_class",
        "stop_condition",
    ):
        if not str(card.get(key, "")).strip():
            fail(f"blank field {key}")
    if card.get("freeze_overlap") is True:
        fail("freeze_overlap is true")
    if str(card.get("data_class")) != "no-prod-secrets":
        fail("data_class is not no-prod-secrets")
    now, start, end = parse_window(card)
    if now.date() != start.date():
        fail("card date is not today in the named timezone")
    if not (start <= now <= end):
        fail(f"now {now.isoformat()} outside {start.time()}–{end.time()}")
    print("quiet-hours allow")
    print(f"duty={card['duty_officer']} owner={card['batch_owner']}")
    print(f"stop={card['stop_condition']}")


if __name__ == "__main__":
    main()

Call the wrapper first, then start the agent process. A simple shell AND-chain keeps the order honest.

python3 sample_quiet_hours_check.py && ./run-agent.sh

If the window is closed, the agent never starts. If freeze_overlap is true, the agent never starts. If the data class drifts, the agent never starts.

Stop_condition belongs on the card for a reason. The duty officer needs a kill rule without rereading the prompt. First failing test is a clean default for refactors.

Some teams run these shared batches on MonkeyCode today. Disclosure: This article was prepared as part of MonkeyCode's product outreach. The open-source project offers free model access and a free server option.

The quiet-hours card does not depend on that vendor. Remove the product name and the ritual still holds. Treat the server as one more shared kitchen tonight.

The same wrapper still applies on a laptop agent. Shared boxes just make the leak louder. Free compute without a last-ticket time recreates the Friday roast.

Limits of the ritual

The wrapper only reads a clock and a few strings. It cannot prove the duty officer was awake. It cannot prove the reviewer will read the later diff.

Timezone mistakes will pass a closed window as open. A copied yesterday card can look valid at a glance. The date check exists to catch that copy, not malice.

Anyone can invoke the agent binary without the wrapper. Teams that need a hard control must hide the raw entrypoint. This sample wrapper does not hide that entrypoint.

The card also does not measure model quality. It does not replace tests, code review, or a change freeze. It only blocks a start that nobody agreed to time.

Solo developers with no pager rotation should skip this card. Mature change boards that already block compute can ignore it. Work that touches production secrets should not use shared agent boxes.

Overnight unattended runs against customer data remain out of scope. A quiet window is not consent for dark data. Abort_contact must be a real human path, not a void channel.

Print the card, then name the officer, then clock the window. Start the batch only after the wrapper prints allow. Teams already using that free server can store the card beside the wrapper.

Stamp a Replay Receipt Before Agent Tickets Close

Morgan Xu — Sat, 19 Sep 2026 09:55:35 +0000

Agent tickets stay open until a human replays the claim. Green text from a model is not proof. A second person must rerun the named command on the claimed commit. Only that receipt may close the ticket.

Cheap drafts make this gate feel slow. It is the opposite of waste. Volume without replay turns a sprint into theater. The floor looks busy. The branch still lies.

Modern agent sessions write tests, logs, and tidy summaries. They paste a passing trace into the ticket. Reviewers skim the story and move on. Nobody reruns the path on the claimed SHA. The bug returns on Monday like a bounced check.

A bank teller does not accept a handwritten total. The teller counts the drawer again. Agent work needs the same second count. Call that count a replay receipt.

The replay desk is a short shift, not a ceremony. One human owns the claim. A different human owns the replay. A desk lead can freeze closes when receipts go missing. Those three roles keep the lane honest.

The claimant never replays their own agent run. Familiarity hides skipped setup and quiet flags. A teammate checks out the SHA instead. They run the exact command written on the card. They file the receipt beside the ticket before anyone hits close.

Handoff is a card, not a chat ping. Chat evaporates after standup and shift change. The wiki keeps the SHA, the command, and the clock. The next replay owner can start cold without hunting scrollback.

Kitchen passes work the same way during a rush. The expo does not plate from a shouted status. The ticket stays in the window until the dish matches the order. Agent tickets deserve that same window. Generated narrative is the shout. Replay is the plate.

Paste this one-page run into the team wiki. Keep the wording boring and identical on every close. Novelty here is a defect, not a craft.

# Replay Desk — Close Gate

Ticket: T-____
Claimed SHA: ________
Claimed command (copy exactly):
  ________
Expected signal: exit 0 and the named test file
Claimant (ran the agent): @____
Replay owner (must be a different human): @____
Desk lead (may freeze closes): @____

Replay steps
1. Refuse a dirty worktree.
2. Detach at the claimed SHA.
3. Run only the claimed command.
4. Write replay-receipt.txt beside the ticket.
5. Close only if the receipt shows exit 0.

