Prompt, Process, or Disk: Which Layer Did You Trust?

Did last night's supposed fix actually land on disk?

Or did a model only narrate a pretty path?

I keep seeing those two answers get mashed together.

Developers talk about "the free box" like one object.

That habit hides missing files and fake green checks.

Why this FAQ exists

A free model answers with tokens, not kernels.

A free server, when present, runs real processes.

Those two layers fail in completely different ugly ways.

Confusing them wastes an afternoon on ghost patches.

Have you merged a "fix" that never existed locally?

The three-layer map I actually use

I label every claim before I trust anything.

Then I simply refuse to merge unlabeled success stories.

• Layer A — Prompt. Tokens in the thread, with no kernel underneath them.
• Layer B — Process host. Some machine ran a command, if a host exists.
• Layer C — Your clone. The working tree sitting on your laptop disk.

If you cannot name the layer, you lack evidence.

You only have a story the model felt like telling.

One question I ask after "done"

Which layer holds the actual bytes right now?

If the answer is only "the chat," you should stop.

Chat is still not a filesystem, however confident.

Myth 1: Free model access equals a free server

This myth shows up in almost every tired standup.

People treat a model endpoint as a rented machine.

A model endpoint returns text and nothing else.

It does not owe you a hostname or writable /tmp.

I hear this claim constantly from exhausted teammates.

Do you actually have a process host right now?

Corrected mental model: inference access is not compute.

You might receive both surfaces in one product.

You might receive only a chat completion path.

Prove the host with a process, never a paragraph.

Proposed probe when someone claims a box

# proposed probe — run it; do not trust a description
echo "LAYER_B_PROBE=$(hostname)-$(id -u)-$(pwd)"
uname -s -m
test -w . && echo "cwd_writable=yes" || echo "cwd_writable=no"

If the assistant pastes this without process output, stay skeptical.

Pretty text still lives entirely in Layer A.

Disclosure: This article was prepared as part of MonkeyCode's product outreach.

I mention MonkeyCode here for one narrow reason.

It offers free model access and an optional free server.

Those two offers are easy to mash into one object.

That mash-up is the exact trap this FAQ attacks.

People hear "free" and assume one shared blob.

Separate the surfaces before you debug anything else.

Treat the model first and the host second, always.

Myth 2: A quoted path means that path exists

Quoted paths are cheap for a language model.

Creating inodes is not cheap, and not automatic.

I have been burned by gorgeous /tmp/patch.diff blocks.

The thread showed a path with perfect confidence.

ls on my laptop showed absolutely nothing there.

Which layer had I trusted without noticing?

Corrected mental model: a path in prose is a string.

A path on disk has a real dentry you can hash.

Demand the second proof before you argue about diffs.

Canary that forces a layer choice

# canary.py — proposed; label your own output
from pathlib import Path
import hashlib, os, socket, time

p = Path("placement_canary.txt")
payload = f"{socket.gethostname()}|{os.getpid()}|{time.time_ns()}\n"
p.write_text(payload)
digest = hashlib.sha256(p.read_bytes()).hexdigest()
print(f"layer=B_or_C host={socket.gethostname()}")
print(f"path={p.resolve()}")
print(f"sha256={digest}")

Then you run the same hash command on Layer C.

Mismatch means you hashed two different machines.

No file means you never left Layer A at all.

test -f placement_canary.txt && echo on_disk || echo missing

That one line refuses to give a speech.

It only reports whether bytes exist.

Myth 3: One chat thread equals one persistent VM

Threads persist tokens across a conversation window.

Hosts persist only what their scheduler still allows.

I do not know your vendor's lifetime, and neither do you.

Not unless you measured it with a canary file.

So I do not assume /tmp survives a reconnect.

I do not assume pip install survives a new chat.

I do not assume environment variables ride along either.

Corrected mental model: treat host state as ephemeral.

Keep treating it that way until a canary proves sticky.

Write a file, then close the session on purpose.

Open another session and ask only one question.

Is the canary still there, with the same hash?

Persistence checklist

1. Write placement_canary.txt on the claimed host.
2. Record hostname, pid, and sha256 in your notes.
3. End the session on purpose, not by accident.
4. Start a completely fresh session after that.
5. Read the file and compare both hashes carefully.
6. Record sticky or ephemeral, then stop arguing.

If step five fails, your "server" was a napkin.

Myth 4: A command in the reply means a package installed

Models love apt-get and invented package flags.

They also love skipping the part where dpkg runs.

Did a package manager actually change Layer B?

Show me command -v, dpkg -s, or pip show.

Show me the exit code beside the name.

A fenced bash block is documentation, not a transaction.

Corrected mental model: installation is a Layer B state change.

No Layer B means no install, full stop.

Minimal proof, not a novel

command -v jq; echo exit:$?
python3 -c "import pkgutil; print('pyyaml', bool(pkgutil.find_loader('yaml')))"

Two lines give real answers you can paste.

If the model explains how jq works instead, remain in Layer A.

Ask it again to run the probe, or run it yourself.

Your laptop is Layer C, and it does not guess.

# proposed: same binary name, three different truths
type jq 2>/dev/null || true
printf 'PATH=%s\n' "$PATH"
python3 -c "import shutil; print('jq', shutil.which('jq'))"

type, PATH, and shutil.which can disagree.

