DEV Community: Riley Wu

Overflow the Laptop Before You Rent Compute

Riley Wu — Sat, 19 Sep 2026 10:06:35 +0000

Remote AI is a cost, not a default. Local tools should fail before any hop. Overflow is the only honest ticket out.

Most coding prompts never need a rented box. They need grep, tests, and a tight diff. Cloud latency is a tax on small questions.

A laptop already holds the working tree. Secrets live there by design. Silence on the wire is a feature.

Teams still ship every half-formed prompt upstairs. The hop feels free because the invoice is delayed. Latency, leakage, and offline breakage still land.

This note treats that hop as a measured overflow. It does not treat remote models as craft. Craft stays on disk until the machine files a claim.

The claim that justifies a hop

Three signals can justify leaving disk. Memory pressure is the first. A secret-clean payload is the second. A live network path is the third.

Miss any one of those signals and the hop is theater. Theater looks like engineering under a chat log. It is still theater.

Latency is not a vibe. A local test loop returns in milliseconds. A remote completion adds a round trip you cannot cache.

Secrets are not a vibe either. A .env file does not become safe in a prompt wrapper. Offline work does not become optional because a server is idle.

Think of the laptop as a harbor. Cargo stays in port until the ship proves a route. A free pier still needs a bill of lading.

Where a free server actually wins

Local-first is not local-only. Burst work can exceed a fan and a stick of RAM. That is overflow, not fashion.

A free server wins when three conditions hold together. The job is bounded and reproducible. The payload has no credentials. The operator can wait on the wire.

It loses when the repo cannot leave the building. It loses when the network is a rumor. It loses when the prompt is a fishing net.

MonkeyCode enters only as an overflow lane, not a home. Disclosure: This article was prepared as part of MonkeyCode's product outreach. The lane offers free model access and a free server option. No model names, quotas, or hardware are claimed here.

Use that lane after a local veto, not before. The veto is a script, not a mood. Moods leak keys.

Artifact: a hop veto you can run

The workflow below is a proposal. Run it on a throwaway clone first. Treat the printout as a gate, not a score.

It inspects the git worktree, not the chat. It refuses remote work when secret-like paths appear. It also refuses when the payload is empty or huge.

Save this as hop_veto.py at the repo root.

#!/usr/bin/env python3
"""Propose LOCAL_ONLY or REMOTE_ELIGIBLE. Not a security scanner."""
from __future__ import annotations

import os
import subprocess
import sys
from pathlib import Path

SECRET_HINTS = (
    ".env",
    ".pem",
    "id_rsa",
    "id_ed25519",
    "credentials",
    "kubeconfig",
    ".p12",
    ".key",
)
MAX_BYTES = 250_000
MIN_BYTES = 40
OFFLINE_FLAG = Path(".offline")


def git_out(*args: str) -> str:
    r = subprocess.run(
        ["git", *args],
        check=True,
        capture_output=True,
        text=True,
    )
    return r.stdout


def worktree_paths() -> list[Path]:
    raw = git_out("ls-files", "-co", "--exclude-standard")
    root = Path(git_out("rev-parse", "--show-toplevel").strip())
    return [root / line for line in raw.splitlines() if line]


def secret_hits(paths: list[Path]) -> list[str]:
    hits = []
    for path in paths:
        name = path.name.lower()
        blob = str(path).lower()
        if any(h in name or h in blob for h in SECRET_HINTS):
            hits.append(str(path))
    return hits


def source_bytes(paths: list[Path]) -> int:
    total = 0
    for path in paths:
        if not path.is_file():
            continue
        if path.suffix.lower() not in {".py", ".ts", ".js", ".go", ".rs", ".java", ".md"}:
            continue
        try:
            total += path.stat().st_size
        except OSError:
            continue
    return total


def mem_pressure_kb() -> int | None:
    avail = Path("/proc/meminfo")
    if not avail.exists():
        return None
    for line in avail.read_text().splitlines():
        if line.startswith("MemAvailable:"):
            return int(line.split()[1])
    return None


