DEV Community: Emery Li

Budget the Tool Loop Before a Hot Laptop Exports the Job

Emery Li — Thu, 08 Oct 2026 09:33:16 +0000

A night build on a developer laptop stalled after the third tool retry, and the chassis grew hot enough to throttle the editor. The agent held a clean task and a local repository, yet every model call waited behind a CPU that had already saturated. A teammate suggested moving the whole loop onto a free remote worker before the morning stand-up began. That shortcut can rescue a batch job, but only after the team measures the loop and keeps secrets on the laptop.

The scene above is a composite framing device, not a measured incident from this account or from any named customer. Local-first agent work fails in a familiar way when placement is treated as a hunch instead of a written budget. Interactive edits want short round trips and a machine that can sleep without abandoning files the user has not committed. Batch refactors, long logs, and repeated test runs want sustained throughput that a warm laptop may refuse to hold.

A free remote server can win the batch class of work, while interactive edits should remain beside the keyboard. The practical failure starts when fan noise convinces someone to upload a loop they have not measured on either seat. A hot laptop adds queue delay to every tool call, and that delay feels like a reason to leave the machine entirely. The upload can copy prompts, tool arguments, and uncommitted diffs into a place the local editor no longer watches.

Latency may improve while confidentiality and offline recovery get worse, which is a poor trade if nobody recorded the numbers. A placement budget forces that trade into a written record before any remote worker is allowed to see the fixture. The record stores local loop time, remote loop time, secret exposure, and how long the job can wait offline. It then selects a seat for one fixture, rather than declaring a permanent home for every repository on the team.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. Free model access and a free server option are treated here as operator-supplied availability claims, not as measured product facts. This draft does not name a model, state a token quota, describe hardware, or promise that either offer will remain available. Anyone adopting the remote seat should re-read the project terms on the day of the run, because unpublished limits go stale quickly.

What to record on the fixture

A useful record uses the team clock on a disposable fixture, not a number copied from a launch announcement or a chat thread. Local loop time covers one tool call plus one model turn on the laptop, including any stall caused by thermal throttling. Remote loop time covers that same fixture, and queue delay stays in its own field so a slow link is not misread. Two further fields mark secret exposure and whether the developer can finish the task with the network cable pulled.

Those fields are enough to reject a fashionable default that sends every slow loop to whatever worker happens to be free. The local seat remains mandatory when a secret marker appears, when the work tree is dirty, or when the link is gone. A free server becomes reasonable only when the fixture is redacted, the job is batch-shaped, and the remote sample wins a prewritten margin. Neither seat expresses a preference about vendors, because both seats are answers to one measured fixture and nothing broader.

Decision table for a single job

The table below is a gate for a single job, and it should be read before any sample is uploaded or discarded. A zero price does not repair a secret leak, and a fast laptop does not finish a batch that has already stalled. The remote column is allowed only when every local blocker is absent and the timing margin was measured on this fixture. Teams that want a published score should measure their own run, because this article does not supply one.

Signal	Stay local	Consider a free remote worker
Secret or credential in the prompt or tool args	Required	Do not send the fixture
Uncommitted diff required for a correct answer	Keep that tree local	Send a redacted patch only
Network during the run	Optional	Required for the remote seat
Laptop throttling on a repeated clean fixture	Fine for short edits	Reasonable if the sample wins
Travel or a dead link	Local queue only	Defer until the path returns
Desire for a published score	Do not invent one	Measure the fixture yourself

Numbered workflow

The commands and the Python helper that follow are a proposal for a disposable fixture, and they were not executed for this draft. Thresholds inside the helper are placeholders that a team should replace after it sees its own editor latency. The samples should be collected on redacted inputs, then discarded if a later review finds a marker the script missed. Treat every printed seat as a suggestion until a human compares it with the dirty tree still sitting on the laptop.

1. Freeze a redacted fixture

Copy one failing tool loop into a fixture file that contains no tokens, no customer rows, and no proprietary uncommitted diff. Leave the original work tree on the laptop so a remote experiment cannot become the only copy of the change. The fixture should still be heavy enough to warm the CPU, or the later comparison will flatter whichever side stayed idle. A public unit-test failure is a reasonable stand-in when the real repository cannot leave the machine even in redacted form.

mkdir -p fixtures samples queue/offline
python3 - <<'PY'
import json
from pathlib import Path
fixture = {
    'task': 'retry a redacted unit test and summarize the failure',
    'repo': 'public-fixture',
    'secrets': [],
    'dirty_tree': False,
}
Path('fixtures/redacted_retry.json').write_text(json.dumps(fixture, indent=2))
PY

2. Time the local seat, then let the machine idle

Write a local skeleton while the editor and the agent share the CPU, then fill loop_ms from the operator clock. Record a second local sample after the machine has been idle long enough for the chassis to cool down. The hot sample explains why a teammate wants to leave the laptop, and it should not be hidden from the record. The idle sample stops that hot reading from becoming a permanent policy for every future edit in the repository.

python3 loop_budget.py sample --seat local --phase hot \
  --fixture fixtures/redacted_retry.json --out samples/local-hot.json
python3 loop_budget.py sample --seat local --phase idle \
  --fixture fixtures/redacted_retry.json --out samples/local-idle.json

3. Time the remote seat only after the redaction check

Send the same fixture to the free server option only after the marker check is clean and the offer is confirmed that day. The helper writes a skeleton and does not open a socket, so measured milliseconds must be pasted in by hand. Keep queue milliseconds in their own field so a congested path is not later described as a weak model. If the free server cannot be confirmed that day, skip the remote file and leave the job on the laptop.

python3 loop_budget.py sample --seat remote \
  --fixture fixtures/redacted_retry.json --out samples/remote.json

4. Score with an explicit refusal path

The helper refuses a remote seat when a secret marker is present, when the tree is dirty, or when the laptop is offline. It also refuses a remote seat when either file lacks loop_ms, because a null timestamp is not a successful sample. A gain below the team margin keeps the work local even if the remote call returned a plausible answer. Interactive edits stay local regardless of speed, since the user is still typing in a tree the server should not own.

#!/usr/bin/env python3
"""Proposal only: record and score one redacted tool loop. Not a live benchmark."""

import json
import sys
from pathlib import Path

MARKERS = ('api_key', 'BEGIN PRIVATE', 'password', 'token')

def blob_has_secret(text):
    return any(item in text for item in MARKERS)

def cmd_sample(seat, phase, fixture, out):
    raw = Path(fixture).read_text()
    if blob_has_secret(raw):
        raise SystemExit('refusing sample: secret marker in fixture')
    payload = json.loads(raw)
    record = {
        'seat': seat,
        'phase': phase,
        'offline': False,
        'dirty_tree': bool(payload.get('dirty_tree')),
        'interactive': False,
        'loop_ms': None,
        'queue_ms': None,
        'note': 'fill loop_ms after timing; null is not a win',
    }
    Path(out).write_text(json.dumps(record, indent=2) + '\n')
    print(out)

def cmd_decide(local_path, remote_path, max_remote_ms=4000, min_gain_ms=800):
    local = json.loads(Path(local_path).read_text())
    remote = json.loads(Path(remote_path).read_text())
    local_raw = Path(local_path).read_text()
    remote_raw = Path(remote_path).read_text()
    if blob_has_secret(local_raw) or blob_has_secret(remote_raw):
        seat, reason = 'local', 'secret marker present; do not upload'
    elif local.get('offline') or local.get('dirty_tree'):
        seat, reason = 'local', 'offline or uncommitted work stays local'
    elif local.get('loop_ms') is None or remote.get('loop_ms') is None:
        seat, reason = 'local', 'missing loop_ms is not a win'
    else:
        gain = local['loop_ms'] - remote['loop_ms']
        remote_ok = remote['loop_ms'] <= max_remote_ms and gain >= min_gain_ms
        if remote_ok and not local.get('interactive'):
            seat, reason = 'remote', 'clean batch fixture; remote loop wins the margin'
        else:
            seat, reason = 'local', 'gain too small, link too slow, or edit is interactive'
    print(json.dumps({'seat': seat, 'reason': reason}, indent=2))

def flag(args, name, default=None):
    if name not in args:
        if default is None:
            raise SystemExit('missing ' + name)
        return default
    return args[args.index(name) + 1]

def main():
    if len(sys.argv) < 2:
        raise SystemExit('usage: loop_budget.py sample|decide ...')
    cmd, args = sys.argv[1], sys.argv[2:]
    if cmd == 'sample':
        cmd_sample(flag(args, '--seat'), flag(args, '--phase', 'unspecified'),
                   flag(args, '--fixture'), flag(args, '--out'))
        return
    if cmd == 'decide':
        cmd_decide(args[0], args[1])
        return
    raise SystemExit('unknown command')

if __name__ == '__main__':
    main()

Sample files should follow one flat object so the scorer can fail closed when a required timing field is missing. Values shown beside this helper are placeholders, and copying them into a report would invent a benchmark this method forbids. A real sample replaces loop_ms only after the operator times that seat on the team machine. Queue time stays beside loop time so a later reader can see whether the link, not the model, dominated the wait.

{
  "loop_ms": null,
  "queue_ms": null,
  "offline": false,
  "dirty_tree": false,
  "interactive": false,
  "phase": "hot"
}

python3 loop_budget.py decide samples/local-hot.json samples/remote.json
python3 loop_budget.py decide samples/local-idle.json samples/remote.json

5. Park offline jobs instead of retrying a dead link

If the path drops, copy the redacted fixture into a local queue and leave the remote seat unused until the path returns. Resume only after a fresh remote sample succeeds on that same fixture, rather than replaying a stale timing file. This queue rule is a workflow suggestion for the operator, not a claim that any particular client already implements it. Offline time is a reason to wait, not a reason to weaken the secret check when the link finally recovers.

cp fixtures/redacted_retry.json "queue/offline/$(date -u +%Y%m%dT%H%M%SZ).json"

Reading the two scores without folklore

A hot local sample that loses by a wide margin supports a remote seat for that batch and for no other job. An idle local sample that already fits the editor budget cancels that support and saves the free server for a heavier fixture. When the two decisions disagree, the idle sample should govern interactive work and the hot sample should govern only the stalled batch. Writing both outcomes next to the fixture prevents a single fan spike from rewriting the placement policy for the week.

Teams should also name the failure they are willing to accept before they compare the two millisecond fields. A remote timeout on a clean fixture can be retried, while a secret upload cannot be retried back into safety. That asymmetry is why the helper checks markers before it subtracts timestamps, and why a faster number never outranks a dirty payload. If the team cannot explain that order to a new teammate, the remote seat is not ready for the queue.

Where a free server earns the seat

A free remote worker earns the seat on repeated redacted fixtures that make a laptop thermally noisy for minutes at a time. Long log summaries, broad reruns of a public test suite, and scaffold drafts from an already public repository fit that shape. Free model access helps in a narrower way, because a team can rehearse the remote sample without purchasing a seat first. That rehearsal is a method check, and it says nothing about output quality, context length, or how long the offer will last.

The same worker loses the seat when the prompt still holds a credential or when the answer depends on an uncommitted diff. It also loses the seat when the developer is offline and cannot accept a result that arrives after the link returns. An idle laptop that already meets the latency budget should keep the job, even if a remote call would finish a little sooner. Price is absent from the signal list on purpose, and a zero price must not return as a silent extra reason to upload.

Test plan before anyone trusts the branch

Before anyone trusts the helper, three local checks should pass on files that never leave the laptop. A fixture containing the marker token must return the local seat even when the remote loop time is tiny. A fixture marked dirty or offline must return the local seat even when the remote sample looks faster. A clean batch fixture should return the remote seat only when the gain meets the placeholder margin and loop time is present.

Run those checks with hand-written JSON files and do not point them at a live provider while the script is still a proposal. Replace the placeholder margin only after the idle laptop sample shows what the editor can already tolerate. Keep the failing fixtures in the repository so a later change to the marker list has something honest to break against. If a check requires uploading a secret to prove the refusal, the test is misdesigned and should be deleted.

Limitations and who should skip the method

This method is a poor fit for production incidents, regulated data, and any tree that cannot be redacted before the next standup. It is also a poor fit for teams that need a signed benchmark, because the helper was not executed for this draft. The numeric thresholds are placeholders, and publishing them as if they were measured results would mislead a later reader. Developers who already measure a private cluster should not migrate work only because a free server sends an empty invoice.

The marker list will miss secrets that use unfamiliar field names, encoded blobs, or values split across adjacent tool arguments. Human review of the fixture remains mandatory before any upload, and a green script is not a substitute for that review. Link loss, conflicting edits from another session, and drift in model output are separate failures that this budget does not close. Anyone who cannot accept those gaps should keep the entire loop on the laptop and skip the remote sample altogether.

Close the loop on one fixture

A team that already keeps interactive agent work beside the editor can still seek relief when a clean batch is cooking the chassis. The practical next step is to time one redacted fixture on both seats and keep the raw samples next to the script. Confirm the current free-model and free-server terms before that offline queue is allowed to grow past a single fixture. That reading takes less time than explaining how a credential left a machine that was only trying to cool down.

Budget the Round Trip Before Scaffold Work Leaves the Laptop

Emery Li — Thu, 08 Oct 2026 07:04:15 +0000

A backend developer kept an agent loop on a laptop while a large monorepo index rebuilt for the third time that afternoon. The loop needed a fresh file map before it could propose a narrow refactor, and the fan was already loud. A free remote server could finish that index sooner, yet the working tree still held environment files and a customer fixture. Moving the whole job would save minutes and could also copy material that never belonged on another machine.

The placement problem is a budget, not a slogan

Local-first agent work fails in two opposite ways when a team treats placement as a mood rather than a measurement. A fully local loop protects secrets and survives a dead network, but a heavy index can miss the afternoon budget. A fully remote loop hides that delay and then strands the job when the link drops or a secret rides along. The practical split measures a connect sample, classifies each path, and sends only scaffold work to another machine.

What this draft does and does not claim

MonkeyCode enters the workflow only as an operator-supplied option for free model access and a free server, not as a measured ranking. Disclosure: This article was prepared as part of MonkeyCode's product outreach. The operator also describes the project as open source, while this draft refuses invented model names, token quotas, hardware sizes, and permanence claims. Any current limit should be read from the product documentation on the day an operator configures the placement gate.

Signals the gate is allowed to see

The gate in this draft reads three signals and ignores vanity metrics such as star counts or leaderboard ranks. Connect time is a single TCP sample to a host taken from current documentation, and it is not a throughput test. Path class marks a file as secret, scaffold, ordinary, or unknown before any byte is queued for transfer. Offline state is a boolean lease: when the lease is closed, even a fast server loses to the local loop.

How the columns decide a step

A secret or unknown path never leaves the laptop, even when the index rebuild is the slowest step in the afternoon. An ordinary edit stays local because round-trip delay usually costs more than the small diff the agent wants to inspect. Scaffold files, such as generated maps and lock summaries, may use the free server only when the offline lease is open. That remote choice also requires the local estimate to miss its budget while the connect sample still looks cheaper.

Path class	Offline lease	Local estimate versus budget	Placement
Secret or unknown	Any	Any	Stay on the laptop
Ordinary edit	Any	Any	Stay on the laptop
Scaffold only	Closed	Any	Stay on the laptop
Scaffold only	Open	Estimate within budget	Stay on the laptop
Scaffold only	Open	Estimate over budget and sample cheaper	Free server for that step

The table is a policy sketch for one step, and it should be stored next to the job rather than buried in a chat scroll. A row wins only when every column matches, which stops a fast sample from overriding a secret label. Operators can add rows for their own scaffold suffixes, but they should not add a row that sends unknown paths away. The later code encodes the same rules so a fixture can fail when someone edits one side and forgets the other.

