Cheap Patches Need a Merge Steward Card

Cheap agent patches fail at clearance, not generation. A named merge steward stops silent landings on main. This playbook is one wiki card a team can paste.

When inference is free, new patches outrun real ownership. That gap becomes the true operating cost for teams. Speed without a signer turns main into lost-and-found.

Think of extra weekend traffic around a shared runway. Planes still need a tower before they land. The merge steward is that tower, not the aircraft.

Some teams bound agent jobs on a free server. They pair that box with free model access. MonkeyCode offers both for a cheap experiment lane.

Disclosure: This article was prepared as part of MonkeyCode's product outreach.

The product name is not the working protocol. Remove the vendor and the steward run still holds. The protocol is human ownership around cheap generation.

Agents write plausible diffs with a missing blast radius. Reviewers skim because the change looks small. Nobody records who may revert after midnight.

The cheap lane makes that failure easy to repeat. A free model will emit a second bad patch. A free server will run it without protest.

The SOP does not make the model wiser. It only makes the handoff visible to humans. Visibility is the control that survives model swaps.

Four seats sit on every cheap-lane change ticket. The requester states the bound and the reject rule. The operator runs the job inside that bound.

The merge steward is a human with revert rights. The steward is not the agent or the ticket bot. On-call is paged only when runtime paths move.

One person may hold two seats on a tiny team. The steward seat still cannot stay empty overnight. An empty steward seat is an automatic reject.

Handoff is a baton, not a pile of chat logs. The operator passes an artifact bundle, not a vibe. The steward accepts or returns that bundle with a reason code.

Every cheap-lane job ends with the same bundle. The bundle is a directory, not a screenshot. If a file is missing, the steward does not guess.

A minimal bundle looks like this on disk.

change/
  ticket.json
  bound.md
  diff.patch
  test-log.txt
  revert.md

ticket.json names the four seats and the bound. bound.md states files the agent may touch. The diff.patch file is the only proposed change.

test-log.txt is command output the operator actually ran. revert.md is a one-command rollback the steward can paste. Missing revert notes fail the gate on sight.

Here is a ticket the operator can emit from a template. Treat the names as placeholders, not a live roster.

{
  "id": "CL-2026-0914",
  "requester": "alex.nguyen",
  "operator": "sam.okonkwo",
  "steward": "jordan.lee",
  "oncall": "unpaged",
  "bound_paths": [
    "src/billing/invoice.py",
    "tests/billing/test_invoice.py"
  ],
  "forbidden_paths": ["infra/", "migrations/", ".github/"],
  "reject_if": ["touches auth", "changes prices", "adds network calls"],
  "runtime_touch": false,
  "status": "awaiting-steward"
}

The steward field is a person, never a model. The oncall field stays unpaged unless runtime_touch is true. A true runtime flag without named on-call fails closed.

bound.md should be shorter than the prompt that created the diff. A usable bound file can look like the block below.

# Bound
Touch only:
- src/billing/invoice.py
- tests/billing/test_invoice.py

Reject if the diff adds network calls.
Revert with: git revert --no-edit HEAD

Paste the following run into the team wiki. Keep the wiki card boring on purpose every week. Boring runs are the ones that survive weekends.

# Cheap-Lane Clearance Run

## Before the agent starts
1. Requester files ticket.json with bound_paths and reject_if.
2. Steward name is filled before any prompt is sent.
3. Operator confirms forbidden_paths with git ls-files.

## During the job
1. Operator runs the agent only against bound_paths.
2. Operator captures stdout and tests into test-log.txt.
3. Operator writes revert.md with a single git command.

## Steward gate
1. Steward reads bound.md before the diff.
2. Steward runs steward-gate.sh on the bundle.
3. Steward merges, returns, or rejects with a reason code.

## After merge
1. Steward pastes the commit SHA on the ticket.
2. Requester watches the first deploy window.
3. On-call is paged only if runtime_touch was true.

The numbered steps live inside the wiki card. Chat remains a hallway with no memory. The wiki is the tower log for the runway.

The steward should not rely on memory at 01:00. A small shell check catches empty seats and path leaks. The script below is a proposal, unexecuted until a fixture run.

