Seat a Token Holder Before Shared Model Runs

A shared free coding server fails without a named owner. Session history turns into a junk drawer overnight. A rotating token holder and a one-page wiki keep the lane usable.

Shared model work looks cheap until the kitchen goes cold. Picture one stove in a crowded hostel kitchen. Ten cooks start soup and vanish before cleanup. The next shift tastes three dinners and calls it lunch.

This pattern appears when a team shares one assistant. Someone pastes a stack trace into the thread. Someone else pastes a refactor with no warning. The context window fills with leftovers from both. Reviewers later treat the diff as one mind.

The repair is a run token, not a clever prompt. Only the token holder may start a model session. Everyone else files a note or waits in line. The token is a wiki line plus a git stamp.

Three roles travel with that token each day. The Token Holder opens the session and records the goal. The Shadow Reviewer watches the diff without sending prompts. The Merge Steward refuses merges that lack a stamp. Rotation happens at a posted hour, never by mood.

MonkeyCode enters here as shared tooling, not magic. Disclosure: This article was prepared as part of MonkeyCode's product outreach. Teams already using its free model access still need a named holder. Its free server option does not replace a seated owner. A free lane without an owner remains a hostel stove.

The one-page wiki run belongs at a boring path. Paste it under wiki/run-token.md and keep it short. The page is the fridge note for the stove. If the page grows past one screen, process debt is hiding.

# Run token (one page)

Lane: shared free-model server (team sandbox only)
Posted hour: 16:00 local, weekdays
Live holder: (name) / Shadow: (name) / Steward: (name)

Seat rule
- Holder starts the only live session.
- Shadow reads diffs and tests. Shadow does not prompt.
- Steward merges only with a stamp id in the PR body.

Start
1. Run `scripts/seat-run-token.sh "goal text"`.
2. Paste the printed `RUN_TOKEN` into the wiki line `Live stamp`.
3. Close any leftover chat or server session first.

Handoff
1. Holder pastes stamp path plus last command in the ticket.
2. Incoming holder reruns `scripts/seat-run-token.sh --resume <id>`.
3. Incoming holder writes `seated` on the wiki line.
4. Old session must be idle before the new seat.

Stop conditions
- No stamp, no prompts.
- Prod credentials never enter the shared lane.
- Incident override needs steward initials on the stamp.

A session starts with a stamp file, not chat. The holder runs a small script before the first prompt. The script writes an id, a goal, and a timestamp. Later review reads that file instead of hallway memory.

The script below is a proposed local helper, not a production service. Teams should read it, then place it next to the wiki page. It only writes a receipt. It does not call a model.

#!/usr/bin/env bash
# scripts/seat-run-token.sh — proposed helper, unexecuted here
set -euo pipefail

ROOT="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
DIR="${ROOT}/.run-tokens"
mkdir -p "${DIR}"

RESUME=""
GOAL=""
while [[ $# -gt 0 ]]; do
  case "$1" in
    --resume) RESUME="${2:-}"; shift 2 ;;
    *) GOAL="$*"; break ;;
  esac
done

if [[ -n "${RESUME}" ]]; then
  FILE="${DIR}/${RESUME}.md"
  if [[ ! -f "${FILE}" ]]; then
    echo "missing stamp ${RESUME}" >&2
    exit 1
  fi
  {
    echo
    echo "## resume $(date -u +%Y-%m-%dT%H:%M:%SZ)"
    echo "holder: ${USER}"
  } >> "${FILE}"
  echo "RUN_TOKEN=${RESUME}"
  echo "FILE=${FILE}"
  exit 0
fi

if [[ -z "${GOAL}" ]]; then
  echo "usage: $0 \"goal text\"" >&2
  exit 1
fi

STAMP="$(date -u +%Y%m%dT%H%M%SZ)-${USER}"
FILE="${DIR}/${STAMP}.md"
cat > "${FILE}" <<EOF
# run token ${STAMP}

- holder: ${USER}
- seated_at: $(date -u +%Y-%m-%dT%H:%M:%SZ)
- goal: ${GOAL}
- lane: shared-free-model
- shadow:
- steward:
EOF

echo "RUN_TOKEN=${STAMP}"
echo "FILE=${FILE}"

The holder then records the same id on the wiki line. That double write is the point. Git keeps the receipt. The wiki keeps the living name. If those two disagree, the steward treats the lane as dirty and sits nobody until they match.