Step 1: Sample reachability without uploading the tree

The first command opens a short TCP connection and prints either a millisecond sample or an offline marker. It does not walk the repository, does not archive the working tree, and does not attach credentials to the socket. Operators should replace the placeholder host with the host named in the current product docs before they trust the number. A failed connect closes the offline lease for that run and forces every later step to remain local.

python - <<'PY'
import socket
import time

host = 'docs-host.example'  # replace from current product docs
started = time.perf_counter()
try:
    socket.create_connection((host, 443), timeout=2.0).close()
except OSError as exc:
    print(f'offline:{exc.__class__.__name__}')
else:
    elapsed_ms = int((time.perf_counter() - started) * 1000)
    print(f'connect_ms:{elapsed_ms}')
PY

The snippet is a proposed check, and this article does not report a live measurement against any vendor endpoint. A connect sample can succeed while a later upload fails, so the gate treats the number as a ceiling hint rather than a contract. Operators who cannot name a documentation host should skip the remote branch and keep the entire agent loop on the laptop. Guessing a hostname would turn a placement aid into an accidental scan, which this workflow refuses.

Step 2: Classify paths before any model hop

Classification runs on names and path parts, and it errs toward secret whenever a token-like fragment appears. The lists below are a starting policy for a scratch repository, not a complete secret scanner for a regulated estate. Unknown suffixes stay in the unknown class, and an unknown label never qualifies a step for the free server branch. A human still has to review the policy when a project uses unusual filenames for private material.

from pathlib import Path

SECRET_NAMES = {'.env', 'id_rsa', 'credentials.json', 'secrets.yaml'}
SECRET_PARTS = ('.pem', '.key', 'token', 'secret')
SCAFFOLD_SUFFIXES = ('.lock', '.map', '.idx')

def classify_path(path: str) -> str:
    name = Path(path).name.lower()
    if name in SECRET_NAMES or any(part in name for part in SECRET_PARTS):
        return 'secret'
    if name.endswith(SCAFFOLD_SUFFIXES):
        return 'scaffold'
    if name.startswith('.'):
        return 'unknown'
    return 'ordinary'

This classifier is proposed example code, and it has not been executed against the account's repositories for this draft. Name matching misses secrets embedded inside ordinary source files, so a positive ordinary label is not a clearance to upload a whole directory. The safe use is a per-step path list that an operator already trimmed down to the files that step will read. A step with mixed classes inherits the strictest class, which keeps one secret file from pulling a large scaffold upload off the laptop.

Step 3: Compare the local estimate with the sample

The local estimate is an operator-entered millisecond budget for the step, taken from a previous local run or a deliberate guess labeled as such. This draft does not publish timings, because no controlled run was supplied with the account history used for context. Remote cost is modeled as two connect samples plus a fixed queue allowance of 150 milliseconds, and that formula is a proposal rather than a benchmark. If the offline lease is closed, the comparison is skipped and the placement remains on the laptop for that step.

QUEUE_ALLOWANCE_MS = 150  # proposed constant, not a measured service level

def remote_cost_ms(connect_ms: int) -> int:
    return connect_ms * 2 + QUEUE_ALLOWANCE_MS

def choose_placement(path_class: str, offline: bool, local_ms: int, budget_ms: int, connect_ms: int) -> str:
    if path_class in {'secret', 'unknown'} or offline:
        return 'local'
    if path_class != 'scaffold':
        return 'local'
    if local_ms <= budget_ms:
        return 'local'
    if remote_cost_ms(connect_ms) < local_ms:
        return 'free-server-scaffold'
    return 'local'

The function returns a label only, and a caller still has to implement the copy with an explicit file list. Free model access can serve either placement, so the model choice does not override a local label produced by the secret check. A free server win means the scaffold step may run remotely, not that the chat transcript or the environment file may follow it. Operators should log the label beside the path list so a later review can see why the hop was allowed.

Step 4: Walk a tiny fixture through the gate

A three-row fixture is enough to show the policy without touching a real working tree or a live remote host. The first row carries a secret class and must stay local even though the local estimate is terrible. The second row is a scaffold class with an open lease and a slow local estimate, so the proposed label is the free server. The third row repeats that scaffold class with the lease closed, which returns the work to the laptop.

# Append to the earlier functions. Proposed and unexecuted in this draft.
FIXTURE = [
    ('secret', True, 9000, 2000, 40, 'local'),
    ('scaffold', False, 9000, 2000, 40, 'free-server-scaffold'),
    ('scaffold', True, 9000, 2000, 40, 'local'),
]

def assert_fixture() -> None:
    for path_class, offline, local_ms, budget_ms, connect_ms, expected in FIXTURE:
        got = choose_placement(path_class, offline, local_ms, budget_ms, connect_ms)
        if got != expected:
            raise SystemExit(f'mismatch:{path_class}:{got}:{expected}')
    print('fixture_ok')

if __name__ == '__main__':
    assert_fixture()

Saving the earlier snippets together as placement_budget.py checks the policy table with no network access and no home-directory reads. The numbers are illustrative inputs for the proposal, not results from a free server or a local model. Changing the queue allowance will change the second row, which is a reason to keep that constant in one place. Teams that adopt the snippet should replace the fixture with path lists from their own repository before they trust a label.

When the free server is the better room

The free server option wins for disposable scaffold work only when three conditions hold at the same time. The step paths are scaffold only, the offline lease is open, and the local estimate misses a budget that the connect sample can still beat. Typical candidates include generated file maps, lockfile summaries, and public dependency graphs that can be deleted and rebuilt. Interactive edits, secret-bearing fixtures, and any path the classifier cannot name should remain on the laptop even if the fan is loud.

Free model access is a separate dial from placement, and it does not make a secret file safe to attach. An operator can keep files on disk and send only a trimmed prompt to the free model access path. That choice still needs a network for the model call, so a closed offline lease should skip remote model hops as well. Neither dial should be treated as a quota promise, a hardware promise, or a reason to skip the path check.

Limitations and who should skip the remote branch

The classifier is a filename policy, so it will miss secrets pasted into source files, notebooks, or logs with ordinary names. A connect sample says nothing about bandwidth, queue depth, or whether the free server option is still offered that afternoon. The 150 millisecond allowance is a teaching constant, and copying it into production without local measurements would fake a precision this draft does not have. Air-gapped networks, regulated repositories, and any tree where scaffold files may contain customer data should not use the remote branch.

Operators who need a contractual uptime target, a named region, or a guaranteed token allotment will not find those promises in this workflow. The gate also does not solve overlapping edits, host sleep, or schema drift between model hops, which are separate problems with their own checks. A team that cannot review the path list before a hop should keep the agent local until that review exists. Disposable scratch indexes are the intended first trial, not production customer trees and not repositories full of private fixtures.

Keep the budget next to the job

A placement label is useful only when it sits beside the path list, the connect sample, and the offline lease for that run. The afternoon monorepo case becomes a narrow remote index job, while the environment file and the customer fixture never enter the copy set. Readers who want free model access or the free server option should confirm current docs, then run this gate on a scratch repository. The workflow remains a local-first budget even if that product option is removed from the story.

Budget the Round Trip Before Scaffold Work Leaves the Laptop

Emery Li — Thu, 08 Oct 2026 06:55:47 +0000

The placement problem is a budget, not a slogan

What this draft does and does not claim

Signals the gate is allowed to see

How the columns decide a step

Path class	Offline lease	Local estimate versus budget	Placement
Secret or unknown	Any	Any	Stay on the laptop
Ordinary edit	Any	Any	Stay on the laptop
Scaffold only	Closed	Any	Stay on the laptop
Scaffold only	Open	Estimate within budget	Stay on the laptop
Scaffold only	Open	Estimate over budget and sample cheaper	Free server for that step

Step 1: Sample reachability without uploading the tree

python - <<'PY'
import socket
import time

host = 'docs-host.example'  # replace from current product docs
started = time.perf_counter()
try:
    socket.create_connection((host, 443), timeout=2.0).close()
except OSError as exc:
    print(f'offline:{exc.__class__.__name__}')
else:
    elapsed_ms = int((time.perf_counter() - started) * 1000)
    print(f'connect_ms:{elapsed_ms}')
PY

Step 2: Classify paths before any model hop

from pathlib import Path

SECRET_NAMES = {'.env', 'id_rsa', 'credentials.json', 'secrets.yaml'}
SECRET_PARTS = ('.pem', '.key', 'token', 'secret')
SCAFFOLD_SUFFIXES = ('.lock', '.map', '.idx')

def classify_path(path: str) -> str:
    name = Path(path).name.lower()
    if name in SECRET_NAMES or any(part in name for part in SECRET_PARTS):
        return 'secret'
    if name.endswith(SCAFFOLD_SUFFIXES):
        return 'scaffold'
    if name.startswith('.'):
        return 'unknown'
    return 'ordinary'

Step 3: Compare the local estimate with the sample

QUEUE_ALLOWANCE_MS = 150  # proposed constant, not a measured service level

def remote_cost_ms(connect_ms: int) -> int:
    return connect_ms * 2 + QUEUE_ALLOWANCE_MS

def choose_placement(path_class: str, offline: bool, local_ms: int, budget_ms: int, connect_ms: int) -> str:
    if path_class in {'secret', 'unknown'} or offline:
        return 'local'
    if path_class != 'scaffold':
        return 'local'
    if local_ms <= budget_ms:
        return 'local'
    if remote_cost_ms(connect_ms) < local_ms:
        return 'free-server-scaffold'
    return 'local'

Step 4: Walk a tiny fixture through the gate

# Append to the earlier functions. Proposed and unexecuted in this draft.
FIXTURE = [
    ('secret', True, 9000, 2000, 40, 'local'),
    ('scaffold', False, 9000, 2000, 40, 'free-server-scaffold'),
    ('scaffold', True, 9000, 2000, 40, 'local'),
]

def assert_fixture() -> None:
    for path_class, offline, local_ms, budget_ms, connect_ms, expected in FIXTURE:
        got = choose_placement(path_class, offline, local_ms, budget_ms, connect_ms)
        if got != expected:
            raise SystemExit(f'mismatch:{path_class}:{got}:{expected}')
    print('fixture_ok')

if __name__ == '__main__':
    assert_fixture()

When the free server is the better room

Limitations and who should skip the remote branch

Keep the budget next to the job

Reject Remote Patches That Overlap Edits Made During the Wait

Emery Li — Thu, 24 Sep 2026 19:46:19 +0000

A coding agent on a laptop had already redacted a parser task when the free server probe returned inside the latency budget. The secret scan was clean, the freshness stamp was new, and the offline change count on that card was zero. While the remote generation was still running, a local typo fix landed in the same function the patch was about to touch. The returning patch matched the old snapshot and would have overwritten the newer line if the apply had been automatic.

The scene is a composite illustration for this tutorial, not a ticket pulled from a named company or a personal lab log. It still captures the tradeoff that appears once a remote runner starts to look cheaper than another local generation. Local execution protects secrets, keeps working through a dead link, and sees edits that arrive during the wait. A free server can win the generation itself when the payload is already safe and the measured round trip fits the budget.

The laptop should still win the apply step whenever that remote patch overlaps work written after the stamp. Admission and apply are different decisions, and a clean scan does not authorize a blind write to disk. Treating them as one step is how a fast, inexpensive hop corrupts a file the remote process never reread.

Admission is not the same as apply

The admission gate asks whether any free server may receive a redacted scaffold for this particular task. The apply gate asks whether the returned patch may change the tree that exists at the moment of return. Latency, secret class, and offline residue are admission inputs, while line overlap is strictly an apply input. A result can pass admission and still be rejected at apply time without any contradiction in the rules.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode appears here only as an operator-described option with free model access and a free server choice. This draft states no model names, token quotas, hardware sizes, or durations, because no primary source was supplied for those figures. The operator describes the project as open source, and the license should be read from the repository rather than inferred from this page.

Readers should confirm the live free model access and free server terms on the project site before planning a real workload. A price of zero does not relax either gate, and it does not make an env file safe to upload. The free server wins admission only when the probe fits the budget, the secret count is zero, and offline residue is absent. It loses admission when the probe fails, a denylist hit appears, or the stamp is older than the agreed window.

What to measure on the laptop

Latency has to come from a fresh probe, not from a diagram that a team remembered from the previous week. The task card stores a budget in milliseconds, and the probe stores a round-trip time that contains no repository text. A failed or missing probe counts as offline, even when a desktop icon still reports that the network is connected. Teams that skip the probe will eventually hand work to a path they have not timed on that day.

Secret class is a count of denylist hits inside the exact payload proposed for the remote call. The scan should cover env files, private keys, raw tokens, and uncommitted diffs marked local-only by the team. A single hit keeps the task on the laptop, because redaction after upload cannot recall a credential. This tutorial ships no universal denylist, so the repository owners need patterns that match their own tree.

Offline residue counts path changes that happened while the link was down, together with the age of the cached stamp. A stamp is a hash of the allowed files, written into a ledger that is required to remain on the laptop. When that hash no longer matches, admission should defer rather than offer a stale scaffold to a remote process. The deferral is intentional, and it costs less than a generation aimed at a tree the agent has already left behind.

How the three tradeoffs interact

A fast probe cannot rescue a payload that still contains a token, so latency never outranks secret class. A clean scan cannot invent connectivity, so good secret hygiene is not the same thing as an offline plan. An online path with a fresh stamp can still lose when the probe time exceeds the budget stored on the card. The laptop should then generate locally or wait, instead of paying for a round trip it has already judged too slow.

The free server wins only the narrow case in which admission is clean and the later overlap check stays silent. That narrow case is still useful, because a long completion can stall a laptop that is already busy with tests. The remote side returns text in that case, while the laptop remains the only place allowed to write the tree. If admission or overlap fails, the zero price of the server is irrelevant and the local outcome is the correct one.

Numbered workflow

The following sequence keeps measurement, admission, and apply in an order that a runner can audit later. Each step uses values the laptop can recompute, and none of the steps assumes a named model or a fixed quota. Operators can insert their own probe command at step four without changing the overlap rule at the end.

Write a task card with a goal, allowed paths, a latency budget in milliseconds, and a freshness window in seconds.
Hash the allowed paths, store the stamp in a local ledger, and refuse to copy that ledger to the free server.
Build the outbound payload, run the secret scan, and keep the task local if the hit count is not zero.
Probe the free server with a health request that carries no repository text, and record the round-trip time.
Admit the redacted scaffold to the free server only when the probe fits the budget and the residue count is zero.
On return, compute line ranges from the patch and from edits made after the stamp, then apply only if the ranges are disjoint.
If the ranges overlap, leave the tree untouched and ask for a new stamp rather than forcing a merge in the agent loop.

Reference checker

The module below is an unexecuted reference for review, not a benchmark and not a log from a hosted run. It accepts measurements from the caller, and it neither opens a socket nor reads a real environment file. The numeric sample later in this section is illustrative input, not an observed latency from any product. Annotations use Python 3.10 union syntax, so an older interpreter should rewrite those hints before import.

from dataclasses import dataclass
from enum import Enum

class Decision(Enum):
    LOCAL = "local"
    FREE_SERVER = "free_server"
    DEFER = "defer"
    REJECT_APPLY = "reject_apply"
    ALLOW_APPLY = "allow_apply"

@dataclass(frozen=True)
class Admission:
    latency_budget_ms: int
    probe_rtt_ms: int | None
    secret_hits: int
    stamp_age_s: int
    freshness_window_s: int
    offline_changes: int
    payload_redacted: bool

@dataclass(frozen=True)
class Span:
    path: str
    start: int
    end: int

def admit(card: Admission) -> Decision:
    if card.secret_hits or not card.payload_redacted:
        return Decision.LOCAL
    if card.stamp_age_s > card.freshness_window_s or card.offline_changes:
        return Decision.DEFER
    if card.probe_rtt_ms is None or card.probe_rtt_ms > card.latency_budget_ms:
        return Decision.LOCAL
    return Decision.FREE_SERVER

def overlaps(left: Span, right: Span) -> bool:
    if left.path != right.path:
        return False
    return left.start <= right.end and right.start <= left.end

def apply_decision(remote: list[Span], local_edits: list[Span]) -> Decision:
    for patch_span in remote:
        for edit in local_edits:
            if overlaps(patch_span, edit):
                return Decision.REJECT_APPLY
    return Decision.ALLOW_APPLY

Save the module as overlap_gate.py in a scratch directory before the sample command is expected to import it. The sample command builds one admitted card and one overlapping span pair, then prints both decision values. The first line should print free_server for that clean card, and the second line should print reject_apply. The sample spans share parser.py across lines 60 through 68, so the inclusive overlap test is expected to fire.

python - <<'PY'
from overlap_gate import Admission, Span, admit, apply_decision
card = Admission(800, 140, 0, 12, 60, 0, True)
print(admit(card).value)
remote = [Span("parser.py", 40, 68)]
local_edits = [Span("parser.py", 60, 72)]
print(apply_decision(remote, local_edits).value)
PY

Move the local span to lines 80 through 90 and the apply check should print allow_apply for that pair. Set secret_hits to 1 and admission should return local, even though the probe time remains comfortably fast. Clear the probe value and admission should also return local, because a missing measurement is not a successful path.

