docs: Sealed Delegation site page + Workshop Local notes

_layouts/default.html

@@ -29,6 +29,7 @@
         <a href="{{ '/' | relative_url }}" class="hide-sm">Home</a>
         <a href="{{ '/agent-signals/' | relative_url }}" class="hide-sm">Agent Signals</a>
         <a href="{{ '/workshop/' | relative_url }}" class="hide-sm">The Workshop</a>
+        <a href="{{ '/sealed-delegation/' | relative_url }}" class="hide-sm">Sealed Delegation</a>
         <a class="nav-gh" href="https://github.com/jennyf19/agentic-devops" target="_blank" rel="noopener">
           <svg width="16" height="16" viewBox="0 0 16 16" fill="currentColor" aria-hidden="true"><path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.01 8.01 0 0016 8c0-4.42-3.58-8-8-8z"/></svg>
           GitHub
@@ -63,6 +64,7 @@
         <a href="https://github.com/jennyf19/agentic-devops" target="_blank" rel="noopener">GitHub</a>
         <a href="{{ '/agent-signals/' | relative_url }}">Agent Signals</a>
         <a href="{{ '/workshop/' | relative_url }}">The Workshop</a>
+        <a href="{{ '/sealed-delegation/' | relative_url }}">Sealed Delegation</a>
         <a href="https://jenny424241.substack.com" target="_blank" rel="noopener">Substack</a>
       </div>
     </div>

index.html

@@ -36,7 +36,7 @@
         <a href="#loop" class="hide-sm">The loop</a>
         <a href="agent-signals/" class="hide-sm">Agent Signals</a>
         <a href="workshop/" class="hide-sm">The Workshop</a>
-                <a href="https://github.com/jennyf19/sealed-delegation" class="hide-sm" target="_blank" rel="noopener">Sealed Delegation</a>
+        <a href="sealed-delegation/" class="hide-sm">Sealed Delegation</a>
         <a class="nav-gh" href="https://github.com/jennyf19/agentic-devops" target="_blank" rel="noopener">
           <svg width="16" height="16" viewBox="0 0 16 16" fill="currentColor" aria-hidden="true"><path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.01 8.01 0 0016 8c0-4.42-3.58-8-8-8z"/></svg>
           GitHub
@@ -160,17 +160,17 @@ <h3>The Workshop</h3>
           </a>
         </div>
 
-                <div class="card">
-                  <div class="ico" aria-hidden="true">
-                    <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.7" stroke-linecap="round" stroke-linejoin="round"><rect x="4" y="3" width="16" height="18" rx="2"/><path d="M8 8h8M8 12h8M8 16h5"/><path d="M15 14l3 2-3 2"/></svg>
-                  </div>
-                  <div class="quote">"I want a local model on one sealed job"</div>
-                  <h3>Sealed Delegation</h3>
-                  <p>Hand a local model one bounded task and only the files you chose. It returns a proposal. A separate check verifies it. Copilot keeps the final decision.</p>
-                  <a class="go card-link" href="https://github.com/jennyf19/sealed-delegation" target="_blank" rel="noopener">Open sealed-delegation
-                    <svg viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.8" aria-hidden="true"><path d="M3 8h10M9 4l4 4-4 4"/></svg>
-                  </a>
-                </div>
+        <div class="card">
+          <div class="ico" aria-hidden="true">
+            <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.7" stroke-linecap="round" stroke-linejoin="round"><rect x="4" y="3" width="16" height="18" rx="2"/><path d="M8 8h8M8 12h8M8 16h5"/><path d="M15 14l3 2-3 2"/></svg>
+          </div>
+          <div class="quote">"I want a local model on one sealed job"</div>
+          <h3>Sealed Delegation</h3>
+          <p>Hand a local model one bounded task and only the files you chose. It returns a proposal. A separate check verifies it. The frontier model keeps the final decision.</p>
+          <a class="go card-link" href="sealed-delegation/">Explore sealed delegation
+            <svg viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.8" aria-hidden="true"><path d="M3 8h10M9 4l4 4-4 4"/></svg>
+          </a>
+        </div>
 
               </div>
     </div>
@@ -219,7 +219,7 @@ <h4><span class="tag">Signals</span> The feedback loop</h4>
       <div class="section-head">
         <p class="kicker">What's here</p>
         <h2 class="sec" id="explore-h">Everything in the repo.</h2>
-        <p class="sec-sub">Skills to load, the signals protocol, the workshop, plus worked examples and reference reading.</p>
+        <p class="sec-sub">Skills to load, the signals protocol, the workshop, sealed local delegation, plus worked examples and reference reading.</p>
       </div>
 