Freeze
If the SHA, command, or owner is blank, do not close.
If claimant equals replay owner, do not close.
If the command differs from the card, do not close.

The card is the contract. The script is the counter. Teams that skip the script start negotiating with memory. Memory is how fake-green work survives a busy afternoon.

Run the replay from a clean clone, not the claimant laptop. Shared laptops hide env files and leftover daemons. A throwaway worktree makes the second count mean something.

#!/usr/bin/env bash
# replay-receipt.sh — second count for an agent claim
set -euo pipefail

SHA="${1:?claimed sha}"
CMD="${2:?claimed command}"
TICKET="${3:?ticket id}"
OUT="${TICKET}-replay-receipt.txt"

if [[ -n "$(git status --porcelain)" ]]; then
  echo "dirty worktree; refuse replay" >&2
  exit 2
fi

git cat-file -t "$SHA" >/dev/null
git switch --detach "$SHA"

START="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
HOST="$(hostname)"
USER_NAME="$(id -un)"

set +e
bash -lc "$CMD"
STATUS=$?
set -e

{
  echo "ticket=$TICKET"
  echo "sha=$SHA"
  echo "cmd=$CMD"
  echo "started_utc=$START"
  echo "host=$HOST"
  echo "replay_user=$USER_NAME"
  echo "exit=$STATUS"
} > "$OUT"

git hash-object "$OUT" >> "$OUT"
echo "wrote $OUT with exit $STATUS"
exit "$STATUS"

Call it with three arguments and nothing else. Extra flags become a second story. Second stories are how tickets close on hope.

chmod +x replay-receipt.sh
./replay-receipt.sh 9f3c1aa "npm test -- src/billing.test.ts" T-1842

A Python helper can refuse a self-signed close. It reads the card fields from the environment. It exits nonzero when the claimant and replay owner match. Put it in the same directory as the shell script.

#!/usr/bin/env python3
import os
import sys

claimant = os.environ.get("CLAIMANT", "").strip()
replay = os.environ.get("REPLAY_OWNER", "").strip()
sha = os.environ.get("CLAIMED_SHA", "").strip()
cmd = os.environ.get("CLAIMED_CMD", "").strip()

problems = []
if not sha or not cmd:
    problems.append("blank sha or command")
if not claimant or not replay:
    problems.append("blank owners")
if claimant and claimant == replay:
    problems.append("claimant cannot replay")

if problems:
    print("refuse close: " + "; ".join(problems))
    sys.exit(2)
print("owners and claim fields look complete")

Wire the helper in front of the close button, not after. After is decoration. Before is a gate. A one-line check in CI can read the receipt file and fail the close job when exit= is missing.

test -f T-1842-replay-receipt.txt
grep -q '^exit=0$' T-1842-replay-receipt.txt

Desk lead duty is narrow on purpose. The lead does not rerun every claim. The lead watches for missing receipts and frozen cards. Two missing receipts in a day is a freeze, not a scolding. Freeze means closes stop until the card is filled.

Announce the freeze in the same wiki page. Do not bury it in a private message. Private freezes create a second floor with different rules. Two floors is how agent theater returns.

FREEZE 2026-09-19T16:00Z
Reason: two closes lacked replay receipts
Owner: desk lead
Lift when: next two tickets carry exit=0 receipts

This SOP is for teams that already generate a lot of agent drafts. Free model access and a free server option raise that volume without raising proof. Disclosure: This article was prepared as part of MonkeyCode's product outreach. Teams drafting on MonkeyCode can keep that lane and still stamp the receipt on close.

The receipt does not certify product quality. It certifies that a named command ran on a named commit. Flaky tests will fail the honest replay. That failure is useful. It stops a story from standing in for a run.

Nondeterministic suites need a tighter command. Point the card at one file, not the whole repository. Broad commands hide the skip. Narrow commands make the second count cheap enough to keep.

Do not treat the receipt as a security review. Secrets, auth, and data deletes need their own owners. A green unit file can still wreck a tenant. Replay is a close gate, not a launch gate.

Do not run secret-bearing jobs on a shared free server under this card alone. The card assumes the command is safe to replay. Unsafe commands belong in an isolated job with their own owners. This playbook will not invent that isolation for you.