def main() -> int:
    if not Path(".git").exists() and subprocess.run(
        ["git", "rev-parse", "--is-inside-work-tree"],
        capture_output=True,
    ).returncode != 0:
        print("LOCAL_ONLY reason=not_a_git_worktree")
        return 2

    if OFFLINE_FLAG.exists() or os.environ.get("HOP_OFFLINE") == "1":
        print("LOCAL_ONLY reason=offline_flag")
        return 3

    paths = worktree_paths()
    hits = secret_hits(paths)
    if hits:
        print("LOCAL_ONLY reason=secret_like_path")
        for hit in hits[:12]:
            print(f"  {hit}")
        return 4

    size = source_bytes(paths)
    if size < MIN_BYTES:
        print(f"LOCAL_ONLY reason=payload_too_small bytes={size}")
        return 5
    if size > MAX_BYTES:
        print(f"LOCAL_ONLY reason=payload_too_large bytes={size}")
        return 6

    avail = mem_pressure_kb()
    # Remote is eligible only when local RAM looks tight.
    if avail is not None and avail > 1_500_000:
        print(f"LOCAL_ONLY reason=ram_still_comfortable kb={avail}")
        return 7

    print(f"REMOTE_ELIGIBLE bytes={size} mem_available_kb={avail}")
    return 0


if __name__ == "__main__":
    sys.exit(main())

Run it from a clean clone, then from a dirty one. The exit code is the decision. Logs are for humans, not for models.

python3 hop_veto.py; echo exit:$?
touch .offline
python3 hop_veto.py; echo exit:$?
rm .offline
HOP_OFFLINE=1 python3 hop_veto.py; echo exit:$?

A passing remote print is not permission to paste the tree. It is permission to consider a redacted slice. Slice means files you already meant to publish.

A small rehearsal, not a benchmark

Label this rehearsal as unexecuted on your metal until you run it. The numbers below are fixtures for the gate. They are not product claims.

Create sample_app/ with one main.py and no env files. Copy hop_veto.py beside it. Init git, add the python file, and run the veto.

Expected path on a quiet Linux box is LOCAL_ONLY with ram comfort. That is correct. Comfort means the laptop still owns the loop.

Then fake pressure without hurting the host. Export a lie only inside the script if you must. A better drill is a tiny ram cgroup, if you have one.

# Fixture only. Do not treat as a load test.
git init sample_app
cd sample_app
printf 'print("ok")\n' > main.py
git add main.py
# Expect LOCAL_ONLY on a machine with spare RAM.
python3 ../hop_veto.py

Add a planted secret name and watch the gate slam. cp /dev/null .env is enough for the name check. The script does not open the file.

That miss is intentional. Name policy is cheap and local. Content scanning is a different program with a different risk.

Latency as a harbor fee

Clock the local loop before you admire a remote token stream. A unit test that returns in 80 ms is a fact. A chat round trip of two seconds is another fact.

Those facts do not need a leaderboard. They need a budget line in the runbook. If the loop is already honest, keep it.

Offline days make the budget brutal. Trains, planes, and locked-down build rooms still exist. A server that you cannot reach is not free. It is absent.

Absence is not a moral failing. It is topology. Topology belongs in the veto, which is why .offline exists.

Secrets stay a local object

A remote overflow path is still a transcript. Transcripts get copied. Copied text has a longer life than a shell history.

The veto uses ugly name matching on purpose. It is a speed bump, not a vault. Vaults belong in a real secret scanner you already trust.

Do not widen the script into a prompt packer. Packing is how keys hitch a ride. Hitchhiking keys are how local-first dies.

If the printout says REMOTE_ELIGIBLE, send a patch-sized question. Send a failing test and the function under fire. Do not send the house keys to pay the harbor fee.

When the free server is the wrong harbor

Skip this approach if you handle regulated patient data. Skip it for unpaid production incident keys. Skip it when legal holds freeze the working tree.

Skip it on air-gapped networks that must stay that way. A free server cannot join a room it cannot enter. Pretending otherwise is a outage with extra steps.

