The Slice Contract Compiled Before Any Remote Token Moved

Описание и применение

В примере разработчики использовали JSON‑контракт и локальный скрипт, чтобы ограничить доступ модели к репозиторию, предотвратить утечку секретов и обеспечить безопасное выполнение теста.

Задача

A failing integration test in a monorepo required a remote coding model to run, but the model could not see the repository tree until a local contract was compiled, risking exposure of secrets and large context leaks.

Результат

The team successfully isolated the test environment, preventing secret leakage and ensuring the remote model only processed a small, vetted bundle, allowing the failing test to pass locally before remote execution.

Рабочий процесс

• 1. Define a slice-contract.json with ticket, failing_command, done_when, allow, deny_globs, redact, max_bytes.
• 2. Run a local packer script (scripts/pack-slice.mjs) to copy only allowed files, apply deny globs, redact secrets, and enforce size limit.
• 3. Verify the packed bundle meets constraints and does not exceed max_bytes.
• 4. Provide the bundle to the remote coding model for execution.
• 5. Confirm the failing_command exits 0 and git diff --stat stays within allowed files.

Доказательства

The senior did not take the keyboard to generate a prompt. They created slice-contract.json in the repo root and waited.

Источник

The script reads the contract, copies only allowlisted files, applies deny globs, redacts line-level matches, and refuses to emit a bundle over max_bytes.

Источник