DEV Community: Riley Wu

Four Scores Before You Leave Local

Riley Wu — Fri, 09 Oct 2026 15:36:37 +0000

Local help should remain the default path for daily coding. A free remote server wins only on narrow, non-secret work. Four scores decide the hop before any token leaves the desk.

Developers often treat the network as a free lunch. The lunch is free only when the plate is empty of secrets. Offline days and slow links still charge you in waiting.

This note is a decision method, not a product tour. The scores come from checks you can run on one laptop. No vendor benchmark is assumed, and none is invented here.

The hop is a tax

A completion request looks small until it carries a secret. File paths, tokens, and customer names ride inside ordinary prompts. Once they cross the wire, local undo cannot pull them back.

Latency has the same shape as a tax on each edit loop. A local model pays that tax in compute on your machine. A remote model pays it in round trips plus queue time.

Offline work breaks the remote path without a warning banner. Trains, flights, and flaky cafe links are normal developer weather. A workflow that requires the cloud will stall in that weather.

Cost is the fourth vote, and free is not the same as fit. A free server can be the right tool for a redacted fixture. It is the wrong tool when the fixture still holds a secret.

Four scores, one route

Score each factor from zero to two before you send anything. A zero on any factor means the turn stays on the machine. Only a full pass on all four factors opens the server.

A timer alone cannot see a secret or an offline flag. Cost also stays invisible if you only watch the clock. The card exists so those missing votes get a number.

Latency score starts with a budget you choose for the task. Interactive edits often need a reply inside one second. Batch refactors can wait longer without breaking the editor flow.

Measure the empty hop before you measure the model. A health check with no repository text shows network time alone. If that empty hop already breaks the budget, do not send code.

Secret score is binary in practice, even if the scale has steps. Any live credential, customer row, or private diff scores zero. Redacted fixtures and public docs can score two after a scan.

Offline score asks whether the task must finish without a network. If the answer is yes, the remote option scores zero today. Queue the request on disk and retry when the link returns.

Cost score asks whether a free server changes the decision at all. If local compute already fits the budget, free remote adds little. Use the free path when local hardware cannot hold the context.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. The operator supplied two availability claims for this draft. MonkeyCode offers free model access and a free server option.

Model names, token quotas, hardware, and duration are not stated here. Those details were not verified against a primary source for this draft. Treat free access as a trial lane, not as a permanent contract.

A proposal you can run

The artifact below is a proposal, not a recorded run. It encodes the four scores in one small function. You can paste it into a scratch file and run the tests locally.

Fail closed works like a turnstile with four arms. One open arm does not let the bag through. A secret hit or a missing hop time keeps the arm down.

# Proposal only. Not executed for this draft.
# Score 0 keeps the turn local. Score 2 allows that factor.
# Any zero fails the remote hop closed.

from dataclasses import dataclass

@dataclass
class TaskCard:
    name: str
    latency_ms_budget: int
    empty_hop_ms: int | None
    secret_hits: int
    must_finish_offline: bool
    local_can_hold_context: bool
    free_server_available: bool

def score_latency(card: TaskCard) -> int:
    if card.empty_hop_ms is None:
        return 0
    if card.empty_hop_ms > card.latency_ms_budget:
        return 0
    if card.empty_hop_ms > card.latency_ms_budget // 2:
        return 1
    return 2

def score_secrets(card: TaskCard) -> int:
    if card.secret_hits > 0:
        return 0
    return 2

def score_offline(card: TaskCard) -> int:
    if card.must_finish_offline:
        return 0
    return 2

def score_cost(card: TaskCard) -> int:
    if not card.free_server_available and not card.local_can_hold_context:
        return 0
    if card.local_can_hold_context:
        return 1
    return 2

def decide(card: TaskCard) -> str:
    scores = (
        score_latency(card),
        score_secrets(card),
        score_offline(card),
        score_cost(card),
    )
    if any(value == 0 for value in scores):
        return "local"
    if all(value == 2 for value in scores):
        return "free_server"
    return "hold"

def sample_cards() -> list[TaskCard]:
    return [
        TaskCard("private-diff", 800, 120, 1, False, False, True),
        TaskCard("flight-edit", 800, 90, 0, True, False, True),
        TaskCard("public-fixture", 5000, 140, 0, False, False, True),
    ]

def test_cards() -> None:
    cards = sample_cards()
    assert decide(cards[0]) == "local"
    assert decide(cards[1]) == "local"
    assert decide(cards[2]) == "free_server"

if __name__ == "__main__":
    test_cards()
    for card in sample_cards():
        print(card.name, decide(card))

Fill empty_hop_ms from a health probe that carries no prompt. Use the total time field, converted to milliseconds. A failed probe should leave the hop time empty.

# Unexecuted probe. Health route only. No repo files.
export HEALTH_URL="https://example.invalid/health"
curl -o /dev/null -s -w 'dns:%{time_namelookup} connect:%{time_connect} total:%{time_total}\n' "$HEALTH_URL"

Read dns, connect, and total as three separate fields. Dns time points at resolver trouble, not at the model. Connect time points at the path, and total includes the server ack.

Do not paste a prompt into that probe to make it realistic. Realism here would smuggle the secret you meant to protect. Realism belongs in a local fixture after redaction, not on the wire.

Fill secret_hits from a local scan, not from a remote classifier. Count matches for keys, private blocks, and your own token prefixes. A count above zero must force the decision back to local.

# Local secret scan proposal. Tune patterns to your formats.
rg -n --hidden -g '!.git' -e 'AKIA[0-9A-Z]{16}' -e '-----BEGIN ' .

Redaction is a local edit, done before any score can reach two. Replace names, ids, and urls with stable placeholders. Then scan again, because a placeholder can still hide a live key.

Read the three sample cards

Consider a public fixture that holds no customer data. The laptop cannot fit the context, and the link is up. The empty hop sits inside a five second batch budget.

That card can score two on every factor. The decision name is free_server, not a promise of quality. You still review the patch before it lands.

Now flip one field and watch the arm drop. Add a single secret hit to the same card. The function returns local, even when the server is free and fast.

A hold result is a pause, not a silent send. Latency scored one, or local compute already fits. Keep the turn local until a human raises the budget on purpose.

Write held cards to a local queue instead of a chat box. A JSON line per task is enough for a later replay. Replay only after the four scores pass again.

A queue line can store the task name and the four scores. Leave the prompt body out of that line. A later run should rebuild the card from the repo, not from the log.

Short edit loops should prefer the local path even when the server is free. A two hundred millisecond hop can still feel late inside a tight edit. Longer jobs can spend that same hop because nobody is waiting.

Context size is a local constraint, not a moral one. If the window will not fit, local fails for a mechanical reason. That is the cleanest case for a free server, once secrets are gone.

Record the hop time next to the decision in a plain text log. Do not copy a number from a blog into that log. Your link is the only latency figure that belongs in the card.

A free lane can be slow, full, or simply gone that day. The score does not retry forever in the background. On a timeout, return the card to the local queue.

Add the three asserts to your usual test command. A secret card must stay on the local path. An offline card must stay local, and a clean batch card may leave.

Raise a latency budget in the card, not in a hidden config. The number should sit next to the task name in review. Reviewers can then see why the hop was allowed.

When the free server wins

A free server wins when four facts line up on the same card. The hop fits the budget, and the scan is clean. The task can wait for a link, but local hardware cannot hold the window.

Use the gate when a local assistant is already in place. An optional remote lane is the only cloud piece required. Solo developers and small teams can share one secret list.

Who should skip this

Skip this gate if you cannot name what counts as a secret. A vague policy will mark everything safe and leak the rest. Teams without a scanner should stay local until that gap closes.

Skip the free server if your work must be reproducible next quarter. Unverified quotas can change, and this draft does not lock a number. Air-gapped repos should ignore the remote branch entirely.

Limits

The script does not call a model and does not open a socket. It only maps fields you already measured on the machine. Wrong inputs produce a confident wrong route, so measure first.

These checks do not prove a vendor is safe or fast. They prove your task cleared your own bars on this day. Run them again when the network, the repo, or the budget changes.

If a local loop is already your default, score one redacted fixture. Compare that card with the free server option only. Publish the four numbers beside the patch, not a slogan.

Three Clocks Pick Local or Server

Riley Wu — Thu, 08 Oct 2026 10:58:00 +0000

A model call should stay local until three clocks agree. Latency, secrets, and offline need are those clocks. A free server wins only inside that narrow overlap.

The laptop is a workshop with the lights already on. The network is a ferry with a posted schedule. You board when the cargo is clean and the crossing fits the deadline.

Habit is a bad dispatcher for this choice. A fast demo last week does not price today's hop. A free seat does not make a secret safe to move.

The latency clock

Latency is the first clock on the desk. Interactive completion dies when the pause outlasts the thought. Batch work can spend more time and still stay useful.

Write the budget before you choose a host. A completion loop might allow four hundred milliseconds. A nightly rename can allow several seconds of delay.

Measure the hop with a probe you control. Keep the median of five runs from the same network. Discard a blog number that names a different city and hour.

# Proposed probe. Point it at a host you operate or trust.
for i in 1 2 3 4 5; do
  curl -o /dev/null -s -w '%{time_total}\n' https://example.invalid/health
done

Sort those five totals and take the middle value. That middle value is your median round trip. Compare it with the budget you wrote down first.

If the median already consumes the budget, the server cannot win. Local execution or a plain deferral is the honest result. Do not average away a failure with a lucky first sample.

Cold start is a separate reading on the same clock. The first call often pays a load cost later calls skip. Warm the process once, then record the five interactive samples.

Use the warm median for a loop that stays open. Use the cold reading when each task starts a fresh process. Mixing those two numbers produces a policy that lies.

The secret clock

Secrets are the second clock on the same desk. A prompt can carry keys, rows, and unreleased diffs. Those fields do not become harmless because a server invoice is zero.

Scan the payload before any client opens a socket. A keyword hit is a hard stay on the laptop. A clean scan only allows the other clocks to continue.

SENSITIVE = ("api_key", "authorization", "password", "private_key", "ssn")

def secret_boundary(text: str) -> bool:
    lowered = text.lower()
    return any(token in lowered for token in SENSITIVE)

This scan is a gate, not a proof of safety. It misses novel field names and encoded blobs. A person still owns the last look at regulated text.

Treat source trees as secret until a review says otherwise. A private monorepo can leak through a stack trace alone. Strip traces before you even run the keyword gate.

The offline clock

Offline work is the third clock on the desk. Planes, incident bridges, and sealed build rooms do not retry politely.

The job must finish while the network is down. A server route has already failed that job.

Write the offline flag before you open a client. A missing flag is not a recorded false. It is an unknown, and unknowns should defer the call.

task:
  name: rename-internal-helper
  latency_budget_ms: 400
  offline_required: true
  contains_secrets: false
  payload_bytes: 12000

Payload size belongs beside the offline flag you stored. A small rename may fit a local model easily. A multi-file context can blow past laptop memory and still be secret-free.

Where a free server wins

A free server wins a small set of jobs. The payload has no secrets, and the offline flag is false. Measured round trip fits the budget, and the laptop cannot finish.

Cost is a vote, not the chair of the meeting. A zero invoice removes one objection from the table. It does not erase a secret or a missed deadline.

MonkeyCode enters here as one host that can take the server side. Disclosure: This article was prepared as part of MonkeyCode's product outreach. The operator states that free model access and a free server option exist.

The operator also presents the project as open source. This draft claims no model names, quotas, hardware, or offer duration. Pin nothing until the docs you open still match the task.

Check the project docs on the day you run the probe. Availability moves, and a copied figure goes stale quickly. The clocks still outrank any offer you find there.

Rerun the route

Decide local_can_finish with a time box, not with a feeling. Give the local runner the same budget you gave the network. A timeout is evidence, and a success is evidence too.

# Proposed local time box. Exit 124 means the box was missed.
timeout 2s python3 -m local_runner --dry-run < task.json
echo "exit:$?"

Exit zero can set local_can_finish to true for that task shape. Exit 124 can set it to false for that same shape. Neither exit is a quality score for the model text.

The function below is a proposed policy module. It was not executed against a live host for this draft. Replace the timing field with your probe before you trust a label.

from dataclasses import dataclass

@dataclass
class Task:
    latency_budget_ms: int
    offline_required: bool
    contains_secrets: bool
    local_can_finish: bool
    measured_rtt_ms: int | None

def route(task: Task) -> str:
    if task.offline_required or task.contains_secrets:
        return "local"
    if task.measured_rtt_ms is None:
        return "defer"
    if task.measured_rtt_ms > task.latency_budget_ms:
        return "local"
    if not task.local_can_finish:
        return "free_server"
    return "either_local_preferred"

Read the labels as policy, not as a vendor score. local means the bytes stay on the machine that created them. free_server means the clocks passed and the laptop cannot finish.

defer means you refused to invent a round trip. either_local_preferred means the server is fast enough, yet the laptop can still finish. Prefer local in that tie, because movement still has a cost.

