FAQ: Four Myths About Proof on a Disposable Server

Did that remote command actually prove your code is portable? I keep seeing teams treat a disposable box like home. Those two machines rarely share the same defaults.

Agents love a green remote run in the chat. Does the chat log list pwd, id, and which python3? If not, you collected a story, not a proof.

Why this FAQ exists

I want a cheap second climate for the same command. Not a twin of my laptop. A witness with papers.

Four claims keep showing up in review comments. Each claim sounds adult until you fingerprint the host. Have you ever diffed two “successful” environments side by side?

This is a proposed local checklist. Label every script as unexecuted until you run it. Do not point it at production credentials.

Myth 1: A free server is just a slower laptop

People say hardware is the only difference that matters. Clock speed is not your real drift. The box has another user, another libc, another Python.

Ask a blunt question before you trust the log. Does which python3 match your laptop output? Does uname -s -m even agree?

# Proposed comparison, run on each host you control.
uname -s -m -r
id -u -n
echo "HOME=$HOME"
which python3
python3 -c "import sys; print(sys.executable); print(sys.version)"
pwd
git rev-parse --show-toplevel HEAD

If those answers diverge, your “proof” already failed. A free server is a different computer. Treat it as a witness, not a twin.

What I actually compare

• Kernel and architecture from uname
• User id and home from id and $HOME
• Interpreter path and version from python3
• Working directory and git root from pwd
• A short hash of PATH

That list is boring on purpose. Boring checks catch silent drift. Fancy dashboards hide it.

Myth 2: One green remote run means the script is portable

A single success is a story, not a distribution. Did you wipe the tree and run it again? Leftover virtualenvs make liars out of logs.

Portability needs at least two clean executions. Same command. Fresh tree. Recorded fingerprint. If fingerprints differ, you learned something real.

# Proposed: two clones, two fingerprints, one diff.
set -euo pipefail
git clone . /tmp/run-a
git clone . /tmp/run-b
(cd /tmp/run-a && python3 fingerprint.py && cp fingerprint.json /tmp/fp-a.json)
(cd /tmp/run-b && python3 fingerprint.py && cp fingerprint.json /tmp/fp-b.json)
diff -u /tmp/fp-a.json /tmp/fp-b.json

Silent diff means the host looks stable. Screaming diff means stop quoting the chat. Which outcome do you actually expect today?

Myth 3: Free models are only for drafting code

This one wastes the cheapest loop you have. Why wait for paid CI to discover a path bug? Why save verification for “later” when later slips?

Disclosure: This article was prepared as part of MonkeyCode's product outreach.

The proposed loop uses a free model to draft a tiny harness. Then you run that harness on a free server. The model is not the judge. The fingerprint file is the judge.

MonkeyCode’s free model access and free server option fit this loop. They give you a second machine without a procurement ticket. I still do not treat that machine as production. I still read every generated line first.

Prompt sketch (proposed, not magic):
Write fingerprint.py that records uname, id, pwd, sys.executable,
PATH sha256 prefix, git root, and git HEAD as JSON.
No network calls. No secret files. No package installs.

Would you merge a script you refused to open? Then do not run one from a model either.

Myth 4: You should customize the box until it feels like home

Dotfiles hide the bug you came to find. Global pip installs poison the next run. Are you debugging your code, or the box’s memory of last Tuesday?

Keep the server sterile. Install into a project directory only. Delete the tree between attempts. Home is for laptops. Evidence is for throwaway hosts.

# Proposed hygiene before you call the run “proof”.
umask 022
env -i HOME="$HOME" PATH="/usr/bin:/bin" PWD="$PWD" \
  /usr/bin/env python3 fingerprint.py

A sanitized env -i is harsh on purpose. If your tool needs a secret shell profile, it is not portable yet. Should CI source your laptop zshrc? Absolutely not.

The artifact: a fingerprint harness

This harness does not grade your feature. It grades the climate. Copy it. Read it. Then run it on a machine you control.

