First Hour on a New Team: Freeze Paths the Agent May Touch

Your first AI hour should freeze the tree, not grow it.
A junior merge goes wrong when new paths appear unreviewed.

Public posts still cheer agents that write every file.
Your first hour is the wrong time to copy that habit.

Why new paths hurt more than bad lines

Reviewers skim hunks and often miss brand new files.
A new workflow can ship secrets to a stranger runner.
A new package can pull a supply-chain surprise overnight.

You do not need a platform for this rule.
You need a snapshot after bootstrap, before any agent write.

The rule in one line

Snapshot tracked paths after you run the project tests.
Reject any agent diff that adds files outside that set.

Ticket cards still matter for scope on the first PR.
Path freeze is a second fence you should keep.

What you will build

You will save a baseline file list after bootstrap.
You will add a small guard script under scripts.
You will run that guard before you open the first PR.

The examples below stay proposals until you execute them.
Copy them, run them, then trust only the output.

Step 1: Clone without the agent

Create a clean directory on your machine first.
Do not ask an agent to set the project up.

git clone [e-mail]:YOUR_ORG/YOUR_REPO.git
cd YOUR_REPO
git switch -c onboarding/path-freeze

Read the README with your own eyes now.
Run only the install command the README already prints.

Step 2: Prove the suite without edits

Pick the test command the README already documents.
Do not invent a parallel runner because it looks faster.

# proposal only; swap in the repo's real command
npm test
# or: make test
# or: pytest -q

Stop if tests fail on a clean clone.
Fix your local toolchain before you touch application code.
A red suite is a setup bug, not an agent task.
You cannot freeze a tree you cannot run.

Step 3: Snapshot the allowed paths

Write the tracked file list to a local artifact.
Keep it out of the first PR if the team hates extra files.
Or commit it later as a baseline file if they agree.

mkdir -p .ai
git ls-files | sort > .ai/path-baseline.txt
git status --porcelain > .ai/status-after-bootstrap.txt
wc -l .ai/path-baseline.txt

Open the porcelain file and confirm it looks empty.
Untracked build junk means your gitignore still needs a human.

Step 4: Add the path guard script

This script is the original artifact for the workflow.
It fails when the agent adds files the baseline never listed.

#!/usr/bin/env bash
# scripts/check-ai-paths.sh — proposal until you run it
set -euo pipefail

BASE=".ai/path-baseline.txt"
fail=0

if [[ ! -f "$BASE" ]]; then
  echo "missing $BASE; snapshot after bootstrap first"
  exit 2
fi

check_new() {
  local path="$1"
  if [[ -z "$path" ]]; then
    return 0
  fi
  if ! grep -Fxq "$path" "$BASE"; then
    echo "NEW_PATH $path"
    fail=1
  fi
}

while IFS= read -r path; do
  check_new "$path"
done < <(git diff --name-only --diff-filter=A HEAD)

while IFS= read -r path; do
  check_new "$path"
done < <(git ls-files --others --exclude-standard)

while IFS= read -r top; do
  [[ "$top" == ".git" || "$top" == ".ai" ]] && continue
  if ! grep -E -q "^${top}(/|$)" "$BASE"; then
    echo "NEW_TOP $top"
    fail=1
  fi
done < <(ls -1A)

if git status --porcelain | grep -E -q '(^\?\?|A )\.github/workflows/'; then
  echo "NEW_WORKFLOW"
  fail=1
fi

if git diff --name-only HEAD | grep -Eq '(^|/)(package\.json|pyproject\.toml|go\.mod|Cargo\.toml)$'; then
  echo "MANIFEST_CHANGED; drop dependency edits from the first PR"
  fail=1
fi

if [[ "$fail" -ne 0 ]]; then
  echo "path freeze failed; drop the extra files before the PR"
  exit 1
fi

echo "path freeze ok"

Make it executable and run it once on the clean tree.

chmod +x scripts/check-ai-paths.sh
./scripts/check-ai-paths.sh

A clean tree should print the ok message.
If it fails now, your snapshot is wrong, so fix that first.

Step 5: Decide what the first PR may touch

Use this table before you paste a prompt.

Change type	First PR	Why
New function in an existing file	Yes	Reviewers can diff a known path
New test in an existing test folder	Yes	Tests belong beside the code
New top-level directory	No	It hides ownership and build entrypoints
New GitHub workflow	No	It can exfiltrate secrets on push
New dependency in a manifest	No	Supply chain is not an onboarding gift
New README section	No	Docs drift before you understand the product
Formatter rewrite of the tree	No	Noise buries the actual ticket

Print the table into the first PR body.
Ask your reviewer to reject any row marked No.

Step 6: Prompt the agent inside the fence

Now you may use an editor agent on a throwaway clone.
State the allowed paths in the prompt and repeat the test command.

You may edit only:
- src/billing/invoice.ts
- src/billing/invoice.test.ts

Do not create files.
Do not add dependencies.
Do not add CI workflows.
Run: npm test
Stop if the test command is missing.

Keep the prompt that short to avoid extra files.
After the agent stops, run the guard before git add.

./scripts/check-ai-paths.sh
git diff --stat

If the guard prints NEW_PATH, drop those files immediately.
Do not negotiate with the model about extra paths.

git restore --staged --worktree -- THE_FLAGGED_PATH
# untracked extras:
rm -i THE_FLAGGED_PATH

Use interactive delete. Do not start with recursive force.

Step 7: First PR, then a cheap rollback

Open a PR that names the ticket and the guard result.
Paste the ok line and git diff stat into the body.

Keep the PR to the two files you listed.
A small PR is a small git revert later.

git revert --no-edit MERGE_SHA

You do not need a drama rollback plan for a two-file change.
That cheap revert is the point of the freeze.

A throwaway clone keeps hour one boring

You may not want the first clone on a laptop full of tokens.
A throwaway remote box keeps secrets and the experiment apart.

Disclosure: This article was prepared as part of MonkeyCode's product outreach.
MonkeyCode offers free model access and a free server option.
Use that server as a scratch clone if you need isolation.
Run the same snapshot, tests, and path guard there.

Do not skip the guard because the model felt cheap.
Free inference still writes files that still merge.
If your team already has a sandbox, use that instead.
The rule is the snapshot, not the vendor.

Limitations

This guard does not understand generated code on purpose.
Protobuf trees and lockfile bumps will fail it.
That is correct for hour one on a new team.
Those tasks are not hour one work for a junior.

Skip this approach when you join a greenfield repo with no files.
Skip it when your ticket is adding the CI workflow.
Skip it when path freeze would block a required codegen step.

The script also misses renamed files presented as add plus delete.
Watch git status yourself and do not treat the script as law.
It is a tripwire for juniors, not a security boundary.

Binary files, submodules, and sparse checkouts can confuse listing.
Read the output and never pipe it into recursive delete blindly.

Who this is for

You are new, you have a ticket, and you have an agent.
You want a merge that a tired reviewer can still trust.

You are not trying to win a speed contest against the codebase.
You are trying to leave a tree the next hire can still map.

Close

Freeze paths in hour one, then let the agent type.
If the guard yells, you still have a repo, not a maze.