A dirty lane feels like a cutting board left wet. The next cook still uses it. The food still leaves the kitchen. Nobody can say which knife made the nick. Shared model output has the same nick when two people typed.

The merge steward can reject unmarked work in CI. A tiny check looks for RUN_TOKEN= in the pull request body. Missing tokens fail the job with a short message. The check does not grade model output at all. It only proves a human claimed the shared lane.

# scripts/require_run_token.py — proposed CI check, unexecuted here
import os
import re
import sys
from pathlib import Path

body = os.environ.get("PR_BODY", "")
match = re.search(r"RUN_TOKEN=([A-Za-z0-9._-]+)", body)
if not match:
    print("no RUN_TOKEN= in pull request body")
    sys.exit(1)

token = match.group(1)
stamp = Path(".run-tokens") / f"{token}.md"
if not stamp.is_file():
    print(f"stamp missing: {stamp}")
    sys.exit(1)

text = stamp.read_text(encoding="utf-8")
if "goal:" not in text or "holder:" not in text:
    print("stamp incomplete")
    sys.exit(1)

print(f"run token seated: {token}")

Wire that check through a short workflow. The workflow only needs the pull request body. It should not scrape chat logs. Chat logs rot. Stamp files stay in git.

# .github/workflows/run-token.yml — proposed, unexecuted here
name: run-token
on:
  pull_request:
    types: [opened, edited, synchronize]
jobs:
  seated:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: require stamp
        env:
          PR_BODY: ${{ github.event.pull_request.body }}
        run: python3 scripts/require_run_token.py

Handoff is a written comment, not a standup speech. The outgoing holder pastes the stamp path and last command. The incoming holder reruns the log script and writes seated. If the free server still holds a live session, close it first. Abandoned sessions are yesterday's onion in today's soup.

A good handoff comment is dull on purpose. It names the stamp, the goal, and the last file touched. It does not retell the model chat. The next holder should rebuild intent from the stamp and the diff. If intent lives only in chat, the token already failed.

Handoff 2026-09-21T15:58Z
RUN_TOKEN=20260921T120003Z-mxu
FILE=.run-tokens/20260921T120003Z-mxu.md
LAST: src/billing/retry.go tests/billing/retry_test.go
STATUS: tests green locally; shadow has not signed
NEXT: incoming holder seats, then steward reviews stamp

The shadow reviewer works like a second cook who never touches the pan. That person reads the diff against the stamped goal. If the diff wanders, the shadow stops the holder. Stopping is the job. Polite silence is how hostel kitchens stay filthy.

Incident override exists because production pages do not wait. The steward initials the stamp and writes override. The holder still seats a token. The team still closes the live session after the fire. Override without a stamp is just another abandoned soup.

Current AI coding talk keeps circling measurement and pretend work. Shared lanes make both problems cheaper to hide. A green test suite can still come from a mixed session. The run token does not prove the code is right. It proves one named person owned the hour.

Limitations sit in plain view. This SOP does not score model quality or latency. It does not replace unit tests, design review, or secret scanning. It adds friction on purpose. Teams that skip the stamp during a rush will watch the wiki rot in a week.

Solo developers should not run this theater. One person already owns the stove. Two-person pairs can share a stamp without three role names. Huge orgs with private model contracts may need ticket queues instead. The hostel-kitchen analogy breaks when every cook has a private kitchen.

Keep credentials off the shared server. The token holder is not a vault. Paste samples, failing tests, and redacted logs only. If the work needs production data, leave the free lane. Move that work to an isolated environment with its own owner.

The method stays useful if the product name is removed. Any shared assistant needs a seated holder. The wiki page, the stamp script, and the CI check are the artifact. MonkeyCode is only one place that lane can live, including its free model access and free server option.

Teams that already keep a clean wiki can try that shared lane after the page exists. Seat the holder first. Then start the session. The stove stays usable when the fridge note is true.