Review the Free Lane Before You Cross

A free lane is useful only after you name its failure domains. You do not receive custody because the invoice says zero. You receive a temporary neighbor that can propose and can check.

People can generate a patch in minutes, and that speed is the trap. The patch still has to cross rooms that do not share a fate. You review the crossing before you celebrate the speed.

That neighbor can leak, stall, or invent a confident diff. Your review starts with boundaries, not with excitement about price. Price is a constraint, and constraints belong on the diagram.

The outreach brief supplied two availability claims for this review. One claim is free model access, and the other is a free server option. Neither claim names a token cap, a machine size, or an end date.

The brief presents MonkeyCode as an open source project you can inspect. You place that project in the neighbor seat, not in the custody seat. Disclosure: This article was prepared as part of MonkeyCode's product outreach.

This review uses it only as that remote neighbor, not as a proven benchmark. Do not freeze a quota from a chat, a slide, or an old post. A number you cannot open on the project page is not a plan.

You check the live page on the day you depend on the lane. A stale allowance will bend the design around a promise you cannot keep. You would rather drop the lane than invent a limit.

Hold the constraints

You keep four constraints even when the lane costs nothing. The packet may describe the work, but it may not carry secrets. The free server may check code, but it must not hold production keys.

The proposal may look finished, but it must not merge itself. A fifth rule sits quietly beneath those four hard constraints. The free workspace is ephemeral, so you do not store state there.

If a check needs a cache, you rebuild that cache inside the job. You also cap time, because a free neighbor can stall without warning. A hung check should fail closed, and your queue should move on.

Walk the four rooms

Picture the path as four rooms with one-way doors. Room one is your editor, where the spec and the tests already live. Room two is the packet builder, which strips names, tokens, and host paths.

Room three is the free model, which may only see that stripped packet. It returns a patch proposal and a short note about assumed versions. Room four is the free server, which may run only an allowed check.

Those doors do not reverse, and that direction is the point. Logs may come home, but home state does not chase them. You apply nothing until a local gate accepts the returned diff.

The model room and the server room are different failure domains. A clever diff is not permission to execute that diff abroad. You insert a broker so those rooms cannot talk in raw editor text.

Watch a retry bug tempt you

Take a retry helper that fails only when a key is missing. You will want to paste the environment file, because the trace mentions it. That urge is the transit failure, and it shows up early.

The packet builder should drop the file and keep the error class. The model can still suggest a test that stubs the missing key. The free server can run that test if the command is allowed.

You do not send the real key to make the foreign run look real. A leaked run is a worse design, not a more honest one. Realism stops where custody starts, and custody stays on your machine.

Name the failure domains

Four failure domains sit on that path, and they do not share a fate. The model domain fails by being wrong, stale, or overly sure. You treat its patch as a draft from a fast colleague, not as law.

The transit domain fails when the packet holds more than the task. A send crosses a boundary, even when the destination looks friendly and free. You redact before send, and you log the redaction, not the secret.

The free server domain fails as a shared, short-lived workshop. A noisy neighbor can slow you, and a reset can delete scratch files. You assume the disk vanishes, and you assume the network is hostile.

The local domain fails when you skip the gate because the run looked green. Green on a foreign host is a clue, not a release decision. Your machine still owns format, review, merge, and the final test.

Encode the review

You can encode this review as a small Python gate. The script below is a proposal, and this draft did not execute it. It refuses a packet that crosses a domain line you already named.

Run it against a fixture before you trust it in a hook. A reject on a dirty packet is the success case you want first. An accept should be rare, boring, and easy to explain.

#!/usr/bin/env python3
'''Proposal only. This gate was not run against a live service.'''

import json
import sys
from pathlib import Path

FORBIDDEN_KEYS = {
    'api_key', 'token', 'secret', 'password', 'private_key', 'authorization',
}
FORBIDDEN_PARTS = {'ssh', 'scp', 'curl', 'wget', 'nc', 'kubectl', 'terraform'}
ALLOWED_HEADS = {'pytest', 'python', 'ruff', 'git'}


def load_packet(path):
    data = json.loads(path.read_text(encoding='utf-8'))
    if not isinstance(data, dict):
        raise SystemExit('packet must be an object')
    return data


def looks_like_secret(text):
    markers = ('sk-', 'ghp_', 'AKIA', '-----BEGIN', 'xoxb-')
    return any(marker in text for marker in markers)


def find_secret_paths(value, prefix=''):
    hits = []
    if isinstance(value, dict):
        for key, item in value.items():
            path = f'{prefix}.{key}' if prefix else key
            if str(key).lower() in FORBIDDEN_KEYS:
                hits.append(path)
            hits.extend(find_secret_paths(item, path))
    elif isinstance(value, list):
        for index, item in enumerate(value):
            hits.extend(find_secret_paths(item, f'{prefix}[{index}]'))
    elif isinstance(value, str) and looks_like_secret(value):
        hits.append(prefix or 'value')
    return hits


