From 5ad66de50b297b106e0a7d2fdfb725b3ad145e44 Mon Sep 17 00:00:00 2001 From: Jenny Ferries Date: Fri, 14 Aug 2026 12:47:11 -0700 Subject: [PATCH] docs: add Sealed Delegation page and Workshop Local Delegation notes Replace the landing-card GitHub deep-link with a first-class site page. Document Cairn's orthogonal Local toggle on the Workshop page and wire nav, explore, and footer to /sealed-delegation/. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: c39b7696-c854-40c2-b2d6-cce84ba09750 --- _layouts/default.html | 2 + index.html | 28 ++--- sealed-delegation/README.md | 210 ++++++++++++++++++++++++++++++++++++ workshop/README.md | 30 ++++++ 4 files changed, 257 insertions(+), 13 deletions(-) create mode 100644 sealed-delegation/README.md diff --git a/_layouts/default.html b/_layouts/default.html index 0956c7d..35b2744 100644 --- a/_layouts/default.html +++ b/_layouts/default.html @@ -29,6 +29,7 @@ Home Agent Signals The Workshop + Sealed Delegation GitHub @@ -63,6 +64,7 @@ GitHub Agent Signals The Workshop + Sealed Delegation Substack diff --git a/index.html b/index.html index 901fba3..1564557 100644 --- a/index.html +++ b/index.html @@ -36,7 +36,7 @@ The loop Agent Signals The Workshop - Sealed Delegation + Sealed Delegation GitHub @@ -160,17 +160,17 @@

The Workshop

 -
- -
"I want a local model on one sealed job"
-

Sealed Delegation

-

Hand a local model one bounded task and only the files you chose. It returns a proposal. A separate check verifies it. Copilot keeps the final decision.

- Open sealed-delegation - - -
+
+ +
"I want a local model on one sealed job"
+

Sealed Delegation

+

Hand a local model one bounded task and only the files you chose. It returns a proposal. A separate check verifies it. The frontier model keeps the final decision.

+ Explore sealed delegation + + +
@@ -219,7 +219,7 @@

Signals The feedback loop

What's here

Everything in the repo.

-

Skills to load, the signals protocol, the workshop, plus worked examples and reference reading.

+

Skills to load, the signals protocol, the workshop, sealed local delegation, plus worked examples and reference reading.