#!/usr/bin/env python3
"""Write fingerprint.json. Proposed example, not a shipped product."""
import hashlib
import json
import os
import platform
import subprocess
import sys
from pathlib import Path


def sh(cmd: str) -> str:
    try:
        out = subprocess.check_output(
            cmd, shell=True, text=True, stderr=subprocess.STDOUT
        )
        return out.strip()
    except subprocess.CalledProcessError as e:
        clipped = (e.output or "").strip()[:200]
        return f"ERR:{e.returncode}:{clipped}"


def main() -> None:
    path = os.environ.get("PATH", "")
    payload = {
        "python": sys.version,
        "executable": sys.executable,
        "platform": platform.platform(),
        "uname": sh("uname -a"),
        "id": sh("id"),
        "pwd": os.getcwd(),
        "home": str(Path.home()),
        "locale": sh("locale"),
        "umask": sh("umask"),
        "path_hash": hashlib.sha256(path.encode()).hexdigest()[:16],
        "which_python3": sh("command -v python3"),
        "git_root": sh("git rev-parse --show-toplevel"),
        "git_head": sh("git rev-parse HEAD"),
    }
    Path("fingerprint.json").write_text(json.dumps(payload, indent=2) + "\n")
    print("wrote fingerprint.json")


if __name__ == "__main__":
    main()

Decision table I keep in the PR

Claim you heard	Check to run	If it fails, believe this instead
Remote is just slower.	uname and id match the laptop?	Different computer, different defaults.
One green run is enough.	Two clean fingerprints match?	You measured leftover state.
The model already verified it.	Did a file change on disk?	Chat is not a filesystem.
I will install my dotfiles first.	Can a fresh clone still run?	You customized the witness.

Print that table. Fill the middle column with real command output. A checked box in chat is not a filled cell.

A one-hour test plan

Work in a throwaway directory. Do not mount customer disks. Do not export cloud keys into the box.

1. Draft fingerprint.py with a free model. Read every line before you run it.
2. Copy the script to the free server. Run it once. Save fingerprint.json.
3. Run your actual command with an explicit working directory.
4. Run the fingerprint script again. Diff the two JSON files.
5. Clone into a new directory. Repeat steps 2-4. Compare across clones.
6. Paste the two JSON files and git HEAD into the PR. Skip the chat screenshot.

# Proposed capture of the “actual command” too.
mkdir -p /tmp/evidence
python3 fingerprint.py
cp fingerprint.json /tmp/evidence/before.json
python3 -m your_module --help > /tmp/evidence/cmd.out 2>&1 || true
python3 fingerprint.py
cp fingerprint.json /tmp/evidence/after.json
diff -u /tmp/evidence/before.json /tmp/evidence/after.json || true

What should you keep? The JSON files. The exact argv. The git HEAD. Not a vibe. Not a screenshot of a green bubble.

Limitations

This harness does not prove correctness. It only proves the host stayed still. It will miss race conditions and network flakes. It will miss secrets loaded from a user session.

JSON equality is not semantic equality. Two PATH hashes can hide swapped but equivalent directories. I still want the hash. It is a tripwire, not a theorem.

Clock skew and locale can still bite parsers. Add date -u if your tests parse timestamps. Add python3 -m pip freeze only inside a project venv you created. A global freeze is another way to customize the witness.

Who should not use this

Skip this if you already have hermetic CI images. Skip this if the server holds customer data. Skip this if you cannot read the generated script.

A free box is not a compliance boundary. Do not use it as a secret store. Do not use it as a long-lived workstation. Do not let an agent pipe curl into sh as root.

If your job needs signed provenance, this JSON file is not that. It is a personal brake pedal. Who else should skip it? Anyone hoping a disposable host will become a laptop replacement.

Corrected mental model

The remote run is a witness statement. Witnesses need identity documents. Fingerprints are those documents.

Your laptop is one climate. The disposable server is another climate. Code that only flowers in one climate is not portable. Want a cheaper climate first? Catch PATH lies before they hit paid CI.

If you already have a free server handy, run the harness once and keep the JSON. That is the whole ask.