A Loading-Dock SOP for Cheap AI Patches

Cheap AI patches pile up like unmarked crates. A team that skips intake will drown in silent debt. This proposed SOP treats every AI-origin change as freight.

The dock lives on a wiki page, not in Slack. Three named roles move each crate in order. Each handoff leaves a written trail for the next shift.

Pair sessions now emit diffs faster than architecture review. Cheap generation does not cheapen later ownership costs. Unpaid debt from AI-written code is a warehouse problem.

A loading dock keeps the process dull on purpose. Dull process survives a late Friday deploy window. Hero review usually dies around six in the evening.

The first named role is the Dock Clerk. The clerk does not judge design quality at all. The clerk only records origin, files, and risk class.

Origin uses one of three explicit stamps today. Those stamps are human-typed, AI-assisted, or fully generated. Risk class must be local, service-wide, or data-path.

Local means a single module with no shared surface. Service-wide means a public API or shared package. Data-path means cache, queue, file, or store access.

The second named role is the Shape Guard. The guard reads one paragraph of shape notes. That note names module boundaries and allowed stores.

A patch that invents a new cache must stop. A patch that opens a side store must stop. The crate waits until the shape note changes.

The third named role is the Merge Notary. The notary never designs and never rewrites code. The notary only checks stamps, logs, and tickets.

Green unit tests without a ticket still fail. A clerk stamp without a sandbox log still fails. The notary records the merge hash beside the ticket.

Handoffs stay linear for a boring reason. Clerk hands work to the Shape Guard next. Guard hands work to the sandbox runner next.

Sandbox hands the log to the Merge Notary. A skipped stamp is always a failed merge. Tiny diffs still walk the same linear line.

The crate metaphor still holds for one-line patches. One line can reroute a production cache key. Silent helpers still create quiet compounding debt.

Teams should paste one runbook, not a novel. The wiki block below is a labeled proposal. Operators must adapt names and paths before use.

# AI Patch Loading Dock (proposed)

Owner of this page: <team-lead>
Shape note (one paragraph): <module boundaries and allowed stores>
Freeze window: <dates or none>

Stamps required before merge:
Clerk records origin, files, and risk class.
Guard records shape-note fit or reject-new-store.
Sandbox attaches a command log no older than 24 hours.
Notary records ticket ID and merge hash.

Handoff line:
Clerk -> Shape Guard -> sandbox -> Merge Notary

Reject without discussion:
new store or cache absent from the shape note;
missing origin stamp;
sandbox log older than 24 hours;
no debt ticket when risk is not local.

The runbook is useless without a classifier nearby. The script below is proposed and not production-hardened. Reviewers should treat its risk label as a hint.

#!/usr/bin/env bash
# proposed: classify_ai_patch.sh
# Unexecuted example. Review before any real use.
set -euo pipefail
DIFF="$(git diff --cached --name-only)"
echo "files:"
echo "${DIFF}"
RISK="local"
if echo "${DIFF}" | grep -Eq '(cache|redis|queue|migration|schema)'; then
  RISK="data-path"
fi
if echo "${DIFF}" | grep -Eq '(pkg/api|internal/public|openapi)'; then
  RISK="service-wide"
fi
echo "proposed_risk=${RISK}"

The classifier only reads staged names, not semantics. A rename can hide a cache file from grep. The Shape Guard still reads the actual diff.

Debt tickets belong in the repo, not in chat. The tiny writer below drops a markdown file. Humans still fill impact and rollback by hand.

# proposed: write_debt_ticket.py
# Unexecuted example. Fill remaining fields by hand.
from pathlib import Path
from datetime import datetime, timezone
import sys

risk = sys.argv[1] if len(sys.argv) > 1 else "local"
slug = datetime.now(timezone.utc).strftime("%Y%m%dT%H%MZ")
path = Path("debt") / f"{slug}-{risk}.md"
path.parent.mkdir(exist_ok=True)
body = """# Debt ticket {slug}

risk: {risk}
origin: AI-assisted
files:
impact:
rollback:
sandbox_log:
""".format(slug=slug, risk=risk)
path.write_text(body)
print(path)

A throwaway clone can smoke both helpers in minutes. The commands below are a proposed test plan. They do not prove production behavior.

# proposed test plan on a throwaway clone
git add pkg/cache/second.go
./classify_ai_patch.sh
# expect proposed_risk=data-path
python3 write_debt_ticket.py data-path
# expect a new markdown file under debt/

Consider a labeled illustration, not a field report. An AI pair session adds a second user cache. The clerk stamps origin as AI-assisted and data-path.

The Shape Guard reads the wiki shape note carefully. The note allows one session store, not two caches. The guard rejects the crate before any sandbox run.

That reject is the whole point of the dock. Cheap patches should fail early at the door. Later cleanup costs more than a delayed merge.

If the shape note later allows a second cache, the clerk reopens the crate. The sandbox then runs tests against a cold cache. The notary files the ticket and stamps the hash.

Release freeze does not pause the loading dock. It changes the notary rule for data-path crates. Data-path crates wait until the freeze window ends.

Local crates may still merge during a freeze. Service-wide crates need an extra owner initial on the ticket. The wiki freeze dates beat a chat announcement.

Local laptops lie about shared cache behavior often. A notary needs a log from a shared runner. Screenshots from one engineer are not a log.

A disposable sandbox is the missing dock door. Disclosure: This article was prepared as part of MonkeyCode's product outreach. Teams may draft the clerk note with that free model access.

They may run the proposed scripts on the free server option. This article names no models, quotas, or hardware details. Availability can change without a blog post.

Teams must check the product surface before depending on it. Free inference does not replace licensed human review. A free server does not prove production cache behavior.

The SOP cannot freeze architecture by itself ever. The SOP fails when three roles collapse into one rubber stamp. It also fails during a live incident with no clerk.

It fails if the shape note is a rotting paragraph. Regulated codebases still need their signed review path. Solo prototypes with no shared store can skip this.

Teams with a working change board should not duplicate it. Security review is never a stamp on this dock. Secret handling stays on the existing security checklist.

Some teams already keep wiki runbooks for merges. They can point the sandbox step at that free server option. The stamps still live in git, not in a vendor UI.