Save the function as route_task.py before you run the driver. The driver imports that file from the working directory. A missing import is a setup error, not a policy result.

Pass fields in dataclass order, or switch to keywords. A swapped boolean silently changes the route you meant.

python3 - <<'PY'
from route_task import Task, route

open_job = Task(800, False, False, False, 180)
secret_job = Task(800, False, True, False, 180)
print(route(open_job))
print(route(secret_job))
PY

Expect free_server on the first line of output. Expect local on the second line of output. If either line drifts, fix the policy before you fix the network.

RTT vs budget	Offline	Secrets	Laptop finishes	Route
inside	no	no	no	free server
inside	no	no	yes	local preferred
missing	no	no	no	defer
any	yes	any	any	local
any	any	yes	any	local

The table is a policy, not a measurement of any vendor. Fill the round-trip cell from a probe you ran today. Do not paste a foreign median and call it current evidence.

Order the checks so the cheap refusal happens first. Offline and secrets return local before any socket opens. The probe runs only after those two gates pass.

That order saves time, and it also saves mistakes. A latency script that uploads a sample prompt has already lost. Probe a health path, never a real task body.

What this will not do

Limitations sit in the gaps the labels cannot name. A keyword list misses secrets buried in minified bundles. A median hides a slow tail that ruins a live demo.

A free server can be limited, blocked, or withdrawn without notice. A local model can be too weak for the refactor you need. None of those facts appear inside the returned label.

Region and identity add two more gaps to the method. A health check from home is not a check from a build agent. A shared free server may log metadata even when you send no secrets.

Skip this route when regulated data lacks a written review. Skip it when the only prompt copy is live production traffic. Skip it as a hiding place for where source code went.

The method sorts ordinary developer tasks, and it does nothing more. It is not a control for a certified security boundary. Do not stretch it into a compliance certificate.

Keep a local log of the decision, not of the prompt text. Store the route, the budget, the median, and the clock time. Review that file when a task felt slow or unsafe.

You want a boring pattern over a week of real edits. Most edits stay local, and the server shows up rarely. It shows up for secret-free jobs the laptop cannot finish.

If the server column is still an open question, read the current MonkeyCode docs. Confirm free model access and the free server option yourself. Send a byte only after the three clocks still agree.

Let a Local Clock Gate the Free Server

Riley Wu — Thu, 08 Oct 2026 08:53:19 +0000

A free server should stay idle while the desk still hits budget. Local latency, secret residue, and an offline drill pick the winner. The remote box is a spare lane, not the home road.

Teams often rent a distant model because the sticker price is zero. That choice still spends time, trust, and a working network. A cheap lane can be the slow lane when the loop is tight.

Treat the laptop as a nearby kitchen clock. Treat the free server as a street courier. The courier wins only after the clock misses the meal.

This draft proposes a gate, not a product score. Figures below are planning targets, not measured vendor claims. Run them on your host before you trust a line.

Budget the desk first

Set two budgets before you send any prompt. An assist hop should return in under 400 milliseconds. A batch review may spend up to eight seconds.

Those ceilings are proposals for a solo repo workflow. Change them when your editor or hardware differs. Do not paste them into a contract or status page.

Assist work sits near the hands, so delay feels like friction. Batch work sits near the calendar, so delay feels like a queue. The same remote hop can pass one budget and fail the other.

Measure the desk with a short sample, not a single lucky call. Seven local runs can sketch a median and a rough tail. With seven runs, that tail is simply the slowest sample.

Four facts, one choice

The gate reads four facts and prints one choice. It samples a local stand-in and scans secret shapes. It also checks a drill marker and a network flag.

Stay local when the local p95 fits the budget. Stay local when the offline drill was never recorded. Block the send when a key-like pattern remains.

Open the spare lane only when the miss is real. Local p95 must sit past budget, and the drill file must exist. The wire must be up, and the secret scan must be clean.

The local stand-in sleeps briefly, then copies the string. It stands in for an on-disk model, linter, or cache. Replace that function before you trust the printed choice.

A fifty millisecond sleep is a fixture, not a hardware result. Your real model may take longer on a cold start. Warm the process once, then time the calls you would ship.

The secret scan is a rough net, not a proof. It flags common key labels and a private-key banner. It misses novel formats, split tokens, and image text.

Treat a clean scan as a permit to continue the clock check. Treat a hit as a stop, even if the clock is slow. Edit the payload, write a new file, and sample again.

The offline marker is a file you write after a real unplug. Cut the route, run the local path, and confirm a result. Only then create the marker file on disk.

A missing marker means the courier is not yet earned. The script will not guess that the laptop works alone. That refusal is the point of the drill.

Airplane mode is a fair cut for a cafe laptop. A lab bench may need a disabled route instead. Record which cut you used beside the marker file.

Save the following harness as gate.py in an empty directory. It was not run against a live remote host for this article. Treat every printed number as a sketch until you execute it.

#!/usr/bin/env python3
"""Proposed local-clock gate. Unexecuted example, not a benchmark."""
import argparse
import json
import re
import statistics
import time
from pathlib import Path

SECRET = re.compile(
    r"(?i)(api[_-]?key|token|password|BEGIN PRIVATE KEY)"
)
BUDGET_MS = {"assist": 400, "batch": 8000}


def local_stub(payload: str) -> str:
    time.sleep(0.05)
    return payload.upper()


def sample_local(payload: str, runs: int = 7) -> dict:
    samples = []
    for _ in range(runs):
        start = time.perf_counter()
        local_stub(payload)
        samples.append((time.perf_counter() - start) * 1000)
    samples.sort()
    index = max(0, int(round(0.95 * len(samples))) - 1)
    return {
        "p50_ms": round(statistics.median(samples), 1),
        "p95_ms": round(samples[index], 1),
        "n": runs,
    }


def decide(kind: str, payload: str, marker: Path, net_up: bool) -> dict:
    clock = sample_local(payload)
    hits = len(SECRET.findall(payload))
    meets = clock["p95_ms"] <= BUDGET_MS[kind]
    drilled = marker.is_file()
    if hits:
        choice, why = "blocked", "secret pattern remains"
    elif not drilled:
        choice, why = "stay_local", "offline drill missing"
    elif meets:
        choice, why = "stay_local", "local p95 inside budget"
    elif net_up:
        choice, why = "free_server", "budget missed and wire up"
    else:
        choice, why = "stay_local", "budget missed but wire down"
    return {"choice": choice, "why": why, "hits": hits, **clock}


def test_block_and_local() -> None:
    blocked = decide("batch", "api_key=example", Path("missing"), True)
    assert blocked["choice"] == "blocked"
    local = decide("batch", "lint the queue", Path("missing"), True)
    assert local["choice"] == "stay_local"


def main() -> None:
    parser = argparse.ArgumentParser(description="Proposed local-clock gate")
    parser.add_argument("--kind", choices=sorted(BUDGET_MS), required=True)
    parser.add_argument("--payload-file", type=Path, required=True)
    parser.add_argument("--marker", type=Path, default=Path(".offline_drill_passed"))
    parser.add_argument("--net-up", type=int, choices=(0, 1), required=True)
    args = parser.parse_args()
    payload = args.payload_file.read_text(encoding="utf-8")
    report = decide(args.kind, payload, args.marker, bool(args.net_up))
    print(json.dumps(report, sort_keys=True))


if __name__ == "__main__":
    main()

Run the sketch from a clean directory you can delete. Pass a payload file that you are willing to inspect. Keep customer text and live environment files out of the trial.

python3 -c "import gate; gate.test_block_and_local()"
printf 'lint the queue module\n' > ./sample.txt
python3 gate.py --kind assist --payload-file ./sample.txt --net-up 1
python3 gate.py --kind batch --payload-file ./sample.txt --net-up 0
printf 'review this api_key=example\n' > ./sample.txt
python3 gate.py --kind batch --payload-file ./sample.txt --net-up 1

The first live command should stay local, because the marker is absent. The key-label file should print blocked, even when the wire flag is up. A fast stub will not open the lane, and that is intended.

The default stub sleeps for about fifty milliseconds, so it beats both budgets. To inspect the free_server branch, set the assist budget to ten. Restore the real budget before you judge a live payload.

Create the marker only after that cut succeeds. Do not copy a touch command in place of the drill. The filename is .offline_drill_passed, and it is only a note.

Read the JSON choice before you change any client setting. A stay_local line means the desk still earns the loop. A blocked line means you edit the payload and sample again.

A free_server line means the spare lane is eligible, not mandatory. You may still keep the work on disk if quality is unsure. Eligibility is a clock result, not an order to migrate.

Read the matrix, then the wire

The same rule fits in a small review table. Use the row that matches your sample, not the row you prefer. A printed choice should agree with that row before you continue.

Local p95	Drill file	Secret hits	Network	Choice
Inside budget	Present	0	Either	stay_local
Outside budget	Missing	0	Up	stay_local
Outside budget	Present	Greater than 0	Up	blocked
Outside budget	Present	0	Down	stay_local
Outside budget	Present	0	Up	free_server

Latency is only one axis on that table. A fast local hop can still be unsafe if a token remains. A slow remote hop can still fit a nightly batch.

Offline work changes the math without a code change. Trains, flights, and lab benches drop the courier without warning. If the drill never passed, you do not know the clock works.

Secrets change the math faster than latency does. A zero invoice does not make a distant hop safe. Redact first, then ask whether the clock missed budget.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. The operator reports free model access and a free server option. Quota size, model names, hardware, and duration were not verified here.

Use that reported lane only when the gate prints free_server. Point a batch client there after redaction, not before the scan. Keep the assist hop on the desk unless its own budget fails.

Do not read a free option as a latency promise. A shared queue can wait behind jobs you cannot see. Sample the remote round trip, then compare it with the local tail.

A fair remote sample uses the payload the gate already cleared. Send one warm call, then five timed calls, and keep the median. Drop the run if any call returns an auth error.

The next loop is a shape, not a private client. Set the URL yourself, and do not place secrets in the file. Replace headers if your existing client already requires them.

# Proposed timing shape. Set FREE_SERVER_URL yourself.
: > /tmp/gate_times.txt
for i in 1 2 3 4 5; do
  curl -sS -o /tmp/gate_body.txt -w "%{time_total}\n" \
    -H "Content-Type: application/json" \
    --data-binary @cleared_payload.json \
    "$FREE_SERVER_URL" >> /tmp/gate_times.txt
done
python3 - <<'PY'
import statistics
from pathlib import Path
vals = [float(x) * 1000 for x in Path("/tmp/gate_times.txt").read_text().split()]
print({"n": len(vals), "median_ms": round(statistics.median(vals), 1)})
PY

Compare that remote median with the local p95, not a slide. If the remote tail is slower than the batch ceiling, stay local. A free box that misses budget is still a miss.

Record both clocks in one line so the comparison stays honest. Include the job kind, the choice, and whether the wire was up. A later reader should not reconstruct the afternoon from memory.

printf '%s %s %s\n' "$(date -u +%FT%TZ)" "$CHOICE" "$P95" >> .gate_log

After a week of samples

Review that log after a week of real edits. If free_server never appears, you do not need the spare lane yet. If it appears on assist hops, the budget or the desk is tight.

Raise the assist budget before near-hand help leaves the machine. Lower the batch budget if the courier often returns late. Edit the script table, then rerun the same payload file.

This method will not rank which model writes a better patch. It will not score prose, taste, or review comments. It only tells you when a free server earned a timed turn.

A small on-disk model can meet the clock and still miss. Pair the gate with a diff check or a unit run you trust. A fast stub is not evidence that the patch is right.

Free capacity can also vanish without a local code change. A refused remote call should fall back to the local stub. Log the fallback reason next to the same clock sample.

def fallback(choice: str, remote_ok: bool) -> str:
    if choice != "free_server" or not remote_ok:
        return "local_stub"
    return "free_server"

Air-gapped repos should never open the spare lane. Regulated text that cannot cross a boundary should stay on disk. A slow local clock is not a permit to break that rule.

Skip the lane when you need a paid support contract. Skip it when prompts still contain raw environment dumps. Skip it when the unplug drill cannot run on the real laptop.

The gate fails in a dull way if you fake the marker. Creating the file without cutting the route is theater, not evidence. The drill is the proof, and the file is only a note.

Cold starts also fool a short sample on a local model. The first call may load weights while later calls look fast. Drop the first sample, or report it apart from the timed set.

Set the network flag from a check you already trust. A failed name lookup is enough to force a local choice. Do not hard-code a vendor address into the first version.

Start with the local clock on a payload you can publish. Record the offline drill before you celebrate a zero price. Open the spare lane only when the printed choice allows it.

When a cleared batch prints that choice, sample the reported lane once. Keep the path that meets budget on the next five calls. The kitchen clock still owns the meal when the street is optional.

