Hold Shared Sandbox Work Behind a Promotion Lane

Shared free compute is not a merge queue. Agent output on a borrowed server still needs a named owner. A sealed replay kit must exist before anyone ships. A human stamp still sits between sandbox and repo.

Teams skip that gate when a sandbox feels disposable. Disposable hardware is the point of the machine. Disposable patches are not the point of shipping. The next person inherits a dirty shared desk. Last run guesses then leak into the next ticket.

A hotel room remains the right working analogy. Guests may boil water in the kettle. They should not leave soup on the stove. Checkout is an inspection and not a feeling. Shared agent sandboxes need that same checkout.

Public talk about smarter agents stays loud. The floor problem is duller than model rankings. The loop can look healthy while the room rots. Two operators may share one login and disk. Green tests then belong to the previous tenant.

An agent can look busy on a shared box. Files appear in odd folders without owners. Tests can flicker green only one time. Nobody can replay the prompt two days later. The branch name is often just tmp. The env file still holds a personal token.

Loop writeups often skip this messy floor. The retry policy is not the only failure. The shared room is the quieter failure. Without a lane, every retry overwrites the last retry. Without a promotion card, sandbox luck becomes a ship argument.

This playbook treats the sandbox as a hotel room. Work parks in a named lane until review. Output leaves only through a written gate. The wiki card below is the whole run.

Four roles keep the hotel room honest. One person may wear two hats today. Blank names are not allowed on the card. The lane claimant books the sandbox slot. The agent operator runs the model session. The promotion reviewer refuses or stamps the patch. The lane resetter wipes the room for the next guest.

Handoffs should move in one direction only. Claim, operate, seal, and review stay ordered. Promote or scrap follows the reviewer stamp. Reset stays last on purpose during every run. Skipping reset lets the next ticket inherit ghosts.

Paste the following card into the team wiki. Fill every name before the agent starts. Do not start a session on a blank card.

# Promotion Lane Card
Date:
Ticket:
Lane id: lane-<ticket>-<initials>
Claimant:
Operator:
Reviewer:
Resetter:
Sandbox host: shared free server, not prod
Model access: team free-model path, not prod keys
Secret policy: no prod secrets in the lane
Allowed writes: ./lane/<id>/work only
Forbidden writes: ~/.ssh, org tokens, prod kubeconfig

## Intake
Problem in one sentence:
Done when:
Out of scope:
Replay command:
Eval command:

## Seal
Replay kit path:
Prompt log path:
Diff path:
Test log path:
Env redaction: done / not done
Checker result: pass / fail

## Gate
Reviewer stamp: approve / return / scrap
Ship PR:
Reset at:

The card is boring on purpose for a reason. Boring cards get filled during a messy night. Clever cards get skipped during the same night.

Ceremony without files remains theater for the next owner. The operator creates a lane directory first. The agent never owns the home directory.

TICKET="PAY-214"
LANE="lane-${TICKET}-mx"
ROOT="${HOME}/agent-lanes/${LANE}"
mkdir -p "${ROOT}/work" "${ROOT}/replay" "${ROOT}/logs"
git -C "${ROOT}/work" init
printf '%s\n' "${TICKET}" > "${ROOT}/TICKET"
date -u +%FT%TZ > "${ROOT}/CLAIMED_AT"
printf '%s\n' "agent-lane-${TICKET}" > "${ROOT}/PROCESS_NAME"

A tiny ignore file keeps secrets out of the kit. It is not a true security boundary. It is a speed bump with a paper trail.

cat > "${ROOT}/.gitignore" <<'EOF'
**/.env
**/*.pem
**/*id_rsa*
**/kubeconfig
**/credentials.json
EOF

The operator records the prompt as a file. Chat legends are not evidence after logout. Disk survives the session and memory does not.

cat > "${ROOT}/replay/prompt.md" <<'EOF'
# Prompt
Goal: describe the ticket in one paragraph.
Constraints: touch only files under work/
Eval: bash ../replay/eval.sh
EOF

A fixed eval script beats a remembered command. The reviewer runs that same file later. Arguments should not live in anyone's head.

cat > "${ROOT}/replay/eval.sh" <<'EOF'
#!/usr/bin/env bash
set -euo pipefail
cd "$(dirname "$0")/../work"
if [ -f package.json ]; then
  npm test
elif command -v pytest >/dev/null; then
  pytest -q
else
  echo "no eval runner" >&2
  exit 2
fi
EOF
chmod +x "${ROOT}/replay/eval.sh"

When the session ends, the operator seals the kit. Sealing is a tar archive of known paths. It is not a screenshot of the terminal. Leftover env files remain the usual leak. Delete them before the archive step runs. Optional shred tools vary by host image. Absence of shred is not a passing grade.

find "${ROOT}" -name '.env' -delete
tar -C "${HOME}/agent-lanes" -czf "${HOME}/agent-lanes/${LANE}.replay.tgz" "${LANE}"
sha256sum "${HOME}/agent-lanes/${LANE}.replay.tgz" | tee "${ROOT}/replay/SHA256"

The reviewer never SSHs in to look around. The reviewer unpacks the kit on a clean clone. If the kit cannot stand alone, the lane failed. Failed lanes do not ship into the real repo.