Solo developers should not fake a second owner. A rubber-stamp alias is worse than no card. The whole point is a different pair of hands. If those hands do not exist, leave the ticket open.

Incident commanders should not open a replay desk mid-fire. Restore service first. After the fire, replay the claimed fix on the SHA that actually shipped. Dating the receipt after the incident is honest. Dating it before is fiction.

Hardware-only checks may not replay on a laptop. Say that on the card in one line. Name the bench, the fixture, and the person who stood there. A missing bench line is a freeze, not a workaround.

The common failure is a rewritten command. The claimant trims flags after the agent run. The replay then tests a different path. Lock the command string at claim time. If the command must change, open a new ticket.

Another failure is SHA drift. The agent amends after the paste. The ticket still shows the old hash. Replay then proves yesterday. Require git rev-parse HEAD in the agent log and on the card. Mismatched hashes refuse the close.

A third failure is receipt theater. Someone copies an old file and changes the ticket id. The hash-object line makes that noisier. It is not cryptography for a court. It is friction against a sleepy paste.

Keep the desk on a weekday hour with overlap. Overnight agent bursts can wait for the morning replay. Speed of draft is not speed of done. Done is the second count.

Train the roles with one dry run on a throwaway ticket. Use a known failing test first. Confirm the script refuses the close. Then use a known passing test. Confirm the receipt file appears. Skip this drill and the freeze will feel personal later.

# dry run: expect nonzero, no close
./replay-receipt.sh "$SHA" "npm test -- src/known-fail.test.ts" T-DRY
# dry run: expect exit 0 and a receipt
./replay-receipt.sh "$SHA" "npm test -- src/known-pass.test.ts" T-DRY2

Write the drill date on the wiki page. A card nobody has run is costume. Costume is how vibe output gets called engineering. The floor does not need more costume.

Limit the SOP to agent-touched tickets. Human-only changes can keep the old close path. Mixing both paths on day one creates loopholes. Loopholes become the real process by Friday.

Review the freeze log once a week, not daily. Daily review turns the desk into surveillance. Weekly review catches a pattern. Patterns mean the claimed commands are too wide, or the owners are the same person.

The close gate will annoy people who ship stories. That annoyance is the signal. If closes feel identical to agent paste, the desk is dead. Revive it by refusing one ticket in public and filing the receipt that should have been there.

Agent labor did not remove the engineering work. It made a green paste easier to confuse with a run. Stamp the replay receipt anyway. Then close the ticket.

Post a Floor Roster Before Agent Hours

Morgan Xu — Fri, 18 Sep 2026 08:18:01 +0000

Unowned agent hours turn free compute into orphan diffs. A posted floor roster stops that quiet drift. The roster names a captain and a path fence before the run.

Night kitchens fail without a chef de partie. Shared agent hours fail in that same way. Tokens move, files change, and nobody owns the burn.

A floor captain holds the shift, not the model. The captain posts the roster and opens the fence. Named seats support that watch and never replace it.

The prompt clerk drafts the task brief for the captain. The clerk never merges those agent edits. The diff steward reads every path the agent touched.

The freeze officer can halt the run when the fence breaks. These four seats still fit a small team. One person may hold two seats on a quiet night.

Two seats must never collapse into one pair of hands. The captain and freeze officer must stay distinct. That split is lockout-tagout for agent work.

The captain starts the machine for the window. The freeze officer can stop that machine. The tag lives in the wiki, not in chat scatter.

Paste the card below into the team wiki. Treat the card as a live shift object. Empty seats mean the window stays closed.

# Floor Roster — Agent Hours
Shift ID:
Window (UTC):
Repo / branch:
Floor captain:
Prompt clerk:
Diff steward:
Freeze officer:
Allowed roots:
Forbidden roots:
Status: closed | open | frozen
Kill command:
Sign-off time (UTC):

The card stays short on purpose. Long charters hide missing names in plain sight. A missing freeze officer is a closed kitchen.

Pair the card with a fence file in git. The fence is the only map the agent may walk. Paths outside that map must fail the checker.

# .agent/fence.txt — proposed local fence, not a vendor format
# allowed prefixes, one per line
apps/web/src/
docs/runbooks/

# forbidden prefixes after a blank line
.github/
infra/
secrets/

Keep the roster beside that fence as structured data. The checker should read files, not a chat pin. The sample below is a proposed local gate.

