From Zero to a Gated Agent Loop: Six Bootstrap Stages, a Smoke Test, and a Token Ledger

Description and use

Step‑by‑step guide to building a secure, token‑budgeted AI agent loop with key protection, server hardening, endpoint smoke testing, and an append‑only ledger.

Problem

Missing stage gates in AI agent loops allow leaked keys and uncontrolled token usage, leading to costly failures.

Outcome

The workflow establishes a secure, token‑budgeted AI agent loop with automated safeguards against key leakage and budget overruns.

Workflow

• Create repo and record tool versions (Stage 0).
• Copy .env.example to .env, set permissions, and grep for leaked keys (Stage 1).
• Provision a free server, create non‑root user, restrict ports (Stage 2).
• Run a single capped request to verify endpoint and usage (Stage 3).
• Implement ledger.py to record usage and abort on budget (Stage 4).

Evidence

The model is not the risky part — the missing stage gate is.

Source

A repo where a leaked key is a failing test, not a bad day.

Source