REVIEW="${HOME}/agent-reviews/${LANE}"
mkdir -p "${REVIEW}"
tar -C "${REVIEW}" -xzf "${HOME}/agent-lanes/${LANE}.replay.tgz"
bash "${REVIEW}/${LANE}/replay/eval.sh"
git -C "${REVIEW}/${LANE}/work" diff --stat

A small checker can fail the seal early. It does not grade the model output. It only grades the room and the kit. The script below is a proposed helper, not a measured production service.

#!/usr/bin/env python3
# Proposed lane seal checker. Unexecuted example.
from pathlib import Path
import sys

FORBIDDEN = {'.env', 'id_rsa', 'kubeconfig', 'credentials.json'}

def main(root):
    errors = []
    required = [
        root / 'TICKET',
        root / 'replay' / 'prompt.md',
        root / 'replay' / 'eval.sh',
        root / 'replay' / 'SHA256',
    ]
    for path in required:
        if not path.is_file():
            errors.append('missing ' + path.name)
    for path in root.rglob('*'):
        if path.name in FORBIDDEN:
            errors.append('forbidden file: ' + str(path))
    for line in errors:
        print(line, file=sys.stderr)
    return 1 if errors else 0

if __name__ == '__main__':
    sys.exit(main(Path(sys.argv[1])))

python3 check_lane.py "${ROOT}"

Promotion is a copy onto a real branch. It is not a push from the sandbox user. Shared sandbox users do not receive org write tokens.

# On the reviewer's laptop, not on the shared host.
git clone [e-mail]:org/service.git
cd service
git checkout -b "lane/${TICKET}"
rsync -a --exclude '.git' "${REVIEW}/${LANE}/work/" ./
git add -A
git status
# Human commit only after reading the diff.

Reset is a separate act after the stamp. A reset before seal destroys the court record. Only the named resetter runs the wipe command. Killing every process for a shared Unix user is too broad. Kill the lane process name only.

# Named resetter only, after reviewer stamp.
pkill -f "agent-lane-${TICKET}" || true
rm -rf "${ROOT}"

A hypothetical night shift shows the gap clearly. Operator A stops work at eighteen hundred hours. Operator B starts ten minutes later on the same login. B sees a green test and a dirty worktree. B ships a small fix from that inherited tree. Morning CI fails on a secret that belonged to A. Nobody can replay A's prompt from chat memory. The hotel never ran a real checkout.

The reviewer keeps three stamps, not two. Approve means the kit stands alone on a clean clone. Approve also means the diff matches the ticket. Scrap means the room or the patch is contaminated. Return means the operator must reseal after a narrow fix. Return is not a quiet approve by another name.

Some teams already burn private laptops for every trial. That habit hides the hotel problem for a while. The problem returns when two people share a box.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode offers free model access and a free server option. Those two facts matter here for one local reason. A shared free server behaves like a hotel room. Free model access is the kettle in that room. Neither gift is a merge queue for production code. Teams may try that free model access and free server option. Then they paste the promotion lane card into the wiki.

The operator parks exploratory work on that free server. The replay kit still leaves with the claimant. If the host is later busy or gone, the kit remains the record. Do not treat the shared host as durable storage.

The usual leak is a leftover env file. The second leak is a prompt that lived in a GUI. The third leak is a green test against the previous tenant database. A promotion lane does not make the model wiser. It only makes the shared room accountable. If eval needs the last tenant Docker volume, the lane is contaminated. Scrap that work and reset the room before a new card.

Another failure is role collapse without written names. Saying everyone reviews means nobody reviews tonight. Write a person and write a backup person. Calendar night is not a qualified reviewer.

This SOP stays slow on purpose for shared hosts. Solo developers on a private machine may skip the hotel ritual. They should still keep a prompt file on disk. They do not need a named resetter for that case.

Do not put production secrets on a shared free server. Do not park patient data on that same host. Do not park payroll files or unreleased keys there. A free sandbox is the wrong building for that work.

The lane is not a replacement for CI. CI still runs on the real pull request. The eval script is a preview and not a release. Reviewers who skip CI after a green sandbox break the ritual.

The commands above assume a Unix login and tar. Windows teams still need the same folder contract. They do not need the same shell binaries. Translate the commands and do not skip the seal.

Teams with ephemeral per-job runners already have lanes. They should not add a second hotel on a shared login. Two rooms for one ticket split the evidence trail.

Unsupported claims go stale in this product space. This article does not assign model names. It does not assign token quotas, hardware sizes, or uptime. Those numbers belong on a dated vendor page. The promotion card does not carry them.

Skip the promotion lane if the agent never writes files. Skip it if every run already dies with the CI job. Skip it if legal forbids shared hosts entirely. Do not use a shared free server as a stealth production jumphost. The lane card will not save that design. Move that work onto an isolated runner instead.

The core rule stays small on purpose. Name the lane before the agent starts. Seal the kit before the reviewer looks. Stamp the card before the patch ships. Reset the room for the next guest.