Reading hunks into spans

Line ranges should come from the diff the agent would apply, not from a guess about the whole file. The helper below is also unexecuted reference code, and it reads unified hunk headers for a single path. It ignores renamed files, mode changes, and binary hunks, which need a richer parser than this tutorial provides. Feed it only the diff for one path, and keep real tokens out of the fixture text used in tests.

import re

HUNK = re.compile(r"^@@ -\d+(?:,\d+)? \+(\d+)(?:,(\d+))? @@")

def spans_from_unified(path: str, diff_text: str) -> list[Span]:
    found = []
    for line in diff_text.splitlines():
        match = HUNK.match(line)
        if not match:
            continue
        start = int(match.group(1))
        count = int(match.group(2) or "1")
        if count == 0:
            continue
        found.append(Span(path, start, start + count - 1))
    return found

Append the hunk helper to the same overlap_gate.py file so tests can import spans and decisions together. A local git invocation can supply that diff without sending the patch to the free server at all. The command below prints a unified diff with zero context lines, which makes hunk headers easier to parse. Pipe that output into a local script that calls spans_from_unified, and compare those spans with edits made after the stamp.

git diff -U0 -- parser.py

That comparison stays on the laptop, even when the patch text was produced by a free server a moment earlier. A zero-context diff is a parsing aid, not a requirement that the agent generate patches with no surrounding lines. If a runner emits standard three-line context, the same hunk header still carries the starting line and the count. The ledger hash should be recomputed after any accepted apply, so the next card cannot reuse a stamp from the pre-patch tree.

Decision table

The table compresses the same rules the functions implement, so a reviewer can audit them without reading Python first. Rows are conditions the laptop can observe, and the result column is the only placement this workflow allows. A free server does not appear as a winner merely because it is offered at no charge.

Condition	Result	Why it matters
Secret hit or payload not redacted	Stay local	Credentials and raw diffs never enter the free server
Probe missing, failed, or slower than the budget	Stay local	Offline or slow paths should not pretend to be remote wins
Stamp expired or offline file changes exist	Defer	The scaffold would describe a tree the laptop has already left
Clean admission, then overlapping local edits	Reject apply	A fast remote patch must not erase work done during the wait
Clean admission and disjoint ranges	Allow apply	Generation left the laptop, but the write still happens locally

Contract checks to add

A team should encode the table as local tests before any runner is allowed to call a network. One test supplies a secret hit plus a tiny probe time and expects the local decision. Another test omits the probe and expects local, while a third sets an expired stamp and expects defer. A fourth test feeds overlapping spans and expects reject_apply, and a fifth uses disjoint spans after clean admission.

python -m pytest tests/test_overlap_gate.py -q

The pytest line is a suggested entry point, not evidence that a suite passed while this article was being written. Fixtures should use stand-in paths and fake token strings, or the test itself becomes a secret-handling failure. A green local run says nothing about queue delay, model quality, or how long a free server option will remain. Those unknowns are why the workflow rechecks terms outside the code instead of baking a quota into the card.

Limitations and who should skip it

The overlap helper treats ranges as closed and inclusive, which simplifies real diff hunks more than a merge tool would. Callers that need renames or binary files should extend the reference and label that extension as their own work. The function trusts caller-supplied spans, so a careless extractor can hide an overlap that should have blocked apply. Shared free servers remain a poor fit for regulated data, production secrets, and source that belongs to a customer.

Those workloads should stay local even when a toy card would have returned a free-server admission. This method assumes the laptop stays the source of truth and that someone can accept a deferral without a broken release. People who need an always-on remote workspace, or who cannot pause an agent on overlap, should not adopt the gate. Operators should reread the current free model access and free server terms, since this article is neither a quota nor a permanence promise.

Place the checker beside the runner that already builds patches, and point the probe at a health endpoint the operator trusts. Keep the freshness ledger on the laptop, and confirm the live terms on the MonkeyCode project page before a real handoff. Only after those checks should a redacted scaffold leave, and only a non-overlapping patch should be allowed to land.

Secrets Stay Home: Splitting Agent Work Between Laptop and Server

Emery Li — Wed, 23 Sep 2026 16:24:02 +0000

On a Tuesday afternoon, a staff engineer watched a local coding agent chew through a refactor on a four-year-old payments service. The laptop stayed warm, the uncommitted tree stayed dirty, and the .env file never left the disk that already held it. Later that night a teammate queued a bulk fixture generator because the laptop could not finish the run before a standup demo. They rsynced the entire working copy to a borrowed cloud box, including the secret file that the daytime session had treated as immovable.

The morning review blamed a missing split between work that must stay local and work allowed to leave. Interactive refactors, dirty trees, and live secrets belong on the laptop that already holds them. Clean batch jobs with an explicit latency budget can use another machine when the laptop is the bottleneck. This article records that split as a manifest, a classifier, and a small test plan rather than as tribal memory.

Secret gravity is not payload mass

Secret gravity describes how hard a path pulls toward the laptop, regardless of CPU need. A .env file, an SSO cookie, a production dump, and an uncommitted patch all have high gravity even when they are tiny. Payload mass describes how expensive the job is to move and to run, including context size, tool fan-out, and wall-clock length. Mixing those two axes is how teams justify copying a whole home directory because a job feels heavy.

A heavy job with high gravity still stays local, or it is reduced until gravity drops. A light job with low gravity can leave even when the laptop is idle, because isolation has value of its own. Public demos this week keep celebrating agents that never leave the user's environment, and that instinct is sound for interactive turns. Batch compute is a different plane, and it should be admitted only after the payload is named.

When a remote plane actually wins

A remote plane wins for clean, repeatable batch work that does not need the dirty tree. Typical winners include fixture generation from a committed spec, a contract suite pinned to a known SHA, and summaries of already-redacted logs. It also wins when the laptop must stay interactive, because a long generation should not steal the editor's cores during review. Offline windows still lose: if the network is gone, the remote plane does not exist, and the local agent must keep a degraded path.

Free model access and a free server option matter only after those gates pass. MonkeyCode offers free model access and a free server option for that second plane, which is worth evaluating after a job is classified as low gravity. Disclosure: This article was prepared as part of MonkeyCode's product outreach. The classifier below remains useful if that product is removed, because residency rules do not depend on a vendor name.

A five-step placement workflow

1. Write a job manifest before any file copy

The operator records intent in a YAML file that lists inputs by path, not by globbing the whole repository. Declared inputs are the only files later eligible for packing. Anything omitted is treated as local-only residue, including editor swap files and ignored secret stores. The manifest is committed or at least reviewed, because an unreviewed pack list is how yesterday's .env travels again.

# job_manifest.yaml
id: fixture-gen-2026-09-23
intent: batch_generate
sha: 7c1e9aa
inputs:
  - specs/fixtures.md
  - contracts/orders.v2.json
outputs:
  - testdata/generated/
max_payload_bytes: 1048576
allow_remote: true
requires_dirty_tree: false
requires_interactive: false

2. Score secret gravity from path patterns

Gravity scoring runs on declared inputs and on the working tree if the job claims it needs dirt. High-gravity matches fail closed; they do not warn and continue. Patterns below are a starting set, not a compliance program, and each team should extend them from its own incident log. A job that needs a high-gravity path must be rewritten to a redacted scaffold before remote placement is considered.

3. Score payload mass from declared inputs only

Mass is the sum of declared file sizes plus a crude estimate of output budget. Scanning the entire git worktree for mass is forbidden, because that scan reintroduces undeclared secrets as "context." If the declared set exceeds the cap, the job is split or it stays local. Mass never overrides gravity: a two-kilobyte secret file still pins the job to the laptop.

4. Apply the fail-closed table

The table in the next section is the policy. Interactive jobs stay local. Jobs that require an uncommitted tree stay local. Jobs that fail gravity checks stay local. Only batch jobs with low gravity, declared inputs, and a known SHA are eligible for a remote plane, including a free server.

5. Copy a scaffold, never a home directory

Eligible jobs pack only listed files into an archive that is hashed before upload. The remote side receives the archive and the SHA, not SSH access to the laptop. Results return as output files that must match the declared output prefix. Anything else is discarded, because surprise paths are how secrets re-enter the story.

Artifact: a classifier the tests can refuse

The script below is a proposal for a local gate. It does not contact a network, and it prints LOCAL or REMOTE_ELIGIBLE on stdout. Operators should run it in a clone that contains dummy secret names, not production material.

#!/usr/bin/env python3
"""Place an agent job: LOCAL or REMOTE_ELIGIBLE. Proposal, not production policy."""
from __future__ import annotations

import argparse
import re
import sys
from pathlib import Path

import yaml

GRAVITY = re.compile(
    r"(?:^|/)("
    r"\\.env(?:\\..*)?|\\.netrc|id_rsa|id_ed25519|"
    r".*\\.(pem|p12|keystore)|secrets?\\.ya?ml|"
    r"credentials\\.json|\\.npmrc|\\.pypirc"
    r")$",
    re.I,
)


def load_manifest(path: Path) -> dict:
    data = yaml.safe_load(path.read_text(encoding="utf-8"))
    if not isinstance(data, dict) or "inputs" not in data:
        raise ValueError("manifest must be a mapping with inputs")
    return data


def gravity_hits(root: Path, rels: list[str]) -> list[str]:
    hits = []
    for rel in rels:
        if GRAVITY.search(rel.replace("\\\\", "/")):
            hits.append(rel)
            continue
        abs_path = (root / rel).resolve()
        if not abs_path.is_file():
            hits.append(f"{rel}:missing")
            continue
        # Tiny content sniff for assignment-like secret lines.
        text = abs_path.read_text(encoding="utf-8", errors="ignore")[:8000]
        if re.search(r"(API_KEY|SECRET|PRIVATE_KEY)\\s*=", text):
            hits.append(f"{rel}:content")
    return hits


def payload_bytes(root: Path, rels: list[str]) -> int:
    total = 0
    for rel in rels:
        abs_path = (root / rel).resolve()
        if abs_path.is_file():
            total += abs_path.stat().st_size
    return total


def place(root: Path, manifest: dict) -> str:
    if manifest.get("requires_interactive"):
        return "LOCAL"
    if manifest.get("requires_dirty_tree"):
        return "LOCAL"
    if not manifest.get("allow_remote"):
        return "LOCAL"
    inputs = list(manifest["inputs"])
    hits = gravity_hits(root, inputs)
    if hits:
        return "LOCAL"
    mass = payload_bytes(root, inputs)
    cap = int(manifest.get("max_payload_bytes", 0))
    if cap and mass > cap:
        return "LOCAL"
    if not manifest.get("sha"):
        return "LOCAL"
    return "REMOTE_ELIGIBLE"


def main() -> int:
    parser = argparse.ArgumentParser()
    parser.add_argument("--root", type=Path, default=Path("."))
    parser.add_argument("--manifest", type=Path, required=True)
    args = parser.parse_args()
    decision = place(args.root, load_manifest(args.manifest))
    print(decision)
    return 0 if decision else 2


if __name__ == "__main__":
    sys.exit(main())

A companion test file pins the fail-closed cases. These tests are meant to run on fixture files in testdata/place_job/, not on a live application repository.

# test_place_job.py
from pathlib import Path

from place_job import place

ROOT = Path("testdata/place_job")


def test_env_file_never_leaves():
    manifest = {
        "inputs": [".env"],
        "allow_remote": True,
        "requires_dirty_tree": False,
        "requires_interactive": False,
        "sha": "abc",
        "max_payload_bytes": 10_000_000,
    }
    assert place(ROOT, manifest) == "LOCAL"


def test_committed_spec_may_leave():
    manifest = {
        "inputs": ["specs/fixtures.md"],
        "allow_remote": True,
        "requires_dirty_tree": False,
        "requires_interactive": False,
        "sha": "7c1e9aa",
        "max_payload_bytes": 10_000_000,
    }
    assert place(ROOT, manifest) == "REMOTE_ELIGIBLE"


def test_interactive_turn_stays():
    manifest = {
        "inputs": ["specs/fixtures.md"],
        "allow_remote": True,
        "requires_dirty_tree": False,
        "requires_interactive": True,
        "sha": "7c1e9aa",
        "max_payload_bytes": 10_000_000,
    }
    assert place(ROOT, manifest) == "LOCAL"

Commands that keep the loop honest look like the following. The pack step is shown as a dry run so a reviewer can read the file list before any copy occurs.

python3 -m pip install pyyaml pytest
pytest -q test_place_job.py
python3 place_job.py --root . --manifest job_manifest.yaml
# Expected on a clean spec job: REMOTE_ELIGIBLE

tar -cvf /tmp/agent-scaffold.tar -T declared_inputs.txt
sha256sum /tmp/agent-scaffold.tar

Decision table

Job class	Secret gravity	Payload mass	Network	Placement
Interactive edit in the current buffer	High by default	Low	Irrelevant	Local laptop
Uncommitted refactor that still compiles	High (dirty tree)	Medium	Irrelevant	Local laptop
Fixture generation from a committed spec	Low if paths are clean	Medium or high	Required	Remote eligible
Contract tests on a pinned SHA	Low	Medium	Required	Remote eligible
Redacted log summary	Low after redaction	High	Required	Remote eligible
Anything touching `.env`, keys, dumps	High	Any	Irrelevant	Local laptop
Same jobs during a network brownout	As above	As above	Absent	Local degraded path

The table is the policy artifact. Teams should print it next to the agent runner, because a model prompt will not remember last week's incident. Remote eligible still means eligible, not mandatory; a quiet laptop may run the batch locally to avoid a round trip.

Measuring the hop without trusting folklore

Latency folklore is how secrets travel: someone claims the laptop is too slow, so the whole tree is copied. Measure the job that is actually proposed, using the declared inputs only. The snippet below is a method, not a published benchmark, and operators must fill times from their own machines.

# method only — record numbers locally; do not paste secrets into the command
/usr/bin/time -f 'local_wall_sec=%e' python3 generate_fixtures.py --spec specs/fixtures.md
# After a classifier pass, time the remote path the same way on the packed archive.
# Compare: pack_sec + upload_sec + remote_wall_sec + download_sec versus local_wall_sec.
# If pack_sec alone exceeds local_wall_sec, the remote plane is not winning.

Three clocks matter, and they are easy to confuse in an incident channel. Local wall clock is the editor-facing cost. Pack and transfer clock is the secrecy boundary, because that is when bytes leave the disk. Remote wall clock is only meaningful after the first two clocks are small and the gravity check is green. If transfer dominates, keep the job local or shrink the scaffold until transfer is boring.

Limitations

The classifier is pattern-based and will miss secrets with novel names, binary blobs, and screenshots of dashboards. It does not prove that a committed spec is free of customer data, and it does not replace a real secret scanner in CI. YAML manifests can be edited to lie; the tests catch fixtures, not a determined bypass. A free server is a convenience plane, not a production SLA, and it should not hold the only copy of generated artifacts.

Word-count and token-count folklore is omitted on purpose, because those figures go stale and are easy to invent. Placement should follow gravity, mass, and measured wall clocks on the job at hand. Teams that need audited isolation, data-processing agreements, or regional pinning must use a controlled runner, not an opportunistic free box.

