# The codegen room agents writing code

**🔵 Expert · Lesson 07**

THE CODEGEN ROOM - where an agent writes code that becomes part of a running world, and the gate it has to get through first. This is the only room kind where the caller supplies EXECUTABLE SOURCE, so it is the only one that has to answer "may I" before "did it work".

THE DEFAULT POSTURE IS DENY, AND THE DENYLIST IS THE THREAT MODEL WRITTEN DOWN. A codegen room with no widening projection ships with imports OFF entirely and thirteen builtins refused by name:

__import__ breakpoint compile dir eval exec getattr globals input locals setattr delattr vars

Read that list as a document rather than a setting. Every entry is a door OUT of the namespace contract: `eval`/`exec`/`compile` execute text the gate never saw, `__import__` bypasses the import rules, `getattr`/`setattr`/`vars`/`dir` reach attributes by computed name, and `globals`/`locals` hand back the environment itself. Somebody enumerated the ways out and wrote them down where you can read them.

A REFUSAL IS A VALUE, AND IT NAMES THE OFFENDER. `validate_codegen` returns a payload, not an exception and not a bare boolean: {"accepted": bool, "frame_name": str, "reason": str, "validation_issues": (str, ...)} Rejected source comes back as `accepted: False` with a message that names the specific thing - "Builtin 'eval' is not allowed in this codegen mode" - because a bare False would force you to re-run validation with different instrumentation just to learn why.

THE CHAIN IS ORDERED AND IT SHORT-CIRCUITS. Syntax is checked first (a parse failure never reaches a gate), then seven strategies run in a fixed sequence and the FIRST refusal returns immediately:

ast_structure -> import_policy -> builtin_policy -> name_resolution -> attribute_access -> reflection_policy -> recursive_control

So `validation_issues` is normally ONE issue: the first gate that objected, not an audit of everything wrong. Fix it and re-ask - the next answer may well name a different gate. And the order is observable, which is why it is worth knowing rather than guessing: `eval('1 + 1')` is refused by builtin_policy, which sits BEFORE name_resolution, so you get the builtin message rather than an unresolved-name one.

READ `recursive_control` TWICE. It is last in the chain and it exists because generated code that generates code is how a bounded system stops being bounded. Someone thought about an agent escaping its sandbox by writing a smaller one inside it.

VALIDATION RUNS BEFORE THE ENVIRONMENT EXISTS, AND THAT ORDERING IS THE POINT. The gates read the AST, not a live namespace. The execution environment has not been built when they run - and building it to find out whether building it was allowed "would be exactly the escape the gate exists to prevent". That is why `validate_codegen` is a separate verb rather than a flag on execute: you can learn a boundary without approaching it.

AND MELDER DOES NOT CLAIM THIS IS A PROOF. In its own words, the checks reject OBVIOUS violations, because "static analysis of Python cannot be exhaustive, so the validation chain is defence in depth alongside the namespace denylists and the ACL posture, not a proof of safety on its own". Three layers, named, with the honest limit stated. A system that claimed a guarantee here would be lying, and the willingness to write that down is worth more than the claim.

THE ROOM OVERRIDES A THIRD PROPERTY. Advanced 11 found static and capability each swap TWO - `command_system` (what you may DO) and `frame_viewer` (what you may SEE). CodegenRiftSpace adds `codegen_system`: what you may MAKE. Do / see / make, each by handing over a different class rather than guarding a shared one.

## Before you run

Use the [Expert guide](../../expert/index.md) for prerequisite concepts. Run from a checkout with Melder installed and Python 3.14 free-threading selected. The collection download includes the level's local helper modules.

## Run the saved script

```bash
python UX_and_AIX_experiences/04_expert/07_the_codegen_room_agents_writing_code.py
```

```powershell
py -3.14t UX_and_AIX_experiences/04_expert/07_the_codegen_room_agents_writing_code.py
```

{download}`Download this collection <../../downloads/expert-examples.zip>` · [Source on GitHub](https://github.com/Synaptic724/melder/blob/4b364a338debcb1c010d0f6e9dcbbabb62945ba0/UX_and_AIX_experiences/04_expert/07_the_codegen_room_agents_writing_code.py)

## Public surface

validate_codegen driven against accepted source, a
                   denied import and a denied builtin; the validation
                   payload shape; RiftSpace.space_kind / command_system /
                   frame_viewer / codegen_system;
                   list_supported_command_methods

## Code

```{literalinclude} ../../downloads/04_expert/07_the_codegen_room_agents_writing_code.py
:language: python
:linenos:
```

## Check the outcome

The script contains its own assertions or demonstrated refusal paths. Run it to evaluate those checks against your installed version. The code above is taken directly from the saved file; no run output is invented here.

[More expert examples](index.md) · [Level guide](../../expert/index.md)

## Related guides

- [Build a working system from generated code](../../expert/codegen.md)
- [Complete operational walkthroughs](../../expert/walkthroughs.md)

## API contracts

- [RiftSpace](../../reference/api/inspection/riftspace.md)