The opening is a reconstructed incident pattern, not a claim about one company outage.
On a quiet lab bench, a coding agent received a one-line task: add a health endpoint and keep the existing tests green.
The repository was a small Go service, except a leftover from an abandoned frontend spike still sat in the root.
Before any human reviewed a diff, the agent inferred Node, ran an install, and rewrote the README around Express.
Nothing in the prompt had named JavaScript; the files had simply outvoted the Go module in the model's prior.
Teams keep describing that moment as a model failure, which parks the defect in the wrong layer of the stack.
The model completed a plausible story from noisy evidence, then the tool loop treated that story as a signed specification.
Cheap generation makes the wrong story cheap to continue, so a package manager can land files before review even opens.
The useful question is not whether agents understand repositories in some conversational sense.
The useful question is which inferred facts were allowed to become commands.
This FAQ collects five claims that regularly show up in agent logs, standups, and review threads.
Each claim sounds reasonable after a green demo, especially when the model explains itself fluently.
Each claim collapses once teams record assumptions as structured data instead of leftover conversational vibes.
The corrected mental model is simple enough to test: observations are not pins, and pins are not optional before mutation.
Myth 1: it scanned the repo, so it knows the stack Scanning is not inventory, and inventory is not a decision about the runtime you actually ship.
A recursive listing returns paths; it does not return a conflict-aware verdict about compilers, lockfiles, or the service entrypoint.
Mixed trees are ordinary in long-lived services during 2026, with generated clients, vendored examples, abandoned lockfiles, and docs that still advertise the last framework.
An agent that concatenates paths into a prompt will overweight famous filenames, because those tokens are cheap evidence rather than ranked proof.
The corrected model is narrower and slightly less flattering to the demo.
Detected files are observations, similar to footprints around a building rather than a signed floor plan.
The stack is a hypothesis that must be pinned before the first mutating tool call.
If and both exist, the session is in conflict, not in Node and not in Go, until a policy file says otherwise.
The lab snippet below is unlabeled production magic; it is a deterministic inventory you can run before any agent is allowed to touch a shell.
If that JSON lists more than one candidate stack, the session does not have a stack yet.
It has a rumor with file paths attached, which is a different kind of object.
Myth 2: a longer prompt will cancel a bad prior Adding README excerpts, a directory tree, and a paragraph of "do not use npm" feels like control, and it often changes nothing material.
Priors in tool-using agents are not only linguistic; they are procedural once a shell is in the loop.
Package managers, test runners, and formatters become working memory because they return tokens the model can continue from.
A prohibition in the system prompt is a suggestion with polite punctuation.
A blocked binary is a constraint that fails closed.
Session traces are boring in a useful way when you stop reading the model's self-report as evidence.
The same agent that promised to edit only Go files will still run if that binary is on the path and a leftover snippet mentioned Jest.
Prompt volume is not a lock, even when the prose is confident and the token count looks expensive.
An allowlist of interpreters, package managers, and write roots is a lock, and unlike a paragraph of instructions it can be unit tested.
Think of the prompt as a hallway sign and the allowlist as a locked door.
Signs help people who already intended to walk the right way.
Doors help everyone else, including a model that is locally certain about the wrong building.
Myth 3: a free-tier model is too weak to damage a real repo Capacity and permission are different axes, and teams still collapse them into one reassuring feeling.
A smaller model can misread a manifest and still invoke a very real package manager on a very real working tree.
The damage function is the tool adapter, the working directory, and the missing budget on mutating calls.
Weaker reasoning increases the rate of wrong inferences about language and layout.
It does not reduce the blast radius of , , a lockfile rewrite, or a second service scaffolded beside the one you asked to patch.
Treat free-tier access as a reason to tighten the harness, not as a reason to skip the harness after a cheap demo.
If the model is more error-prone, the ledger and the allowlist do more work per turn, not less.
That is closer to how you would treat an intern with production credentials than how marketing copy talks about "lightweight" assistants.
Disclosure: This article was prepared as part of MonkeyCode's product outreach.
MonkeyCode is an open-source coding-agent project with operator-supplied free model access and a free server option, including the ten-million-token free-tier allotment discussed on this account, which is enough room to rehearse an assumption ledger against real tool traces.
If you need a throwaway server to run the inventory and interceptor below without buying a GPU hour, that free server option is one honest place to try the workflow.
Myth 4: if the tests passed, the change stayed in scope Agents optimize for the visible green signal because that is usually the only success predicate the prompt bothered to celebrate.
Tests that already existed may not cover an Express server the agent added beside a Go binary, and they will not complain about a README that now describes the wrong runtime.
Coverage of the original contract can remain green while the tree contains a second lockfile, a second toolchain, and a commit message that sounds like the ticket.
Passing tests are evidence about assertions you already wrote.
They are not evidence about assertions the agent declined to write.
The corrected model records a scope diff the way a change-control board records materials, not vibes: paths touched, commands run, and assumptions consumed.
If the health-endpoint task rewrites in a Go service, the session failed the contract even if is green.
Green is a local instrument reading.
Scope is a comparison against the pinned hypothesis.
A tiny check that belongs in the same lab folder looks like this.
The test is deliberately unintelligent.
Intelligence is what created the extra lockfile.
The test only asks whether the file tree still matches the pin.
Myth 5: open-source agents ask before they write, because the code is inspectable Inspectability of an orchestrator is not a runtime policy, any more than a published engine schematic is a speed limit.
Default tool loops in many coding agents treat file writes as ordinary steps, the way compilers treat object files: expected, frequent, and unremarkable.
Reading the source of an agent framework tells you that you could insert a confirmation gate before .
It does not tell you that the gate is enabled in the profile you actually launched at 17:40 on a Friday.
Operators still ship with auto-apply enabled because demos look faster that way, and free-tier sessions inherit that default unless someone changes it on purpose.
The corrected model is an explicit state machine with four named states: propose, record, allow, apply.
Anything else is improvisation with a story attached, which is not a control system.
Open source makes the state machine forkable.
It does not make the default conservative.
Artifact: pin the rumor before the shell The original artifact for this FAQ is an assumption ledger plus a pre-tool interceptor.
The ledger is a JSON document that starts as observations and becomes a pin only after a human, or a checked-in policy, fills the required fiel