FAQ: Five Environment Myths Hiding in a Free Agent Box

Did the agent pass because the box was lucky? Or did the box simply not look like CI?

I keep hearing the same five claims. They sound harmless in Slack. They blow up after merge.

This is a myth-busting FAQ. Not a product tour. Not a latency sermon.

Why this FAQ exists

A free model can draft a patch fast. A free server can run that patch tonight.

Neither fact proves the environment. Path, locale, and missing tools still lie.

Sound familiar? You paste a green transcript. CI still red. You blame the model.

Wrong suspect. The box was a stranger. You never asked it for papers.

The corrected mental model

Treat every agent box as ephemeral. Treat every toolchain as unproven.

Fingerprint first. Diff laptop, box, and CI. Promote contracts, not vibes.

I do not trust a hostname. I do not trust a chat summary. I trust a file.

The artifact: an environment fingerprint

Below is a proposed diagnostic. Label it as unexecuted until you run it.

It writes a JSON fingerprint. It avoids dumping secret values. It is not a benchmark.

Save it as scripts/env_fingerprint.sh.

#!/usr/bin/env bash
# Proposed diagnostic. Run it. Do not score models with it.
set -euo pipefail

out="${1:-./env-fingerprint.json}"
tmp="$(mktemp)"
trap 'rm -f "$tmp"' EXIT

json_escape() {
  python3 -c 'import json,sys; print(json.dumps(sys.stdin.read().rstrip("\n")))'
}

has() { command -v "$1" >/dev/null 2>&1 && echo yes || echo no; }

{
  echo '{'
  echo "  \"uname\": $(uname -a | json_escape),"
  echo "  \"date_utc\": $(date -u +%Y-%m-%dT%H:%M:%SZ | json_escape),"
  echo "  \"pwd\": $(pwd | json_escape),"
  echo "  \"shell\": $(printf '%s' "${SHELL:-}" | json_escape),"
  echo "  \"user\": $(printf '%s' "${USER:-}" | json_escape),"
  echo "  \"home_exists\": $([ -d "${HOME:-/no-home}" ] && echo true || echo false),"
  echo "  \"locale\": $(printf '%s' "${LC_ALL:-${LANG:-}}" | json_escape),"
  echo "  \"tz\": $(date +%Z | json_escape),"
  echo "  \"python\": $( { python3 --version 2>/dev/null || echo missing; } | json_escape),"
  echo "  \"node\": $( { node --version 2>/dev/null || echo missing; } | json_escape),"
  echo "  \"npm\": $( { npm --version 2>/dev/null || echo missing; } | json_escape),"
  echo "  \"git\": $( { git --version 2>/dev/null || echo missing; } | json_escape),"
  echo "  \"make\": \"$(has make)\","
  echo "  \"docker\": \"$(has docker)\","
  echo "  \"jq\": \"$(has jq)\","
  echo "  \"env_names\": $(env | cut -d= -f1 | sort | python3 -c 'import json,sys; print(json.dumps([l.strip() for l in sys.stdin if l.strip()]))')"
  echo '}'
} > "$tmp"

python3 -c 'import json,sys; json.load(open(sys.argv[1]))' "$tmp"
mv "$tmp" "$out"
echo "wrote $out"

Run it in three places. Keep the files. Diff them like tests.

chmod +x scripts/env_fingerprint.sh
./scripts/env_fingerprint.sh ./fingerprints/laptop.json
# on the agent box
./scripts/env_fingerprint.sh ./fingerprints/agent-box.json
# in CI
./scripts/env_fingerprint.sh ./fingerprints/ci.json

diff -u fingerprints/laptop.json fingerprints/agent-box.json || true
diff -u fingerprints/agent-box.json fingerprints/ci.json || true

Want a one-line gate? Compare selected keys only. Ignore noisy hostnames.

python3 - <<'PY'
import json, sys
keys = ("python", "node", "locale", "tz", "make", "git")
a, b = (json.load(open(p)) for p in sys.argv[1:3])
mism = {k: (a.get(k), b.get(k)) for k in keys if a.get(k) != b.get(k)}
if mism:
    print("ENV_DRIFT", mism)
    raise SystemExit(2)
print("ENV_KEYS_MATCH")
PY
fingerprints/agent-box.json fingerprints/ci.json

That script is the whole point. Myths die on a diff. They do not die on confidence.

FAQ: the five claims I still hear

Myth 1. "The free box matches my laptop toolchain."