Who should not use this split

This workflow is a poor fit for regulated datasets that cannot leave the endpoint under any packing story. It is also a poor fit for agents whose only mode is interactive pair editing, because those turns were never candidates for a remote plane. Operators who cannot name a SHA, a declared input list, and an output prefix should keep every byte on the laptop. Treat the remote option as an overflow lane for clean batch work, not as a second home directory.

Label Tool Arguments Before Any Model Hop

Emery Li — Tue, 22 Sep 2026 14:44:00 +0000

On a Tuesday afternoon, an engineer asked a coding agent to tidy a configuration parser that had grown messy. The agent planned a reasonable sequence of file reads, AST rewrites, and unit test commands that looked harmless on the transcript. The third tool call then bundled the adjacent dotenv file into the argument list, because the parser imported environment keys by name. A remote hop at that moment would have shipped live credentials with the request payload.

Local-first routing is often framed as a latency preference, yet the sharper constraint is the secret surface of tool arguments. Model weights can sit on a laptop, a browser tab, or a borrowed server without changing that surface. The hop that matters is the one that serializes tool names and argument values toward any process the engineer does not control. This article treats that serialization as a placement problem rather than a prompt-writing problem.

Tool loops leak more than prompts

Modern agents do not merely complete text; they emit tool calls that a runtime executes against the working tree. The usual wire shape is a JSON object with a tool name, a call identifier, and a map of arguments. Those arguments frequently contain absolute paths, file excerpts, stack traces, session cookies, and database DSNs copied from local config. A system prompt can forbid exfiltration and still lose, because the dispatcher sits below the model's stated intentions.

Offline laptops make this failure mode easy to ignore until the next brownout ends. The moment connectivity returns, a queued tool call may flush toward a remote endpoint with yesterday's secrets still in the payload. Latency compounds the mistake, because a slow remote loop encourages larger batched arguments, which are harder to review by hand. The control that actually works is a gate that inspects arguments before any network write occurs.

Four labels for every argument

Each argument value receives exactly one label before the dispatcher is allowed to run. The labels are secret, dirty-tree, bulky-public, and tiny-public, and they are assigned in that priority order. Secret always wins over the other three, even when the same string also looks like ordinary source code. Dirty-tree wins over the public labels whenever the value overlaps an uncommitted path in the working tree.

Mark secret when the value matches credential shapes, private-key sentinels, or known secret filenames.
Mark dirty-tree when the value names a path with uncommitted hunks, or embeds a diff from those hunks.
Mark bulky-public when the value is large, already committed, and free of credential sentinels.
Mark tiny-public when the value is a short committed identifier, a test name, or a documented flag.

These labels are content labels, not job-level health signals about load, sleep, or path delay. They do not replace hop counters, brownout runbooks, or working-set overflow rules that other checklists already cover. They answer a narrower placement question about whether this particular JSON may leave the machine. The decision table below maps the strongest label on a call onto a residency action.

Strongest label on the call	Local unix-socket loop	Free-server loop	Action
secret	allowed	refused	keep the call on the laptop
dirty-tree	allowed	refused	finish the edit locally
bulky-public	optional	allowed	remote hop may spend CPU
tiny-public	preferred	allowed	local hop is usually cheaper

A reproducible classifier

The following Python module is a proposed gate, not a production security scanner. It uses filename hints, simple regular expressions, and a dirty-path prefix list supplied by the operator of the repo. It deliberately avoids network calls so the same check still functions during an offline afternoon. Engineers should treat matches as fail-closed signals and unmatched text as unknown, not as safe.

# tool_arg_gate.py
from __future__ import annotations

import re
from dataclasses import dataclass
from pathlib import Path
from typing import Any, Iterable, Literal

Label = Literal["secret", "dirty-tree", "bulky-public", "tiny-public", "unknown"]
Action = Literal["local", "remote-ok", "refuse"]

SECRET_NAME_RE = re.compile(
    r"(?i)(pass(word)?|secret|token|api[_-]?key|authorization|private[_-]?key|\.env|id_rsa)"
)
SECRET_VALUE_RE = re.compile(
    r"(?i)(-----BEGIN (RSA |OPENSSH |EC )?PRIVATE KEY-----|"
    r"ghp_[A-Za-z0-9]{20,}|sk-[A-Za-z0-9]{20,}|AKIA[0-9A-Z]{16})"
)
BULKY_CHARS = 8_192

@dataclass(frozen=True)
class Verdict:
    label: Label
    action: Action
    reason: str

def _strings(value: Any) -> Iterable[str]:
    if isinstance(value, str):
        yield value
    elif isinstance(value, dict):
        for key, item in value.items():
            yield str(key)
            yield from _strings(item)
    elif isinstance(value, list):
        for item in value:
            yield from _strings(item)
    elif value is not None:
        yield str(value)

def label_argument(value: Any, dirty_prefixes: tuple[str, ...]) -> Label:
    blob = "\n".join(_strings(value))
    if SECRET_NAME_RE.search(blob) or SECRET_VALUE_RE.search(blob):
        return "secret"
    for prefix in dirty_prefixes:
        if prefix and prefix in blob:
            return "dirty-tree"
    if len(blob) >= BULKY_CHARS:
        return "bulky-public"
    if blob.strip():
        return "tiny-public"
    return "unknown"

def decide(
    tool_name: str,
    arguments: dict[str, Any],
    dirty_prefixes: tuple[str, ...],
    remote_allowlist: frozenset[str],
) -> Verdict:
    labels = [label_argument(v, dirty_prefixes) for v in arguments.values()]
    if "secret" in labels:
        return Verdict("secret", "local", "credential-shaped argument stays on the laptop")
    if "dirty-tree" in labels:
        return Verdict("dirty-tree", "local", "uncommitted path or hunk stays on the laptop")
    if tool_name not in remote_allowlist:
        return Verdict("unknown", "refuse", f"tool {tool_name!r} is not in the remote allowlist")
    if "bulky-public" in labels:
        return Verdict("bulky-public", "remote-ok", "sanitized bulky payload may use a free server")
    return Verdict("tiny-public", "local", "tiny public payload is cheaper on a local socket")

def collect_dirty_prefixes(repo: Path) -> tuple[str, ...]:
    # Proposed helper: a trusted wrapper refreshes this file; the model does not.
    marker = repo / ".agent-dirty-prefixes"
    if not marker.exists():
        return ()
    lines = marker.read_text(encoding="utf-8").splitlines()
    return tuple(line.strip() for line in lines if line.strip())

The helper that fills .agent-dirty-prefixes should run from a trusted Git wrapper, not from the model. A small shell snippet can refresh that file before every agent turn without copying hunks into the gate. The classifier then reads prefixes only, so it does not become a second copy of the working tree. That split keeps uncommitted text on the encrypted laptop disk even when a later hop is allowed.

#!/usr/bin/env bash
set -euo pipefail
repo="$(git rev-parse --show-toplevel)"
git -C "$repo" status --porcelain | awk '{print $NF}' > "$repo/.agent-dirty-prefixes"

Numbered workflow for one agent turn

Refresh .agent-dirty-prefixes from git status --porcelain before the model emits a tool call.
Intercept the JSON tool call in the dispatcher, before sockets other than the local model are opened.
Run decide() with the tool name, the argument map, dirty prefixes, and a tight remote allowlist.
Execute secret and dirty-tree calls against local tools only, speaking to a unix socket or in-process function.
When the verdict is remote-ok, strip argument keys that are not on a public schema, then send the remainder.
Log SHA-256 hashes of argument blobs, tool names, and verdicts, and never log the raw secret strings.

The allowlist should contain tools that cannot read the filesystem, such as a pure formatter or a public documentation lookup. Tools like read_file, run_terminal, and apply_patch stay local even when a remote queue is idle and inexpensive to start. Unknown labels refuse the remote hop outright, and they do not default to a yes. That fail-closed choice is the difference between a gate and a dashboard that merely reports regret.

Latency, offline work, and when a free server wins

A local unix-socket loop usually wins on first-token wait and on offline afternoons, because no DNS or TLS handshake sits on the path. Secrets and dirty trees reinforce that default, since those payloads should not cross a network boundary at all. Interactive refactors of a hot module therefore stay on the laptop even when a remote queue is empty. The laptop also keeps stdout, stderr, and core dumps inside the same encrypted disk as the working tree.

A free server wins after the classifier returns remote-ok and the remaining work is bulky, repetitive, or thermally expensive on the laptop fan. Examples include formatting a committed public corpus, summarizing already-published API docs, or running a long public test matrix that does not need the dirty tree. The extra hop is then a cost the engineer chooses, not a leak the agent stumbles into during a tool loop. Offline laptops should queue those jobs rather than retry later with a wider, less reviewed payload.

Proposed measurement, not an executed benchmark, looks like a stopwatch around the dispatcher rather than a marketing table. Record local socket time, remote round-trip time, argument bytes after redaction, and whether the verdict blocked a hop. Compare those four numbers on the same committed fixture, and never on a live dotenv file from a developer laptop. If remote time is lower and the verdict is remote-ok, the free server is a legitimate placement. If the verdict is local or refuse, ignore the stopwatch entirely and keep the bytes at home.

MonkeyCode is relevant on that remote-ok path because the project offers free model access and a free server option for work that has already been sanitized. Disclosure: This article was prepared as part of MonkeyCode's product outreach. The local gate above does not depend on that option; removing the product still leaves a usable dispatcher policy. The server is a placement target for bulky-public tool loops, not a bypass around the classifier or the dirty-prefix file.

Limitations and who should skip this gate

Regex credential detection is incomplete, and entropy heuristics misfire on minified vendor bundles that look like random keys. The dirty-prefix file can go stale if an editor writes the tree after git status and before the tool call. Encrypted secrets that look like bulky-public text will be mislabeled unless a filename hint catches them first. Teams that handle production customer data should use a reviewed policy engine, not this sample module.

Regulated environments that forbid any remote model, free or not, should keep the remote allowlist empty on every machine. Engineers without a content-addressed copy of committed files should not mark payloads bulky-public, because they cannot prove the bytes are already public. People chasing leaderboard latency numbers will dislike the fail-closed refusals, and they are not the audience for this gate. The module also does not claim to stop a malicious local plugin that reads files outside the dispatcher.

A short test plan

The fixture below is small enough to check in and boring enough to rerun on every change to the dispatcher. Each case states the expected label and the expected action in plain assertions. Failures should break the agent boot path, not emit a warning in a log that nobody reads during a busy afternoon.

# test_tool_arg_gate.py
from tool_arg_gate import decide

DIRTY = ("src/config.py",)
ALLOW = frozenset({"format_public_corpus", "summarize_docs"})

def test_dotenv_stays_local():
    v = decide("read_file", {"path": "/home/dev/project/.env"}, DIRTY, ALLOW)
    assert v.action == "local" and v.label == "secret"

def test_uncommitted_path_stays_local():
    v = decide("apply_patch", {"path": "src/config.py", "diff": "@@"}, DIRTY, ALLOW)
    assert v.action == "local" and v.label == "dirty-tree"

def test_unknown_tool_is_refused():
    v = decide("run_terminal", {"cmd": "ls"}, DIRTY, ALLOW)
    assert v.action == "refuse"

def test_sanitized_docs_may_go_remote():
    docs = "A" * 9000
    v = decide("summarize_docs", {"text": docs}, DIRTY, ALLOW)
    assert v.action == "remote-ok" and v.label == "bulky-public"

Run the tests with python -m pytest test_tool_arg_gate.py -q after placing both files on PYTHONPATH. Replace the synthetic AAAA... blob with a committed public document if the team already has one in-tree. Do not paste live tokens into the test file to exercise SECRET_VALUE_RE; the private-key sentinel string is enough. Green tests mean the dispatcher policy is still fail-closed, not that the regexes found every secret on earth.

The Tuesday dotenv incident is a placement bug, not a model-quality bug in the transcript. Label the arguments, keep secret and dirty payloads on the laptop, and spend a free-server hop only on bulky-public work. Readers who already wrap their dispatcher can drop the classifier in without changing prompts or system messages. Those who want a remote target for the remote-ok branch can try MonkeyCode's free server after the gate, not before it.

Count the Hops Before You Spill Agent Work

Emery Li — Mon, 21 Sep 2026 12:58:20 +0000

A mid-afternoon refactor on a payments service looked simple until the agent started walking the repository one search at a time. The first rg finished locally in forty milliseconds, but the next step waited on a remote hop of two hundred milliseconds. Twelve more searches, two test invocations, and one format pass stacked those hops into a multi-second pause that felt like a hang. A dotenv file in the same tree made a naive move onto a bigger remote box unsafe for that session.

Serial tool calls punish remote placement

Local-first agent loops are not slow because local processors cannot search an ordinary application tree. They feel slow when every observation waits on a model that lives one network round trip from the working copy. Chatty sessions issue many short tool calls in sequence, so latency adds in series instead of hiding under one compile. A remote placement that looks cheaper on tokens can still lose wall-clock time once hop counts climb into double digits.

Interactive loops also keep secrets in prompt context without anyone intending to export those values off the laptop. Path names, stack traces, and failed test output often carry hostnames, tokens, and customer identifiers from local fixtures. Spilling that transcript to a free server to chase speed trades a latency problem for an egress problem that is harder to unwind. Offline windows make the same trade worse, because a job that already left the laptop cannot continue when the commute tunnel drops.

Three vetoes that are not one score

Latency, secret residency, and offline continuity should not be mashed into a single heuristic score for placement. A low round-trip time does not authorize shipping a private key material file to any remote worker. A clean secret scan does not help if the laptop is about to close the lid on a train. A stable network does not justify remote placement when the session is a tight loop over a dirty tree.

The table below is a proposed decision aid, not a production policy and not a measured benchmark from a live fleet.

Shape of work	Typical hop count	Secrets in tree	Link state	Placement
Chatty search and test loop	8+ serial tools	present or unknown	any	stay local
Chatty loop, fixtures only	8+ serial tools	none found	online	stay local anyway
One-shot lint or format	1–2 tools	none found	online	local preferred
Long test or compile batch	1–3 coarse steps	none found	online and stable	free server may win
Long batch with mixed files	any	secret-shaped hits	any	stay local
Any job during a drop	any	any	offline or brownout	stay local

The chatty rows are the ones teams skip when a bigger remote box looks tempting on paper. Chatty loops stay local even when the secret scanner is quiet, because the round-trip tax dominates wall-clock time. The free-server win is the coarse batch that does not need a secret and does not need a reply between every file touch. Remote almost never wins the millisecond comparison on serial hops; it wins when the job is coarse enough that CPU, not chatter, dominates.

When a job is batch-shaped, secret-clean, and online, a free server can absorb a heavy compile without holding the interactive loop hostage. Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode's free model access and free server option fit that batch path only after the hop gate says the working set may leave. Readers who already trace local agent sessions can point the same gate at that free-server path and keep the chatty loop on the laptop.

A proposed hop-budget artifact

The script below is an unexecuted example for a laptop-side preflight before any agent placement change. It reads a JSONL trace of tool calls, applies a configured round-trip tax, and scans listed paths for crude secret shapes. It then prints LOCAL_HOLD or SERVER_BURST so a wrapper script can fail closed without a human staring at the spinner. Operators should treat the numbers as inputs they measure on their own network, not as published product claims.