That disagreement is data, not a vibe.

Myth 5: The sandbox is mine, so secrets are fine

This myth is how throwaway keys become incident tickets.

A free server is not your laptop, period.

A free model context is not a vault either.

Prompts get retained more often than people hope.

Hosts get recycled more often than people hope.

I do not put production tokens in either layer.

Not even for a minute of convenience debugging.

Corrected mental model: Layer A is a postcard.

Layer B is a borrowed kitchen you did not inspect.

Layer C is your house, and secrets cook there.

What I refuse to paste into either free surface

• Cloud access keys and session tokens
• Database URLs that still embed passwords
• Customer dumps, even "tiny" anonymized samples
• Private keys labeled temporary in the filename

Need a remote repro anyway?

Mint a throwaway credential you can revoke tonight.

Revoke it after the session, without exceptions.

If you cannot revoke it, do not use it there.

Artifact: the placement decision table

I use this table before I merge anything claimed.

Run the probe. Tick exactly one cell in the table.

Do not tick two cells because it feels true.

Observation	Layer A (prompt)	Layer B (process host)	Layer C (your clone)
Only a code fence, no exit code	Yes	No	No
Process output with pid and hostname	No	Maybe	Maybe
File exists in your working tree	No	No	Yes
Hash still matches after a new chat	No	Sticky host	Your disk
Hash gone after a new chat	Tokens only	Ephemeral host	Never written
Model recites the file, test -f fails	Memorized string	Not written	Not written

"Maybe" means you still must compare hostnames.

If Layer B hostname disagrees with your laptop, do not merge.

Copy artifacts down, then hash again on Layer C.

# proposed: compare claimed host vs laptop host
printf 'claimed=%s\nlaptop=%s\n' "$CLAIMED_HOST" "$(hostname)"

Four fields beat a victory paragraph every time.

Full probe I keep in boring shell form

#!/usr/bin/env bash
# placement_probe.sh — proposed method, no vendor magic
set -euo pipefail
stamp="$(date -u +%Y%m%dT%H%M%SZ)"
host="$(hostname 2>/dev/null || echo unknown-host)"
cwd="$(pwd)"
file="placement_canary_${stamp}.txt"
printf 'stamp=%s\nhost=%s\ncwd=%s\npid=%s\n' "$stamp" "$host" "$cwd" "$$" > "$file"
if command -v sha256sum >/dev/null; then
  hash="$(sha256sum "$file" | awk '{print $1}')"
else
  hash="$(shasum -a 256 "$file" | awk '{print $1}')"
fi
printf 'LAYER_PROBE\nfile=%s\nsha256=%s\nhost=%s\ncwd=%s\n' "$file" "$hash" "$host" "$cwd"

Copy those four fields into notes, not into another prompt.

Those notes survive threads when chats vanish.

Chat threads themselves do not survive honest debugging sessions.

A fifteen-minute workflow, no heroics

1. State the claim in one boring sentence.
2. Name the layer that claim actually needs.
3. Run placement_probe.sh on the suspected host.
4. Run the same script again on your laptop.
5. Diff host, cwd, and sha256 without storytelling.
6. Only then copy a patch into Layer C.
7. Run your own tests on Layer C, locally.

Skip a step and you are merging a ghost.

I do this for tiny edits, especially tiny edits.

Those are the ones nobody bothers to hash.

# proposed: after both probes, compare without a story
diff -u laptop_probe.txt host_probe.txt || true

A nonempty diff is not an insult.

It is the whole point of the ritual.

What this does not prove

This probe does not prove tenant isolation.

It does not prove a service level, either.

It does not name a CPU, GPU, or region.

It does not freeze any free-tier policy.

Vendors change free model access without a parade.

Vendors change free servers without a parade too.

I am not documenting quotas here on purpose.

I do not have a durable number worth repeating.

Measure the host today, not from memory.

Throw the number away next month without grief.

A matching hash is necessary, not sufficient.

Someone could echo a hash into the thread.

Prefer writing the file yourself on Layer C.

Then test the product, not the narration.

Who should not use this approach

Skip this if you already have real CI hosts.

Your pipeline is the process layer that matters.

Do not insert a mystery box into that path.

Skip this for regulated or customer-held data.

A borrowed server is the wrong room for that.

Skip this if you need days of leftover state.

Ephemeral hosts will gaslight you on purpose later.

Skip this if you cannot read a hex digest.

Then grab a teammate before you merge anything.

Do not "just trust the thread" as a shortcut.

The mental model I want you to steal

Prompt is not a process, and process is not disk.

Free model access is not a free server.

A quoted path is not an inode.

A thread is not a VM you rented.

A code fence is not an install transaction.

Once you separate those, debugging gets boring fast.

Boring is the entire goal of this FAQ.

Closing

So which layer wrote your last claimed fix?

If you cannot answer, run the probe today.

If you can answer, hash the file anyway.

I am not selling a feeling in this piece.

I am asking for four fields you can copy.

Use any model you want for the words.

Use a host you can name for the bytes.

If you try MonkeyCode's free model or free server, label the layer first.

Then paste the probe output, not the victory speech.