Weekend Build Log: One Curl Demo, Zero Extra Surfaces

You sit down Saturday with a two-hour window.
You want one POST that stores a note.
The agent replies with a six-surface plan.
The plan adds login, dashboards, WebSockets, retries, and CI.
None of that proves the note path works.
Your weekend just became a product kickoff.

This log is about cutting that surface.
You will freeze the demo as one curl.
You will skip every path the curl never hits.
You will still leave with a working spike.

The scene that keeps repeating

You paste a short goal into the agent.
Store a note, then return the saved JSON.
The plan comes back sounding strangely complete.
It wants /login before any write exists.
It wants a React shell for a JSON body.
It wants exponential backoff for a laptop POST.

You did not ask for a launch checklist.
You asked for a demo you can replay.
Those are different jobs on a short Saturday.
Agents fill empty product space with extra surfaces.
Your job is to remove that empty space early.

Freeze the demo, not the whole repo

Do not freeze file count in this round.
Do not freeze library count in this round.
Freeze the public demo instead of the tree.
One recorded curl is the entire weekend contract.
If a change does not serve that curl, cut it.

Paste this block before any generated plan:

WEEKEND DEMO CONTRACT
Allowed command: scripts/demo.sh
Allowed method: POST
Allowed path: /notes
Allowed proof: HTTP 200 plus JSON keys id, body
Forbidden: extra routes, UI, auth, retries, CI
If the plan needs forbidden work, rewrite the plan.

That block is blunt on purpose.
Agents treat silence as permission to expand.
You remove the silence before the first file lands.

Step 1: Write the curl before the server

You record the demo first, on purpose.
No server exists yet, and that stays fine.
The script is the spec, not a later souvenir.

Create scripts/demo.sh with this spike-only command:

#!/usr/bin/env bash
set -euo pipefail

base="${DEMO_URL:-http://127.0.0.1:8787}"

curl -sS -f -X POST "$base/notes" \
  -H "content-type: application/json" \
  -d '{"body":"ship the spike"}'
echo

Keep the flags boring and easy to read.
You need a JSON body and failure on HTTP errors.
You do not need a pretty printer this morning.

Mark the script executable before the agent starts:

chmod +x scripts/demo.sh

If the agent adds extra curl tools, reject them.
The demo has one verb, and you protect it.
A second verb is next weekend, not this one.

Step 2: Pin a scope file the agent must honor

Create weekend-scope.yml before any handler code.
This is not production configuration for later deploys.
This is a Saturday fence around the demo surface.

# Proposed weekend spike. Not a product spec.
name: notes-spike
demo:
  command: scripts/demo.sh
  method: POST
  path: /notes
  expect:
    status: 200
    json_keys: ["id", "body"]
skip:
  - authentication
  - html_ui
  - extra_http_verbs
  - background_retries
  - websockets
  - ci_workflows
  - admin_pages
rules:
  - one process
  - one listen port
  - in-memory store only

Read the skip list out loud once.
If an item is not required for curl, it stays skipped.
You can restore a skipped item on a later weekend.
Do not restore it because the plan sounded mature.

Step 3: Allow one tiny process, nothing else

Do not ask the agent for a framework tour.
Ask for one process that satisfies the yaml.
The example below is a labeled weekend spike.
It is not a service you should bill against.

server.py using only the Python standard library:

#!/usr/bin/env python3
"""Weekend spike: one POST /notes path. Nothing else."""

from http.server import BaseHTTPRequestHandler, HTTPServer
import json
import uuid

NOTES = {}


class Handler(BaseHTTPRequestHandler):
    def do_POST(self):
        if self.path != "/notes":
            self.send_error(404)
            return
        length = int(self.headers.get("Content-Length", "0"))
        raw = self.rfile.read(length)
        payload = json.loads(raw.decode("utf-8") or "{}")
        note = {
            "id": str(uuid.uuid4()),
            "body": payload.get("body", ""),
        }
        NOTES[note["id"]] = note
        body = json.dumps(note).encode("utf-8")
        self.send_response(200)
        self.send_header("Content-Type", "application/json")
        self.send_header("Content-Length", str(len(body)))
        self.end_headers()
        self.wfile.write(body)

    def log_message(self, fmt, *args):
        return


if __name__ == "__main__":
    HTTPServer(("127.0.0.1", 8787), Handler).serve_forever()

Notice the absences before you praise the code.
There is no GET list and no DELETE path.
There is no HTML page and no token header.
There is no retry wrapper around a local POST.
That absence is the whole point of the weekend.

