Show the Stop Phrase Before a Shared Draft Writes Your Script

I almost shipped a moderator script I could not defend.

A teammate pasted it into our research channel. "The model already knows how we interview," they said. Does it? Who owns that claim tomorrow morning?

I owned the decision that day. The consequence was a live session with five participants. The reverse path was a rewrite after harm. That is a miserable reverse path.

Nobody had written a stop phrase. The draft may have run on a shared server. Our prototype tasks were still under NDA. I came close to saying yes. This tutorial is the gate I now use.

Think of a kitchen ticket. The cook does not fire the dish without the ticket. A model is not a cook with judgment. It is a stove. You still write the ticket first.

Recent talk treats fluent output as engineering. Fluency is not a protocol. A protocol can fail closed. This one does. I label everything below as a proposed kit. It is not a completed study. It is not a vendor benchmark.

Stage one: freeze the decision before heat

Stage one starts on an empty card. Do not open a model tab yet. Write the decision, the owner, and the harm. Write the reverse path in the same file.

# proposed file: research/decision_card.yaml
decision_card:
  id: moderator-script-2026-09-18
  owner: product-design
  decision: "May a shared draft write our moderator script?"
  consequence: "Participants may hear untested skip promises."
  reversibility: "Stop the session; keep the script record."
  missing_evidence:
    - stop_phrase_visible_before_generate
    - server_class_shown_to_reviewer
    - nda_tasks_excluded_from_prompt
  noise_fields:
    - empathy_adjectives_in_the_script
    - token_dashboards_without_a_task
  stop_phrase: "Refuse if the script promises a skip we never tested."
  hand_back: "Return to a human moderator. Do not silent-retry."

Verify stage one out loud. Read the file to a partner. If the stop phrase is missing, you stop. If the owner is "the team," you stop. A crowd cannot refuse in the moment.

I keep a tiny verifier beside the card. It fails closed. Treat it as local protocol, not product magic.

# proposed local verifier, unexecuted until you run it
import sys, yaml
from pathlib import Path

card = yaml.safe_load(Path("research/decision_card.yaml").read_text())
d = card["decision_card"]
required = ["owner", "decision", "consequence", "reversibility", "stop_phrase", "hand_back"]
missing = [k for k in required if not str(d.get(k, "")).strip()]
if missing:
    print("STOP. Card incomplete:", ", ".join(missing))
    sys.exit(1)
if not d.get("missing_evidence"):
    print("STOP. You never named required evidence.")
    sys.exit(1)
print("Stage one verified. Generation is still forbidden.")

Run that check now.

python3 research/verify_card.py

You should see the forbidden line. That is success for stage one. No script. No vibes. A closed gate. Do you still want a sample paragraph? Then you are bargaining with empty evidence.

Stage two: put the alarm handle on the review surface

Stage two writes the stop phrase into review copy. Not into a wiki. Onto the control the reviewer will see. I treat this like a fire alarm. A beautiful alarm with no handle is decoration.

Proposed fields, labeled as draft copy only:

SERVER CLASS: shared free server, research draft only
TASK: write a moderator script for review, not for the session
STOP PHRASE: Refuse if the script promises a skip we never tested.
EVIDENCE BOX: observations only
HYPOTHESIS BOX: design guesses only
[ Refuse and hand back ]    [ Generate research draft ]

Verify stage two with scenarios, not a cropped screenshot. Scenario A. The reviewer uses a screen reader. Does refuse have a name? Is it before generate in focus order? Scenario B. The reviewer cannot rely on color. Can they still read the server class as text? Scenario C. The draft is slow. Does a live region say the job is still on a shared server?

If any scenario fails, you still do not generate. I write the checks as a second file, still a proposal.

# proposed file: research/a11y_review.txt
refuse_name: Refuse and hand back
generate_name: Generate research draft
focus_order: refuse_before_generate
server_class: text_not_color_only
status_live_region: polite
timeout_is_not_consent: true
nda_tasks_in_prompt: false

Would a token graph help here? It usually adds noise. Stop approval if the refuse control is unnamed. Stop approval if generate comes first. That is the evidence that matters on this surface.

Stage three: only now may a shared draft run

Stage three is the first moment a model may run. I needed a fence for research drafts. Not production. Not participant recordings. Not the live research repo.

Disclosure: This article was prepared as part of MonkeyCode's product outreach.

MonkeyCode is an open source project with free model access and a free server option. I use that pair as a sandboxed draft host after the card exists. I do not treat the output as user research. I do not send NDA tasks there. I do not invent a model name I cannot verify.

A proposed command shape looks like this. Swap in your own authenticated entrypoint. Keep the card. Drop the private tasks.