Skip it if your “overflow” is actually indecision. Indecision is a local refactor. Renting compute will not name the function.

Monorepos that blow MAX_BYTES should not raise the cap blindly. Split the question instead. The wire should carry a sample, not a district.

Windows hosts will miss /proc/meminfo. That miss fails closed toward local work. Closed is the point.

How this stays distinct from chat theater

Recent talk treats fluent generation as delivered engineering. Fluency is cheap. Review, tests, and a veto are not.

The veto does not grade prose. It grades whether the laptop already lost. If the laptop did not lose, the chat is optional.

Optional chat can still teach. Teaching does not require a payload dump. Dumping is how a cheap hop becomes an expensive story.

Keep the analogy small. Disk is the workshop. The wire is a courier. Couriers do not own the bench.

Limits you should keep in the file header

The script ignores binary assets and lockfile churn. It can under-count real context. It can over-count markdown novels in /docs.

It does not talk to any model. It does not start a server. It does not prove a remote job will finish.

It will not save you from a paste into a random box. Policy lives in habit plus review. Code only makes the habit louder.

Adjust MAX_BYTES only with a recorded reason. Reasons belong in commit messages. Silent cap changes are how gates rot.

A closing check, then stop

Start on disk. Fail on disk. Overflow only with a clean, small, online payload.

If the veto still prints REMOTE_ELIGIBLE, a free server path can take the burst. MonkeyCode is one such overflow lane after that print. Probe it with a redacted failing test, not with the whole house.

Assay the Diff Before It Travels

Riley Wu — Fri, 18 Sep 2026 08:36:38 +0000

A remote coding pass should follow a scored packet. The local git index should stay on disk. Only a bounded diff plus tests may leave.

Vibe driven uploads treat the cloud like another brain. That analogy fails for latency, secrets, and offline work.

A clinic does not mail the entire building. It mails a labeled sample with a test. Your repo index is the clinic on disk.

This gate scores the sample before any network hop. It ignores model brands and marketing names. It asks whether the packet earned travel.

Git already lists the candidate paths for you. Status and diff name dirty files without a chat. The assay reads those paths as evidence.

Chat remains a prompt sitting on the side. The packet is the thing that can move. Mixing them is how whole trees leak.

The script below is a labeled proposal only. Thresholds are starting constants, not lab measurements. Run it on your tree before you trust it.

#!/usr/bin/env python3
"""Work-packet assay. Proposal, not a published benchmark."""
from __future__ import annotations

import re
import subprocess
import sys
import tarfile
from pathlib import Path

# Proposed constants. Tune after you watch local logs.
MAX_BYTES = 256 * 1024
MAX_FILES = 12
SECRET_HITS_MAX = 0
SECRET_PATTERNS = [
    re.compile(r"AKIA[0-9A-Z]{16}"),
    re.compile(r"(?i)api[_-]?key\s*[:=]\s*\S+"),
    re.compile(r"(?i)secret\s*[:=]\s*\S+"),
    re.compile(r"-----BEGIN .*PRIVATE KEY-----"),
]
SKIP_NAMES = {".env", ".env.local", "id_rsa", "id_ed25519", "credentials"}


def git_paths() -> list[Path]:
    named = subprocess.check_output(
        ["git", "diff", "--name-only", "HEAD"], text=True
    )
    extra = subprocess.check_output(
        ["git", "ls-files", "--others", "--exclude-standard"], text=True
    )
    names = [n.strip() for n in (named + extra).splitlines() if n.strip()]
    return [Path(n) for n in names if Path(n).is_file()]


def secret_hits(text: str) -> int:
    return sum(len(p.findall(text)) for p in SECRET_PATTERNS)