Start the process in one terminal only:

python3 server.py

Run the recorded demo in a second terminal:

./scripts/demo.sh

You should see JSON with id and body.
If you see a login form, the gate already failed.
Delete the extra surface before you keep prompting.

Step 4: Add a checker the agent cannot charm

Humans get talked into extra routes after lunch.
A checker does not care about a confident plan.
Put the proof in a script, then refuse debate.

scripts/check-demo.sh:

#!/usr/bin/env bash
set -euo pipefail

base="${DEMO_URL:-http://127.0.0.1:8787}"
out="$(mktemp)"
trap 'rm -f "$out"' EXIT

code="$(curl -sS -o "$out" -w "%{http_code}" -X POST "$base/notes" \
  -H "content-type: application/json" \
  -d '{"body":"ship the spike"}')"

test "$code" = "200"
python3 - "$out" <<'PY'
import json, sys
path = sys.argv[1]
data = json.load(open(path))
assert "id" in data and "body" in data, data
assert data["body"] == "ship the spike", data
print("demo contract ok")
PY

Run the checker after every agent edit:

chmod +x scripts/check-demo.sh
./scripts/check-demo.sh

If the checker still passes, you can stop.
Passing is the definition of done today.
A green checker beats a prettier architecture sketch.

Step 5: Reject extra surfaces with a table

Use this table when the agent improves the spike.
Ask it to fill the middle column before writing code.
If the answer is No, the work is out of scope.

Agent proposal	Serves scripts/demo.sh?	Saturday action
POST /notes	Yes	Keep
GET /notes	No	Skip
Login and JWT	No	Skip
React settings page	No	Skip
Retry with backoff	No	Skip
Dockerfile and compose	No	Skip
GitHub Actions workflow	No	Skip
WebSocket status feed	No	Skip
Second listen port	No	Skip

Print the table inside the prompt itself.
Do not negotiate rows after the agent starts coding.
The table is cheaper than a two-hour rollback.

What you skip on purpose

You skip auth because the spike is local only.
You skip UI because curl is the interface today.
You skip retries because failure should stay loud.
You skip CI because nobody else runs this yet.
You skip extra verbs because listing is not the demo.

That list would look reckless on a work Monday.
It is responsible on a two-hour Saturday spike.
A finished happy path beats a half-built platform.
Ship the replayable curl, then close the laptop.

Where a free model loop fits

You can run this gate in any coding agent.
The yaml and checker stay tool-agnostic on purpose.
A free model path helps when plans expand too fast.
A free server path helps when your laptop is busy.

Disclosure: This article was prepared as part of MonkeyCode's product outreach.

MonkeyCode matters here only as a host for that loop.
It offers free model access for the planning passes.
It also offers a free server option for the checker.
Use those if you want the fence off your laptop.
Do not treat the sandbox as a reason to grow scope.
The recorded curl still wins over the extra machine.

If you run the same Saturday fence there, glue the skip list to the prompt.

Limitations

This workflow is for spikes, not launches.
It hides real product work on purpose.
Do not use it for payment or billing flows.
Do not use it for private user data.
Do not use it when compliance needs audit logs.
Do not use it as your only test suite.

The in-memory map dies on process restart.
That is acceptable for a demo transcript.
It is not acceptable for anything you bill.
Restart the process and the notes are gone.

The checker proves one happy path only.
It does not prove security, load, or auth.
It will not catch a missing rate limit.
You skipped those items. Remember that Monday.

Who should not use this

Skip this gate if you ship to users today.
Skip it if authentication is the actual problem.
Skip it if the demo must be a visible UI.
Skip it if your team needs public staging now.
Skip it if you cannot explain the skipped list.

This is a weekend knife, not a process religion.
Do not drop it onto a regulated codebase.
Do not confuse a green curl with production readiness.

Close the laptop with a replay

Before you stop, run three things in order.
Start the process, run the demo, run the checker.
If all three work, the weekend actually shipped.
If the agent added a dashboard, delete that surface.
Your recorded curl is the product for today.

You can add GET lists next Saturday if needed.
You can add auth when a second user exists.
You cannot add those hours back tonight.
Leave the skip list in the repo as a warning.