#!/usr/bin/env python3
"""hop_gate.py — proposed preflight, not a production DLP control."""
from __future__ import annotations

import argparse
import json
import re
import socket
import sys
from pathlib import Path

SECRET_SHAPES = (
    re.compile(r"AKIA[0-9A-Z]{16}"),
    re.compile(r"-----BEGIN (?:RSA )?PRIVATE KEY-----"),
    re.compile(r"(?i)(api[_-]?key|secret|token)\s*[:=]\s*\S{12,}"),
)


def load_trace(path: Path) -> list[dict]:
    rows = []
    for line in path.read_text(encoding="utf-8").splitlines():
        line = line.strip()
        if line:
            rows.append(json.loads(line))
    return rows


def hop_tax_ms(rows: list[dict], rtt_ms: float) -> tuple[float, float, int]:
    local = sum(float(r.get("local_ms", 0)) for r in rows)
    hops = len(rows)
    remote = local + hops * rtt_ms
    return local, remote, hops


def secret_hits(roots: list[Path]) -> list[str]:
    hits: list[str] = []
    skip = {".git", "node_modules", "dist", ".venv"}
    for root in roots:
        candidates = [root] if root.is_file() else [
            p for p in root.rglob("*")
            if p.is_file() and p.stat().st_size < 1_000_000
        ]
        for path in candidates:
            if any(part in skip for part in path.parts):
                continue
            try:
                text = path.read_text(encoding="utf-8", errors="ignore")
            except OSError:
                continue
            if any(rx.search(text) for rx in SECRET_SHAPES):
                hits.append(str(path))
    return hits


def link_is_up(host: str, port: int, timeout: float) -> bool:
    try:
        with socket.create_connection((host, port), timeout=timeout):
            return True
    except OSError:
        return False


def decide(hops: int, secrets: list[str], online: bool, chatty_at: int) -> str:
    # Gray zone (4..chatty_at-1) stays local so export is never the default.
    if secrets or not online or hops >= chatty_at:
        return "LOCAL_HOLD"
    if hops <= 3:
        return "SERVER_BURST"
    return "LOCAL_HOLD"


def main() -> int:
    p = argparse.ArgumentParser(description="Proposed hop gate for local-first agents")
    p.add_argument("--trace", type=Path, required=True)
    p.add_argument("--rtt-ms", type=float, default=180.0)
    p.add_argument("--scan", type=Path, nargs="*", default=[])
    p.add_argument("--probe-host", default="example.com")
    p.add_argument("--probe-port", type=int, default=443)
    p.add_argument("--chatty-at", type=int, default=8)
    args = p.parse_args()
    rows = load_trace(args.trace)
    local_ms, remote_ms, hops = hop_tax_ms(rows, args.rtt_ms)
    secrets = secret_hits(args.scan) if args.scan else []
    online = link_is_up(args.probe_host, args.probe_port, timeout=1.5)
    decision = decide(hops, secrets, online, args.chatty_at)
    json.dump(
        {
            "hops": hops,
            "local_ms": round(local_ms, 1),
            "remote_ms_estimate": round(remote_ms, 1),
            "rtt_ms": args.rtt_ms,
            "secret_hits": secrets,
            "online": online,
            "decision": decision,
        },
        sys.stdout,
        indent=2,
    )
    sys.stdout.write("\n")
    return 0 if decision == "SERVER_BURST" else 2


if __name__ == "__main__":
    raise SystemExit(main())

A tiny trace file makes the tax visible without pretending to be a published benchmark from a vendor lab. Save it as session.jsonl beside the script and keep payload bodies out of the log.

{"tool": "rg", "local_ms": 42}
{"tool": "rg", "local_ms": 38}
{"tool": "rg", "local_ms": 51}
{"tool": "pytest", "local_ms": 860}
{"tool": "rg", "local_ms": 40}
{"tool": "rg", "local_ms": 33}
{"tool": "rg", "local_ms": 47}
{"tool": "ruff", "local_ms": 120}
{"tool": "rg", "local_ms": 36}
{"tool": "pytest", "local_ms": 910}

python3 hop_gate.py --trace session.jsonl --rtt-ms 180 --scan . --chatty-at 8; echo exit:$?

Ten serial tools at one hundred eighty milliseconds of round-trip tax add eighteen hundred milliseconds before remote compute starts. The local column stays near two seconds of tool time, while the remote estimate crosses three and a half seconds on hops alone. That gap is why chatty loops stay on the laptop even when a free server would win a single long compile. A wrapper can treat a non-zero exit as LOCAL_HOLD and refuse to start a remote session.

Sessions with four to seven hops stay local in this proposed gate so the gray zone does not silently export a working tree. The printed remote_ms_estimate remains a teaching number: it shows the tax, and it does not override a secret hit or an offline probe. Operators should replace the default one hundred eighty milliseconds with a ping they took on the same link the laptop will use.

A six-step workflow

The sequence below is a concrete workflow, not a claim that any particular team has already shipped it to production.

Record one representative session as JSONL with each tool name and locally measured duration, and never log file contents or environment values.
Measure round-trip time to the candidate remote endpoint from the same network the laptop will actually use during the job. Office Ethernet, home Wi-Fi, and a phone tether disagree enough to change the hop gate outcome.
Run the hop gate against the working tree paths the agent would read, including dotenv files, fixture dumps, and leftover snapshots.
Treat any secret-shaped hit as a hard LOCAL_HOLD, even if the remote estimate looks faster on paper than the local column. Regex patterns are a tripwire for obvious material and are not a clearance to export a repository.
If the gate returns SERVER_BURST, send only a secret-stripped scaffold and keep the dirty tree on the laptop until a reviewable patch returns. Interactive follow-up turns remain local after the batch lands so the hop tax does not return through chat.
Re-run the same batch locally as a control when time allows, and keep both traces beside the decision for the next session.

Step five is where a free server earns its keep on coarse work rather than on chatty search loops. Coarse jobs with few hops can overlap compile and test on spare remote capacity while the laptop stays responsive for review. Batch reasoning belongs off-laptop only when the scaffold that leaves the machine has already failed closed on secrets and hop count.

Limitations, and who should skip this gate

The script estimates serial round-trip tax and does not model queueing, thermal throttling, or disk cache effects on either side. It will over-punish a remote job that batches tool calls, and it will under-punish a local model that swaps on a small laptop. The secret patterns miss cloud tokens that do not look like AWS keys, and they false-positive on docs that quote a PEM header. Missing traces, skipped scans, and ambiguous probes must fail closed, which means the working set stays on the laptop.

This approach is the wrong control for regulated repositories that need real DLP, allowlists, and durable audit logs. It is also the wrong control for air-gapped shops that already forbid egress, because the interesting placement decision never arises. Teams that pair through an agent on every keystroke should stay local regardless of a SERVER_BURST hint from the script. Free model access and a free server option are availability claims, not promises of capacity, permanence, or a particular model catalog. Operators should verify current limits in the product's own documentation before scheduling overnight batches around those options.

Hop count is a practical proxy for whether an agent session is a conversation with the tree or a batch thrown over the wall. Conversations stay local because each reply pays the network, and secrets in the working copy never get a chance to ride along. Batches may leave only after latency, residency, and offline vetoes all pass, which is a narrower win than a slogan about remote speed.

Keep Agent Work Local During a Network Brownout

Emery Li — Sun, 20 Sep 2026 11:06:40 +0000

A backend engineer boarded a regional train with a half-finished refactor and a local coding agent still running. The laptop remained warm, the working tree stayed dirty, and the cellular hop dropped packets every few seconds. The agent had a spill rule that moved heavy synthesis to a remote machine whenever local tokens felt slow. Mid-tunnel, that rule uploaded a truncated prompt, waited on retries, and returned a patch that no longer matched the files on disk.

That failure was not a model quality problem and it was not a missing unit test. It was a placement error that treated a brownout as spare remote capacity rather than as a damaged hop. Local-first agent work already holds the editor buffer, the test cache, and the secret material on the laptop. Relocating a turn across an unstable hop taxes latency, leaks partial context, and breaks offline continuity without buying useful compute.

The cost of relocating a turn on a flaky hop

A coding agent turn is a loop of reads, tool calls, and patches rather than a single completion. Each tool call on a remote worker pays wide-area latency twice, once outbound and once for the result. Packet loss converts those round trips into retries, and retries often resend prompts that now disagree with a tree that kept changing locally. Secrets in environment files, SSH keys, and session cookies should never ride that retry path, even toward a complimentary remote runner.

Offline work is the other constraint that remote spill quietly destroys during ordinary travel and building Wi-Fi. Elevators, rural stretches, and airplane mode still allow compilation, tests, and local model steps if no remote session starts. A free remote server wins only after the link is stable, the job is compute-heavy, and the payload has been stripped of secret-adjacent files. Until those three conditions hold together, the laptop should remain the only runtime for the agent loop.

Three connectivity classes

Teams can classify the current hop before any spill decision, using measurements anyone can reproduce on a laptop. The classes below are operational labels for placement, and they map onto latency, secrets, and offline behavior. They are not product tiers, and they should be computed immediately before a job is allowed to leave the machine.

OFFLINE — name resolution fails, or several probes in a row time out with no useful payload.
BROWNOUT — some probes succeed, but loss, jitter, or stall time would truncate a multi-tool agent turn.
STABLE — consecutive probes succeed within a local budget, with jitter small enough for a full remote turn.

OFFLINE and BROWNOUT keep the agent on the machine that already has the working set. STABLE is permission to consider a free server for bulky, secret-free work, not an order to move every completion off the laptop.

A reproducible link-class probe

The following workflow stays on the developer machine and writes a small JSON record the agent policy can read. It does not require a vendor SDK, and it fails closed when the probe itself cannot run.

Save the script in the repository as scripts/link_class.py so every clone measures the hop the same way.
Choose a boring probe target that is not the agent vendor, such as a public resolver or an internal status URL.
Run a short burst of timed probes and record success ratio, mean delay, and delay spread for the hop.
Map those three numbers onto OFFLINE, BROWNOUT, or STABLE with thresholds the team can argue about in review.
Point the agent spill gate at the JSON file, and refuse relocation unless the recorded class is STABLE.

The script below is a labeled example for a POSIX laptop and should be treated as a starting point. Operators should tune thresholds against their own commute, office wireless, and VPN rather than copying constants blindly.

#!/usr/bin/env python3
"""Classify the current hop for local-first agent placement.

Labeled example: thresholds are starting points, not production SLOs.
"""
from __future__ import annotations

import argparse
import json
import socket
import statistics
import time
from pathlib import Path


def probe_once(host: str, port: int, timeout: float) -> float | None:
    started = time.perf_counter()
    try:
        with socket.create_connection((host, port), timeout=timeout):
            return (time.perf_counter() - started) * 1000.0
    except OSError:
        return None


def classify(samples: list[float | None], timeout_ms: float) -> str:
    ok = [s for s in samples if s is not None]
    if not ok:
        return "OFFLINE"
    loss = 1.0 - (len(ok) / len(samples))
    mean = statistics.fmean(ok)
    jitter = statistics.pstdev(ok) if len(ok) > 1 else 0.0
    if loss >= 0.25 or mean > (0.6 * timeout_ms) or jitter > 80.0:
        return "BROWNOUT"
    return "STABLE"


def main() -> None:
    parser = argparse.ArgumentParser()
    parser.add_argument("--host", default="1.1.1.1")
    parser.add_argument("--port", type=int, default=443)
    parser.add_argument("--samples", type=int, default=8)
    parser.add_argument("--timeout", type=float, default=1.5)
    parser.add_argument("--out", default=".agent/link_class.json")
    args = parser.parse_args()

    samples = [
        probe_once(args.host, args.port, args.timeout) for _ in range(args.samples)
    ]
    cls = classify(samples, args.timeout * 1000.0)
    ok = [s for s in samples if s is not None]
    record = {
        "class": cls,
        "successes": len(ok),
        "attempts": len(samples),
        "mean_ms": round(statistics.fmean(ok), 2) if ok else None,
        "jitter_ms": round(statistics.pstdev(ok), 2) if len(ok) > 1 else None,
        "allow_remote_spill": cls == "STABLE",
        "keep_secrets_local": True,
    }
    out = Path(args.out)
    out.parent.mkdir(parents=True, exist_ok=True)
    out.write_text(json.dumps(record, indent=2) + "\n", encoding="utf-8")
    print(json.dumps(record, indent=2))


if __name__ == "__main__":
    main()

A wrapper in the agent bootstrap keeps the measurement close to the moment of placement rather than using a stale class.

#!/usr/bin/env bash
set -euo pipefail
python3 scripts/link_class.py --out .agent/link_class.json
python3 - <<'PY'
import json, sys
from pathlib import Path
rec = json.loads(Path(".agent/link_class.json").read_text())
if rec["class"] != "STABLE":
    print(f"stay local: link class is {rec['class']}", file=sys.stderr)
    sys.exit(10)
print("link class STABLE; remote spill is eligible for secret-free jobs")
PY

Exit code ten is a policy miss, not a crash, so wrappers can skip remote dispatch without failing local tests. A small unit test locks the classification rules so threshold tweaks cannot silently reopen remote spill.

# tests/test_link_class.py
"""Labeled example tests for the brownout classifier."""
from link_class import classify


def test_all_failures_are_offline():
    assert classify([None, None, None, None], timeout_ms=1500) == "OFFLINE"


def test_high_loss_is_brownout():
    samples = [40.0, None, 45.0, None, 42.0, None, 41.0, None]
    assert classify(samples, timeout_ms=1500) == "BROWNOUT"


def test_tight_cluster_is_stable():
    samples = [18.0, 19.0, 17.0, 20.0, 18.5, 19.5, 18.0, 19.0]
    assert classify(samples, timeout_ms=1500) == "STABLE"

PYTHONPATH=scripts pytest tests/test_link_class.py -q

Placement table after the class is known

Once the JSON record exists, placement becomes a table that reviewers can demand beside probe output. Latency, secret residency, and offline continuity stay explicit instead of hiding inside a remote SDK default.

Link class	Interactive edits	Long test or build	Secret files	Offline expectation
OFFLINE	Local agent only	Local agent only	Never leave disk	Continue; queue remote work
BROWNOUT	Local agent only	Local agent only	Never leave disk	Continue; do not open a remote session
STABLE	Prefer local for tight loops	Free server may win	Still local or redacted	Remote allowed for bulky jobs

Interactive turns remain on the laptop even on a STABLE link because keystroke-coupled tool calls are latency sensitive. A free server becomes interesting for long, parallel, secret-free jobs after the hop has earned that class. The table belongs in review next to the JSON record, so spill decisions leave an auditable trail.

When the free server is the right runtime

Local-first policy is not a vow to ignore spare remote capacity when the laptop is already thermally saturated. A STABLE hop plus a job that thrashes memory, fans, or battery is a legitimate case for remote execution. Useful examples include a full integration suite, documentation synthesis over committed trees, and batch refactors without editor round trips. Those jobs still ship a scaffold without environment files, credentials, or uncommitted secrets, which keeps residency honest.

Limitations

The socket probe measures TCP reachability, not application throughput, TLS interception, or a captive portal page. A hotel network that accepts a TCP connect and then injects a login page can still look STABLE to this script. VPN split tunnels can mark a public address stable while the intended runner remains unreachable behind another interface. Production gates should probe the actual spill endpoint, and fiber-tuned thresholds will misclassify cellular handoffs during travel.

The script does not observe battery level, thermal throttle, or a dirty working tree on disk. The classifier also cannot see truncated prompts after a remote session has already started on a fading hop. A job that begins STABLE and then enters a tunnel still needs a cancel-and-resume path on the laptop. Without that path, brownout placement only helps at job start and cannot repair a session already in flight.

Who should not use this gate

Engineers on wired office networks with a single always-on runner gain little from eight extra probes per turn. Safety-critical systems that already forbid any remote model should not add a STABLE branch that reintroduces egress. Teams without a secret-redaction step should keep every agent turn local, because a green class does not sanitize payloads. If the local machine cannot run tests at all, fixing the local toolchain matters more than classifying the hop.

The train story ends the same way most brownouts end for people who keep a working toolchain on the laptop. The useful work was the local compile and the tests that never needed a remote hop to finish. Classify the link, keep secrets on disk, and relocate an agent job only when the hop is STABLE and the job is actually large.

Disclosure: This article was prepared as part of MonkeyCode's product outreach.

MonkeyCode provides free models that can run this workflow.