Remote Models Need Three Independent Permits

Riley Wu — Wed, 23 Sep 2026 17:35:59 +0000

Remote models should not see traffic until three permits clear. Latency, secrets, and link state each get a veto. A free server becomes useful only after all three permits pass.

Teams often grant the hop first and invent permits later. That order leaks tokens and then adds latency to the apology. The cheaper path is a local default with a measured exception.

Picture a workshop with a locked loading dock. Work happens at the bench until the crate is ready. The dock opens only when the bench is too small. The crate must be clean and the road must exist. Opening the dock because the bench looks old loses crates.

On-device agents and in-browser agents revived this dock problem. The useful part is not another hosted demo. The useful part is that the wire remains a choice. Treat that choice as a permit system, not a preference.

Permits need numbers rather than taste or vendor slides. Taste does not survive a thermal throttle or a leaked env file. The rest of this note is a method you can run today. It stays useful even if every hosted name is deleted.

Permit A: the clock

Your silicon sets a floor for local decode speed. The network adds handshake time, queue time, and return time. If the added time exceeds one editor breath, the loop starves.

Call an editor breath the gap between two considered keystrokes. Developers protect that gap without writing a performance spec. They simply stop feeding the tool any rich context.

Do not debate laptops versus clouds in the abstract. Time a local stub on the repository you actually edit. Time a TLS handshake to a harmless public host. Compare those two clocks before any prompt leaves disk.

Handshake time is only the cover charge for a hop. Shared queues can still ruin a free remote decode. Re-run the hop during work hours, not at midnight.

The script later in this article prints both clocks. It is an assay, not a claim about your GPU. Swap the stub for your local runner and keep the rest.

Permit B: the secret surface

A remote completion stores a copy of whatever you packed. Stack traces, internal URLs, and env fragments travel together. Local inference keeps that blob under the same user id.

Filename checks are blunt and still worth running first. If env files or private keys sit in the tree, fail closed. Expand the name set until it matches your actual shop.

Adjacent secrets still count against the remote hop. A context builder that walks every file will vacuum fixtures. Narrow the glob until a dry run shows ticket-safe source.

Redaction is not the main artifact in this note. The permit stays binary at the loading dock. A dirty glob means the model stays on disk. A clean glob means you may consider the clock next.

You can preflight secret names with git before the assay.

git ls-files | grep -E '(^|/)\.env$|(^|/)id_rsa$|(^|/)credentials\.json$' || true

Empty output is not a security proof. It is only permit B in its cheapest form. Anything printed here keeps the model on disk.

Permit C: the link

Offline is not an edge case for people who ship from trains. A loop that dies without packets is a fair-weather tool. Local weights turn a dead network card into a planned mode.

Offline also deletes a pile of auth failure modes. There is no refresh token and no SSO interstitial. The laptop remains the only principal in the loop.

When the link returns, you still hold the transcript on disk. You can export a bounded job after the other permits pass. You cannot unsay a prompt that already crossed the card.

When a free server wins

Local-first is not a vow to suffer on a hot laptop. Fans roar when context outgrows quiet thermal limits. Some reviews need a second model you refuse to store.

Those are dock-opening events, not a new default home. The crate must be clean before it rolls to the dock. The road must exist, and the bench must be too small. Then a remote hop can carry one bounded job.

MonkeyCode fits that narrow dock role for measurement. Disclosure: This article was prepared as part of MonkeyCode's product outreach. The project is open source and offers free model access. It also offers a free server option for that measured hop. Use those options after the three permits pass, not before.

Free still crosses a trust boundary you do not control. Free does not mean private, resident, or fast under load. Free means you can measure a hop without a billing loop.

A free server wins when local stub time is long. It also needs a small handshake, a clean glob, and a live link. It loses when any permit fails, including policy. It also loses when you need a written service agreement.

Do not park a home directory on a complimentary box. Send a redacted batch and bring the answer back. Keep weights and secrets on the bench after the hop.

The assay

Save this file as permits.py at a repository root. Run it with Python 3 from that same root. It prints clocks, secret hits, and a single verdict. Treat the stub as a placeholder you must replace.

#!/usr/bin/env python3
"""Labeled assay: local stub vs TLS hop vs secret filenames.

This is a method template, not a benchmark. Replace time_local_stub()
with your on-disk runner before you trust HOP_MAY_WIN.
"""
from __future__ import annotations

import ssl
import socket
import sys
import time
from pathlib import Path

SECRET_NAMES = {".env", ".env.local", "id_rsa", "credentials.json"}
SKIP_DIRS = {".git", "node_modules", "dist", ".venv", "__pycache__"}


def time_local_stub(prompt: str, rounds: int = 80) -> float:
    t0 = time.perf_counter()
    text = prompt
    acc = 0
    for _ in range(rounds):
        acc += hash(text) & 0xFFFF
        text = text[::-1]
    # The acc sink stops a too-eager optimizer.
    if acc < 0:
        raise RuntimeError("unreachable")
    return time.perf_counter() - t0


def time_tls_hop(host: str, port: int = 443, timeout: float = 5.0) -> float:
    ctx = ssl.create_default_context()
    t0 = time.perf_counter()
    with socket.create_connection((host, port), timeout=timeout) as raw:
        with ctx.wrap_socket(raw, server_hostname=host) as sock:
            sock.do_handshake()
    return time.perf_counter() - t0


def secret_hits(root: Path) -> list[str]:
    hits: list[str] = []
    for path in root.rglob("*"):
        if not path.is_file():
            continue
        if any(part in SKIP_DIRS for part in path.parts):
            continue
        if path.name in SECRET_NAMES:
            hits.append(str(path))
    return hits


def decide(local_s: float, hop_s: float | None, hits: list[str]) -> str:
    if hits:
        return "HOLD_LOCAL_SECRETS"
    if hop_s is None:
        return "HOLD_LOCAL_LINK"
    if hop_s > max(local_s * 3.0, 0.25):
        return "HOLD_LOCAL_CLOCK"
    if local_s > 2.0 and hop_s < 0.08:
        return "HOP_MAY_WIN"
    return "HOLD_LOCAL_DEFAULT"


def main() -> None:
    root = Path(".").resolve()
    host = sys.argv[1] if len(sys.argv) > 1 else "example.com"
    readme = root / "README.md"
    prompt = readme.read_text(encoding="utf-8", errors="ignore")[:4000] if readme.exists() else "local-first assay"
    local_s = time_local_stub(prompt)
    try:
        hop_s: float | None = time_tls_hop(host)
    except OSError:
        hop_s = None
    hits = secret_hits(root)
    verdict = decide(local_s, hop_s, hits)
    hop_out = f"{hop_s:.4f}" if hop_s is not None else "unreachable"
    print(f"local_stub_s={local_s:.4f}")
    print(f"tls_hop_s={hop_out}")
    print(f"secret_files={len(hits)}")
    print(f"verdict={verdict}")


if __name__ == "__main__":
    main()

Run the assay with a plain interpreter command.

python3 permits.py

Pass a host if you need a different handshake target.

python3 permits.py example.com

The printer should emit four lines similar to this shape. The numbers below are format samples, not measured claims.

local_stub_s=0.0412
tls_hop_s=0.1866
secret_files=2
verdict=HOLD_LOCAL_SECRETS

Replace the stub with a call to your on-disk runner. Keep the secret scan and the decide function under policy. Commit the assay next to the context builder to prevent drift.

Read HOP_MAY_WIN as permission to measure one redacted batch. It is not permission to stream keystrokes. It is not permission to upload the working tree.

Limitations

The hash loop is not inference on real weights. It only proves the wiring of the permit method. A real local model may be slower than the hop.

Handshake time ignores application queues after TLS completes. A free shared server can stall after the handshake succeeds. Measure one throwaway completion that contains no secrets.

Filename filters miss keys embedded in source and docs. Add a content scan if that risk is in scope. This article does not ship that extra scanner.

The method ignores data residency and contractual limits. A fast clean hop can still violate org policy. Stop at policy, not at the verdict string alone.

Thermal state changes across an ordinary heavy workday. Morning numbers can lie after a long compile. Run the assay under your normal editor and build load.

Who should skip this

Skip this permit system if an approved private endpoint exists. Skip it if laptops may not store model weights at all. Skip it if you cannot redact a prompt before any hop.

Regulated shops with logging duties may need the wire. A local default would fight an audit trail duty. Follow the duty and keep this assay off the critical path.

People who cannot yet run a local model should wait. The stub is not a substitute for a working runner. Get disk inference working, then time it against the hop.

Close

Grant remote models three independent permits, then one bounded hop. Clock, secrets, and link each vote, and any veto sticks. A free server is a dock, never a second workshop.

Treat Remote Tokens as a Spillway

Riley Wu — Tue, 22 Sep 2026 15:50:51 +0000

Remote inference is a spillway, not a default pipe. The local disk already holds the working loop. You open the wire after three gates pass.

Latency looks like the loudest cost on paper. Secrets and offline gaps still cost far more. A fast hop still leaks when the payload is dirty.

Think hydrology, not a vendor roadmap slide. Your laptop is a reservoir with a known rim. The network is a spillway that leaves the watershed.

You do not lift that gate for a quicker looking river. Speed outside the watershed is still water leaving home.

This article is a proposed workflow, not a field study. The script below is runnable on Node 18. Printed timings belong only to your local machine.

Three separate costs share one fail-closed local decision. The first cost is round-trip time on the wire. The second cost is secret surface inside the prompt.

The third cost is work that must finish offline. Offline is not a percentile the way latency is. Either the next tool can run, or it cannot.

Pretty uptime graphs do not move that binary. A train tunnel still zeros the entire path.

Most teams still optimize the first cost only. That habit treats the cloud as a shorter path. It is often a longer path with extra copies.

A secret does not care about milliseconds at all. A private key in a prompt is already gone. Pretty links still fail an offline compile step.

Gate one reads the payload before any socket opens. It searches for private-key banners and cloud identifiers. A single hit keeps the reservoir fully closed.

Gate two asks if the next action needs a model. Lint, test, and hash do not need remote tokens. Those steps should never pay a network hop.

Gate three estimates local pressure from file size. This is a labeled heuristic, not a published benchmark. Large clean context can justify a later spill.

Small clean context should remain on local disk. Do not spill a rename because a server is idle.

The composite rule stays fail closed under pressure. Secrets always win the argument against raw latency. Offline need always wins against mere chat convenience.

Only a clean, heavy, online-tolerant job may spill. That is the narrow case a free server can serve. Everything else remains a local disk loop instead.

The analogy stays strict when the queue grows. Flooding a valley to save one minute is still a flood. Copying a dotenv file into a chat is that flood.

Round-trip time also hides queue delay on shared servers. Your local hash does not wait behind strangers. That difference rarely appears on a homepage chart.

Here is a proposed Node gate you can run. Save it as spillway-test.js beside a prompt file. Pass the file path as the first argument.

#!/usr/bin/env node
'use strict';

const fs = require('fs');
const crypto = require('crypto');
const { performance } = require('perf_hooks');

const SECRET_RE = [
  /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/,
  /AKIA[0-9A-Z]{16}/,
  /(?:^|\n)(?:API[_-]?KEY|SECRET|TOKEN|PASSWORD)\s*=\s*\S+/i,
  /ghp_[A-Za-z0-9]{36}/,
  /xox[baprs]-[A-Za-z0-9-]{10,}/,
  /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\./,
];

function leakHits(text) {
  let n = 0;
  for (const re of SECRET_RE) {
    if (re.test(text)) n += 1;
  }
  return n;
}

function pressureOf(bytes) {
  // Proposed bands only. Tune them on your disk.
  if (bytes > 2_000_000) return 'high';
  if (bytes > 200_000) return 'mid';
  return 'low';
}

function decide(hits, pressure, offlineRequired) {
  if (hits > 0) return 'HOLD';
  if (offlineRequired) return 'HOLD';
  if (pressure === 'high') return 'SPILL';
  return 'HOLD';
}

function sha256(buf) {
  return crypto.createHash('sha256').update(buf).digest('hex');
}

function main() {
  const file = process.argv[2];
  const offlineRequired = process.argv.includes('--offline');
  if (!file) {
    console.error('usage: node spillway-test.js <prompt-file> [--offline]');
    process.exit(2);
  }

  const t0 = performance.now();
  const buf = fs.readFileSync(file);
  const text = buf.toString('utf8');
  const digest = sha256(buf);
  const t1 = performance.now();

  const hits = leakHits(text);
  const pressure = pressureOf(buf.length);
  const verdict = decide(hits, pressure, offlineRequired);

  const report = {
    file,
    bytes: buf.length,
    sha256: digest,
    local_read_ms: Number((t1 - t0).toFixed(3)),
    leak_hits: hits,
    pressure,
    offline_required: offlineRequired,
    verdict,
    note: 'Unexecuted remote hop. Local gate only.',
  };

  console.log(JSON.stringify(report, null, 2));
  process.exit(verdict === 'HOLD' ? 1 : 0);
}

main();

Run the gate on a dry file first. Then run it on a file that should fail. Compare the two JSON objects, not gut feel.

printf 'refactor the parser, keep tests green\n' > /tmp/clean.prompt
node spillway-test.js /tmp/clean.prompt; echo exit:$?

printf 'TOKEN=ghp_%s\n' "$(printf 'a%.0s' {1..36})" > /tmp/dirty.prompt
node spillway-test.js /tmp/dirty.prompt; echo exit:$?

node spillway-test.js /tmp/clean.prompt --offline; echo exit:$?