#!/usr/bin/env bash
# steward-gate.sh — proposal, run on a fixture first
set -euo pipefail
DIR="${1:?usage: steward-gate.sh ./change}"

need() {
  [[ -s "$DIR/$1" ]] || { echo "FAIL missing $1"; exit 2; }
}

need ticket.json
need bound.md
need diff.patch
need test-log.txt
need revert.md

python3 - <<'PY' "$DIR/ticket.json" "$DIR/diff.patch"
import json, sys, re, pathlib
ticket = json.loads(pathlib.Path(sys.argv[1]).read_text())
diff = pathlib.Path(sys.argv[2]).read_text()
for seat in ("requester", "operator", "steward"):
    if not ticket.get(seat):
        raise SystemExit(f"FAIL empty seat: {seat}")
if ticket.get("runtime_touch") and ticket.get("oncall") in (None, "", "unpaged"):
    raise SystemExit("FAIL runtime touch without on-call")
files = re.findall(r"^\+\+\+ b/(.+)$", diff, re.M)
bound = set(ticket["bound_paths"])
leaks = [f for f in files if f not in bound]
if leaks:
    raise SystemExit("FAIL path leak: " + ", ".join(leaks))
print("PASS steward-gate")
PY

The steward runs it from a clean checkout every time. A PASS is permission to read, not to merge. Merge still needs the human stamp on main.

Path leaks remain the usual cheap-lane surprise. Free models wander into infra when the prompt is vague. The bound list is a fence, not a suggestion.

Confirm the flight plan against git before anyone applies ink.

git ls-files src/billing/invoice.py tests/billing/test_invoice.py
git checkout -b cl-2026-0914
git apply --check change/diff.patch
git apply change/diff.patch
git diff --stat

The check flag is the cheap test before apply. If it fails, the bundle goes back to the operator. The steward does not repair the patch in place.

Returned bundles need a short code, not a novel. Those codes keep the next operator run tight. The wiki can keep this tiny roster in one block.

R1 bound-leak
R2 empty-seat
R3 no-revert
R4 tests-unrun
R5 runtime-unpaged
R6 steward-reject-product

The operator treats R1 through R5 as mechanical. R6 is a human no from the steward. Mechanical codes should not spawn a debate thread.

A tiny Makefile target keeps the gate from drifting.

.PHONY: steward-gate
steward-gate:
    bash scripts/steward-gate.sh ./change

The target is ceremony, and ceremony is the point. People skip unsigned scripts under heavy time pressure. They run a named target more often at night.

The SOP does not score model quality for the team. It does not promise a quota, a GPU, or a forever-free box. Those claims change and do not belong on the wiki card.

It does not replace architecture review on large work. Large refactors still need a short design note. Cheap-lane merges are for bounded files with a revert.

It does not make the agent the owner of main. Ownership stays on the steward's named account always. If that person is away, the job waits.

Do not use this run on production auth or payments. Do not use it when no steward can revert within one hour. Do not use it as a way to skip tests.

Solo hobby repos may skip the four seats. A team with shared main should not skip them. Shared main is a street, not a private driveway.

Regulated codebases still need their own change board. This card is a tower clerk, not a compliance officer. Mixing the two hides real audits behind a cute SOP.

Suppose the bound lists only src/billing/invoice.py. The same diff also touches .github/workflows/ci.yml. Then steward-gate.sh exits with a path leak.

The steward writes R1 bound-leak on the ticket. The operator recuts the job without the workflow file. The second bundle passes the gate and still needs a human read.

That loop is slower than pasting the first diff. It is faster than a broken deploy at dawn. The tower is supposed to be slower than the aircraft.

After a merge, the steward pastes the commit SHA on the ticket. The requester watches the first deploy window without new prompts. On-call stays quiet unless runtime_touch was true.

A last local check belongs in revert.md before anyone sleeps.

git revert --no-edit HEAD
git push origin main

That command pair is the actual stamp ink. If revert.md cannot be that short, the change is too wide. Wide changes leave the cheap lane and enter design review.

Name the merge steward before the cheap lane starts. Paste the run into the wiki and keep the bundle boring. The agent can be swapped; the stamp cannot.

Teams that want a cheap lane can reuse this steward gate. MonkeyCode's free model access and free server option fit this cheap lane. The protocol stays useful if that product is absent.