       <div class="dir">
@@ -240,6 +240,7 @@ <h4>Agent Signals — the loop</h4>
           <h4 style="margin-top:22px">The Workshop</h4>
           <ul>
             <li><a href="workshop/"><span class="n">The Workshop</span><span class="d">A room of agents on one shared bench</span></a></li>
+            <li><a href="sealed-delegation/"><span class="n">Sealed Delegation</span><span class="d">Bounded local workers with an independent gate</span></a></li>
           </ul>
         </div>
         <div class="dir-group">
@@ -327,6 +328,7 @@ <h4>Research</h4>
         <a href="https://github.com/jennyf19/agentic-devops" target="_blank" rel="noopener">GitHub</a>
         <a href="agent-signals/">Agent Signals</a>
         <a href="workshop/">The Workshop</a>
+        <a href="sealed-delegation/">Sealed Delegation</a>
         <a href="https://jenny424241.substack.com" target="_blank" rel="noopener">Substack</a>
       </div>
     </div>

sealed-delegation/README.md

@@ -0,0 +1,210 @@
+# Sealed Delegation
+
+> Give a local model one bounded job and only the files you choose. It returns a
+> proposal. A separate check verifies the answer. The frontier model keeps the
+> final decision.
+
+**Open source · [github.com/jennyf19/sealed-delegation](https://github.com/jennyf19/sealed-delegation)**  
+Runs against [Foundry Local](https://github.com/microsoft/Foundry-Local) on your
+machine — loopback only — so the local work stays local.
+
+---
+
+## The wrong question
+
+Everyone running a capable laptop is asking the same thing this year: *can a
+local model do real work yet?*
+
+That is the wrong question. Local models have been able to do *some* real work
+for a while. The question that matters is:
+
+**Which work, exactly — and how would you know?**
+
+Sealed Delegation is a small research preview that answers that. A frontier
+agent (GitHub Copilot CLI, in our case) delegates one bounded task to a second
+agent running entirely against a local model — and never trusts a word it says.
+
+## The pattern
+
+The setup is deliberately asymmetric:
+
+```
+frontier agent (trusted, holds all authority)
+  → seals ONE bounded task + the exact input files
+  → launcher hashes inputs into an isolated workspace
+  → local child agent (loopback model, minimal tools) prepares an artifact
+  → an INDEPENDENT gate verifies before anything advances
+```
+
+The local agent's output is a **proposal**. Always.
+
+- Process exit zero is not evidence.
+- Fluent prose is not evidence.
+- Confidence is not evidence.
+
+A separate gate — a different process, re-checking file hashes and exact-matching
+the artifact — decides whether the contribution is kept, edited, redone, or
+escalated. Nothing the local model produces can advance a decision on its own.
+
+That sounds paranoid until you watch a 7B model under pressure: it fabricates
+fluently, claims file access it does not have, and produces plausible-looking
+output for tasks it did not understand. The pattern does not try to "fix" that.
+It builds a boundary the failures cannot cross.
+
+## Why bother, if you cannot trust it?
+
+Three reasons, in increasing order of durability.
+
+### 1. Economics — but not the way you think
+
+The honest measure is not "tokens saved." It is **all-in cost per independently
+verified success**: failed attempts, retries, verification, and wall time
+included.
+
+By that measure, local delegation pays when verifying an artifact is much cheaper
+than producing it, times a success rate high enough that retries do not eat the
+gap. That is a narrow-but-real class of work.
+
+What makes it interesting is *which* resource it spends. On a metered frontier
+seat, frontier requests are scarce currency. Local delegation converts them into
+an abundant one: your own silicon plus wall time. Two minutes for a task the
+frontier does in seconds is a bad trade on speed and a good one on utilization —
+when the work is grunt work you would otherwise pay premium requests for.
+
+### 2. Privacy
+
+A missing-input check on material that policy says cannot leave the machine has
+*no* frontier-priced equivalent. The child talks to `127.0.0.1` or it does not
+run — enforced in code, not stated in a README. For some work, "the evidence
+never leaves the box" is not a discount. It is the only way the work happens at
+all.
+
+### 3. The trend asymmetry
+
+Local models improve every quarter. The harness — sealing, gating, receipts,
+qualification — is a fixed cost, and it is model-agnostic. So the class of work
+that qualifies only grows, and each expansion costs one preflight run and one
+benchmark re-run, not a redesign.
+
+Most people will argue about whether local agents are "good enough" from vibes.
+If you own the measuring instrument, you will know exactly where your threshold
+is, and you will notice the week it moves.
+
+## Where the boundary sits today
+
+Set expectations honestly. This preview will not blow anyone's mind on speed or
+breadth.
+
+**Qualified today**
+
+- Bounded staged-file reads
+- Missing-input / evidence-completeness checks
+- Explicit input, small scope, cheap exact verification
+- Foundry Local + a measured route (for example
+  `qwen2.5-7b-instruct-generic-gpu` under the published qualification tables)
+
+**Not qualified**
+
+- Edits or shell
+- Broad repository discovery
+- Large-context synthesis
+- Final security, compliance, merge, or deployment decisions
+- Whole-session-local desks
+- Dollar-savings claims without an independent gate
+
+`Handled locally` is utilization, not savings. Failed, redone, or escalated
+local work earns zero credit.
+
+## How it connects to The Workshop
+
+In [**The Workshop**](../workshop/), Cairn (the live desk dashboard) exposes an
+orthogonal **Local** toggle next to the existing **open** / **connected** tool
+profiles:
+
+```text
+repo / connected        = which tools the frontier desk can see
+Local Delegation off/on = whether that desk may invoke a bounded local worker
+```
+
+The desk stays frontier-powered either way. When Local is effective, eligible
+subtasks may use the installed `local-agent-delegation` skill. Conversation,
+decomposition, judgment, and the final answer remain frontier-owned.
+
+Availability is **fail-closed**:
+
+1. the skill is installed, and
+2. a qualified route receipt (or explicit route id) is present.
+
+Otherwise the control shows why and does not take effect. Preference lives
+user-locally — a cloned workshop cannot ship `preference: on`.
+
+## Get it
+
+### 1. Install the skill
+
+From a clone of
+[jennyf19/sealed-delegation](https://github.com/jennyf19/sealed-delegation):
+
+```powershell
+copilot skill add .\.github\skills\local-agent-delegation
+```
+
+### 2. Run Foundry Local
+
+Load a qualified model on loopback. See the repo's
+[QUALIFICATION.md](https://github.com/jennyf19/sealed-delegation/blob/main/QUALIFICATION.md)
+for measured host/route tuples — qualification is exact, not "any local model."
+
+### 3. Declare the route (fail-closed)
+
+Either set:
+
+```powershell
+$env:WORKSHOP_LOCAL_DELEGATION_ROUTE_ID = "foundry-qwen25-7b-qualified"
+```
+
+or write a receipt at `~/.copilot/local-agent-runs/qualified-route.json`:
+
+```json
+{
+  "status": "qualified",
+  "route_id": "foundry-qwen25-7b-qualified"
+}
+```
+
+### 4. Use it from Cairn (optional)
+
+With [The Workshop](../workshop/) and the signals dashboard installed, open
+Cairn, flip **Local** on when available, and open a desk. You should see a toast
+like:
+
+> Local Delegation effective · route foundry-qwen25-7b-qualified
+
+The desk orientation stays short; policy rides on
+`WORKSHOP_LOCAL_DELEGATION=enabled` plus the skill.
+
+### 5. Or invoke the skill directly
+
+Any frontier Copilot CLI session with the skill installed can seal a bounded
+read/evidence task without the Workshop. The gate still decides.
+
+## What this is not
+
+- Not autonomous local coding
+- Not a universal cost-savings claim
+- Not a third desk profile that replaces the frontier model
+- Not a promise that local agents are "safe" because they run on your machine
+
+**Local** means inference and selected data stay on the box. The model is still
+untrusted. The surrounding system makes bounded use safe.
+
+## See also
+
+- [**The Workshop**](../workshop/) — the room where Local Delegation becomes a
+  Cairn toggle
+- [**Agent Signals**](../agent-signals/) — the feedback loop desks emit after
+  real work
+- [**GitHub repo**](https://github.com/jennyf19/sealed-delegation) — skill,
+  launcher, gates, qualification, threat model
+- [**The Wow Signal**](https://jenny424241.substack.com) — ongoing experiments
+  in human–AI co-creation