The clean file should print HOLD with low pressure. Size stays small, so the spillway remains shut. That default HOLD is the design, not a bug.

The dirty file should print HOLD as well. Leak hits rise above zero and override size. A non-zero exit lets nearby scripts fail closed.

The offline flag forces HOLD on huge clean files. Train that path before any travel day starts. An airport queue is a poor discovery moment.

Local read time is a baseline, not a contest. It records how cheap a disk already is. Skip vendor slides when you have this number.

A remote hop is absent from this script on purpose. Opening a socket would teach the wrong operational lesson. Measure the wire later, after HOLD feels boring.

A free server wins only after three checks agree. Leak hits must stay at zero on the payload. Offline mode must be false for that job.

Pressure must read high because local work cannot finish. That last clause is the whole economic test. High pressure means the machine cannot complete the step.

It does not mean a chat box sat closer than the terminal. Proximity of a text field is not capacity. Capacity is whether the local reservoir already overflowed.

Lint belongs on disk for the entire loop. A unit test belongs on disk as well. A two-kilobyte rename never earns a spillway opening.

Large secret-free context that saturates local memory may spill. Treat the remote box as overflow plumbing only. Pull the result back, then close the gate again.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode offers free model access and a free server option. Use that option only after this gate prints SPILL.

The copy still leaves disk, with ordinary third-party limits. Do not treat free as a frictionless default path. Free compute does not erase data residency rules.

Free does not replace a real secret scanner. Keep a dedicated scanner in the same export path.

Limitations of this gate are concrete and narrow. Regular expressions miss novel secret shapes every week. File size is a blunt stand-in for RAM and CPU.

The script never proves a model was required. False HOLD remains an acceptable operational miss. False SPILL is not an acceptable operational miss.

Tune size bands upward when prompts are large and dull. Do not tune bands downward just to feed a server. Raw convenience is not a pressure reading.

Some readers should reject the spillway path entirely. Do not use it if law forbids third-party inference. Do not point it at production dumps or customer exports.

Do not treat it as a scanner for key material. Those files should never approach a prompt assembler. Local deletion is safer than a clever HOLD.

Air-gapped teams should skip remote tokens as a class. The reservoir is the product in that environment. A free server becomes a policy incident there, not a shortcut.

Keep the exit code in any prompt export path. A non-zero HOLD should block the copy step. Latency arguments do not override that local block.

A one-line wrapper can block clipboard export tools. Read the verdict before any HTTP client loads. That ordering is the entire local control plane.

The core conclusion does not move after the demo. Remote tokens remain a spillway under every clock. Local loops remain the reservoir that owns secrets.

Offline need keeps the gate closed without debate. If the loop already lives on disk, keep running this gate. Open a free spillway only when the JSON verdict reads SPILL.

Export Batches, Never Keystrokes

Riley Wu — Mon, 21 Sep 2026 14:09:16 +0000

Interactive completions belong inside the local editor process first. Remote compute should only accept scrubbed, offline-tolerant batches.

The tab key is a reflex, not a shipping document. Reflexes die when they must cross a building or an ocean.

This article splits AI coding work into two job shapes. Completions stay in-process, while refactors may travel after measurement.

The split is not ideology but a latency and secrecy budget. Blur the two shapes and the editor starts waiting on weather.

Treat the next hour of editing as a closed control loop. Each keystroke expects an answer before attention drifts to email. A remote model inserts DNS, TLS, queues, and retry storms.

Those hops do not belong in the inner loop of an editor. A batch job has a different nervous system and a different clock. Hold it, scrub it, and collect results after the build finishes.

A spinal reflex should not mail a letter for advice. Overnight crate shipping can wait for a clean dock and a dry road. That is the whole local-first argument in one picture.

Before any remote call, run three cheap measurements on your desk. They cost seconds and they prevent a week of leaked fixtures.

Probe the hop

Start with round-trip time, because interaction dies on the first extra hop. A completion that waits on DNS cannot feel like a keystroke.

# Unexecuted template. Point URL at a host you already use.
# Do not treat sample timings from another network as yours.
for i in 1 2 3 4 5; do
  curl -s -o /dev/null --max-time 5 \
    -w "n=${i} connect=%{time_connect} total=%{time_total}\n" \
    "https://example.com/"
done

Run the probe on the same network you actually edit from. Coffee-shop Wi-Fi and office Ethernet will not agree on hops.

Read printed RTT as a veto for interactive work, not a trophy. Classic interface research treats about 100ms as instantaneous feel. That hundred-millisecond line is a heuristic, not a bench from this account.

If median hop exceeds that band, keep every tab completion local. Do not argue with the WAN during a rename across twelve files.

Scrub the crate

The second measurement is secret surface, and it is wider than .env. Snapshot tests often embed customer names inside otherwise boring JSON.

Migration logs embed host paths that map your internal network. Agent traces embed the command that printed those names and paths. A batch that still contains those traces has no honest remote route.

# Unexecuted snippet. Pair with job_route.py below.
SECRET_RES = [
    re.compile(rb"AKIA[0-9A-Z]{16}"),
    re.compile(rb"-----BEGIN (?:RSA |OPENSSH |EC )?PRIVATE KEY-----"),
    re.compile(rb"(?i)(api[_-]?key|secret|passwd|password|token)\s*[:=]\s*\S+"),
    re.compile(rb"(?i)bearer\s+[a-z0-9._\-]{20,}"),
]

Treat a single hit as a closed gate, not a debate prompt. Rewrite the archive until the scanner prints a clean receipt.

The third measurement is the offline window of the current desk. A train tunnel does not care about a remote inference queue.

Flaky LTE turns a batch into a half-written remote object. Keep the archive on disk until the upload can finish in one pass.

Job size still matters after latency and secrecy both pass. A two-line rename is not a batch even on a perfect link. A whole-repo documentation pass can be a batch if the tree is clean.

Local cores may already be hot from tests, indexes, and browsers. That heat is a reason to consider overflow, not a reason to skip scrubbing.

When those three clocks pass, a free remote path can be rational. MonkeyCode currently offers free model access and a free server option. Disclosure: This article was prepared as part of MonkeyCode's product outreach.

Use that option only as an overflow dock for already-scrubbed batches. No model names or quotas are required to apply the routing rule.

Encode the route

The router below encodes the same rule so a teammate can rerun it. It is a template. It is not a benchmark from this account.

#!/usr/bin/env python3
"""job_route.py — local interactive vs hold vs remote batch candidate.

Label: template. Run it on your laptop. Do not cite this file as evidence.
"""
from __future__ import annotations

import argparse
import re
import statistics
import subprocess
import sys
from pathlib import Path

SECRET_RES = [
    re.compile(rb"AKIA[0-9A-Z]{16}"),
    re.compile(rb"-----BEGIN (?:RSA |OPENSSH |EC )?PRIVATE KEY-----"),
    re.compile(rb"(?i)(api[_-]?key|secret|passwd|password|token)\s*[:=]\s*\S+"),
    re.compile(rb"(?i)bearer\s+[a-z0-9._\-]{20,}"),
]
SKIP_DIRS = {".git", "node_modules", "dist", "__pycache__", ".venv", ".tox"}
SKIP_SUFFIX = {".png", ".jpg", ".jpeg", ".woff", ".woff2", ".zip", ".gz", ".pyc"}


def iter_files(root: Path):
    for path in root.rglob("*"):
        if not path.is_file():
            continue
        if any(part in SKIP_DIRS for part in path.parts):
            continue
        if path.suffix.lower() in SKIP_SUFFIX:
            continue
        yield path


def scan_secrets(root: Path) -> list[str]:
    hits: list[str] = []
    for path in iter_files(root):
        try:
            blob = path.read_bytes()[:1_000_000]
        except OSError:
            continue
        if any(cre.search(blob) for cre in SECRET_RES):
            hits.append(str(path.relative_to(root)))
    return hits


def payload_bytes(root: Path) -> int:
    total = 0
    for path in iter_files(root):
        try:
            total += path.stat().st_size
        except OSError:
            continue
    return total


def sample_rtt_ms(url: str, n: int) -> list[float]:
    times: list[float] = []
    for _ in range(n):
        try:
            proc = subprocess.run(
                [
                    "curl", "-s", "-o", "/dev/null", "-w", "%{time_total}",
                    "--max-time", "5", url,
                ],
                check=False,
                capture_output=True,
                text=True,
            )
        except FileNotFoundError:
            raise SystemExit("curl is required for the RTT probe")
        if proc.returncode != 0:
            continue
        try:
            times.append(float(proc.stdout.strip()) * 1000.0)
        except ValueError:
            continue
    return times


def main() -> int:
    parser = argparse.ArgumentParser()
    parser.add_argument("--payload", required=True, type=Path)
    parser.add_argument("--url", default="")
    parser.add_argument("--samples", type=int, default=5)
    parser.add_argument("--min-batch-bytes", type=int, default=32_000)
    parser.add_argument("--shape", required=True, choices=["interactive", "batch"])
    args = parser.parse_args()
    root = args.payload.expanduser().resolve()
    if not root.is_dir():
        print("payload must be a directory", file=sys.stderr)
        return 2

    hits = scan_secrets(root)
    size = payload_bytes(root)
    rtt = None
    if args.url:
        samples = sample_rtt_ms(args.url, args.samples)
        if samples:
            rtt = statistics.median(samples)

    if args.shape == "interactive":
        decision = "LOCAL_INTERACTIVE"
        why = "keystroke-loop"
    elif hits:
        decision = "LOCAL_HOLD"
        why = f"secret_hits={len(hits)}"
    elif not args.url or rtt is None:
        decision = "LOCAL_HOLD"
        why = "link_unproven"
    elif size < args.min_batch_bytes:
        decision = "LOCAL_HOLD"
        why = f"too_small={size}"
    else:
        decision = "REMOTE_BATCH_CANDIDATE"
        why = f"size={size}; rtt_ms={rtt:.1f}"

    print(f"decision={decision} why={why}")
    for rel in hits[:8]:
        print(f"hit={rel}")
    return 0


if __name__ == "__main__":
    raise SystemExit(main())

Pass a payload directory and an optional timing URL from your shell. The script prints LOCAL_INTERACTIVE, LOCAL_HOLD, or REMOTE_BATCH_CANDIDATE for each run.

LOCAL_INTERACTIVE means the work still looks like a keystroke loop. LOCAL_HOLD means secrets or a dead link still block export. REMOTE_BATCH_CANDIDATE means overflow is allowed, not that it is mandatory.

# Unexecuted local test plan with fake, non-live values only.
mkdir -p /tmp/job-clean /tmp/job-dirty
printf 'title: demo\n' > /tmp/job-clean/note.md
printf 'password=demo-not-real\n' > /tmp/job-dirty/note.md
python3 job_route.py --payload /tmp/job-dirty --shape batch --url "https://example.com/"
python3 job_route.py --payload /tmp/job-clean --shape batch --url "https://example.com/"
python3 job_route.py --payload /tmp/job-clean --shape interactive --url "https://example.com/"

Run the scanner and confirm the dirty tree stays on LOCAL_HOLD. Confirm a clean batch tree can print REMOTE_BATCH_CANDIDATE.

Then add a sleep on the timing URL or unplug the network adapter. The router should flip from candidate back to hold without debate.

Failure mode one is classifying chat as a batch because the prompt looks long. Length is not shape; shape is whether a human waits in the loop.

Failure mode two is trusting a regex and missing base64 blobs. Encoded secrets will ride inside screenshots, notebooks, and golden files.

Failure mode three is measuring RTT once on a quiet Sunday backbone. Re-run the probe at the hour you actually intend to export.

Limits

Who should ignore this workflow sits in three practical camps. People with a local model that already meets the inner loop should stay put. People under HIPAA, PCI, or similar review should not export batches this way.

Incident responders staring at unknown production data should also stay local. A free server is not a contract or an audit log.

The method also assumes curl and Python exist on the laptop. If those probes cannot run, you cannot prove the route.

A regex scrubber is not a compliance program or a legal review. Teams that cannot name the data class in the tree should not export at all.

None of this is a ranking of models or a promise about free capacity. Capacity changes. The job-shape rule does not need to change with it.

