A Green Suite Must Not Unlock the Free Server

The scene below is a composite staging pattern, not a logged customer incident. A Friday patch looked finished before anyone read the diff. A free model had rewritten a small rate-limit parser.

The local unit suite reported zero failures that afternoon. A shared free server then received the binary. Monday traffic sent a header the tests never built.

The parser dropped that header and opened the limiter. Staging became a noisy neighbor for every other tenant. That pattern is a promotion failure, not a model-quality debate.

A green suite measured the tests already on disk. It did not measure the traffic that host would meet. A free lane can still draft the patch.

It must not own the promotion decision alone. This note is not a workload placement guide. It is a promotion gate for model-written patches.

What a green suite actually proved

A unit suite proves the cases someone already wrote. It does not prove header coverage for live traffic. It does not prove clock behavior on the host.

It does not prove neighbor isolation on a shared box. Zero failures can still hide one missing case. Treat a perfect score as a narrow lab result.

Do not treat that score as a deploy permit. CI logs often add a false kind of comfort. A green check mark names a workflow file.

It does not name the absent fixture at all. Read the test file list before the badge. If the new header is missing there, the badge is noise.

Red flags before a free-server copy

Stop the copy when any flag below is true. One flag is enough to hold the binary. Several flags mean the lane itself is wrong.

• The diff touches auth, billing, webhooks, or limits.
• The suite has no fixture for the new header or clock.
• The target host is shared with other tenants or jobs.
• Rollback needs a person who is already offline.
• The model wrote both the patch and the new tests.
• No human diff review is attached to the change record.
• The free server has no per-tenant CPU or restart cap.
• Logs on that host mix several projects in one stream.

Move the change to an isolated reviewed host. Or drop the change until the suite grows real fixtures. Do not argue from the green badge alone.

Read the diff before the badge

Run these commands from the branch under review. They are a review habit, not a claim about any one repository. Scan the name list before opening the badge.

git diff --name-only origin/main...HEAD
git diff --stat origin/main...HEAD
git log -1 --format='%an %ae %s'

Scan the name list for limit, auth, bill, and webhook paths. Open the matching test files in the next step. Confirm a new fixture fails on the old parser.

If the fixture passes on the old parser, it does not guard the change. Write a better fixture before any host copy. A passing new test on old code is a weak guard.

A clock case with the same hold

A second composite case shows the same hold without a limiter. A report job sorted dates as plain strings. A free model rewrote that date sort alone.

The tests used one local timezone only. The scratch host ran in UTC that night. Monday's report hid Sunday's rows from the office view.

The suite on that branch was fully green. The missing fixture was the host clock setting. Hold that binary before any shared host copy.

A local hold script

The script below is an unexecuted proposal only. It has not been executed for this article. It reads a small local manifest file first.

It exits non-zero when the promotion is unsafe. Wire it in front of any copy to a free server. Do not treat a zero exit as proof of correctness.

This proposal never exits zero on purpose here. A later human step can override the hold. Record that override outside the model transcript file.

#!/usr/bin/env bash
# proposed gate — not an executed benchmark
set -euo pipefail

manifest="${1:-promotion.yaml}"
test -f "$manifest" || { echo "missing manifest"; exit 2; }

python3 - "$manifest" <<'PY'
import sys, pathlib
try:
    import yaml
except ImportError:
    sys.stderr.write("pyyaml required for this proposal")
    sys.exit(2)

raw = pathlib.Path(sys.argv[1]).read_text()
data = yaml.safe_load(raw) or {}
reasons = []
touches = set(data.get("touches") or [])
banned = {"auth", "billing", "webhook", "limits"}

if data.get("model_wrote_tests"):
    reasons.append("model wrote the tests that claim coverage")
if touches & banned:
    reasons.append("diff touches a banned path for this lane")
if not data.get("human_diff_review"):
    reasons.append("no human diff review on the change record")
if data.get("target") == "shared-free-server" and not data.get("neighbor_cap"):
    reasons.append("shared host has no neighbor cap")
if "limits" in touches and int(data.get("new_header_fixtures") or 0) < 1:
    reasons.append("limit change has no new header fixture")
if "clock" in touches and int(data.get("clock_fixtures") or 0) < 1:
    reasons.append("clock change has no timezone fixture")
if not data.get("rollback_owner_online"):
    reasons.append("rollback owner is offline")

print("HOLD")
for item in reasons:
    print("- " + item)
print("- green suite is not a promotion permit")
sys.exit(1)
PY

Example manifest for the Friday parser:

# proposed fixture — not a production record
model_wrote_tests: true
touches: ["limits"]
human_diff_review: false
target: shared-free-server
neighbor_cap: false
new_header_fixtures: 0
clock_fixtures: 0
rollback_owner_online: false
suite_result: green

Expected result of this proposal is exit code 1. Printed reasons name the hold in plain text. A green suite result is present and then ignored.

