Freeze pyproject.toml Before the Model Opens a Weekend API

说明与用途

冻结 pyproject.toml 防止模型添加新依赖，保持成本为零。

问题

Indie founders risk runaway costs when AI models add dependencies to an application without oversight, leading to unexpected invoices.

结果

The app runs with a fixed dependency set, preventing unapproved packages from inflating costs while still allowing the model to contribute code within the allowed surface.

工作流

• Install the initial dependencies and record the hash of pyproject.toml as lock.sha256.
• Mark pyproject.toml read‑only in the workspace.
• Run record_allowlist.py on a clean, known‑good boot to capture the allowed import surface and write it to allowed_modules.txt.
• Add lock.sha256 and allowed_modules.txt to git.
• During each boot, run tools/check_seal.py to verify the hash matches and that all top‑level imports are in the allowlist or stdlib.
• If the seal or imports drift, the checker fails and the app does not start.

证据

The freeze is a hash, a read‑only bit, and a boot checker that refuses to start.

来源

Re‑run this script only when a human upgrades the framework. Do not let a model regenerate it during the same session that writes features.

来源