workshop/README.md

@@ -103,6 +103,34 @@ external system.
 
 ---
 
+## Local Delegation: a local worker, not a local desk
+
+Cairn also exposes a **Local** toggle. It is orthogonal to **open** /
+**connected**:
+
+```text
+repo / connected        = which tools the frontier desk can see
+Local Delegation off/on = whether that desk may invoke a bounded local worker
+```
+
+When Local is **effective**, the frontier desk may send cleared, bounded
+subtasks — staged-file reads and evidence checks — through
+[**Sealed Delegation**](../sealed-delegation/). The local model returns a
+proposal. An independent gate decides whether anything is kept. Conversation,
+judgment, and the final answer stay with the frontier desk.
+
+Availability is fail-closed: the `local-agent-delegation` skill must be
+installed, and a qualified Foundry Local route must be declared. Otherwise the
+control shows why and does not take effect. Operator preference is stored
+user-locally so a cloned workshop cannot ship `preference: on`.
+
+This is not whole-session-local coding, and it is not a savings claim.
+`Handled locally` is utilization until a gate accepts the artifact.
+
+[Read the full Sealed Delegation pattern →](../sealed-delegation/)
+
+---
+
 ## Principles
 
 1. **Direct, don't relay.** You set direction and make the calls the room can't
@@ -234,5 +262,7 @@ ongoing experiments in human-AI co-creation.
 
 ## See Also
 
+- [**Sealed Delegation**](../sealed-delegation/): bounded local workers with an
+  independent gate — what the Cairn Local toggle turns on
 - [**Agent Signals**](../agent-signals/): the feedback loop every desk feeds into
 - [**The Interaction Changes Everything**](https://devblogs.microsoft.com/engineering-at-microsoft/the-interaction-changes-everything-treating-ai-agents-as-collaborators-not-automation/): the research behind treating agents as collaborators, not automation