Freeze pyproject.toml Before the Model Opens a Weekend API

Description and use

Freezing pyproject.toml stops the model from adding new dependencies, keeping costs at zero.

Problem

Indie founders risk runaway costs when AI models add dependencies to an application without oversight, leading to unexpected invoices.

Outcome

The app runs with a fixed dependency set, preventing unapproved packages from inflating costs while still allowing the model to contribute code within the allowed surface.

Workflow

• Install the initial dependencies and record the hash of pyproject.toml as lock.sha256.
• Mark pyproject.toml read‑only in the workspace.
• Run record_allowlist.py on a clean, known‑good boot to capture the allowed import surface and write it to allowed_modules.txt.
• Add lock.sha256 and allowed_modules.txt to git.
• During each boot, run tools/check_seal.py to verify the hash matches and that all top‑level imports are in the allowlist or stdlib.
• If the seal or imports drift, the checker fails and the app does not start.

Evidence

The freeze is a hash, a read‑only bit, and a boot checker that refuses to start.

Source

Re‑run this script only when a human upgrades the framework. Do not let a model regenerate it during the same session that writes features.

Source