Keep the reflex off the WAN even when a remote dock looks idle. Export only crates that can survive delay, inspection, and a dropped socket.

If overflow remains after a clean receipt, try a free server as a dock. Do not move the tab key there with the crates.

Run the probes on the next oversized refactor before you open a remote tab. If the router prints HOLD, the laptop is still the honest computer.

Hash the Prompt Before You Cross the Wire

Riley Wu — Sun, 20 Sep 2026 12:01:11 +0000

Remote help is not free if the hop is slow. A prompt that never leaves disk cannot leak. The cheap path is a local cache with a measured fill.

Most coding assistants resend the same context twice. The second trip pays latency already spent. Hash the prompt and the file set first. Store the draft beside the repo. Cross the wire only on a miss.

This is not a model-quality argument. It is a path argument. Latency, secrets, and offline time decide the path. A free remote server wins only after those three checks pass.

Teams keep scoring models in public threads. They under-score the path those models travel. A stale hop can waste more time than a weak draft. A leaked token can waste more than time.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode offers free model access and a free server option. Those two facts matter only after a local ledger says the hop is clean. The ledger still works if the fill URL is a stub.

Treat the working tree as the source of truth. Treat the network as a spare lane. The spare lane opens on a cache miss. It stays closed when secrets match, when the probe is slow, or when the machine is offline.

The artifact is a content-addressed preflight. It hashes the prompt text and a sorted file list. It binds that hash to git rev-parse HEAD. It refuses to fill if a secret pattern hits. It probes one round trip before any payload moves.

Label the numbers below as a method, not a result. This draft does not claim a measured speedup. Run the script on your repo. Record your own timings. Do not borrow someone else's hop tax.

Create a directory that never gets committed. Keep drafts next to the work, not in git. A cache is a notebook, not a source of record.

mkdir -p .prompt-cache
echo ".prompt-cache/" >> .git/info/exclude
git rev-parse HEAD
python3 --version

The exclude line keeps drafts off the remote. The HEAD binding keeps drafts honest. A hash without HEAD will replay a draft onto the wrong tree. That failure looks like a smart model. It is a stale cache.

Here is a compact hasher you can run locally. It reads stdin as the prompt. It reads file paths as extra context. It writes a ledger line that later steps can parse.

# preflight_hash.py — run locally; do not ship secrets
import hashlib, json, os, sys, time
from pathlib import Path

SECRET_MARKERS = (
    "BEGIN PRIVATE KEY",
    "AWS_SECRET_ACCESS_KEY",
    "xoxb-",
    "ghp_",
)

def sha(data: bytes) -> str:
    return hashlib.sha256(data).hexdigest()

def scan(text: str) -> list[str]:
    hits = [m for m in SECRET_MARKERS if m in text]
    return hits

def read_files(paths: list[str]) -> bytes:
    blob = b""
    for p in sorted(paths):
        blob += Path(p).read_bytes()
        blob += b"\n--\n"
    return blob

def main() -> None:
    prompt = sys.stdin.read()
    files = sys.argv[1:]
    head = os.popen("git rev-parse HEAD").read().strip()
    payload = prompt.encode() + b"\0" + read_files(files)
    digest = sha(payload)
    hits = scan(prompt) + scan(payload.decode("utf-8", "replace"))
    record = {
        "head": head,
        "digest": digest,
        "bytes": len(payload),
        "files": len(files),
        "secret_hits": hits,
        "ts": int(time.time()),
    }
    Path(".prompt-cache").mkdir(exist_ok=True)
    Path(".prompt-cache/ledger.jsonl").open("a").write(
        json.dumps(record) + "\n"
    )
    print(json.dumps(record))
    if hits:
        sys.exit(2)

if __name__ == "__main__":
    main()

Exit code 2 means the hop is forbidden. The ledger still records the attempt. That record is the audit trail. A silent skip teaches nothing the next morning.

Wire the hasher to a tiny cache lookup. A hit returns the draft from disk. A miss may call a fill URL. The fill URL can be empty. Empty means stay local and stop.

# cache_fill.py — proposal: readers must supply FILL_URL
import json, os, sys, time, urllib.request
from pathlib import Path

def probe(url: str, timeout: float = 1.5) -> float | None:
    start = time.perf_counter()
    try:
        urllib.request.urlopen(url, timeout=timeout)
    except Exception:
        return None
    return time.perf_counter() - start

def main() -> None:
    record = json.loads(sys.stdin.read())
    digest = record["digest"]
    cache = Path(".prompt-cache") / f"{digest}.txt"
    if cache.exists():
        sys.stdout.write(cache.read_text())
        return
    if record.get("secret_hits"):
        raise SystemExit("refuse fill: secret hit")
    url = os.environ.get("FILL_URL", "")
    if not url:
        raise SystemExit("cache miss and no FILL_URL")
    rtt = probe(url.rstrip("/") + "/health")
    if rtt is None or rtt > 0.8:
        raise SystemExit(f"refuse fill: rtt={rtt}")
    # Payload send belongs behind your own client.
    # Keep keys on disk. Do not print them here.
    print(f"miss {digest} rtt={rtt:.3f}s", file=sys.stderr)
    raise SystemExit("fill client not wired in this sample")

if __name__ == "__main__":
    main()

The 0.8 second gate is a local policy, not a universal law. Change it after you probe your own path. A café network fails this gate often. A wired desk may pass it. The policy should follow the link, not a blog number.

A free server wins in a narrow window. The cache is cold. The secret scan is clean. The probe is fast. The laptop is already busy on a compile. Offline work is not required today. Outside that window, disk still wins.

Think of the hop as a courier. The courier is cheap when the envelope is thin. The courier is costly when the envelope holds keys. The courier is useless when the road is down. Hashing is weighing the envelope before the door opens.

Bind a test to the hasher so the policy cannot drift. The test does not call a model. It only checks that a planted marker blocks the fill.

# test_preflight_hash.py — run: pytest -q test_preflight_hash.py
import io, json, os, subprocess, sys, textwrap
from pathlib import Path

def run_hasher(prompt: str, tmp: Path) -> subprocess.CompletedProcess:
    env = os.environ.copy()
    return subprocess.run(
        [sys.executable, str(tmp / "preflight_hash.py")],
        input=prompt,
        text=True,
        capture_output=True,
        cwd=tmp,
        env=env,
    )

def test_secret_blocks_and_records(tmp_path, monkeypatch):
    src = Path("preflight_hash.py").read_text()
    (tmp_path / "preflight_hash.py").write_text(src)
    (tmp_path / ".git").mkdir()
    # Stub HEAD when git is missing in the sandbox.
    monkeypatch.setenv("PATH", os.environ["PATH"])
    prompt = "rotate ghp_exampletokenonly"
    result = run_hasher(prompt, tmp_path)
    assert result.returncode == 2
    line = (tmp_path / ".prompt-cache" / "ledger.jsonl").read_text()
    row = json.loads(line.splitlines()[-1])
    assert "ghp_" in row["secret_hits"]

If git is absent in CI, stub git rev-parse with a fixture. The point is the fail-closed path. A green test that never sees a secret is a weak test. Plant a marker. Watch the exit code.

Byte size belongs in the ledger for a reason. A 20 KB prompt and a 2 MB dump are not the same hop. Large dumps punish both local RAM and remote queues. Trim the file list before you hash. Hashing a noisy tree teaches the cache the wrong lesson.

A practical trim is the diff, not the repo. Ask git for names of changed files. Feed only those paths to the hasher. Unchanged files already live in HEAD. They do not need to ride the courier again.

PROMPT=$(cat <<'EOF'
Summarize the risk in the staged diff only.
EOF
)
FILES=$(git diff --cached --name-only)
printf '%s' "$PROMPT" | python3 preflight_hash.py $FILES \
  | python3 cache_fill.py

That pipeline is the whole workflow. It reads as one breath. Hash. Record. Refuse or fill. The assistant is downstream of the ledger. It is not the ledger.

Limitations sit in the open. SHA-256 of a prompt is not a semantic match. Two paraphrases miss the cache and pay twice. The secret list is a toy. Real scanners need your own patterns and entropy checks. The health probe is not a load test. A cheap 200 can still hide a slow generate. The sample fill client stops before it sends context. Wire that part with care.

The cache can lie if two trees share a HEAD by mistake. Worktrees and detached states need extra tags. Add git rev-parse --show-toplevel if you juggle several checkouts. Do not share .prompt-cache across machines. A draft from another clock is a rumor.

Who should not use this path. Air-gapped teams with a no-fill rule should skip the probe. They already have an answer. Regulated shops that forbid any remote model should keep FILL_URL unset. People chasing model leaderboards will hate this. The method does not rank models. It ranks paths.

Who should use it. Developers who repeat the same review prompt. People who rotate between offline trains and a desk. Anyone who has watched a key travel inside a context dump. The free server is a burst valve, not a home.

If a fill is allowed, keep credentials in a local secret store. Pass a short-lived handle to the client. Do not embed keys in the prompt. Do not log the prompt body to a shared disk. The ledger stores hashes and counts. That is enough to debug a miss.

A note on current AI talk. Measurement talk often chases bigger exams. Path talk still fits a laptop. You can hash today. You can refuse today. You can probe today. None of that waits on a new scoreboard.

Run the hasher on one real change set this week. Read the ledger line. If secret_hits is not empty, the wire did not earn the job. If the probe fails, the laptop still holds the loop. If the cache hits, you already paid once.

MonkeyCode's free model access and free server option can sit behind FILL_URL when the ledger is green. Point that URL only after the scan and the probe pass. The rest of the method does not need the product. Disk remains the default lane.

Overflow the Laptop Before You Rent Compute

Riley Wu — Sat, 19 Sep 2026 10:06:35 +0000

Remote AI is a cost, not a default. Local tools should fail before any hop. Overflow is the only honest ticket out.

Most coding prompts never need a rented box. They need grep, tests, and a tight diff. Cloud latency is a tax on small questions.

A laptop already holds the working tree. Secrets live there by design. Silence on the wire is a feature.

Teams still ship every half-formed prompt upstairs. The hop feels free because the invoice is delayed. Latency, leakage, and offline breakage still land.

This note treats that hop as a measured overflow. It does not treat remote models as craft. Craft stays on disk until the machine files a claim.

The claim that justifies a hop

Three signals can justify leaving disk. Memory pressure is the first. A secret-clean payload is the second. A live network path is the third.

Miss any one of those signals and the hop is theater. Theater looks like engineering under a chat log. It is still theater.

Latency is not a vibe. A local test loop returns in milliseconds. A remote completion adds a round trip you cannot cache.

Secrets are not a vibe either. A .env file does not become safe in a prompt wrapper. Offline work does not become optional because a server is idle.

Think of the laptop as a harbor. Cargo stays in port until the ship proves a route. A free pier still needs a bill of lading.

Where a free server actually wins

Local-first is not local-only. Burst work can exceed a fan and a stick of RAM. That is overflow, not fashion.

A free server wins when three conditions hold together. The job is bounded and reproducible. The payload has no credentials. The operator can wait on the wire.

It loses when the repo cannot leave the building. It loses when the network is a rumor. It loses when the prompt is a fishing net.

MonkeyCode enters only as an overflow lane, not a home. Disclosure: This article was prepared as part of MonkeyCode's product outreach. The lane offers free model access and a free server option. No model names, quotas, or hardware are claimed here.

Use that lane after a local veto, not before. The veto is a script, not a mood. Moods leak keys.

Artifact: a hop veto you can run

The workflow below is a proposal. Run it on a throwaway clone first. Treat the printout as a gate, not a score.

It inspects the git worktree, not the chat. It refuses remote work when secret-like paths appear. It also refuses when the payload is empty or huge.

Save this as hop_veto.py at the repo root.