def review(packet):
    failures = []
    domain = packet.get('domain')
    if domain not in {'proposal', 'check'}:
        failures.append('domain must be proposal or check')
    if packet.get('contains_secrets') is True:
        failures.append('packet admits secrets')
    for hit in find_secret_paths(packet.get('inputs', {})):
        failures.append(f'secret-like field: {hit}')
    command = str(packet.get('command') or '')
    parts = command.split()
    head = parts[0] if parts else ''
    if domain == 'proposal' and command:
        failures.append('proposal domain cannot carry a command')
    if domain == 'check':
        if head not in ALLOWED_HEADS:
            failures.append('command not allowed: ' + (head or 'empty'))
        if any(part in FORBIDDEN_PARTS for part in parts):
            failures.append('command crosses a network or admin line')
        timeout = int(packet.get('timeout_seconds') or 0)
        if timeout <= 0 or timeout > 120:
            failures.append('timeout must sit between 1 and 120 seconds')
    if packet.get('persist_workspace') is True:
        failures.append('remote workspace must not persist')
    if packet.get('apply_on_remote') is True:
        failures.append('remote apply is forbidden')
    return failures


def main():
    if len(sys.argv) != 2:
        raise SystemExit('usage: review_free_lane.py <packet.json>')
    packet = load_packet(Path(sys.argv[1]))
    failures = review(packet)
    if failures:
        print('reject')
        for item in failures:
            print(item)
        return 2
    print('accept')
    print(packet.get('domain'))
    return 0


if __name__ == '__main__':
    raise SystemExit(main())

Save the proposal as review_free_lane.py and keep the fixtures beside it. The dirty fixture is the case you want to see fail first. The clean fixture is the narrow case you are willing to send.

{
  "domain": "check",
  "contains_secrets": false,
  "persist_workspace": false,
  "apply_on_remote": false,
  "timeout_seconds": 30,
  "command": "curl https://example.invalid",
  "inputs": {
    "note": "retry failed",
    "api_key": "sk-demo-not-real"
  }
}

{
  "domain": "check",
  "contains_secrets": false,
  "persist_workspace": false,
  "apply_on_remote": false,
  "timeout_seconds": 60,
  "command": "pytest tests/test_retry.py",
  "inputs": {
    "error_class": "MissingKey",
    "note": "stub the key in the test"
  }
}

mkdir -p fixtures
jq -n --arg note 'stub the missing key' \
  '{domain:"check",contains_secrets:false,persist_workspace:false,apply_on_remote:false,timeout_seconds:60,command:"pytest tests/test_retry.py",inputs:{error_class:"MissingKey",note:$note}}' \
  > fixtures/clean.json
python3 review_free_lane.py fixtures/dirty.json
echo dirty_exit:$?
python3 review_free_lane.py fixtures/clean.json
echo clean_exit:$?

A dirty fixture should fail on a secret-shaped field and a network command. A clean fixture should pass with pytest and a short timeout. You keep both fixtures beside the script so the rule stays visible.

Expect the dirty file to print reject and exit two. Expect the clean file to print accept and exit zero. Those outcomes are designed behavior, not a measured run from this draft.

You do not pipe a raw chat log into this gate. A chat log is a swamp of paths, names, and half secrets. The packet is a small contract, and the contract is what you review.

Change the design next

The next design change is a narrow broker between the two remote rooms. The broker may forward a proposal id, but not a raw buffer. That cut stops a bad draft from becoming a server script.

After the first quiet week, you split reads from any write tool. You pin allowed commands in a file the gate reads each run. You store job ids locally, beside the spec, not on the server.

A later run should rebuild the check from the spec and the job id. That leaves durable history on the machine that already holds the repo. You would not add deploy rights just to make the lane feel finished.

You would also record which domain produced each artifact in the log. A proposal diff and a check log should never wear the same label. Mixed labels are how a foreign green bar sneaks into a release note.

Say the limits

This design has sharp edges, and you should say them out loud. The gate scans shapes, but it can miss a secret hidden in prose. A determined paste can still bypass a script that you forget to run.

Shared tenancy means timing noise, so do not benchmark the free server here. This draft records no latency, no token count, and no hardware claim. If a page quotes those figures, cite that page, not this review.

The model can recommend an API that your lockfile no longer contains. You confirm package versions locally before you accept the patch. Free access can also shrink or pause, so keep a local fallback flow.

Who should walk away

Do not use this path for regulated data, customer dumps, or private keys. Do not use it when you cannot explain the packet to a reviewer. Do not use it as a production runner or as a durable disk.

If policy forbids third-party inference, the free model is already out. If you need a guaranteed quota, wait until the live page states one. You can still learn the gate on a toy repo with fake values.

The useful move is boring, and that boredom is why it survives. You name the domains, cut the packet, and keep the merge local. A free neighbor can speed a draft, but it cannot own the system.

Read the current MonkeyCode limits, then try one toy repo only. Stop if the live page no longer matches the brief you were given.