# .agent/roster.yaml — proposed shift card
shift_id: "2026-09-18-eu-late"
window_utc: "18:00/22:00"
floor_captain: "alex"
prompt_clerk: "sam"
diff_steward: "riley"
freeze_officer: "jordan"
status: "open"

A proposed checker then loads the roster and the fence. The script is a local gate, not a hosted service. Run it on the shift branch before any agent loop starts.

# check_roster.py — proposed local gate, unexecuted here
from pathlib import Path
import sys
import yaml

ROSTER = Path(".agent/roster.yaml")
FENCE = Path(".agent/fence.txt")
CHANGED = Path(".agent/changed.txt")
FROZEN = Path(".agent/FROZEN")


def die(msg):
    print("FAIL:", msg)
    sys.exit(1)


def load_fence(path):
    text = path.read_text().splitlines()
    allowed, forbidden, mode = [], [], "allowed"
    for raw in text:
        line = raw.strip()
        if not line or line.startswith("#"):
            if not line and allowed:
                mode = "forbidden"
            continue
        if mode == "allowed":
            allowed.append(line)
        else:
            forbidden.append(line)
    return allowed, forbidden


def main():
    if FROZEN.exists():
        die("shift is frozen; freeze officer must clear the stamp")
    if not ROSTER.exists():
        die("missing .agent/roster.yaml")
    roster = yaml.safe_load(ROSTER.read_text())
    cap = roster.get("floor_captain")
    frz = roster.get("freeze_officer")
    if not cap or not frz:
        die("captain and freeze officer are required")
    if cap == frz:
        die("captain cannot be freeze officer")
    if roster.get("status") != "open":
        die("window is not open")
    allowed, forbidden = load_fence(FENCE)
    if not allowed:
        die("fence has no allowed roots")
    changed = CHANGED.read_text().splitlines() if CHANGED.exists() else []
    for path in changed:
        if not path:
            continue
        if any(path.startswith(item) for item in forbidden):
            die(f"forbidden path {path}")
        if not any(path.startswith(item) for item in allowed):
            die(f"unfenced path {path}")
    print("PASS: roster and fence hold for this shift")


if __name__ == "__main__":
    main()

Collect the changed paths with git, not with memory. Memory lies after a long agent loop. Git still tells the truth on the branch.

mkdir -p .agent
git fetch origin main
git diff --name-only origin/main...HEAD > .agent/changed.txt
python3 check_roster.py

A late window needs one more command from the freeze officer. That officer writes a freeze stamp when the fence breaks. The captain must not delete that stamp during the window.

# proposed freeze stamp, issued only by the freeze officer
date -u +%Y-%m-%dT%H:%M:%SZ > .agent/FROZEN
echo "frozen by ${USER}" >> .agent/FROZEN
git add .agent/FROZEN
git status --short

The next loop reads that stamp first. A frozen tree is a closed stove. No new agent cycle starts on a frozen tree.

Now the hour itself follows a fixed pass. The clerk posts a brief with a single outcome. The captain copies that brief into the agent session.

The steward watches the name-only diff, not the chat. The freeze officer watches the fence file and the stamp. Talk stays cheap. Paths stay expensive.

Shared labs often park idle agent work on spare compute. MonkeyCode offers free model access and a free server option for that class of shift. Disclosure: This article was prepared as part of MonkeyCode's product outreach.

The roster still applies if another host provides the compute. The seats do not change with the vendor. Compute without a named floor is still an unowned kitchen.

Free shared hours tempt teams to skip the roster. The room feels empty, so the rules feel heavy. That is the trap that burns the branch.

A good shift lasts one window, then stops. The captain closes the status field on the card. The steward pastes the name-only diff under that card.

The freeze officer confirms the stamp is absent or still honored. Then the branch waits for ordinary review. Ordinary review is not this playbook.

Tests, design, and product intent stay elsewhere. The roster only answers who owned the hour. It does not certify the patch as correct.

This method will fail some rooms on contact. A solo hobby clone does not need four seats. A production incident already has a commander.

A regulated merge needs more than a wiki card. Those rooms should not borrow this as cover. The fence also fails when roots are too wide.

Allowing the whole repo is a paper wall. Forbidden lists that omit secrets are worse than no list. The steward must read the fence before the window opens.

Chat pins are not a roster in any useful sense. A thread will scroll off the shift. The wiki card stays at a stable URL.

The checker reads files, not vibes from the thread. That is the whole point of the floor watch. Vibe sessions can still happen inside the fence.

Engineering starts when names, paths, and a freeze exist. Calling the session engineering without those three is a costume. The roster removes the costume before main sees the diff.