Keep the Dirty Tree Local: A Spill Gate for Uncommitted Agent Work

Emery Li — Sat, 19 Sep 2026 09:24:04 +0000

The laptop fans rose while the payment service tests were still red on Friday afternoon. An unfinished refactor sat across six files, plus a .env.local that still held a sandbox key. Debug logging had printed a handful of customer identifiers into a scratch JSON file meant for deletion. A coding agent then offered to finish the remaining methods remotely because local inference felt painfully slow.

That offer looked reasonable if latency were the only signal that mattered for agent placement. Uncommitted work, however, mixes secrets, unpublished intent, and half-reverted experiments in one working tree. A free remote server can help with clean, committed slices when the laptop cannot keep up. It should not inherit a dirty tree that the developer still planned to rewrite or discard.

Unpublished Intent Is a Placement Bug

Local-first agent setups already weigh latency, secret residency, and offline recovery when work leaves the laptop. Dirty trees add a fourth failure mode that those debates often skip: unpublished developer intent. The working copy contains lines the author has not accepted, including debug prints and aborted spikes. Remote models treat every received byte as authorized context, which is the wrong default for scratch.

Scratch files, local overrides, and abandoned experiments often sit beside the real source in one directory. Offline recovery also suffers because a failed spill can split uncommitted state across two machines. The practical response is a spill gate that inspects git status before any prompt context leaves. The gate fails closed, so unknown paths stay local until a human promotes them into a committed slice.

Decision Table

Dirty path class	Examples	Local-first action	Free server allowed
secret	`.env.local`, `id_rsa`, `*.pem`	keep bytes on disk; never attach	no
unpublished	scratch JSON, WIP notes, commented spikes	keep on the laptop; optional local model	no
generated	`dist/`, coverage HTML, compiled wasm	rebuild after the patch; do not upload	no
source, uncommitted	`src/*/.py` with local edits	commit or cut a redacted patch first	only after commit or explicit promote
source, clean HEAD	committed module with tests	laptop first; spill if thermal or offline	yes, scaffold only

The table above is a policy artifact rather than a benchmark of model quality or server speed. Teams should extend the secret and unpublished patterns until they match the real repository layout.

Workflow: Fail Closed Before Any Spill

The following five steps wrap an agent turn as a proposed control rather than a measured production system. Each step uses ordinary git commands so a developer can reproduce the gate on a throwaway checkout. The control refuses remote context until classification finishes and the working tree matches a clean HEAD.

1. Snapshot the tree

Record branch, HEAD, and every path git considers dirty before the agent receives a prompt.

mkdir -p .agent
{
  echo "branch=$(git rev-parse --abbrev-ref HEAD)"
  echo "head=$(git rev-parse HEAD)"
  echo "user.email=$(git config user.email)"
  git status --porcelain=v1 -uall
} > .agent/tree.snap
git diff --binary > .agent/unstaged.patch
git diff --binary --cached > .agent/staged.patch

Untracked files belong in the snapshot because agents create env overrides and debug dumps without staging them. Nested submodules should be listed separately so a dirty child repo cannot hide under a clean parent. The snapshot file later proves whether HEAD moved while a remote worker was still rewriting a file.

2. Classify each dirty path

Run a small classifier that labels paths before any model call is allowed to see file bytes. The implementation below is proposed example code, and operators should review it before installing a hook.

#!/usr/bin/env python3
"""spill_gate.py — proposed local classifier for agent spill decisions."""
from __future__ import annotations

import re
import subprocess
import sys
from pathlib import Path

SECRET_PATTERNS = [
    re.compile(r"(^|/)\.env"),
    re.compile(r"(^|/)\.env\.[^/]+$"),
    re.compile(r"id_rsa$"),
    re.compile(r"\.pem$"),
    re.compile(r"\.p12$"),
    re.compile(r"credentials\.json$"),
    re.compile(r"secret", re.I),
]
GENERATED_PATTERNS = [
    re.compile(r"(^|/)dist/"),
    re.compile(r"(^|/)build/"),
    re.compile(r"coverage"),
    re.compile(r"\.wasm$"),
]
UNPUBLISHED_PATTERNS = [
    re.compile(r"scratch", re.I),
    re.compile(r"wip", re.I),
    re.compile(r"dump", re.I),
    re.compile(r"\.local$"),
]
SECRET_BYTES = [
    re.compile(rb"API_KEY\s*="),
    re.compile(rb"BEGIN (RSA |OPENSSH )?PRIVATE KEY"),
    re.compile(rb"AKIA[0-9A-Z]{16}"),
]


def porcelain() -> list[tuple[str, str]]:
    out = subprocess.check_output(
        ["git", "status", "--porcelain=v1", "-uall"], text=True
    )
    rows = []
    for line in out.splitlines():
        if not line.strip():
            continue
        status, path = line[:2], line[3:]
        if " -> " in path:
            path = path.split(" -> ", 1)[1]
        rows.append((status, path))
    return rows


def label(path: str) -> str:
    if any(p.search(path) for p in SECRET_PATTERNS):
        return "secret"
    if any(p.search(path) for p in GENERATED_PATTERNS):
        return "generated"
    if any(p.search(path) for p in UNPUBLISHED_PATTERNS):
        return "unpublished"
    try:
        data = Path(path).read_bytes()[:65536]
    except OSError:
        return "source"
    if any(p.search(data) for p in SECRET_BYTES):
        return "secret"
    return "source"


def main() -> int:
    if subprocess.call(
        ["git", "rev-parse", "--is-inside-work-tree"],
        stdout=subprocess.DEVNULL,
    ):
        print("spill_gate: not a git work tree; refuse spill", file=sys.stderr)
        return 2
    blocked = []
    allowed_local = []
    for status, path in porcelain():
        kind = label(path)
        print(f"{status} {kind:12} {path}")
        if kind in {"secret", "unpublished", "generated"}:
            blocked.append(path)
        else:
            allowed_local.append(path)
    if blocked:
        print("FAIL_CLOSED: dirty non-source paths stay on the laptop", file=sys.stderr)
        print("blocked=" + ",".join(blocked), file=sys.stderr)
        return 1
    if allowed_local:
        print("LOCAL_ONLY_UNTIL_COMMIT: source edits exist; do not spill raw tree")
        return 1
    print("CLEAN_TREE: free-server spill may be considered")
    return 0


if __name__ == "__main__":
    raise SystemExit(main())

The script exits with status one whenever the tree is dirty, including ordinary uncommitted source edits. That refusal is intentional, because uncommitted source still encodes unpublished intent the author may revert. A later promote step can cut a committed patch and then reopen the spill path for batch work.

3. Keep interactive repair on the laptop

Latency for a single file edit is usually dominated by editor round trips rather than raw model throughput. Secret-shaped strings and unpublished dumps should be rewritten locally, where disk encryption and history still apply. A local model can propose a patch, but the patch lands through git apply --check on the laptop. The free server is not invited to this interactive turn, even when remote tokens would appear cheaper.

python3 spill_gate.py
# non-zero status: stay local
git apply --check .agent/proposed.local.patch
git apply .agent/proposed.local.patch
pytest -q tests/test_spill_gate.py

4. Promote a clean slice only after commit

When the laptop is thermally throttled or the job is a long batch rewrite, a free server can win. The author first commits the accepted source, drops secrets from the archive, and exports a narrow scaffold. The scaffold contains committed tests and modules only, with no working-tree residue and no local overrides.

git add src/payments/ledger.py tests/test_ledger.py
git commit -m "Accept local ledger refactor before any remote spill"
python3 spill_gate.py  # must print CLEAN_TREE
git archive --format=tar HEAD src/payments tests/test_ledger.py > /tmp/scaffold.tar
# attach /tmp/scaffold.tar only; never tar the dirty worktree

A thin wrapper makes the same rule harder to skip during an impatient Friday turn.

#!/usr/bin/env bash
# agent-wrap.sh — refuse remote spill unless spill_gate exits 0
set -euo pipefail
python3 spill_gate.py
mode=${1:-local}
if [[ "$mode" == "remote" ]]; then
  echo "remote spill permitted for clean HEAD $(git rev-parse --short HEAD)"
else
  echo "running local turn"
fi

5. Re-import remote output as a patch, not a tree

Remote output should return as a unified diff against the same HEAD the snapshot recorded earlier. The laptop applies the diff, runs the test suite, and refuses the change if HEAD moved underneath. This preserves offline recovery, because a dead network still leaves the committed local tree as truth. Divergent uncommitted copies on two machines are the failure mode this step exists to prevent.

test "$(git rev-parse HEAD)" = "$(awk -F= '/^head=/{print $2}' .agent/tree.snap)"
git apply --check /tmp/remote.proposed.patch
git apply /tmp/remote.proposed.patch
pytest -q

A Tiny Test Plan

The classifier should be tested against a throwaway repository so policy does not depend on production history. The test below is executable documentation and does not claim live traffic numbers or latency percentiles.

# tests/test_spill_gate.py
import subprocess
from pathlib import Path

import spill_gate


def init_repo(tmp_path: Path) -> None:
    subprocess.check_call(["git", "init", "-q"], cwd=tmp_path)
    subprocess.check_call(["git", "config", "user.email", "dev@example.com"], cwd=tmp_path)
    subprocess.check_call(["git", "config", "user.name", "Dev"], cwd=tmp_path)
    (tmp_path / "src").mkdir()
    (tmp_path / "src" / "app.py").write_text("print('ok')\n")
    subprocess.check_call(["git", "add", "src/app.py"], cwd=tmp_path)
    subprocess.check_call(["git", "commit", "-qm", "init"], cwd=tmp_path)


def test_env_local_blocks(tmp_path, monkeypatch):
    init_repo(tmp_path)
    (tmp_path / ".env.local").write_text("SANDBOX_KEY=example\n")
    monkeypatch.chdir(tmp_path)
    assert spill_gate.main() == 1


def test_scratch_dump_blocks(tmp_path, monkeypatch):
    init_repo(tmp_path)
    (tmp_path / "customers.dump.json").write_text("[]\n")
    monkeypatch.chdir(tmp_path)
    assert spill_gate.main() == 1


def test_uncommitted_source_stays_local(tmp_path, monkeypatch):
    init_repo(tmp_path)
    (tmp_path / "src" / "app.py").write_text("print('wip')\n")
    monkeypatch.chdir(tmp_path)
    assert spill_gate.main() == 1


def test_clean_tree_allows_consideration(tmp_path, monkeypatch):
    init_repo(tmp_path)
    monkeypatch.chdir(tmp_path)
    assert spill_gate.main() == 0

Run those tests with pytest from a checkout that also contains the classifier module beside the test file. A failing test here is a placement bug, not a complaint about model quality or server quota.

Latency, Secrets, Offline, and the Rare Remote Win

Interactive repair still belongs on the laptop because round-trip latency dominates small edits more than throughput. Secret-shaped files never leave disk, which also covers the offline case when a cafe network drops mid-turn. The free server wins only when those three constraints are already satisfied and remaining work is a committed batch. Thermal throttle plus a clean HEAD is the usual pair that justifies moving generation off the laptop.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. Its free model access and free server option can run that clean committed slice while secrets stay on the laptop. Removing that product sentence leaves the git classifier, the decision table, and the test plan intact.

Limitations and Who Should Skip This

The gate assumes a single developer, a git work tree, and a fail-closed policy that can delay remote help. Pairing sessions that must share uncommitted buffers over a remote desktop should not use this control. Generated-code monorepos with intentional dirty artifacts will need a custom allowlist, or every turn blocks. Byte scanners miss encrypted secret stores and binary keychains, so this script does not replace dedicated scanning.

The gate also cannot prove that a committed file is free of customer data or screenshots. It only proves the working tree matches the policy classes listed in the decision table. Teams under regulated data rules should keep customer dumps out of the repository entirely, local or remote. The approach fails when the agent edits ignored files that git status never reports to the classifier.

Those ignored paths need an explicit inventory besides git, or the placement decision is incomplete. Until that inventory exists, the honest placement decision is to keep the agent turn on the laptop. Operators should not treat a green spill_gate as approval to upload build directories or docker volume mounts.

Closing

Uncommitted buffers are not a latency optimization problem; they are a residency problem with a git-shaped interface. Measure dirtiness first, keep secrets and scratch on the laptop, and promote a committed scaffold only afterward. The machine should lose the job only when thermal, battery, or batch length make local completion unrealistic. Teams that already wrap agent turns can drop the classifier in front of the next remote worker.

Fail Closed on Path Delay: A Repo Deadline for Local-First Agents

Emery Li — Fri, 18 Sep 2026 07:21:53 +0000

On a Tuesday commute, a backend engineer opened a failing helper that parsed inbound webhook timestamps. The local agent had already listed the test file, sketched a patch, and paused for one confirmation. The laptop stayed on battery while the office VPN dropped twice during a tunnel renewal. A default in the agent config then spilled the next generation call to a remote endpoint. The editor caret froze for almost two seconds because handshake and queue wait had already spent the interactive budget.

That stall is a placement failure rather than a model-quality failure, and it shows up whenever leftover tokens become the score. Interactive agent work dies on wall clock, not on unused context that a remote runtime still happens to offer. This article records a repo deadline file, a path-delay probe, and a closed default that keep secrets and tight turns on the laptop. A free server still participates when batch work actually wins on heat, battery, and a relaxed deadline.

Token surplus is the wrong score

Teams often treat unused context as waste, and that habit pushes generation off the laptop as soon as any remote option appears. The user-facing constraint is different, because an interactive turn has a deadline the caret will not forgive. A three-line patch and an overnight refactor do not share that deadline, even when both consume tokens from the same pool. Scoring the work on surplus capacity hides the freeze that the developer actually felt.

Recent public threads have argued about casual generation versus engineering discipline, and the useful part of that argument is measurement. Placement is engineering when the repo publishes a deadline, a secret glob, and a residency decision that a later incident review can read. Casual generation skips those files and then blames the model for a freeze the network already caused. Wall clock, secret residency, and offline behavior have to be written down before any remote default is flipped.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode's free model access and free server option belong in the batch class after secrets are stripped, not in the inline path that must fail closed on path delay.

Four clocks in one turn

An agent turn is the interval from the last developer input to the first trustworthy token or tool result. Four clocks consume that interval, and generation is only the third. Local prework covers file reads, grep, secret redaction, and prompt assembly on the laptop. Path delay covers DNS, TLS, queue wait, and the return path once the call leaves the machine.

Generation covers sampled tokens on whatever runtime accepted the prompt. Local postwork covers patch application, tests, and the next tool call in the same loop. Interactive placement should fail closed when path delay plus generation exceeds the remaining deadline after prework. Batch placement may ignore the caret deadline and optimize for throughput, thermal headroom, or remaining battery. Offline placement ignores the remote clock entirely and queues compacted work on disk until the network returns.

A deadline file in the repository

Label the following schema as a proposal, not a vendor SLA. Commit turn_deadline.json next to the agent config so every surface reads the same numbers. Reviewers can treat that file like linter config, because a silent remote default is harder to audit than a published deadline.

{
  "surfaces": {
    "inline": { "class": "interactive", "deadline_ms": 400 },
    "sidebar": { "class": "tool-loop", "deadline_ms": 1500 },
    "nightly": { "class": "batch", "deadline_ms": 60000 }
  },
  "secret_globs": [".env", "**/*.pem", "fixtures/customers/**"],
  "offline_policy": "local_queue",
  "fail_closed_on_path_delay": true
}

Let D be the surface deadline in milliseconds, P the measured prework, R the measured path delay, and G a conservative generation estimate. Keep the job local when the turn is interactive and R is not zero. Keep it local when P + R + G exceeds D for tool-loop work. Consider a free server only when the class is batch, the secret globs match nothing in the payload, and R is finite.

The numeric examples are placeholders for the probe, not product benchmarks and not promises of latency. Operators should replace D and G with numbers taken from their own editor surface and their own tree.

Class	Example D (ms)	Path delay allowed	Default residency
interactive	400	no	local
tool-loop	1500	only if P + R + G <= D	local first
batch	60000+	yes if secrets allow	free-server candidate
offline	n/a	never	local queue

Numbered workflow

The workflow below runs on the developer laptop before any agent default is flipped toward a remote runtime. Each step produces a number or a glob match that the later probe can log.