#!/usr/bin/env python3
"""Propose LOCAL_ONLY or REMOTE_ELIGIBLE. Not a security scanner."""
from __future__ import annotations

import os
import subprocess
import sys
from pathlib import Path

SECRET_HINTS = (
    ".env",
    ".pem",
    "id_rsa",
    "id_ed25519",
    "credentials",
    "kubeconfig",
    ".p12",
    ".key",
)
MAX_BYTES = 250_000
MIN_BYTES = 40
OFFLINE_FLAG = Path(".offline")


def git_out(*args: str) -> str:
    r = subprocess.run(
        ["git", *args],
        check=True,
        capture_output=True,
        text=True,
    )
    return r.stdout


def worktree_paths() -> list[Path]:
    raw = git_out("ls-files", "-co", "--exclude-standard")
    root = Path(git_out("rev-parse", "--show-toplevel").strip())
    return [root / line for line in raw.splitlines() if line]


def secret_hits(paths: list[Path]) -> list[str]:
    hits = []
    for path in paths:
        name = path.name.lower()
        blob = str(path).lower()
        if any(h in name or h in blob for h in SECRET_HINTS):
            hits.append(str(path))
    return hits


def source_bytes(paths: list[Path]) -> int:
    total = 0
    for path in paths:
        if not path.is_file():
            continue
        if path.suffix.lower() not in {".py", ".ts", ".js", ".go", ".rs", ".java", ".md"}:
            continue
        try:
            total += path.stat().st_size
        except OSError:
            continue
    return total


def mem_pressure_kb() -> int | None:
    avail = Path("/proc/meminfo")
    if not avail.exists():
        return None
    for line in avail.read_text().splitlines():
        if line.startswith("MemAvailable:"):
            return int(line.split()[1])
    return None


def main() -> int:
    if not Path(".git").exists() and subprocess.run(
        ["git", "rev-parse", "--is-inside-work-tree"],
        capture_output=True,
    ).returncode != 0:
        print("LOCAL_ONLY reason=not_a_git_worktree")
        return 2

    if OFFLINE_FLAG.exists() or os.environ.get("HOP_OFFLINE") == "1":
        print("LOCAL_ONLY reason=offline_flag")
        return 3

    paths = worktree_paths()
    hits = secret_hits(paths)
    if hits:
        print("LOCAL_ONLY reason=secret_like_path")
        for hit in hits[:12]:
            print(f"  {hit}")
        return 4

    size = source_bytes(paths)
    if size < MIN_BYTES:
        print(f"LOCAL_ONLY reason=payload_too_small bytes={size}")
        return 5
    if size > MAX_BYTES:
        print(f"LOCAL_ONLY reason=payload_too_large bytes={size}")
        return 6

    avail = mem_pressure_kb()
    # Remote is eligible only when local RAM looks tight.
    if avail is not None and avail > 1_500_000:
        print(f"LOCAL_ONLY reason=ram_still_comfortable kb={avail}")
        return 7

    print(f"REMOTE_ELIGIBLE bytes={size} mem_available_kb={avail}")
    return 0


if __name__ == "__main__":
    sys.exit(main())

Run it from a clean clone, then from a dirty one. The exit code is the decision. Logs are for humans, not for models.

python3 hop_veto.py; echo exit:$?
touch .offline
python3 hop_veto.py; echo exit:$?
rm .offline
HOP_OFFLINE=1 python3 hop_veto.py; echo exit:$?

A passing remote print is not permission to paste the tree. It is permission to consider a redacted slice. Slice means files you already meant to publish.

A small rehearsal, not a benchmark

Label this rehearsal as unexecuted on your metal until you run it. The numbers below are fixtures for the gate. They are not product claims.

Create sample_app/ with one main.py and no env files. Copy hop_veto.py beside it. Init git, add the python file, and run the veto.

Expected path on a quiet Linux box is LOCAL_ONLY with ram comfort. That is correct. Comfort means the laptop still owns the loop.

Then fake pressure without hurting the host. Export a lie only inside the script if you must. A better drill is a tiny ram cgroup, if you have one.

# Fixture only. Do not treat as a load test.
git init sample_app
cd sample_app
printf 'print("ok")\n' > main.py
git add main.py
# Expect LOCAL_ONLY on a machine with spare RAM.
python3 ../hop_veto.py

Add a planted secret name and watch the gate slam. cp /dev/null .env is enough for the name check. The script does not open the file.

That miss is intentional. Name policy is cheap and local. Content scanning is a different program with a different risk.

Latency as a harbor fee

Clock the local loop before you admire a remote token stream. A unit test that returns in 80 ms is a fact. A chat round trip of two seconds is another fact.

Those facts do not need a leaderboard. They need a budget line in the runbook. If the loop is already honest, keep it.

Offline days make the budget brutal. Trains, planes, and locked-down build rooms still exist. A server that you cannot reach is not free. It is absent.

Absence is not a moral failing. It is topology. Topology belongs in the veto, which is why .offline exists.

Secrets stay a local object

A remote overflow path is still a transcript. Transcripts get copied. Copied text has a longer life than a shell history.

The veto uses ugly name matching on purpose. It is a speed bump, not a vault. Vaults belong in a real secret scanner you already trust.

Do not widen the script into a prompt packer. Packing is how keys hitch a ride. Hitchhiking keys are how local-first dies.

If the printout says REMOTE_ELIGIBLE, send a patch-sized question. Send a failing test and the function under fire. Do not send the house keys to pay the harbor fee.

When the free server is the wrong harbor

Skip this approach if you handle regulated patient data. Skip it for unpaid production incident keys. Skip it when legal holds freeze the working tree.

Skip it on air-gapped networks that must stay that way. A free server cannot join a room it cannot enter. Pretending otherwise is a outage with extra steps.

Skip it if your “overflow” is actually indecision. Indecision is a local refactor. Renting compute will not name the function.

Monorepos that blow MAX_BYTES should not raise the cap blindly. Split the question instead. The wire should carry a sample, not a district.

Windows hosts will miss /proc/meminfo. That miss fails closed toward local work. Closed is the point.

How this stays distinct from chat theater

Recent talk treats fluent generation as delivered engineering. Fluency is cheap. Review, tests, and a veto are not.

The veto does not grade prose. It grades whether the laptop already lost. If the laptop did not lose, the chat is optional.

Optional chat can still teach. Teaching does not require a payload dump. Dumping is how a cheap hop becomes an expensive story.

Keep the analogy small. Disk is the workshop. The wire is a courier. Couriers do not own the bench.

Limits you should keep in the file header

The script ignores binary assets and lockfile churn. It can under-count real context. It can over-count markdown novels in /docs.

It does not talk to any model. It does not start a server. It does not prove a remote job will finish.

It will not save you from a paste into a random box. Policy lives in habit plus review. Code only makes the habit louder.

Adjust MAX_BYTES only with a recorded reason. Reasons belong in commit messages. Silent cap changes are how gates rot.

A closing check, then stop

Start on disk. Fail on disk. Overflow only with a clean, small, online payload.

If the veto still prints REMOTE_ELIGIBLE, a free server path can take the burst. MonkeyCode is one such overflow lane after that print. Probe it with a redacted failing test, not with the whole house.

Assay the Diff Before It Travels

Riley Wu — Fri, 18 Sep 2026 08:36:38 +0000

A remote coding pass should follow a scored packet. The local git index should stay on disk. Only a bounded diff plus tests may leave.

Vibe driven uploads treat the cloud like another brain. That analogy fails for latency, secrets, and offline work.

A clinic does not mail the entire building. It mails a labeled sample with a test. Your repo index is the clinic on disk.

This gate scores the sample before any network hop. It ignores model brands and marketing names. It asks whether the packet earned travel.

Git already lists the candidate paths for you. Status and diff name dirty files without a chat. The assay reads those paths as evidence.

Chat remains a prompt sitting on the side. The packet is the thing that can move. Mixing them is how whole trees leak.

The script below is a labeled proposal only. Thresholds are starting constants, not lab measurements. Run it on your tree before you trust it.

#!/usr/bin/env python3
"""Work-packet assay. Proposal, not a published benchmark."""
from __future__ import annotations

import re
import subprocess
import sys
import tarfile
from pathlib import Path

# Proposed constants. Tune after you watch local logs.
MAX_BYTES = 256 * 1024
MAX_FILES = 12
SECRET_HITS_MAX = 0
SECRET_PATTERNS = [
    re.compile(r"AKIA[0-9A-Z]{16}"),
    re.compile(r"(?i)api[_-]?key\s*[:=]\s*\S+"),
    re.compile(r"(?i)secret\s*[:=]\s*\S+"),
    re.compile(r"-----BEGIN .*PRIVATE KEY-----"),
]
SKIP_NAMES = {".env", ".env.local", "id_rsa", "id_ed25519", "credentials"}


def git_paths() -> list[Path]:
    named = subprocess.check_output(
        ["git", "diff", "--name-only", "HEAD"], text=True
    )
    extra = subprocess.check_output(
        ["git", "ls-files", "--others", "--exclude-standard"], text=True
    )
    names = [n.strip() for n in (named + extra).splitlines() if n.strip()]
    return [Path(n) for n in names if Path(n).is_file()]


def secret_hits(text: str) -> int:
    return sum(len(p.findall(text)) for p in SECRET_PATTERNS)


def assay(paths: list[Path]) -> dict:
    files = []
    hits = 0
    total = 0
    skipped = []
    for p in paths:
        if p.name in SKIP_NAMES:
            skipped.append(str(p))
            continue
        data = p.read_bytes()
        total += len(data)
        hits += secret_hits(data.decode("utf-8", errors="ignore"))
        files.append(p)
    reasons = []
    if len(files) == 0:
        reasons.append("empty_packet")
    if len(files) > MAX_FILES:
        reasons.append("too_many_files")
    if total > MAX_BYTES:
        reasons.append("over_max_bytes")
    if hits > SECRET_HITS_MAX:
        reasons.append("secret_pattern")
    if skipped:
        reasons.append("skipped_sensitive_names")
    decision = "REMOTE" if files and not reasons else "LOCAL"
    return {
        "decision": decision,
        "file_count": len(files),
        "bytes": total,
        "secret_hits": hits,
        "skipped": skipped,
        "reasons": reasons,
        "files": [str(p) for p in files],
    }


def pack(files: list[str], dest: Path) -> None:
    with tarfile.open(dest, "w:gz") as tar:
        for f in files:
            tar.add(f)


def main() -> int:
    report = assay(git_paths())
    print(report)
    if report["decision"] != "REMOTE":
        print("stay_local", ",".join(report["reasons"]) or "no_files")
        return 2
    dest = Path("work-packet.tgz")
    pack(report["files"], dest)
    print("packet", dest, report["bytes"])
    return 0


if __name__ == "__main__":
    sys.exit(main())

Save it as assay_packet.py beside the repo root. Then run a dry pass from a dirty branch. Read the dict before you open a remote session.

git status --short
python3 assay_packet.py; echo $?
# 0 means REMOTE. 2 means stay on disk.

The exit code is the entire travel policy. A zero exit means the sample may travel. Two means the index won and the wire lost.

A free server wins on a clean small packet. It does not win on a whole monorepo tarball. It also fails when the test oracle is missing.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode provides free model access and a free server option. Those two properties fit this assay, not a blank upload.

Keep the first hop boring and measurable. Send the tarball plus one test command. Ask the remote side for a patch or log.

# Proposed remote contract. Unexecuted here. Adjust paths.
scp work-packet.tgz user@free-server:inbox/
ssh user@free-server 'mkdir -p /tmp/pkt && tar -xzf inbox/work-packet.tgz -C /tmp/pkt'
ssh user@free-server 'cd /tmp/pkt && python -m pytest -q'

That contract stays dull for a reason. Dull contracts keep secrets off the wire. They also keep latency honest with known bytes.

Latency still matters after the score prints. A 256 KiB packet still is not free. It is only cheaper than a huge context dump.

Secrets fail the assay by explicit design. Pattern hits force LOCAL even when size is tiny. Name skips catch env files that must never travel.

The skipped list is not a full secret scanner. It is a cheap tripwire at the door. Dedicated scanners still belong in local pre-commit.

Tests are the other half of the sample label. A packet without a failing test is a rumor. Add a local command and record its exit.

# Proposed test stamp. Store beside the tarball.
python -m pytest -q tests/test_touched.py
echo $? > packet-test.exit
git diff --stat HEAD > packet-diff.stat

If the local test already passes, stay local. Remote review of green tests wastes the hop. If the test cannot run offline, stop the assay.

Incomplete assays should not go remote today. Fix the oracle on disk before any hop. The cloud cannot invent a missing fixture.

Think of the score as a tariff at the dock. Heavy and dirty unlabeled cargo stays in port. Light secret-free cargo may sail after scoring.

That tariff is the engineering part of the loop. Calling a chat session engineering skips the tariff. The packet score puts a number on the claim.

Current debate around vibe coding misses this meter. The problem is not a fast local draft. The problem is an unmeasured upload wearing a lab coat.

Use the meter on one branch for a week. Log decision, bytes, and secret_hits after each run. Compare those logs with how often remote patches landed.

# Proposed log line. Append only. No extra services.
python3 assay_packet.py | tee -a .packet-assay.log

Do not parse vibes from that log. Parse the counts and the reasons field. If REMOTE never appears, your diffs are too fat.

Fat diffs mean the change set is not a sample. Split the branch until the assay prints REMOTE. Dirty diffs mean secrets or env files still sit nearby.

When REMOTE does appear, the free server is a mill. It grinds the sample and then returns grit. You still own the index and the merge.

Local-first work remains the default mill. Editors, grep, and unit tests stay on disk. The wire is a burst lane for a scored sample.

A free server option helps when local CPU is busy. It also helps when you want a clean tree. It does not help when you cannot name the files.

It does not help during a network partition. Offline hours should keep shipping inside git. The assay will keep printing LOCAL, which is correct.