Teams already using that free server can pin the roster beside the workspace. Run the checker before the window, not after the merge. The floor stays named, and the diffs stay owned.

File an Evidence Packet Before Agent Code Merges

Morgan Xu — Thu, 17 Sep 2026 06:32:45 +0000

Agent output is not a merge. Compile success is not a review. Teams that skip a written evidence packet treat vibe output as engineering. This playbook keeps that fiction off the default branch.

The packet is a short wiki card. It records who ran the agent session. It names the human who witnessed the raw diff. Those two names freeze the change for a stated window.

Cheap model access makes the gap louder. A free server lets a whole desk spawn patches overnight. Volume then outruns judgment by morning standup. The loading dock fills with unsigned boxes.

Inventory becomes a story nobody can audit. Reviewers later argue from chat scraps. The merge already landed in production traffic. The packet exists to stop that sequence.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. Some desks run exploratory agents through MonkeyCode free model access and the free server option. That pair is fine for drafts. It does not replace a witness on the diff.

The SOP still holds if another tool wrote the patch. The product is only the cheap draft lane. Promotion still needs human stamps on paper.

Roles live on one wiki page. The duty engineer owns the prompt and the working tree. The witness reads the diff without the original prompt. The freeze clerk holds the merge button for a named window.

A tiny team may share two hats across people. One person cannot wear all three on one change. That is the two-chair rule in this shop.

A cashier should not audit the till just counted. An agent runner should not witness the packet they filed. Distance is the whole point of the second chair.

Handoff is a card, not a hallway story. The duty engineer pastes the packet before stepping away. The witness refuses unsigned packets in the same hour. The freeze clerk ignores pings that skip the card.

Night runs make the handoff sharper. The next shift inherits a file, not a vibe. Analogies help here more than slogans. Think of a sealed evidence bag at a crime desk.

The bag is boring on purpose. Boring bags survive weekends and timezone gaps. Flashy dashboards do not survive a tired Monday. Paste the bag into the team wiki as-is.

# Agent Evidence Packet
Status: draft | witnessed | frozen | merged | rejected
Change-id: <git short hash or worktree name>
Repo: <name>
Branch: <name>
Duty engineer: <handle>
Witness: <handle, different person>
Freeze clerk: <handle>
Freeze window: <start ISO-8601> .. <end ISO-8601>
Draft lane: free-model / free-server / other
Prompt hash: <sha256 of prompt file>
Command log: <path to sanitized shell transcript>
Tests run: <command + exit code>
Risk note: <one sentence, no adjectives>
Witness verdict: accept-with-nits | reject-rewrite | reject-unsafe

The card is the one-page run. Nobody needs a second document for the night. Extra pages become a graveyard of good intentions. One page either exists or the merge waits.

A reproducible check belongs next to the card. The check is a small script, not a platform. It refuses to tag a merge when the packet is missing. Teams can run it locally before any hook debate.

#!/usr/bin/env bash
# evidence_gate.sh — refuse merge without a complete packet.
set -euo pipefail
PACKET="${1:-./EVIDENCE_PACKET.md}"
BRANCH="$(git rev-parse --abbrev-ref HEAD)"
HEAD_SHORT="$(git rev-parse --short HEAD)"

if [[ ! -f "$PACKET" ]]; then
  echo "missing evidence packet: $PACKET" >&2
  exit 2
fi

need() {
  local key="$1"
  grep -E "^${key}:" "$PACKET" | grep -vE '<.*>' | grep -q .
}

for key in Duty\ engineer Witness Freeze\ clerk Freeze\ window Prompt\ hash Tests\ run Witness\ verdict; do
  if ! need "$key"; then
    echo "packet field incomplete: $key" >&2
    exit 3
  fi
done

DUTY="$(sed -n 's/^Duty engineer: //p' "$PACKET" | head -n1)"
WITNESS="$(sed -n 's/^Witness: //p' "$PACKET" | head -n1)"
if [[ "$DUTY" == "$WITNESS" ]]; then
  echo "two-chair rule failed: duty equals witness" >&2
  exit 4
fi

VERDICT="$(sed -n 's/^Witness verdict: //p' "$PACKET" | head -n1)"
case "$VERDICT" in
  accept-with-nits) ;;
  reject-rewrite|reject-unsafe)
    echo "witness rejected the packet" >&2
    exit 5
    ;;
  *)
    echo "unknown witness verdict" >&2
    exit 6
    ;;
esac

echo "evidence ok for $BRANCH@$HEAD_SHORT"

Mark the script executable in the repo. Keep it next to the wiki paste, not in a private gist. A gist dies when the author changes teams. A tracked script survives the next rotation.

chmod +x evidence_gate.sh
./evidence_gate.sh ./EVIDENCE_PACKET.md

A pre-push hook can call the same gate. The hook is optional on day one. The script is not optional if the team claims engineering. Optional theater is how vibe patches sneak through.