1. Publish the deadline per surface

Pick one deadline for inline completions and a looser one for sidebar chat. Write both numbers into turn_deadline.json so the runtime does not borrow chatbot patience for an editor caret. Review the file in pull requests the same way reviewers already treat formatter config. Surfaces that share a runtime still need separate classes, because a sidebar pause is not a frozen caret.

2. Measure prework on the real tree

Time the reads the agent actually performs, including git status, a bounded file listing, and secret scanning. Prework that already spends three hundred milliseconds leaves almost nothing for a remote handshake on a four-hundred-millisecond deadline. Re-run the measurement after large generated directories appear, because ignored build output still costs walk time. Record P beside the surface name rather than as a one-off memory.

3. Probe path delay without sending source

ICMP is not TLS, and a green ping does not prove an inference endpoint will answer inside the budget. Measure HTTPS time to an operator-supplied probe URL with a tiny JSON ping that carries no repository bytes. If that probe is already over budget, generation never gets a chance to look fast. Treat any probe exception as infinite path delay so the default stays local.

4. Classify secrets before any spill

API keys, .env files, customer fixtures, and private submodules stay on the laptop under the glob list. A remote job may receive a scaffold, a redacted prompt, or a failing test name, never the raw secret material. When a glob matches, residency stays local even if the batch class would otherwise win. This rule is the difference between a thermal offload and an egress incident.

5. Spill only the batch class

Long refactors, slow test matrices, and summaries of already-public trees can leave the laptop when battery, heat, or wall clock say so. Interactive confirmation turns stay local, including the single confirmation step after a patch is sketched. A free server that is idle still loses when path delay alone exceeds the caret deadline. Offline laptops queue compacted jobs on disk instead of blocking on DNS.

6. Record the decision beside the diff

Log class, deadline, P, R, G, and residency in a small JSON line next to the agent trace. A later incident review needs that ledger more than a screenshot of leftover tokens. If the residency is local, do not burn remote capacity just because unused tokens still look attractive. The log is also how a team notices that prework, not generation, has become the real cost.

Reproducible artifact: `turn_budget.py`

The script below is a local probe. It does not call a vendor API, does not claim hardware, and treats remote timing as an optional URL the operator supplies. Run it from the repository root after turn_deadline.json exists. Generation time is an operator estimate, labeled as such, because this article does not invent model latency.

#!/usr/bin/env python3
"""Turn-deadline budget probe. Timings are local measurements, not vendor SLAs."""

from __future__ import annotations

import argparse
import json
import statistics
import subprocess
import time
import urllib.request
from dataclasses import asdict, dataclass
from pathlib import Path
from typing import Optional


@dataclass
class Probe:
    deadline_ms: float
    prework_ms: float
    path_delay_ms: float
    gen_estimate_ms: float
    job_class: str
    residency: str
    reason: str


def time_prework(root: Path) -> float:
    start = time.perf_counter()
    subprocess.run(
        ["git", "-C", str(root), "status", "--porcelain"],
        check=False,
        capture_output=True,
    )
    counted = 0
    for _path in root.rglob("*.py"):
        counted += 1
        if counted >= 200:
            break
    return (time.perf_counter() - start) * 1000.0


def time_path(url: Optional[str], samples: int) -> float:
    if not url:
        return 0.0
    delays = []
    payload = b'{"ping": true}'
    headers = {"Content-Type": "application/json"}
    for _ in range(samples):
        req = urllib.request.Request(
            url, data=payload, headers=headers, method="POST"
        )
        t0 = time.perf_counter()
        try:
            with urllib.request.urlopen(req, timeout=5) as resp:
                resp.read(64)
        except Exception:
            return float("inf")
        delays.append((time.perf_counter() - t0) * 1000.0)
    return statistics.median(delays)


def classify(
    job_class: str, deadline: float, prework: float, path_delay: float, gen_ms: float
) -> tuple[str, str]:
    if job_class == "offline":
        return "local", "network partition; queue locally"
    if job_class == "interactive" and path_delay > 0:
        return "local", "interactive class forbids nonzero path delay"
    if prework + path_delay + gen_ms > deadline and job_class in {
        "interactive",
        "tool-loop",
    }:
        return "local", "deadline miss if remote path is included"
    if job_class == "batch" and path_delay != float("inf"):
        return "free-server-candidate", "batch class and finite path delay"
    if deadline - prework < gen_ms:
        return "local-or-split", "generation estimate exceeds remaining deadline"
    return "local", "default closed: stay on the laptop"


def main() -> None:
    parser = argparse.ArgumentParser(description="Probe a turn-deadline budget")
    parser.add_argument("--deadline-ms", type=float, default=400.0)
    parser.add_argument(
        "--job-class",
        choices=["interactive", "tool-loop", "batch", "offline"],
        default="interactive",
    )
    parser.add_argument("--gen-estimate-ms", type=float, default=180.0)
    parser.add_argument(
        "--ping-url",
        default="",
        help="Optional operator-supplied probe URL; send no repo bytes",
    )
    parser.add_argument("--samples", type=int, default=5)
    args = parser.parse_args()

    prework = time_prework(Path.cwd())
    path_delay = time_path(args.ping_url or None, args.samples)
    residency, reason = classify(
        args.job_class, args.deadline_ms, prework, path_delay, args.gen_estimate_ms
    )
    probe = Probe(
        deadline_ms=args.deadline_ms,
        prework_ms=round(prework, 2),
        path_delay_ms=path_delay
        if path_delay == float("inf")
        else round(path_delay, 2),
        gen_estimate_ms=args.gen_estimate_ms,
        job_class=args.job_class,
        residency=residency,
        reason=reason,
    )
    print(json.dumps(asdict(probe), indent=2))


if __name__ == "__main__":
    main()

Example local-only run for an inline surface:

python3 turn_budget.py --deadline-ms 400 --job-class interactive --gen-estimate-ms 180

Example batch candidate. The operator supplies a probe URL, and the script still sends only {"ping": true}:

python3 turn_budget.py --deadline-ms 60000 --job-class batch --gen-estimate-ms 8000 --ping-url "$PROBE_URL"

Offline class, which must never wait on DNS:

python3 turn_budget.py --job-class offline --deadline-ms 400

Keep the JSON line next to agent config. When residency is local, that turn does not leave the machine even if a remote runtime is idle.

When a free server still wins

A free server wins when the job is batch, the path delay is finite, and the payload has been reduced to a scaffold. Battery-constrained laptops, thermally throttled fans, and overnight test matrices are the usual triggers. Interactive patches, secret-bearing fixtures, and any moment the network is a partition are not. Idle remote capacity does not cancel TLS, queue wait, or a dropped VPN.

That is the only product-shaped pairing this workflow needs: free model access for the batch class, and a free server option when the laptop should yield after the budget says so. The probe does not depend on a particular vendor, and the same ledger works with any remote runtime the operator already trusts. Readers who want to try that pairing can start from current public product materials and apply the deadline file first, rather than flipping every turn to remote.

Secrets, offline, and latency as one policy

Latency is the loud failure that freezes the caret during a commute. Secrets are the quiet failure that turns a convenient spill into an incident. Offline is the failure that makes remote defaults look clever until DNS stops resolving on a train. A local-first budget treats all three as one policy rather than three separate dashboards.

Interactive turns require zero path delay. Any spill requires glob-based redaction before the prompt is assembled. A partition requires a disk queue rather than a hung HTTPS client. Do not ship the working tree to make generation look cheaper on paper. Ship a failing test name, a stack frame, or a redacted schema, and keep the signing key on the laptop.

Limitations and who should skip this

The probe measures this machine, this tree, and an optional URL. It does not measure model quality, vendor quota, or hardware, and it must not be quoted as a benchmark. The generation estimate is an operator input. Infinite path delay is reported on any probe exception, which is conservative and can hide a mistyped URL. The Python file walk stops at two hundred paths so the probe stays bounded, which can understate prework on huge monorepos.

Skip this approach when the organization already forbids any egress, when the editor surface has no local runtime at all, or when the work is hard real-time below operating-system scheduling noise. Skip it for medical, payroll, or similarly regulated corpora unless a security review already defined an allow-list. Teams with a private, low-latency inference box on the same LAN should measure that box as local-equivalent rather than as a free-server spill.

The method also fails if the agent issues hidden tool calls after the first token. Budget the whole loop, not the first completion. Schema checks, tests, and patch application belong in postwork, and they often dominate the wall clock that the caret actually feels.

Closing

Interactive agents are late when the wrong clock is optimized. Publish a deadline in the repo, fail closed on path delay, keep secrets and tight turns on the laptop, and let a free server take the batch class only after the probe says the path still fits. Token surplus is not a reason to miss a caret blink.

Interactive Agent Turns Stay on the Laptop

Emery Li — Thu, 17 Sep 2026 05:29:29 +0000

A staff engineer opened a refactor chat while a test suite was still running on the same sixteen-gigabyte laptop. The first two agent turns completed against files already in memory, and the editor stayed responsive throughout those replies. The third turn uploaded a compressed workspace to a remote endpoint, and the cursor froze until a two-second round trip returned. The engineer cancelled the job, because an interactive review cannot wait on a remote host that sits a network away.

That scene is common in local-first agent setups that treat every hard task as a candidate for remote compute. The failure was not a missing accelerator, and it was not a context window that had already overflowed RAM. The failure was a turn class mistake: an interactive reply crossed the network while a human stared at the editor. The rest of this article treats that class mistake as a gate, with a small classifier that teams can run before any spill.

Public threads this week keep arguing whether models already outcode most developers, while editor freezes from remote hops go unmeasured in those debates. Quality arguments skip the residency question that actually decides whether a person keeps the agent open. Latency, secret handling, and offline vetoes are less glamorous than model scoreboards, yet they decide whether the next turn belongs on the laptop. The workflow below stays useful even if every product name in it is removed.

Interactive latency is a different axis from working-set size

Many local-first writeups treat working-set overflow as the only honest reason to leave the laptop. That framing misses the turn that still fits in RAM and still fails the person waiting on a reply. An interactive agent turn is a conversation with a human on the other side of the editor cursor. A batch turn is a job that can finish after lunch, after a commute, or after the laptop lid closes.

Free remote compute can win the batch case and still lose the interactive case on round-trip time alone. The network hop adds serialization, queueing, and TLS before the first model token even appears on screen. Local inference on a warm process avoids that tax even when the on-device model is the smaller of the two. The point is not that local models are stronger; the point is that waiting humans experience latency before they experience quality.

A local refuse is therefore a product decision, not a hardware confession. Teams that skip the refuse will keep shipping interactive work to whichever host looks idle in a dashboard. Idle remote capacity is the wrong signal when the user is mid-keystroke and the secret scanner has not run. The classifier in this article ignores host idle time on purpose.

Secrets and offline status veto a spill even when latency looks fine

Latency is only the first veto, and a fast remote answer remains a leak if the prompt carried a live secret. API keys, session cookies, and private environment files often ride along in helpful context packs built for agents. Offline work adds a third veto, because a closed lid and a dead radio cannot reach a remote host at all. A spill policy that ignores those two vetoes will ship secrets or hang at the worst possible moment for the user.

Secret scanning has to happen before serialization, not after a retry loop has already posted the bundle. Once bytes leave the machine, deleting a chat log does not rewind the upload. Offline detection has to happen before the agent blocks the editor on a socket that will never complete. Fail-closed local residency is the only safe default when either veto fires.

A turn-class table before any host choice

The classifier below maps a turn to a residency decision without pretending to measure model quality or dollar cost. Teams should treat the table as a starting policy and replace the waiting-human column with a real product SLO. The default for interactive work is a hard refuse, even when a remote host is idle and willing to accept the job. The default for batch work is a conditional allow, and only after a secret scan and a reachability probe both pass.

Turn class	Human waiting	Secrets in prompt	Network up	Default residency
Interactive edit	yes	no	yes	local, refuse spill
Interactive debug	yes	yes	yes	local, refuse spill
Overnight test repair	no	no	yes	remote allowed
Large unattended generate	no	no	yes	remote allowed
Cabin or flight work	maybe	maybe	no	local, fail closed
Secret rotation script	no	yes	yes	local, refuse spill

This table is a policy, not a benchmark, and the cells are not measurements of any hosted model. Operators who need different SLO numbers should edit the YAML file in the artifact rather than argue about the labels. The refuse for interactive turns stays hard in every row that marks a human as waiting. Remote residency appears only where the human is not waiting, the bundle is clean, and the network is actually up.

A five-step workflow for each agent turn

The following steps run before the agent runtime selects a host, and they are deliberately boring on purpose. Boring gates survive better than clever routers when an editor freeze is the failure the user will remember. Each step records a reason code so a later log can explain a refuse without reconstructing the original prompt. The agent then either continues locally or, for surviving batch turns only, may spill.

1. Classify the turn as interactive or batch

Mark a turn interactive when a human is blocked on the next token, diff, or test diagnosis in the editor. Mark a turn batch when the job can complete without a person watching the stream, including overnight repairs and index rebuilds. Persist that label on the turn record before any file packer runs, because packers tend to assume remote residency by default. Refuse to infer the label from job size alone, since a small interactive fix and a small batch fix look identical on disk.

2. Scan the outbound bundle for secrets

Run a local scanner across the prompt, the attached diffs, and any .env fragments the agent proposed to include. Treat known key prefixes, bearer headers, and private PEM blocks as automatic refuses, even for batch jobs that would otherwise spill. Write only a boolean and a rule name into the log, never the secret material that tripped the rule. If the scanner cannot complete, fail closed and keep the turn on the laptop.

3. Probe reachability without uploading the bundle

Check that the network is up with a cheap probe that does not include source files, prompts, or tool traces. A failed probe is an offline veto, not a hint to retry with a larger payload on the next timer tick. Record probe latency as telemetry for operators, and do not treat that number as a model quality score. Skip the probe entirely when the turn is already classified interactive, because the refuse does not depend on the network.

4. Enforce a hard refuse for interactive turns

If the turn is interactive, select local residency and stop, regardless of remote idle capacity. Interactive work includes inline completions, review replies, and debug questions asked from a breakpoint. Shipping those turns remotely trades a warm local process for a round trip the waiting human will feel on every keystroke. The refuse is the feature; a dashboard that overrides it should require an explicit break-glass flag.

5. Spill only the surviving batch turns

A batch turn may leave the laptop only when the secret scan passed and the reachability probe passed. Keep a local copy of the scaffold and the reason code, so a failed remote hop can resume without re-packing secrets. Do not spill because the laptop fans spun up, and do not spill because a free remote queue looks empty. Thermal discomfort is a scheduling hint for later, not a license to ignore the interactive refuse.

Artifact: a proposed spill classifier in Python

The script below is a proposed harness, not a production agent, and it has not been executed against a live fleet. It reads a JSON turn descriptor, applies the vetoes, and prints a residency decision with a stable reason code. Operators can wrap it around an existing local agent by calling it from the same shell that launches the chat. Placeholder latency fields are illustrative only and are not measurements of any vendor endpoint.