Limitations are part of the method, not a footnote. The byte cap is a proposal, not physics. Binary assets will blow the cap on purpose.

Generated folders will also blow the cap. Do not add dist or node_modules to the packet. If the diff includes them, stay local and clean.

Monorepos can produce twelve tiny files that still leak. File count is a weak proxy for coupling. Read the file list before you accept REMOTE.

This approach is a poor fit for several shops. Regulated datasets should not leave the disk at all. If legal review forbids any packet, skip the wire.

It is also a poor fit without a local test command. Remote green-light theater is not an assay. Teach the test to run offline first.

Do not use this gate as a secret scanner replacement. Regex tripwires miss custom tokens and cloud roles. Keep a real scanner in the local pre-commit path.

Do not use it to justify pasting logs into random chats. The tarball contract is narrower than a prompt box. Narrower is the point of the whole assay.

If your work is single-file and already local, skip the server. The assay will often print LOCAL instead. That result is a success, not a failed product moment.

The core loop stays short on purpose. Score the dirty paths before any hop. Refuse unlabeled cargo and ship only a judged sample.

Run the assay on one dirty branch. Keep the score next to the patch.

Clock the Hop Before You Leave Disk

Riley Wu — Thu, 17 Sep 2026 06:45:16 +0000

Local codegen still beats most remote hops on wall clock. A free server only wins after the laptop queue stalls. Printed token banners do not decide that race.

The rest of this article is a timing method. It treats the network as a cost, not a default. Offline remains the honest baseline for short edits.

Think of a bicycle versus a freight train. One page does not need steel rails. You board the train only when the street is jammed.

Public AI threads this week skip that street. They argue models already outcode most working developers. They rarely clock the path those tokens travel.

Vibe-coded hops hide delay inside chat chrome. Engineering writes a budget before the first paste. The tool is a clock, not a mood.

Keep the prompt on disk at the start. Keep the repo map and the secrets there too. Send bytes only after local wait crosses a written limit.

That limit is milliseconds you can defend later. It is not taste and not a slogan. Write it down before any remote call.

The harness below is an unexecuted example. Run it on your machine only. Do not treat the constants as measured truth.

#!/usr/bin/env python3
"""local_vs_hop.py — compare local wait against a remote RTT budget.

Unexecuted example. Fill LOCAL_CMD and REMOTE_URL for your setup.
The probe never ships source, secrets, or prompts.
"""
from __future__ import annotations

import argparse
import json
import statistics
import subprocess
import time
import urllib.error
import urllib.request
from pathlib import Path

DEFAULT_BUDGET_MS = 450.0  # written limit, not a published benchmark
HOP_PAD_MS = 80.0          # starting jitter pad; recalibrate on your route


def time_local(cmd: list[str], rounds: int) -> list[float]:
    samples: list[float] = []
    for _ in range(rounds):
        t0 = time.perf_counter()
        subprocess.run(cmd, check=False, capture_output=True)
        samples.append((time.perf_counter() - t0) * 1000.0)
    return samples


def time_hop(url: str, rounds: int, timeout: float) -> list[float]:
    samples: list[float] = []
    payload = b'{"ping":true}'  # health probe, not repository text
    for _ in range(rounds):
        req = urllib.request.Request(
            url,
            data=payload,
            method="POST",
            headers={"Content-Type": "application/json"},
        )
        t0 = time.perf_counter()
        try:
            with urllib.request.urlopen(req, timeout=timeout) as resp:
                resp.read()
            samples.append((time.perf_counter() - t0) * 1000.0)
        except (urllib.error.URLError, TimeoutError):
            samples.append(float("inf"))
    return samples


def decide(local_ms: float, hop_ms: float, budget_ms: float) -> str:
    if hop_ms == float("inf"):
        return "offline: keep work on disk"
    if local_ms <= budget_ms:
        return "local: laptop still inside the budget"
    if hop_ms + HOP_PAD_MS < local_ms:
        return "hop: remote queue is materially faster"
    return "local: hop does not pay the trip"


def main() -> None:
    parser = argparse.ArgumentParser()
    parser.add_argument("--local-cmd", nargs="+", default=["python3", "-c", "pass"])
    parser.add_argument("--remote-url", default="")
    parser.add_argument("--rounds", type=int, default=7)
    parser.add_argument("--budget-ms", type=float, default=DEFAULT_BUDGET_MS)
    parser.add_argument("--out", type=Path, default=Path("hop_budget.json"))
    args = parser.parse_args()

    local = time_local(args.local_cmd, args.rounds)
    hop = (
        time_hop(args.remote_url, args.rounds, timeout=2.0)
        if args.remote_url
        else [float("inf")] * args.rounds
    )
    finite_hop = [x for x in hop if x != float("inf")]
    hop_p50 = statistics.median(finite_hop) if finite_hop else float("inf")
    report = {
        "local_p50_ms": statistics.median(local),
        "hop_p50_ms": None if hop_p50 == float("inf") else hop_p50,
        "hop_failures": sum(1 for x in hop if x == float("inf")),
        "budget_ms": args.budget_ms,
        "decision": decide(statistics.median(local), hop_p50, args.budget_ms),
    }
    args.out.write_text(json.dumps(report, indent=2) + "\n")
    print(json.dumps(report, indent=2))


if __name__ == "__main__":
    main()

Point the local command at your real inference wrapper. Point the URL at a health endpoint you control. Never attach repository text to the probe body.

python3 local_vs_hop.py \
  --local-cmd python3 -c "import time; time.sleep(0.05)" \
  --remote-url https://example.invalid/health \
  --budget-ms 450 \
  --rounds 7

Replace the sleep with the wrapper you actually run. Replace the invalid host with a probe you own. Keep the JSON beside the repo, not inside a chat log.

The JSON file is the record that matters. Median latency beats a single lucky pulse. Failure counts belong beside those medians, always.

If hop_p50_ms is null, the wire failed closed. Stay on disk and keep editing. That brownout is the offline path doing its job.

A free remote path still has a narrow role. It is the train after the street jams. It is not the default driveway for every keystroke.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode is an open-source coding project with free model access and a free server option. Those two availability notes come from the operator; this article does not add quotas, model names, or hardware claims.

Use that remote path only after the clock agrees. Local p50 has already blown the written budget. Remote p50 plus a jitter pad still beats local, and the job carries no secrets.

The pad exists because TLS and DNS stack quietly. Eighty milliseconds is a starting guess only. Recalibrate it on the route you actually use.

Calibrate with a dry loop, not a real prompt. Use the same round count each morning. Record the decision string, then delete the probe logs.

mkdir -p /tmp/hop-clock
for i in 1 2 3; do
  python3 local_vs_hop.py \
    --rounds 7 \
    --budget-ms 450 \
    --out "/tmp/hop-clock/hop_$i.json"
done
python3 - <<'PY'
import json, pathlib, statistics
rows = [json.loads(p.read_text()) for p in pathlib.Path("/tmp/hop-clock").glob("hop_*.json")]
locals_ = [r["local_p50_ms"] for r in rows]
print("local_p50_spread_ms", max(locals_) - min(locals_))
print("decisions", [r["decision"] for r in rows])
PY

Spread tells you if the laptop is thermally honest. A cold first run can flatter local inference. Warm the machine before you trust the comparison.

Even when the hop wins, strip the tree. Send a packed task file you reviewed by hand. Leave .env, credentials, and private modules on disk.

Treat keys like a hotel safe, not checked luggage. Compute may ride after the clock says so. Identity documents stay in the room.

Offline laptops are not second class in this design. They are the control group for every later hop. If local work dies without Wi-Fi, the budget was fake.

Add a tiny guard so editors fail toward disk. The snippet is a proposal, not a shipped plugin. Wire it to your own wrapper only.

# proposal: refuse a hop when the budget file is missing
from pathlib import Path
import json

BUDGET = Path("hop_budget.json")

def allow_remote_job(has_secrets: bool) -> bool:
    if has_secrets:
        return False
    if not BUDGET.exists():
        return False
    data = json.loads(BUDGET.read_text())
    return data.get("decision", "").startswith("hop:")

The decide() checks below are also proposals. They encode the gates in code you can read. They do not prove production safety on your network.

def test_decide_stays_offline_on_dead_wire():
    assert decide(120.0, float("inf"), 450.0).startswith("offline")

def test_decide_stays_local_inside_budget():
    assert decide(200.0, 40.0, 450.0).startswith("local")

def test_decide_hops_only_when_remote_is_materially_faster():
    # 900ms local, 40ms hop, 80ms pad -> hop pays
    assert decide(900.0, 40.0, 450.0).startswith("hop")

def test_decide_rejects_a_marginal_hop():
    # 500ms local, 470ms hop, pad eats the gap
    assert decide(500.0, 470.0, 450.0).startswith("local")

Run those four assertions after each harness change. A broken decision function is worse than a slow laptop. The clock is only useful if the gates stay boring.

Limitations sit in the timing shape itself. The harness times a ping, not full generation. Full generation adds queue, decode, and retry tails.

Recheck the budget on a representative job size. A health endpoint can look fast and still starve. Probe the real job shape before you ship work.

Remote health is not remote codegen. A fast /health can hide a slow queue. Treat a green probe as necessary, never sufficient.

Do not use this method to justify leaking source. A faster hop that exports the tree is still a loss. Speed does not outrank the repo door.

People in regulated air gaps should skip the hop entirely. People who need a vendor SLA should skip a free server. People without a local baseline command should not compare.

Teams that cannot name their secrets should not hop either. If you cannot list what must never leave disk, stay local. Ambiguity is not a latency budget.

Write the budget in the repo and keep it dull. Re-run the harness when the route changes. Let the clock, not the feed, pick the path.

If a hop already earned that trip, MonkeyCode's free model access and free server option can host the reviewed job. Keep the probe, the secrets, and the default loop on disk.

Park the Prompt Until the Line Is Honest

Riley Wu — Wed, 16 Sep 2026 04:48:41 +0000

A dead network should not freeze a coding session. Park each prompt on local disk first. Flush it only when three conditions hold.

Those conditions are a live line, a clean secret boundary, and a job that actually needs remote capacity. AI-assisted coding made this placement problem louder. More diffs now start as prompts, not as keystrokes.

The laptop remains the source of truth. The cloud is a mill across town. You do not haul every board through traffic.

This week’s feeds keep arguing whether models already outcode most developers. Treat that as noise, not a deployment plan. The practical question is narrower. Where does this prompt run without stalling you or leaking the repo?

The offline window is the real constraint

Cafe wifi dies in the middle of a refactor. A train enters a tunnel. A hotel captive portal sits on the first hop. None of that is exotic. It is Tuesday.

If your editor blocks on a remote model, the session stops. If the prompt sits in a local queue, you keep moving. Local search, tests, and patches still run. The mill can wait.

Think of the queue as a mailbox on the porch. The courier only comes when the road is open. The letters stay yours until then.

Latency is not one number. It is a chain. DNS, TLS, queue time, tokens, and the trip home all add up. A local grep does not pay that chain.

Secrets make the chain sharper. .env files, cookies, and private keys live on disk for a reason. A free remote box does not erase that reason. Compute can travel. Credentials should not.

When a free server actually wins

A free remote path is not a personality. It is a burst lane. Use it when the laptop is the bottleneck, not when the prompt is small.

Heavy refactors across many files can justify the hop. Long generated tests can justify it. A thermally throttled fan can justify it. A one-line rename rarely does.

Offline work still wins the morning commute. Local work still wins the secret-touched path. Remote work wins only after the line is honest and the job is large.

Do not confuse “free” with “always on.” Shared capacity is a courtesy, not an SLA. Keep production traffic off that lane.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode offers free model access and a free server option for that burst path. This article does not name models, quote quotas, or invent hardware. The method below still works if you swap the remote target.

Artifact: a disk queue with three gates

The script below is a proposed workflow. It is not a measured bake-off. It stores prompts as JSONL on disk. It refuses a flush when any gate fails.

Gate A probes connectivity with a short TCP handshake. Gate B scans attached paths for secret-like names. Gate C compares payload size to a local-first threshold you set.

Save it as prompt_queue.py.

