Pick the Agent Seat by the Commit You Would Sign

Pick the Agent Seat by the Commit You Would Sign I do not start with the price tag when I place an agent on a machine today. I start with a harder question: would I sign the commit this run is about to create? If the answer is no, a free shared seat can still be a fair draft bench. If the answer is yes, I want a host whose git identity, license files, and secret boundary I can name before the push. That split sounds fussy until a generated patch lands in a public repository with the wrong author line. Have you ever opened a pull request and then noticed the committer email belonged to a shared runner? I treat that moment as a hosting decision, not as a cosmetic git fix after the fact. The seat should match the signature you are actually willing to defend in a public review. What this guide actually decides This note is a fit guide between seats, not a benchmark and not a vendor price shootout. I am comparing three seats you can actually reason about before you spend a weekend on setup. Those seats are a free shared agent server, a self-hosted box you administer, and a paid isolated runner. The real question is which seat may draft, which seat may commit, and which seat may push. You might ask why a commit signature should outrank raw speed on a quiet Tuesday afternoon at all. A fast draft you cannot attribute becomes a real liability the moment it leaves your laptop. A slower draft you can sign, license, and later revert is usually the safer promotion path. Would you rather explain a missing signature in review, or explain a token that rode along in the diff? I am not claiming timings, token quotas, hardware sizes, or how long any free offer lasts. Those product facts change quickly, and I have not measured any of them for this particular note. If a dashboard shows a number, read that dashboard, and do not borrow my silence as a measurement. Can you point to a primary page for the exact limit you are about to rely on today? Fit criteria I refuse to skip I keep the criteria short so I can apply them on a tired afternoon without a spreadsheet. Each one is a yes or no I can check in the repository, not a feeling about a logo. If I cannot answer a criterion, I do not promote that run past a local patch. Would you really promote a branch that you cannot even describe clearly to a waiting teammate today? Author identity. Can I set the git name and email to an identity I control, and can a shared runner not overwrite them later? Signature path. Can I sign with a key that never sits on the shared seat, or am I only pretending the commit is mine? License and notice. Does the tree already contain the license I must preserve, and can the agent edit be stopped from stripping it? Secret boundary. Can I prove the diff does not add keys, tokens, or environment files before anything is pushed upstream? Rollback story. If the patch is wrong, can I drop the branch without negotiating with a host I do not administer? A free seat can still win the draft half of this list when I copy the patch home before I commit. It usually loses the signature path, because I should not upload a private key to a machine I do not control. Self-hosted and paid isolated seats win when the push itself must happen on that same machine. Which half of this list is your current agent run actually asking the host to satisfy today? A worksheet you can run locally The following script is a proposed check, not a log from a run I executed on any host. It inspects the repository you are standing in and prints local git facts you can read as a gate. It does not call the network, and it does not print secret file contents, only matching names. Run it only inside a repository you already trust enough to open on your own machine. #!/usr/bin/env bash # Proposed, unexecuted example: seat fit from local git facts. set -euo pipefail echo "1. Identity" git config --get user.name || echo "MISSING user.name" git config --get user.email || echo "MISSING user.email" echo "2. Signing key configured on THIS machine? (presence only)" if git config --get user.signingkey >/dev/null; then echo "signing key is configured here" else echo "no signing key on this machine" fi echo "3. License file" ls -1 LICENSE LICENSE.md COPYING 2>/dev/null || echo "NO license file found" echo "4. Suspicious paths in the unstaged diff (names only)" git diff --name-only -- . ':(exclude)*.lock' \ | grep -E '(^|/)\.env|id_rsa|\.pem|credentials|secret' \ || echo "no obvious secret filenames in diff" echo "5. Branch state" git status -sb I read that output as a gate, not as a score I can average into a winner. Missing identity means I am not ready to commit the patch on any seat at all. A signing key that exists only on my laptop means the shared server may draft, and the laptop must sign. A secret filename sitting in the diff means I stop, even when the seat looks inexpensive. Numbered path from draft to signed push I follow the same sequence every single time so that the host choice stays boring and repeatable. You can skip a step only when the answer is already written down beside the branch. If you skip the secret scan because a model usually behaves, you are guessing with a public history. Does your team actually want that kind of guess attached to your name in the public