@@ -240,6 +240,7 @@

Agent Signals — the loop

The Workshop

@@ -327,6 +328,7 @@

Research

GitHub Agent Signals The Workshop + Sealed Delegation Substack
diff --git a/sealed-delegation/README.md b/sealed-delegation/README.md new file mode 100644 index 0000000..955dabb --- /dev/null +++ b/sealed-delegation/README.md @@ -0,0 +1,210 @@ +# Sealed Delegation + +> Give a local model one bounded job and only the files you choose. It returns a +> proposal. A separate check verifies the answer. The frontier model keeps the +> final decision. + +**Open source · [github.com/jennyf19/sealed-delegation](https://github.com/jennyf19/sealed-delegation)** +Runs against [Foundry Local](https://github.com/microsoft/Foundry-Local) on your +machine — loopback only — so the local work stays local. + +--- + +## The wrong question + +Everyone running a capable laptop is asking the same thing this year: *can a +local model do real work yet?* + +That is the wrong question. Local models have been able to do *some* real work +for a while. The question that matters is: + +**Which work, exactly — and how would you know?** + +Sealed Delegation is a small research preview that answers that. A frontier +agent (GitHub Copilot CLI, in our case) delegates one bounded task to a second +agent running entirely against a local model — and never trusts a word it says. + +## The pattern + +The setup is deliberately asymmetric: + +``` +frontier agent (trusted, holds all authority) + → seals ONE bounded task + the exact input files + → launcher hashes inputs into an isolated workspace + → local child agent (loopback model, minimal tools) prepares an artifact + → an INDEPENDENT gate verifies before anything advances +``` + +The local agent's output is a **proposal**. Always. + +- Process exit zero is not evidence. +- Fluent prose is not evidence. +- Confidence is not evidence. + +A separate gate — a different process, re-checking file hashes and exact-matching +the artifact — decides whether the contribution is kept, edited, redone, or +escalated. Nothing the local model produces can advance a decision on its own. + +That sounds paranoid until you watch a 7B model under pressure: it fabricates +fluently, claims file access it does not have, and produces plausible-looking +output for tasks it did not understand. The pattern does not try to "fix" that. +It builds a boundary the failures cannot cross. + +## Why bother, if you cannot trust it? + +Three reasons, in increasing order of durability. + +### 1. Economics — but not the way you think + +The honest measure is not "tokens saved." It is **all-in cost per independently +verified success**: failed attempts, retries, verification, and wall time +included. + +By that measure, local delegation pays when verifying an artifact is much cheaper +than producing it, times a success rate high enough that retries do not eat the +gap. That is a narrow-but-real class of work. + +What makes it interesting is *which* resource it spends. On a metered frontier +seat, frontier requests are scarce currency. Local delegation converts them into +an abundant one: your own silicon plus wall time. Two minutes for a task the +frontier does in seconds is a bad trade on speed and a good one on utilization — +when the work is grunt work you would otherwise pay premium requests for. + +### 2. Privacy + +A missing-input check on material that policy says cannot leave the machine has +*no* frontier-priced equivalent. The child talks to `127.0.0.1` or it does not +run — enforced in code, not stated in a README. For some work, "the evidence +never leaves the box" is not a discount. It is the only way the work happens at +all. + +### 3. The trend asymmetry + +Local models improve every quarter. The harness — sealing, gating, receipts, +qualification — is a fixed cost, and it is model-agnostic. So the class of work +that qualifies only grows, and each expansion costs one preflight run and one +benchmark re-run, not a redesign. + +Most people will argue about whether local agents are "good enough" from vibes. +If you own the measuring instrument, you will know exactly where your threshold +is, and you will notice the week it moves. + +## Where the boundary sits today + +Set expectations honestly. This preview will not blow anyone's mind on speed or +breadth. + +**Qualified today** + +- Bounded staged-file reads +- Missing-input / evidence-completeness checks +- Explicit input, small scope, cheap exact verification +- Foundry Local + a measured route (for example + `qwen2.5-7b-instruct-generic-gpu` under the published qualification tables) + +**Not qualified** + +- Edits or shell +- Broad repository discovery +- Large-context synthesis +- Final security, compliance, merge, or deployment decisions +- Whole-session-local desks +- Dollar-savings claims without an independent gate + +`Handled locally` is utilization, not savings. Failed, redone, or escalated +local work earns zero credit. + +## How it connects to The Workshop + +In [**The Workshop**](../workshop/), Cairn (the live desk dashboard) exposes an +orthogonal **Local** toggle next to the existing **open** / **connected** tool +profiles: + +```text +repo / connected = which tools the frontier desk can see +Local Delegation off/on = whether that desk may invoke a bounded local worker +``` + +The desk stays frontier-powered either way. When Local is effective, eligible +subtasks may use the installed `local-agent-delegation` skill. Conversation, +decomposition, judgment, and the final answer remain frontier-owned. + +Availability is **fail-closed**: + +1. the skill is installed, and +2. a qualified route receipt (or explicit route id) is present. + +Otherwise the control shows why and does not take effect. Preference lives +user-locally — a cloned workshop cannot ship `preference: on`. + +## Get it + +### 1. Install the skill + +From a clone of +[jennyf19/sealed-delegation](https://github.com/jennyf19/sealed-delegation): + +```powershell +copilot skill add .\.github\skills\local-agent-delegation +``` + +### 2. Run Foundry Local + +Load a qualified model on loopback. See the repo's +[QUALIFICATION.md](https://github.com/jennyf19/sealed-delegation/blob/main/QUALIFICATION.md) +for measured host/route tuples — qualification is exact, not "any local model." + +### 3. Declare the route (fail-closed) + +Either set: + +```powershell +$env:WORKSHOP_LOCAL_DELEGATION_ROUTE_ID = "foundry-qwen25-7b-qualified" +``` + +or write a receipt at `~/.copilot/local-agent-runs/qualified-route.json`: + +```json +{ + "status": "qualified", + "route_id": "foundry-qwen25-7b-qualified" +} +``` + +### 4. Use it from Cairn (optional) + +With [The Workshop](../workshop/) and the signals dashboard installed, open +Cairn, flip **Local** on when available, and open a desk. You should see a toast +like: + +> Local Delegation effective · route foundry-qwen25-7b-qualified + +The desk orientation stays short; policy rides on +`WORKSHOP_LOCAL_DELEGATION=enabled` plus the skill. + +### 5. Or invoke the skill directly + +Any frontier Copilot CLI session with the skill installed can seal a bounded +read/evidence task without the Workshop. The gate still decides. + +## What this is not + +- Not autonomous local coding +- Not a universal cost-savings claim +- Not a third desk profile that replaces the frontier model +- Not a promise that local agents are "safe" because they run on your machine + +**Local** means inference and selected data stay on the box. The model is still +untrusted. The surrounding system makes bounded use safe. + +## See also + +- [**The Workshop**](../workshop/) — the room where Local Delegation becomes a + Cairn toggle +- [**Agent Signals**](../agent-signals/) — the feedback loop desks emit after + real work +- [**GitHub repo**](https://github.com/jennyf19/sealed-delegation) — skill, + launcher, gates, qualification, threat model +- [**The Wow Signal**](https://jenny424241.substack.com) — ongoing experiments + in human–AI co-creation diff --git a/workshop/README.md b/workshop/README.md index eb9dd4c..3eff960 100644 --- a/workshop/README.md +++ b/workshop/README.md @@ -103,6 +103,34 @@ external system. --- +## Local Delegation: a local worker, not a local desk + +Cairn also exposes a **Local** toggle. It is orthogonal to **open** / +**connected**: + +```text +repo / connected = which tools the frontier desk can see +Local Delegation off/on = whether that desk may invoke a bounded local worker +``` + +When Local is **effective**, the frontier desk may send cleared, bounded +subtasks — staged-file reads and evidence checks — through +[**Sealed Delegation**](../sealed-delegation/). The local model returns a +proposal. An independent gate decides whether anything is kept. Conversation, +judgment, and the final answer stay with the frontier desk. + +Availability is fail-closed: the `local-agent-delegation` skill must be +installed, and a qualified Foundry Local route must be declared. Otherwise the +control shows why and does not take effect. Operator preference is stored +user-locally so a cloned workshop cannot ship `preference: on`. + +This is not whole-session-local coding, and it is not a savings claim. +`Handled locally` is utilization until a gate accepts the artifact. + +[Read the full Sealed Delegation pattern →](../sealed-delegation/) + +--- + ## Principles 1. **Direct, don't relay.** You set direction and make the calls the room can't @@ -234,5 +262,7 @@ ongoing experiments in human-AI co-creation. ## See Also +- [**Sealed Delegation**](../sealed-delegation/): bounded local workers with an + independent gate — what the Cairn Local toggle turns on - [**Agent Signals**](../agent-signals/): the feedback loop every desk feeds into - [**The Interaction Changes Everything**](https://devblogs.microsoft.com/engineering-at-microsoft/the-interaction-changes-everything-treating-ai-agents-as-collaborators-not-automation/): the research behind treating agents as collaborators, not automation