Policy file spill_policy.yaml:

# Proposed policy. Not a measured SLO.
interactive_refuse: true
fail_closed_on_scan_error: true
fail_closed_when_offline: true
secret_rules:
  - name: env_assignment
    pattern: "(?i)(api[_-]?key|secret|token|password)\\s*=\\s*['\"][^'\"]+['\"]"
  - name: bearer_header
    pattern: "(?i)authorization\\s*:\\s*bearer\\s+\\S+"
  - name: private_pem
    pattern: "-----BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY-----"

Classifier spill_gate.py:

#!/usr/bin/env python3
"""Proposed turn-class spill gate. Unexecuted example; not a hosted client."""

from __future__ import annotations

import json
import re
import sys
from dataclasses import dataclass
from pathlib import Path
from typing import Iterable


@dataclass(frozen=True)
class Decision:
    residency: str
    reason: str
    spill_allowed: bool


DEFAULT_RULES = (
    ("env_assignment", re.compile(r"(?i)(api[_-]?key|secret|token|password)\s*=\s*['\"][^'\"]+['\"]")),
    ("bearer_header", re.compile(r"(?i)authorization\s*:\s*bearer\s+\S+")),
    ("private_pem", re.compile(r"-----BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY-----")),
)


def scan_secrets(text: str, rules: Iterable[tuple[str, re.Pattern[str]]] = DEFAULT_RULES) -> str | None:
    for name, pattern in rules:
        if pattern.search(text):
            return name
    return None


def classify(turn: dict) -> Decision:
    kind = turn.get("kind", "interactive")
    bundle = turn.get("bundle_text", "")
    offline = bool(turn.get("offline", False))
    scan_error = bool(turn.get("scan_error", False))

    if scan_error:
        return Decision("local", "scan_error_fail_closed", False)
    if kind == "interactive":
        return Decision("local", "interactive_hard_refuse", False)

    hit = scan_secrets(bundle)
    if hit:
        return Decision("local", f"secret_rule:{hit}", False)
    if offline:
        return Decision("local", "offline_fail_closed", False)
    return Decision("remote_allowed", "batch_clean_online", True)


def main(argv: list[str]) -> int:
    if len(argv) != 2:
        sys.stderr.write("usage: spill_gate.py TURN.json\n")
        return 2
    payload = json.loads(Path(argv[1]).read_text(encoding="utf-8"))
    decision = classify(payload)
    json.dump(decision.__dict__, sys.stdout)
    sys.stdout.write("\n")
    return 0 if decision.residency == "local" or decision.spill_allowed else 1


if __name__ == "__main__":
    raise SystemExit(main(sys.argv))

A tiny self-check, still labeled as a proposed test rather than a recorded run:

import unittest

class SpillGateTests(unittest.TestCase):
    def test_interactive_never_spills(self):
        d = classify({"kind": "interactive", "bundle_text": "rename Foo to Bar", "offline": False})
        self.assertEqual(d.residency, "local")
        self.assertFalse(d.spill_allowed)
        self.assertEqual(d.reason, "interactive_hard_refuse")

    def test_batch_secret_stays_local(self):
        d = classify({
            "kind": "batch",
            "bundle_text": "API_KEY='ak_live_example'",
            "offline": False,
        })
        self.assertEqual(d.residency, "local")
        self.assertIn("secret_rule", d.reason)

    def test_batch_clean_online_may_spill(self):
        d = classify({
            "kind": "batch",
            "bundle_text": "recompute fixture hashes for module payments",
            "offline": False,
        })
        self.assertTrue(d.spill_allowed)
        self.assertEqual(d.reason, "batch_clean_online")

    def test_offline_batch_fails_closed(self):
        d = classify({
            "kind": "batch",
            "bundle_text": "recompute fixture hashes for module payments",
            "offline": True,
        })
        self.assertEqual(d.reason, "offline_fail_closed")

if __name__ == "__main__":
    unittest.main()

Shell wiring that keeps the probe off the secret path:

# Proposed local wrapper. Replace TURN.json with a real descriptor from the agent.
python3 spill_gate.py TURN.json
case $? in
  0) printf '%s\n' "gate passed; runtime may select local or classified batch spill" ;;
  2) printf '%s\n' "usage error" >&2 ;;
  *) printf '%s\n' "gate refused spill; continue on the laptop" ;;
esac

Operators who want a latency breadcrumb can time a reachability probe in a separate process that never receives the bundle. That probe belongs in operations telemetry, not in the residency rule for interactive turns. Mixing the two numbers reintroduces the original bug, where a slow ping becomes an excuse to upload source. Keep the refuse cheap, local, and independent of remote queue depth.

When a free server still wins

Batch jobs that outgrow laptop thermals, or that need a long unattended window, remain the honest case for remote residency. Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode provides free model access and a free server option for classified batch turns after the local gate refuses interactive spills. The product does not change the residency rule in this article, and it does not remove the need to scan prompts for secrets.

A surviving batch turn is usually a large generate, a long test-repair loop, or an index rebuild that nobody is watching. Those jobs can sit on a free server without stealing the next keystroke from the person at the editor. Interactive completions, review replies, and breakpoint questions should never take that path, even when the same free server is empty. The gate exists so the free option is used as overflow for batch work, not as a default brain for every chat turn.

Limitations

The classifier does not estimate model quality, token burn, or wall-clock runtime on any host. It cannot see secrets that are assembled at tool-call time after the scan, so agents that interpolate env vars late still need a second scan. It also cannot prove that a remote provider will retain or forget a bundle, which is why secret-positive turns never leave the machine. Teams that need contractual deletion, regional pinning, or audited isolation must add those controls outside this script.

Placeholder latency comments in the narrative are scene-setting, not measurements, and they should not be copied into dashboards as facts. The YAML patterns will both over-match documentation and under-match novel secret formats. Fail-closed behavior will annoy people who wanted a remote answer more than they wanted a correct refuse. That annoyance is cheaper than an editor freeze or a leaked token, but it is still a real cost.

Who should skip this gate

Cloud-only IDEs with no local runtime should skip this design, because there is no laptop residency to protect. Teams that already run every agent behind a locked-down remote enclave with no local secrets may want the inverse policy. Interactive pair-programming products that stream tokens as the core experience should still refuse secret spills, yet they may need a different latency budget than a staff engineer's editor. Anyone hoping the gate will rank models, cut inference cost, or replace code review should use a different artifact.

The refuse also does not help a machine that cannot run a local agent at all. In that case the honest move is to shrink the bundle, strip secrets, and treat every turn as a reviewed upload, not to pretend a classifier created local compute. Borrowing a free server without the scan is worse than waiting. The laptop-first rule only pays off when a local process can actually answer the interactive turn.

Interactive agent work fails in the editor long before it fails on a leaderboard. Classify the turn, scan the bundle, and keep waiting humans on the warm local process. Spill only the batch residue that is clean, online, and nobody is watching. Teams that already pin interactive work to the laptop can try the same classifier against a free server only on batch turns that survive the secret scan.

Working-Set Overflow: When a Local Agent Should Yield to a Free Server

Emery Li — Wed, 16 Sep 2026 03:48:06 +0000

On a delayed commuter train, a backend engineer watched a local coding agent chew through a bulky integration-test rewrite. The repository held container layers, snapshot fixtures, and multi-gigabyte logs that the laptop could not keep warm. Disk thrash rose while the tunnel killed the cellular link for minutes at a time. A free remote server looked useful for the bulky, non-secret half, yet ignored dotenv files still held live credentials.

That scene is a composite walkthrough rather than a production incident, and it exists only to frame a yield drill. Local-first defaults still protect secrets, tight tool loops, and work that must survive radio silence. Working-set overflow is the honest case where the laptop loses, but only after credential material is excluded from the remote slice.

Placement is an envelope problem

Public threads this week keep arguing whether models already outcode most developers, which misses the placement unit. Engineering care sits in three envelopes around a job: local latency, secret surface, and network weather. A free remote runner wins when the working set walks off the machine and remaining bytes stay non-secret. It loses when the job is a tight local loop, a secret-touching edit, or a partition-bound task.

This article treats overflow as a measurable condition instead of a slogan about cloud versus laptop pride. The proposed workflow classifies the tree, times a local stand-in command, samples connectivity, and emits a yield verdict. No production timings are claimed below, and every number must come from the reader's own machine. Teams that cannot run even that dry classification should keep the default on the laptop.

Envelope A: local latency under a warm working set

Overflow shows up as page-cache misses, thermal throttle, and tool steps that wait on disk more than on the model. A local agent that rewrites tests while indexing huge fixtures will spend wall time on the filesystem, not on tokens. Remote execution can win for that bulky, secret-free slice because the server holds a cold copy without fighting the laptop fan. Remote execution still loses for sub-second tool loops that need the editor buffer and the local language server.

Measure the laptop on the actual job shape rather than on a synthetic hello-world prompt. The script later times a stand-in command that walks the working set the agent would touch. If that walk already dominates, adding a remote hop can still be cheaper than waiting on thermal recovery. If the walk is tiny, the remote hop is pure tax and the job should stay local.

Envelope B: secret surface that must never yield

Overflow never authorizes shipping dotenv files, private keys, session cookies, or customer extracts to any remote host. A yield is valid only after a classifier fails closed on known secret paths and on high-entropy filenames. Hashing a secret still leaves a tracking problem if the remote log stores the hash beside the prompt. The safe remote payload is scaffold, fixtures without credentials, and failing tests that contain no live tokens.

Treat ignore files as hints, not as proof, because agents read what shells can read. The classifier in the artifact scans the candidate upload set, not the git index alone. Any pattern match forces a local-only verdict, even when the laptop is thermally miserable and loud. Operators who need finer policy should extend the pattern list before they enable a real copy.

Envelope C: network weather and the offline cliff

Trains, hotel wifi, and corporate captive portals create partitions that cancel remote jobs without cancelling local disks. A yield policy that cannot detect a partition will strand the agent between two incomplete trees. The drill samples a cheap connectivity probe before any copy, and it refuses remote placement when the probe fails. Offline work then continues locally with a smaller working set, or it pauses with a clear local checkpoint.

Weather is not the same as average latency, because a fifty-millisecond path that vanishes in tunnels is still a cliff. Record probe success, not only round-trip mean, and require consecutive passes before any remote yield. The example uses a short TCP probe to an operator-supplied base URL and treats timeouts as rain. Readers should point that URL at infrastructure they already trust, not at a random public echo host.

Proposed yield drill

The following workflow is an unexecuted example, so operators should run it on a throwaway clone first. They should read the JSON verdict carefully before any real remote copy leaves the staging directory.

1. Pin the candidate tree

Create a staging directory that contains only the files the remote job would actually need to run. Keep dotenv files, private keys, and credential JSON outside that staging directory by construction rather than by hope.

# Proposed commands, not a production pipeline.
mkdir -p /tmp/yield-stage
rsync -a \
  --exclude '.env' --exclude '.env.*' \
  --exclude '*.pem' --exclude 'id_rsa*' \
  --exclude 'credentials.json' --exclude '.git' \
  ./ /tmp/yield-stage/

2. Classify secret surface on the staged tree

# yield_classify.py — proposed helper, unexecuted example.
from __future__ import annotations

import json
import re
from pathlib import Path

SECRET_PATTERNS = [
    re.compile(r"(^|/)\.env(\.|$)"),
    re.compile(r"(^|/)id_rsa"),
    re.compile(r"\.pem$", re.I),
    re.compile(r"credentials\.json$", re.I),
    re.compile(r"secret", re.I),
    re.compile(r"\.kube/config$"),
]

def classify(root: Path) -> dict:
    hits = []
    for path in root.rglob("*"):
        if not path.is_file():
            continue
        rel = str(path.relative_to(root)).replace("\\", "/")
        if any(p.search(rel) for p in SECRET_PATTERNS):
            hits.append(rel)
    return {
        "root": str(root),
        "file_count": sum(1 for p in root.rglob("*") if p.is_file()),
        "secret_hits": hits,
        "secret_surface": "blocked" if hits else "clear",
    }

if __name__ == "__main__":
    report = classify(Path("/tmp/yield-stage"))
    print(json.dumps(report, indent=2))

3. Time the local working-set walk

# Proposed local envelope sample.
/usr/bin/time -f 'elapsed_sec=%e max_rss_kb=%M' \
  python - <<'PY'
from pathlib import Path
root = Path("/tmp/yield-stage")
total = 0
for p in root.rglob("*"):
    if p.is_file():
        total += p.stat().st_size
print(f"bytes={total}")
PY

4. Sample network weather

# yield_weather.py — proposed helper, unexecuted example.
from __future__ import annotations

import json
import os
import socket
import time
from urllib.parse import urlparse

def probe(url: str, attempts: int = 3, timeout: float = 1.5) -> dict:
    parsed = urlparse(url)
    host = parsed.hostname or ""
    port = parsed.port or (443 if parsed.scheme == "https" else 80)
    passes = 0
    samples = []
    for _ in range(attempts):
        started = time.perf_counter()
        try:
            with socket.create_connection((host, port), timeout=timeout):
                elapsed_ms = (time.perf_counter() - started) * 1000
                samples.append(round(elapsed_ms, 1))
                passes += 1
        except OSError:
            samples.append(None)
    return {
        "url_host": host,
        "passes": passes,
        "attempts": attempts,
        "samples_ms": samples,
        "weather": "clear" if passes == attempts else "rain",
    }

if __name__ == "__main__":
    base = os.environ.get("FREE_SERVER_BASE", "https://example.invalid")
    print(json.dumps(probe(base), indent=2))

5. Combine envelopes into a verdict

# yield_verdict.py — proposed helper, unexecuted example.
from __future__ import annotations

import json

def verdict(secret_surface: str, local_walk_sec: float, weather: str) -> dict:
    if secret_surface != "clear":
        action = "stay_local"
        reason = "secret_surface_blocked"
    elif weather != "clear":
        action = "stay_local"
        reason = "network_weather_rain"
    elif local_walk_sec < 2.0:
        action = "stay_local"
        reason = "working_set_fits"
    else:
        action = "yield_nonsecret_slice"
        reason = "working_set_overflow"
    return {"action": action, "reason": reason}

if __name__ == "__main__":
    print(json.dumps(verdict("clear", 8.4, "clear"), indent=2))

The eight-point-four second walk in the last snippet is a labeled placeholder, not a measured result claimed as live evidence. Replace that placeholder with the elapsed seconds from step three before trusting any remote yield decision. Consecutive weather passes should be required in real wrappers, because a single lucky TCP handshake does not prove a tunnel-free path.

Decision table

Secret surface	Local walk	Network weather	Placement
blocked	any	any	Stay local, shrink the job
clear	under two seconds	clear	Stay local, remote hop is tax
clear	overflow	rain	Stay local, checkpoint, wait
clear	overflow	clear	Yield only the staged non-secret slice

The two-second boundary is a starting heuristic for interactive agent loops, not a universal SLA. Batch jobs that already run for minutes can raise that floor after they record their own walk times. Do not copy another team's number into a policy file and call the result science.

Where a free server is a participant, not a default

Disclosure: This article was prepared as part of MonkeyCode's product outreach. After the staged tree is secret-clear and the local walk shows overflow, a free model path can take the non-secret slice. A free server option can host that slice without moving the laptop's default residency for secret-touching work. The envelopes above do not depend on that option, and the drill still holds if the remote target is any operator-controlled runner. Readers who already keep secrets on the laptop can point FREE_SERVER_BASE at a server they intend to use. They can then compare weather samples with their own working-set walk times before copying anything.

Limitations

The classifier is filename-oriented and will miss secrets embedded in ordinary source, screenshots, or log bodies. It will also false-positive on the word secret in documentation, which is acceptable because this drill fails closed. The connectivity probe measures TCP reachability, not application health, queue depth, or data-residency obligations. Nothing in this drill benchmarks tokens, hardware, quotas, or durability of any vendor plan or tier.

Working-set size is not the same as git size, because generated artifacts and container layers often dwarf the tracked tree. Operators who stage with rsync must exclude those layers unless the remote job truly needs them. Thermal state is omitted from the verdict helper even though fans and skin temperature change local walk times. Extend the script with a reading from powermetrics or turbostat only when those tools exist on the host.

Who should not use this yield

Regulated environments that forbid any non-local processing, even of public fixtures, should ignore remote yield entirely. Air-gapped desks cannot sample weather against a free server and should keep a local-only policy. Teams without a reviewed secret classifier should not invent a copy step from this article. People who would paste a live dotenv file into any remote prompt are not ready for overflow placement.

The laptop remains the default home for agent work that touches credentials, editor state, or partition-bound edits. Overflow is a narrow exception with a staged tree, a fail-closed classifier, and a weather gate. Run the helpers on a clone, read the JSON, and keep the remote side hungry for scaffold rather than for secrets.