log? Create the change on a throwaway branch, and keep the default remote unset until the diff is clean. Run the worksheet in the repository root, and save the printed text next to the patch file. If identity or a license file is missing, fix that on your own machine before any agent continues. If the diff names a secret file, remove the file and rotate the credential before you discuss hosting. Choose the seat from the table below, then move the patch only, and leave the signing key at home. Sign and push from the machine that holds the key, even when a cheaper seat wrote the draft. The next block is a proposed local sequence for step 6, not a transcript from a hosted run. I keep the push commented until the signature line looks like a commit I would defend. Would you paste a private key into a chat box just to avoid these six lines? # Proposed local sequence on the signing machine. Do not paste a key into a prompt. git switch -c draft/agent-seat-check git diff --name-only git add -p git commit -S -m "Apply the reviewed agent draft" git log -1 --show-signature # Push only after the signature line looks right. # git push -u origin HEAD How the three seats trade off Fit signal Free shared agent server Self-hosted box Paid isolated runner Draft a patch you will rewrite Fits if you copy the patch home Fits, often more setup than the draft deserves Fits, though you may pay for exploration Commit with your identity Only if that identity cannot be overwritten Fits when you administer the git config Fits when the contract lets you set identity Sign with your private key Poor fit; do not upload the key Fits if the key stays on a machine you control Fits only if the key never has to be pasted into a prompt Touch production secrets or release tokens Do not use for this run Fits only with an explicit secret store Fits only under the same secret-store rules Need a named rollback owner Weak unless you can export the branch Strong, because you own the disk Strong if snapshots are actually in the contract Disclosure: This article was prepared as part of MonkeyCode's product outreach. The free model access and the free server option are the two availability claims I was given to discuss here. I am not naming models, token quotas, hardware, duration, or benchmark figures, because those were not verified for this draft. If you use that free seat, treat it as the left column: draft there, then carry the patch home before you sign. I would read the current MonkeyCode terms only after this table says the free column matches the run in front of me. That quiet reading step is the only invitation I am willing to make anywhere in this note. Confirm the live limits on the product page yourself, because an outreach draft is not a contract and it is not a measurement. Are you choosing a seat you can leave, or a seat you will have to explain later? Tradeoffs I want written down Free shared compute lowers the cost of a bad draft, and that lower cost is the actual point of it. The tradeoff is weaker custody over base images, log retention, and a workspace you might forget to wipe. Self-hosting flips that tradeoff toward maintenance hours, and toward git config you can actually pin down. A paid isolated runner sits between them when you want separation without becoming the person on call. Have you noticed how often a temporary free workspace becomes the place a release script quietly starts to live? I assume that drift will happen unless I schedule the move back home before the branch grows. The worksheet is how I notice the drift before a push, not after a reviewer does. If I cannot export the branch, I was never sitting in a seat I should sign from. None of these seats will repair a vague prompt or a repository that still has no tests. They only change who can see the mess, who can retain the logs, and who can put a name on the commit. I still want a failing test on my own machine before I call the patch done. Would a green agent transcript satisfy you if the local test suite had never actually been run? Who should not use this approach Do not use this guide when the change already needs production credentials, customer data, or a signed release on the first pass. That work does not belong on a free shared seat, and a filename scan is not a security review. Do not use it when your organization already mandates a specific runner, a hardware security module, or a reviewed signing service. In that case the seat is chosen, and this table would only invent a shadow path around policy. Also skip this method when you cannot read the diff yourself before you push the branch. An agent draft you do not understand is not ready for a free seat or a paid one. This check is local and name-level, so it misses secrets pasted into a source file under an innocent name. Pair it with your real secret scanner and with the host's current retention note before you promote the branch. Where I land on the next run I keep the conclusion in the same place I started, because the price tag will try to sneak back in. If I would not sign the commit, I may draft on the free seat and I leave the key at home. If I would sign it, I move to a self-hosted or paid seat whose identity and rollback I can name out loud. The script is the artifact I re-run, and the table is the argument I am willing to keep.