# proposed research-draft call, placeholders only
mkdir -p research/sessions
awk '/stop_phrase|decision|hand_back/' research/decision_card.yaml > research/request.txt
# send the card, not prototype NDA tasks
printf '\nWrite a moderator script. Obey stop_phrase. Do not claim a skip was tested.\n' >> research/request.txt
# host: free server used only after stage two passes
# save model output to research/sessions/draft.md, never to the live script

Verify stage three with boring file tests. The request must include the stop phrase. The request must exclude private task names. The response must land in a draft file.

grep -q "stop_phrase" research/request.txt || echo "STOP. Stop phrase never sent."
grep -Ei "secret-task|nda|participant-email" research/request.txt && echo "STOP. Private material leaked into the prompt."
test -f research/sessions/draft.md && echo "draft isolated" || echo "STOP. No draft file."

If either check fails, discard the output. Do not "just glance." Glancing is how a fake skip lands in a live session. Would you read a contract after signing it? Then do not read a draft after pasting it into the runbook.

Stage four: split evidence from hope

Stage four splits evidence from hypothesis. This is the part teams skip. They paste confident lines, then retrofit a rationale. Remember a lab notebook. The left page is what happened. The right page is what you hope it means.

# research/sessions/session-2026-09-18.md

## Evidence (do not rewrite)
- Server class shown: shared free server
- Stop phrase shown before generate: yes
- Refuse control focused first: yes
- Draft promised "you can skip any task": yes
- Skip path rehearsed with a pilot participant: no

## Hypotheses (may be wrong)
- The tone feels calmer than our last script
- A shorter warm-up might reduce nerves

## Decision
- Status: refused
- Reason: skip was implied, not tested
- Hand-back: human rewrite, no silent retry

Verify stage four with a brutal grep. Feeling language without a participant is a hypothesis. Hypotheses do not ship.

if grep -Ei "users felt|participants will|you can skip" research/sessions/draft.md; then
  if ! grep -Ei "pilot participant|rehearsed" research/sessions/session-2026-09-18.md; then
    echo "STOP. Feeling language without a participant is a hypothesis."
  fi
fi

Did the model outgrow your test? Then your test was never a test. It was a compliment. Compliments do not belong in the evidence box.

Stage five: walk the flow you will actually refuse

Stage five is the user flow I will not approve without. Walk it with a partner. You are not measuring eloquence. You are measuring whether a human can still refuse.

flowchart TD
  A[Decision card exists] --> B{Stop phrase visible?}
  B -->|No| H[Hand back. Do not generate]
  B -->|Yes| C{Refuse named and first in focus?}
  C -->|No| H
  C -->|Yes| D{NDA tasks excluded from prompt?}
  D -->|No| H
  D -->|Yes| E[Generate on isolated free server]
  E --> F[Split evidence and hypothesis]
  F --> G{Skip or recovery implied but untested?}
  G -->|Yes| H
  G -->|No| I[Human may edit the script]

Success measure: refuse works without a timeout. Success measure: the session record still holds the stop phrase. Stop measure: any implied skip without a rehearsal. Stop measure: missing server class on the review card. If your partner cannot refuse on the first pass, the flow failed. Do not "fix it in copy" later.

Stage six: keep the refused line in the record

Stage six records the hand-back. Keep the discarded sentence. Do not let the next generate pretend it never happened. Silent retries train the team to forget. I will not approve that amnesia.

# proposed file: research/sessions/hand_back.yaml
hand_back_record:
  refused_span: "You can skip any task."
  why: "No skip path rehearsed with a pilot."
  next_human_task: "Write a script that only offers tested exits."
  retry_allowed: false

Verify with a read-back. If the refused span vanished, the record failed. Ask one more question before you close the folder. Which missing evidence should stop approval? Which extra field would only add noise?

For me, three gaps still stop the run. An unnamed refuse control. A skip promise with no rehearsal. A draft that cannot show its server class. Extra token charts are noise. Empathy adjectives are noise. A second generate "just to see" is noise.

Why does a free shared server belong in this kit at all? Because research drafts need a fence. A free server is a fence only if you treat it as one. It is the spare table in the hallway. Fine for cardboard models. Wrong for the family silver. Do not put real recordings on it. Do not put unpublished NDA tasks on it. Do not call the draft a usability finding.

Who should not use this approach? Teams that need a private, contracted isolation boundary. Teams shipping unsupervised agents to production users. Researchers who would skip a pilot after a fluent paragraph. Anyone hoping a free host becomes an SLA.

Limitations sit in the open. This protocol does not score model quality. It does not prove consent law. It does not replace accessibility testing with real people. Free model access can change without notice. I will not claim quotas, latency, or permanence. I will not pretend a tutorial is a study.

The human still owns the script. The model can rent the pencil. It does not get the signature. If you already keep research drafts off production hosts, MonkeyCode's free model access and free server option can park that generate step after the card exists. Keep the stop phrase on screen first.