#!/usr/bin/env bash
# .git/hooks/pre-push
set -euo pipefail
ROOT="$(git rev-parse --show-toplevel)"
"$ROOT/evidence_gate.sh" "$ROOT/EVIDENCE_PACKET.md"

Prompt hashing keeps the packet honest. The witness should not need the raw prompt. The hash still proves which instruction produced the tree. Teams store the prompt file beside the packet.

sha256sum prompts/change-17.txt > prompts/change-17.sha256
# then paste the hex digest into Prompt hash on the wiki card

Sanitized transcripts matter as much as hashes. Secrets in shell logs turn the packet into a leak. Strip tokens before the witness ever opens the file. The duty engineer owns that redaction step.

# labeled example only — adjust patterns for the local stack
sed -E 's/(token|key|secret|password)=[^ ]+/\1=REDACTED/Ig' \
  raw_session.log > session.sanitized.log

Tests in the packet are commands, not feelings. "Looks good" is not a test line. The duty engineer pastes the exact command and the exit code. The witness may rerun that command on a clean tree.

npm test -- --runInBand
echo "exit:$?"

If the stack has no tests yet, the packet says so in one sentence. Missing tests are a risk note, not a hidden skip. The freeze clerk then lengthens the window. Silence is not an acceptable risk note.

Decision paths stay on the same page. They read as a tiny matrix in a fence. The matrix is an artifact, not a slide. People follow it at 1 a.m. without a meeting.

verdict            freeze window         merge allowed
accept-with-nits   2 working hours       after nits land
reject-rewrite     none                  no, new packet required
reject-unsafe      none                  no, duty files incident note

Accept-with-nits is not a shrug. Nits become a second tiny commit with the same packet id. The witness checks that the nits match the note. Scope creep restarts the whole card.

Reject-rewrite is the common honest outcome. The draft lane did its job by being cheap. The default branch did its job by staying closed. Pride has no field on the card.

Reject-unsafe is rarer and louder. The freeze clerk pages the incident channel, not the author chat. The duty engineer stops further agent loops on that tree. Loops without a new packet are just more fog.

A worked example keeps the SOP concrete. Suppose a night agent patches a rate limiter. The duty engineer files the card before logging off. The morning witness reads the diff on a cold laptop.

The witness finds a default that fails open. Verdict becomes reject-unsafe in one line. The freeze clerk never opens the merge queue. The free draft lane still earned its keep by failing early.

Another example goes the other way. The agent adds a retry around a flaky client. Tests pass twice on a clean clone. The witness accepts with nits on log wording.

The nits land in a follow-up commit under the same change-id. The freeze window covers lunch, not a week. The merge then looks like ordinary engineering. That is the point of the stamps.

Limitations are part of the playbook. The script does not prove the code is correct. It only proves a second human signed a card. Liars can still type two names.

The hash does not prove the prompt was wise. It only binds a file to a digest. A poisoned prompt still hashes cleanly. Wisdom stays a human job.

The freeze window does not replace load tests. It only slows a rushed merge after a cheap draft. High-stakes systems still need their real gates. This SOP is a receiving clerk, not a lab.

Who should not use this approach is equally plain. Solo hobby repos with one author gain little. The two-chair rule cannot clone a person. Those repos should keep ordinary personal review habits.

Regulated codebases with existing change-advisory boards should not swap boards for this card. The packet can feed those boards. It should not pretend to be one. Compliance theater is worse than no packet.

Teams that cannot redact transcripts should not file them. A packet full of secrets is a worse incident. They can store hashes and test commands only. Empty secret fields beat leaked ones.

Desks that treat free draft compute as production compute should stop first. A free server is a sandbox with a clerk. It is not a silent path to main. The airlock is social, then technical.

The trend this week is loud on engineering versus vibe. This shop does not need that debate as a slogan. It needs a bag with names and a clock. Names and clocks still work when models change.

Paste the card. Run the gate. Keep the second chair empty of the first. That is the whole night run, and it fits on one wiki page.

Desks already drafting on the free model lane can drop the packet template into the wiki before the next shared night run.