No. Matching a prompt is not matching a compiler. Node 20 is not Node 22.

Ask it. Do not assume python3 means the same patch level. Print versions.

Corrected model: toolchain identity is a test fixture. Check it every session.

Myth 2. "Missing env vars fail loudly."

They often fail quiet. The app falls back. The agent invents a default.

Did tests pass because DATABASE_URL was empty? Did cache hit /tmp instead?

Corrected model: assert required names. Never assert values in the fingerprint.

# Proposed check. Names only. No secret values.
required='CI NODE_ENV DATABASE_URL'
for k in $required; do
  if ! env | cut -d= -f1 | grep -qx "$k"; then
    echo "missing name: $k"
    exit 2
  fi
done

Myth 3. "The filesystem is durable like a workstation."

Is the working tree still there tomorrow? Who owns /tmp after preemption?

Agents install CLIs into a home cache. That cache may vanish. CI will not inherit it.

Corrected model: anything not in git or the image does not exist.

Myth 4. "Network and clocks match CI."

Can the box reach private packages? Is the clock UTC? Is TLS inspection present?

A model can fetch a gist. Your CI runner cannot. Then the lockfile lies.

Corrected model: network and time are part of the contract. Fingerprint both.

Myth 5. "If the agent installed a tool, CI has it too."

The agent ran npm i -g prettier. Your job image did not. Green box. Red pipeline.

I ask one rude question. Would a clean checkout still pass without that install?

Corrected model: installs belong in the image or the lockfile. Never in memory.

Decision table

Use this table when a transcript looks fine. Pick the row. Run the check.

Symptom	Repeated claim	Check	Better model
Local green, CI red	"Box matches laptop"	Diff python/node keys	Toolchain is a fixture
Flaky config	"Missing vars explode"	Assert env names	Silence is a bug
Lost CLI after rerun	"Disk is a laptop"	Re-run on clean tree	Ephemeral by default
Package fetch fails in CI	"Network is the same"	Compare registry access	Network is a dependency
Formatter missing in CI	"Global install traveled"	Search Dockerfile/lockfile	Only git and images persist

No row says "trust the model." Every row says "diff the box."

A 20-minute workflow I actually repeat

1. Capture laptop fingerprint before prompting.
2. Capture agent-box fingerprint before accepting a patch.
3. Capture CI fingerprint on the first failed job.
4. Diff the three JSON files.
5. Fix the environment, then re-run the tests.
6. Only then argue about the model's patch quality.

Skip step two and you debug ghosts. Skip step five and you rate the wrong thing.

Need a make target? Keep it boring. Boring survives onboarding.

.PHONY: env-fingerprint env-gate
FINGERPRINT ?= fingerprints/local.json
CI_FINGERPRINT ?= fingerprints/ci.json

env-fingerprint:
    ./scripts/env_fingerprint.sh $(FINGERPRINT)

env-gate:
    python3 scripts/env_gate.py $(FINGERPRINT) $(CI_FINGERPRINT)

scripts/env_gate.py can be the small Python block above. Check it in.

Where a free model and free server fit

I use the free path for the fingerprint loop, not for production secrets.

Disclosure: This article was prepared as part of MonkeyCode's product outreach.

MonkeyCode offers free model access and a free server option. That pair is enough to capture agent-box.json without burning a paid runner.

The method still works if you delete the product name. A VM and a shell suffice.

Do not paste credentials into that box. Do not call it a SOC2 control. It is a diff.

If you already have a free server slot, run the fingerprint once and keep the JSON beside the PR. That is the only ask.

Limitations

This fingerprint is shallow. It does not prove package hashes. It does not prove CPU flags.

It can miss container capabilities. It can miss glibc versus musl. It can miss case-sensitive disks.

JSON equality on selected keys is a gate, not an audit. Extend keys when your stack needs them.

Timezone names can alias. node missing versus nodejs will still fool you. Add aliases if needed.

Who should not use this approach

• Teams that must keep source off shared free servers.
• Workloads with customer data in the working tree.
• Pipelines that already pin hermetic toolchains and prove them.
• People hoping a FAQ replaces image rebuilds.

If your CI is already a cleanroom, you do not need this FAQ. You need fewer agents.

Closing the loop

What failed, the model or the PATH? Ask the JSON.

Five myths. One file. Three machines. That is the whole ritual.

I still let models write code. I just refuse to let them define reality.