Grade the Guesses: A Bootcamp Lab With an Assumption Gate

Cheap AI code is not the hard part. Unstated assumptions are. A student types "add a waitlist endpoint." The agent returns JWT, Redis, Postgres, and a welcome email. Looks senior. It is mostly fiction. This lab grades the guess log first. The diff comes second. If that sounds harsh, good. Bootcamps keep shipping features that never had a chance to be true. Why this lab exists I wrote it because pull requests that solve an unassigned product are a grading nightmare. The brief said with an email. That is it. No auth story. No provider. No queue. The model filled every silence with a vendor. Students accepted the story because the code compiled. Sound familiar? Agents are autocomplete with confidence. Confidence is not evidence. This lab teaches one mechanical habit: no implementation until every material assumption is tagged. We will use a tiny Node checker, a frozen requirements file, and a four-checkpoint rubric. You can run the whole thing on a laptop. The lab still works if you delete the optional infra paragraph below. The trap feature Students get one page. Instructors do not "clarify" in Slack. Ambiguity is the point. Product brief (frozen): Add JSON body: Response: with In-memory storage is acceptable No login, no billing, no email send Deliver in Node.js That is the entire product. Everything else is a guess. Lab setup Fork a starter that contains with a health check only, plus (the brief above) and an empty . Pick any coding agent you already use. Paid, local, browser tab, whatever. Optional infra for a zero-invoice agent loop: point the agent at MonkeyCode. Disclosure: This article was prepared as part of MonkeyCode's product outreach. The only capabilities I am using here are free model access and a free server option. No model names, quotas, or hardware claims. If those matter for a syllabus, verify them on the product page before you publish dates. Install Node 20+. The grader needs no extra packages. If the checker fails on an empty repo, that is correct. An empty assumption log is a failing lab, not a blank canvas. The artifact: an assumption budget Students must keep in this shape: Status is a closed enum: — quoted from or a written instructor answer — considered and explicitly out of scope — the agent (or the student) filled a silence Budget rule: submitted code may depend on rows only. rows live in the table. They must not appear as branches, dependencies, or env vars. rows are not a backlog. They are a fence. Why a table instead of a vibe-y architecture note? Because I can grade a table. I cannot grade "we thought about architecture." Decision table If you see this in the diff Required row Else , sessions, API keys auth assumption, almost always fail checkpoint 2 Redis, queues, workers durability / rate-limit assumption fail unless nodemailer, SendGrid, SMTP email-send assumption fail Postgres, Prisma, SQLite file persistence assumption fail unless the brief changed on duplicates uniqueness assumption allowed only if , or parked as with no code The checker (run this in CI) Save as . It is deliberately picky. Treat it as a lab tool, not a production linter. Run it like a unit test: Is the smell list complete? No. It is a teaching fence. Students who rename to and call SMTP anyway still fail the human review. The script exists so the obvious fiction dies in CI. Checkpoints Checkpoint 0 — freeze the brief Paste into the repo. Do not edit it. If the agent rewrites the brief, that is an automatic zero for this checkpoint. Why so strict? Because "helpful" rewrites are how a waitlist becomes a growth stack. Checkpoint 1 — log before code Fill with at least three rows before gains a route. Commit that file alone. I want a that proves the log came first. Ask the agent a rude prompt and stop there: If it still opens a Prisma schema, you have a process bug, not a model bug. Checkpoint 2 — implement under the budget Add . Keep storage in a module-level array. Return 201. No extra packages unless a row names them. Then run the checker. A legal happy path looks boring. Boring is the point. Did that check invent a validation rule? Yes. Park it as or strip it. See how fast the habit shows up? Smoke test without extra libraries: You want and . Anything else is either a broken student or a broken brief. Do not "fix" it by adding Redis. Checkpoint 3 — mutate the brief Instructor adds one sentence: duplicate emails return . Students must: Move uniqueness from to with evidence pointing at the new sentence Change the code Re-run the checker If they change code without touching the table, they fail even if the HTTP behavior is right. We are grading the coupling, not the status code. Stretch goals Add a second smell pack for Python or Go if your cohort is polyglot. Same table. Different walker. Replace regex smells with a lockfile diff: any new dependency needs a row that names the package. Record a 3-minute walkthrough of the student arguing with the agent: "Do not add Redis." Use that as evidence for checkpoint 1. Turn rows into tests that must not pass. A rejected welcome-email is a test that asserts no SMTP call happened. Fair grading rubric (100 points) Area Points Pass bar Checkpoint 0: unmodified 10 file hash matches the handout Checkpoint 1: assumption commit before route commit 20 order is checkable Table quality 20 ≥3 rows, legal statuses, has evidence Checkpoint 2: checker exit 0 + 201 path 25 curl shown in the README Checkpoint 3: brief mutation reflected in table and code 15 409 only after the table update Human review: no silent vendors 10 reviewer can name every extra import Automatic zeros: rewriting the brief, committing secrets, adding a paid API call to "finish" the lab, or deleting the checker. I do not grade prose style. I do not grade how "production ready" the waitlist looks. Production-ready was how we got a fake email pipeline. Limitations (read this before you copy the rubric) This is a teaching protocol. It is not an architecture review board. The checker is heuristic. Clever students can hide SMTP behind . That is why 10 points stay human. An assumption table is not threat modeling. still needs abuse thinking if you ever put it on the internet. This lab should stay on localhost. Free model access and a free server option can change. Do not print a course catalog promise that depends on one vendor remaining free. Keep a local-model backup. English-only tables punish some cohorts. Translate the status enum if you need to. Do not drop the enum. Who should not use this: seniors who already write ADRs; capstone teams talking to real users (they need discovery, not a guess budget of zero); anyone treating a free server as production hosting. If your class is "build anything," this lab will feel like a muzzle. Use it in week 2, not week 12. What I want students to feel The agent will still guess. That is its job. Your job is to make the guess visible, cheap, and fireable. Run the checker. Fail on purpose once. Then ask the model to list assumptions and stop. That prompt is the whole course if you are short on time. Steal the checker either way. If you need a zero-invoice box for the agent half of the exercise, MonkeyCode's free model access and free server option are how this lab keeps the infra row of the syllabus empty.