The field may still exist in the notes. It must not clear the promotion gate alone. Keep that rule even if a later script grows new checks.

Decision table

Use this table before any copy step. A row can fail while the suite stays green. Clear prose is not a promotion permit here.

Signal	Free-model draft	Free-server run	Promotion
Docs typo, no runtime path	Allowed with review	Unnecessary	Human merge only
Parser change, new fixtures, isolated host	Draft only	Scratch run only	Hold for a human canary
Parser change, missing header fixture	Refuse this lane	Do not copy the binary	Rewrite tests first
Clock change, one timezone in tests	Draft only	Refuse shared hosts	Add clock fixtures first
Auth, billing, or webhook diff	Refuse this lane	Refuse this host	Use an isolated reviewed path
Model wrote the passing tests	Draft the code only	Do not trust that suite	Independent tests required
Shared host, no neighbor cap	Irrelevant	Refuse this host	Move to an isolated box

A fast draft is not a canary plan. Read the row that matches the diff. Then stop or continue on that row alone.

Better alternatives

Keep the free lane on disposable drafts only. Generate a patch, then stop that lane there. A second person writes the missing fixtures next.

Those fixtures must fail on the old code. Only then may a scratch process start safely. Prefer an isolated scratch host for that process.

A laptop container is enough for a parser. A shared free server is a poor neighbor for limit experiments. Cap restarts on any scratch box in use.

Wipe the box after the scratch run ends. Do not point live traffic at that box. Split the roles on the change record itself.

One lane may suggest a diff and nothing more. That same lane may not grade its own tests. A human owns the promotion step in full.

A human owns the rollback step as well. Write both names next to the manifest hash. Store that record outside the model chat.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. The operator states that free model access exists. The same note states a free server option.

This guide uses those options only as a draft lane and a scratch host. It does not quote quotas, hardware, duration, or model names. No token allotment is stated in this draft.

No primary quota figure was attached here. Primary docs remain the source for current terms. Terms can change between one week and the next.

This text is not a capacity or uptime promise. Where a free model is used, keep it off the promotion gate. Where a free server is used, keep it off shared tenant traffic.

Remove every product name and the method still stands. The hold is about blast radius, not a score. It is not about a vendor score at all.

Exit criteria

Leave the free lane when any line below becomes true. Exit means stop the copy to the host. It does not mean delete the local draft.

1. The patch now touches auth, billing, webhooks, or limits.
2. The suite cannot fail the old code on a new fixture.
3. The only host available is shared and uncapped.
4. The rollback owner is offline for the next traffic window.
5. The same model wrote the patch and the passing tests.
6. Primary docs no longer match the access assumed last week.
7. A neighbor job has already been starved on that host.
8. The change record has no human diff review link.

Park the patch in the open review branch. Grow the suite with one failing fixture first. Book an isolated host for the next run.

Then review the manifest with a second person. Re-entry is allowed only after those flags clear. A later green suite does not reopen a closed flag.

Clear the flag inside the manifest itself first. Run the hold script again on that file. Expect another hold from this proposal script run.

Then apply a separate human canary plan next. Do not let the model write that canary plan alone. A second person should name the abort signal.

Limits of this guide

This guide does not measure model accuracy at all. It does not rank hosts or cloud regions. It does not set a token budget here.

It does not claim a free server is private or durable. It does not claim a free lane is staffed or permanent. The script remains an unexecuted local proposal only.

PyYAML is an assumed import, not a bundled tool. Review the script locally before any real wiring. A missing import should fail closed, as written.

Do not use this gate as a compliance certificate. It will not catch a weak fixture that still passes. It will not catch a hostile dependency in the tree.

It will not replace secret scanning or policy review. Pair it with ordinary human code review steps. Pair it with an isolated canary run next.

Pair it with a rollback drill a person can run without the model. Teams with no shared staging can still use the red-flag list. They should not invent a free-server story to fit the table.

Solo experiments on disposable repos can skip the shared-host rows. They should not skip a human reading of limit or clock parsers. Disposable does not mean unread.

Who should not use this pattern

Skip the shared-host rules when the binary never leaves one laptop. Skip the product notes when no free lane sits on the path. Do not skip the self-graded test rule.

A model that writes its own passing tests is a weak witness. That rule survives without any vendor in the path. It also survives a perfect local suite score.

Staff who need a production region should not improvise. A contract or a named quota is a different lane. Do not stretch a free option into that role.

Ask the current primary docs for access terms. If those docs are silent, stay on an isolated reviewed path. Silence is not a deploy permit for anyone.

Put the hold script beside the deploy notes. Fill a manifest for the next parser or clock change. Confirm current free-access terms before any scratch host is chosen.

Keep the ship button on a human hand. Leave the model on the draft side of that line.