#!/usr/bin/env python3
"""Local-first prompt queue. Proposed workflow, not a vendor SDK."""
from __future__ import annotations

import argparse
import json
import socket
import time
from pathlib import Path

QUEUE = Path.home() / ".cache" / "prompt_queue" / "jobs.jsonl"
SECRET_NAMES = {
    ".env",
    ".env.local",
    "id_rsa",
    "id_ed25519",
    "credentials.json",
    "secrets.yaml",
}
SECRET_PARTS = {".pem", ".p12", "kubeconfig"}
LOCAL_FIRST_BYTES = 32_768  # tune per team; not a benchmark


def load_jobs() -> list[dict]:
    if not QUEUE.exists():
        return []
    rows = []
    for line in QUEUE.read_text(encoding="utf-8").splitlines():
        if line.strip():
            rows.append(json.loads(line))
    return rows


def save_jobs(rows: list[dict]) -> None:
    QUEUE.parent.mkdir(parents=True, exist_ok=True)
    payload = "".join(json.dumps(r) + "\n" for r in rows)
    QUEUE.write_text(payload, encoding="utf-8")


def secret_hits(paths: list[str]) -> list[str]:
    hits = []
    for raw in paths:
        p = Path(raw)
        name = p.name.lower()
        blob = str(p).lower()
        if name in SECRET_NAMES or any(part in blob for part in SECRET_PARTS):
            hits.append(str(p))
    return hits


def payload_bytes(prompt: str, paths: list[str]) -> int:
    total = len(prompt.encode("utf-8"))
    for raw in paths:
        p = Path(raw)
        if p.is_file():
            total += p.stat().st_size
    return total


def line_is_honest(host: str, port: int, timeout: float) -> tuple[bool, float]:
    start = time.perf_counter()
    try:
        with socket.create_connection((host, port), timeout=timeout):
            pass
        return True, time.perf_counter() - start
    except OSError:
        return False, time.perf_counter() - start


def decide(job: dict, host: str, port: int) -> dict:
    live, rtt = line_is_honest(host, port, timeout=1.5)
    hits = secret_hits(job.get("paths") or [])
    size = payload_bytes(job["prompt"], job.get("paths") or [])
    if hits:
        action = "HOLD_SECRETS"
    elif not live:
        action = "HOLD_OFFLINE"
    elif size <= LOCAL_FIRST_BYTES:
        action = "LOCAL"
    else:
        action = "FLUSH"
    return {
        "action": action,
        "rtt_s": round(rtt, 4),
        "secret_hits": hits,
        "payload_bytes": size,
    }


def cmd_add(args: argparse.Namespace) -> None:
    jobs = load_jobs()
    jobs.append(
        {
            "id": int(time.time() * 1000),
            "prompt": args.prompt,
            "paths": args.paths or [],
            "created_at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
        }
    )
    save_jobs(jobs)
    print(f"queued {jobs[-1]['id']} at {QUEUE}")


def cmd_status(args: argparse.Namespace) -> None:
    jobs = load_jobs()
    if not jobs:
        print("queue empty")
        return
    for job in jobs:
        verdict = decide(job, args.host, args.port)
        print(json.dumps({"id": job["id"], **verdict}, indent=2))


def cmd_flush(args: argparse.Namespace) -> None:
    jobs = load_jobs()
    kept = []
    for job in jobs:
        verdict = decide(job, args.host, args.port)
        if verdict["action"] != "FLUSH":
            kept.append(job)
            print(f"keep {job['id']}: {verdict['action']}")
            continue
        # Proposed remote call site. Wire your own runner here.
        print(
            json.dumps(
                {
                    "flushed_id": job["id"],
                    "rtt_s": verdict["rtt_s"],
                    "payload_bytes": verdict["payload_bytes"],
                    "note": "replace this print with your remote runner",
                }
            )
        )
    save_jobs(kept)


def main() -> None:
    parser = argparse.ArgumentParser(description="Park prompts on disk until the line is honest.")
    parser.add_argument("--host", default="1.1.1.1")
    parser.add_argument("--port", type=int, default=443)
    sub = parser.add_subparsers(dest="cmd", required=True)

    add_p = sub.add_parser("add")
    add_p.add_argument("prompt")
    add_p.add_argument("--paths", nargs="*")
    add_p.set_defaults(func=cmd_add)

    st_p = sub.add_parser("status")
    st_p.set_defaults(func=cmd_status)

    fl_p = sub.add_parser("flush")
    fl_p.set_defaults(func=cmd_flush)

    args = parser.parse_args()
    args.func(args)


if __name__ == "__main__":
    main()

Run it from a throwaway clone, not from a secrets directory.

chmod +x prompt_queue.py
python3 prompt_queue.py add "sketch a retry wrapper" --paths src/http_client.py
python3 prompt_queue.py status --host example.com --port 443
python3 prompt_queue.py flush --host example.com --port 443

The status command prints a verdict per job. It does not send the prompt. The flush command only drops jobs that passed every gate. Held jobs remain on disk for the next honest line.

A companion check belongs in your shell profile. It should fail closed when the probe host is unreachable.

# proposed helper; label it as unexecuted until you time it yourself
probe_line() {
  python3 - <<'PY'
import socket, sys
try:
    socket.create_connection(("example.com", 443), timeout=1.5)
except OSError:
    sys.exit(1)
PY
}

if ! probe_line; then
  echo "line is not honest; keep the queue on disk"
fi

How to read a verdict

HOLD_OFFLINE means the mill is unreachable. Keep typing locally. Re-run status after the tunnel.

HOLD_SECRETS means a attached path looks like a credential. Strip that path. Then queue a redacted slice. Do not “just this once” the flush.

LOCAL means the payload is small enough to finish on disk. Your editor, compiler, and tests already live there. Spending a round trip on a 2 KB hint is theatre.

FLUSH means the road is open, the envelope is clean, and the crate is heavy. That is the only time a free server is the rational mill. Even then, pin the work to a branch you can delete.

Notice the order. Secrets beat connectivity. Connectivity beats size. Size never overrides a secret hit. That order is the whole policy.

A short decision matrix you can copy

Keep this table next to the script. It is a method, not a scoreboard. Fill the last column with your own timings later.

Situation	Line	Secrets in paths	Payload	Action
Train tunnel	down	no	any	HOLD_OFFLINE
Cafe wifi, `.env` attached	up	yes	any	HOLD_SECRETS
Office net, 8 KB helper	up	no	small	LOCAL
Office net, multi-file refactor	up	no	large	FLUSH
Captive portal	down or fake	no	large	HOLD_OFFLINE

The captive portal row matters. A handshake to port 443 can still lie. If the portal returns HTML, treat the line as dishonest. Add an HTTP status check before you trust FLUSH in hotels.

# proposed extra gate; run only after TCP succeeds
import urllib.request

def http_looks_real(url: str) -> bool:
    try:
        with urllib.request.urlopen(url, timeout=2) as resp:
            return 200 <= resp.status < 400 and "text/html" not in resp.headers.get("Content-Type", "")
    except Exception:
        return False

That snippet is conservative on purpose. A false negative keeps work local. A false positive ships a prompt into a login page.

Limitations

This queue does not encrypt the JSONL file. Disk access still means laptop access. Use full-disk encryption and a locked screen.

Filename heuristics miss secrets in ordinary source. A hard-coded token in app.py will pass Gate B. Pair this with a real secret scanner before any flush.

The TCP probe is not a bandwidth test. A 200 ms handshake can still precede a terrible upload. Time a small PUT yourself if the payload is large.

There are no model names here, and no token budgets. Shared free capacity can vanish without notice. Do not build a release pipeline on it.

The script never proves that remote output is better. It only proves the hop was allowed. Review stays on you.

Who should not use this

Skip this approach if policy forbids any remote inference. Air-gapped shops should delete the flush command entirely.

Skip it if your working tree is patient data, unpublished keys, or unreleased exploits. A free server is the wrong mill for that timber.

Skip it if you need guaranteed GPUs and pinned regions. A courtesy box is not a contract.

Skip it if the team already streams the whole monorepo to a hosted agent. This workflow assumes the laptop is still the door.

Close the loop on disk

Start every prompt on disk. Let tests, diffs, and redaction happen there. Move compute only when the line is honest, the envelope is clean, and the crate is heavy.

That rule survives model hype cycles. It also survives a tunnel. If a hop already passed those gates, the free remote path is one mill you can try on a throwaway branch.

Secrets Stay Local, Compute Can Travel

Riley Wu — Mon, 14 Sep 2026 22:01:28 +0000

Secrets Stay Local, Compute Can Travel

Route by data class, not by vendor. Secrets and repo material stay on disk. Bulk text transformation can take the hop. That one rule settles most local-first arguments before they start.

Last week the DEV feed argued about whether AI writes better code than people. Useful heat, wrong question for me. My daily decision is narrower: this prompt, this laptop, this link — which side runs it? That question has a stopwatch answer, not an opinion.

Measure the hop before you trust it

A local model call pays almost no network cost. It pays in CPU contention instead. Your editor, test runner, and containers share the same cores. A remote call has the opposite profile: fixed overhead first, elastic capacity after. Small payloads lose that trade every time.

So measure both sides with the same harness. Keep it dependency-free and boring.

// route.js — measure first, route second. Node 18+, no dependencies.
const LOCAL  = process.env.LOCAL_URL  ?? "http://127.0.0.1:11434/v1/chat/completions";
const REMOTE = process.env.REMOTE_URL ?? ""; // fill from docs you have verified yourself
const MODEL  = process.env.MODEL ?? "local-default";

const SECRET_PATTERNS = [
  /-----BEGIN [A-Z ]*PRIVATE KEY-----/,
  /\b(sk|ghp|glpat)-[A-Za-z0-9_-]{16,}\b/,
  /\bAKIA[0-9A-Z]{16}\b/,
];

function classify(prompt) {
  // Fail closed: anything that looks like a credential stays local.
  return SECRET_PATTERNS.some((re) => re.test(prompt)) ? "secret" : "plain";
}

async function timed(url, prompt, timeoutMs) {
  const ctl = new AbortController();
  const timer = setTimeout(() => ctl.abort(), timeoutMs);
  const start = process.hrtime.bigint();
  try {
    const res = await fetch(url, {
      method: "POST",
      signal: ctl.signal,
      headers: { "content-type": "application/json" },
      body: JSON.stringify({ model: MODEL, messages: [{ role: "user", content: prompt }] }),
    });
    if (!res.ok) throw new Error(`HTTP ${res.status}`);
    await res.text();
    return Number(process.hrtime.bigint() - start) / 1e6;
  } finally {
    clearTimeout(timer);
  }
}

function route({ kind, bytes, localMs, remoteMs }) {
  if (kind === "secret") return { side: "local", why: "data class wins" };
  if (!REMOTE) return { side: "local", why: "no remote configured" };
  if (bytes < 4096) return { side: "local", why: "hop cost dominates" };
  return remoteMs * 1.4 < localMs
    ? { side: "remote", why: "remote wins by more than 40%" }
    : { side: "local", why: "margin too thin to risk" };
}

Run it against a fixed prompt set with a repeat count, then read the medians.

LOCAL_URL=http://127.0.0.1:11434/v1/chat/completions \
REMOTE_URL=https://your-endpoint.example/v1/chat/completions \
node route.js --prompts bench/*.md --repeat 5

The 1.4 multiplier is not decoration. A remote win under forty percent disappears when your connection hiccups. Local never retries because the train entered a tunnel.

The policy function is the whole product

Three inputs decide the route: data class, payload size, measured time. Everything else is commentary. Local-first is a default setting, never a religion.

Condition	Route	Reason
Credential pattern matched	local	fail closed, no exceptions
Payload under ~4 KB	local	hop overhead exceeds token cost
Offline or captive wifi	local	availability, not speed
50 KB refactor, remote measured 3x faster	remote	elastic capacity earns the hop
Remote ahead by less than 40%	local	noise and retries eat the margin
Regulated data, no signed agreement	local	policy, not latency

Cache those measurements on disk instead of memory. A cold editor start should not re-benchmark anything. Write route.json with the last medians plus a timestamp. Re-measure when the link changes, or on a fixed weekly schedule.

Where a free server changes the calculus

The harness needs a REMOTE_URL worth testing. Standing up your own GPU box is one answer, but it is slow to provision and idle most of the day. An idle box is a cost with no measurement attached.

MonkeyCode is an open-source project that documents free model access and a free server option, so the remote branch of that policy function has somewhere to point. Disclosure: This article was prepared as part of MonkeyCode's product outreach. I am deliberately not restating a model list, hardware spec, quota, or retention policy here, because those terms change. Read the project's own docs and copy the current limits into your runbook before you route real work.

That restriction matters for one specific reason. The free server is the cheapest way to fill REMOTE_URL and obtain a real remoteMs sample. Do not let it become the default route on day one. A free tier is a measuring instrument first and a production dependency second.

What this approach does not solve

Numbers from my laptop will not transfer to your network. Measure again, and measure with the prompt sizes you actually send. Long-context jobs change shape, because uploading 200 KB of source can cost more than the inference itself. Test that case explicitly, since the break-even rarely sits where intuition places it.

Skip this design if you handle regulated data without a processor agreement. Skip it if you need a per-call audit trail and cannot log locally. Skip it if you work offline by habit, because the remote branch never fires. And skip it if you cannot run the stopwatch — an unrouted guess is just a guess with extra steps.

The rule stays small on purpose. Secrets stay local, compute can travel, and the stopwatch decides. If you want to test the hop, point REMOTE_URL at the project's free server once and run the harness on your own prompts.