Freeze pyproject.toml Before the Model Opens a Weekend API

Описание и применение

Заморозка pyproject.toml предотвращает добавление модели новых зависимостей, сохраняя расходы на ноль.

Задача

Indie founders risk runaway costs when AI models add dependencies to an application without oversight, leading to unexpected invoices.

Результат

The app runs with a fixed dependency set, preventing unapproved packages from inflating costs while still allowing the model to contribute code within the allowed surface.

Рабочий процесс

• Install the initial dependencies and record the hash of pyproject.toml as lock.sha256.
• Mark pyproject.toml read‑only in the workspace.
• Run record_allowlist.py on a clean, known‑good boot to capture the allowed import surface and write it to allowed_modules.txt.
• Add lock.sha256 and allowed_modules.txt to git.
• During each boot, run tools/check_seal.py to verify the hash matches and that all top‑level imports are in the allowlist or stdlib.
• If the seal or imports drift, the checker fails and the app does not start.

Доказательства

The freeze is a hash, a read‑only bit, and a boot checker that refuses to start.

Источник

Re‑run this script only when a human upgrades the framework. Do not let a model regenerate it during the same session that writes features.

Источник