def assay(paths: list[Path]) -> dict:
    files = []
    hits = 0
    total = 0
    skipped = []
    for p in paths:
        if p.name in SKIP_NAMES:
            skipped.append(str(p))
            continue
        data = p.read_bytes()
        total += len(data)
        hits += secret_hits(data.decode("utf-8", errors="ignore"))
        files.append(p)
    reasons = []
    if len(files) == 0:
        reasons.append("empty_packet")
    if len(files) > MAX_FILES:
        reasons.append("too_many_files")
    if total > MAX_BYTES:
        reasons.append("over_max_bytes")
    if hits > SECRET_HITS_MAX:
        reasons.append("secret_pattern")
    if skipped:
        reasons.append("skipped_sensitive_names")
    decision = "REMOTE" if files and not reasons else "LOCAL"
    return {
        "decision": decision,
        "file_count": len(files),
        "bytes": total,
        "secret_hits": hits,
        "skipped": skipped,
        "reasons": reasons,
        "files": [str(p) for p in files],
    }


def pack(files: list[str], dest: Path) -> None:
    with tarfile.open(dest, "w:gz") as tar:
        for f in files:
            tar.add(f)


def main() -> int:
    report = assay(git_paths())
    print(report)
    if report["decision"] != "REMOTE":
        print("stay_local", ",".join(report["reasons"]) or "no_files")
        return 2
    dest = Path("work-packet.tgz")
    pack(report["files"], dest)
    print("packet", dest, report["bytes"])
    return 0


if __name__ == "__main__":
    sys.exit(main())

Save it as assay_packet.py beside the repo root. Then run a dry pass from a dirty branch. Read the dict before you open a remote session.

git status --short
python3 assay_packet.py; echo $?
# 0 means REMOTE. 2 means stay on disk.

The exit code is the entire travel policy. A zero exit means the sample may travel. Two means the index won and the wire lost.

A free server wins on a clean small packet. It does not win on a whole monorepo tarball. It also fails when the test oracle is missing.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode provides free model access and a free server option. Those two properties fit this assay, not a blank upload.

Keep the first hop boring and measurable. Send the tarball plus one test command. Ask the remote side for a patch or log.

# Proposed remote contract. Unexecuted here. Adjust paths.
scp work-packet.tgz user@free-server:inbox/
ssh user@free-server 'mkdir -p /tmp/pkt && tar -xzf inbox/work-packet.tgz -C /tmp/pkt'
ssh user@free-server 'cd /tmp/pkt && python -m pytest -q'

That contract stays dull for a reason. Dull contracts keep secrets off the wire. They also keep latency honest with known bytes.

Latency still matters after the score prints. A 256 KiB packet still is not free. It is only cheaper than a huge context dump.

Secrets fail the assay by explicit design. Pattern hits force LOCAL even when size is tiny. Name skips catch env files that must never travel.

The skipped list is not a full secret scanner. It is a cheap tripwire at the door. Dedicated scanners still belong in local pre-commit.

Tests are the other half of the sample label. A packet without a failing test is a rumor. Add a local command and record its exit.

# Proposed test stamp. Store beside the tarball.
python -m pytest -q tests/test_touched.py
echo $? > packet-test.exit
git diff --stat HEAD > packet-diff.stat

If the local test already passes, stay local. Remote review of green tests wastes the hop. If the test cannot run offline, stop the assay.

Incomplete assays should not go remote today. Fix the oracle on disk before any hop. The cloud cannot invent a missing fixture.

Think of the score as a tariff at the dock. Heavy and dirty unlabeled cargo stays in port. Light secret-free cargo may sail after scoring.

That tariff is the engineering part of the loop. Calling a chat session engineering skips the tariff. The packet score puts a number on the claim.

Current debate around vibe coding misses this meter. The problem is not a fast local draft. The problem is an unmeasured upload wearing a lab coat.

Use the meter on one branch for a week. Log decision, bytes, and secret_hits after each run. Compare those logs with how often remote patches landed.

# Proposed log line. Append only. No extra services.
python3 assay_packet.py | tee -a .packet-assay.log

Do not parse vibes from that log. Parse the counts and the reasons field. If REMOTE never appears, your diffs are too fat.

Fat diffs mean the change set is not a sample. Split the branch until the assay prints REMOTE. Dirty diffs mean secrets or env files still sit nearby.

When REMOTE does appear, the free server is a mill. It grinds the sample and then returns grit. You still own the index and the merge.

Local-first work remains the default mill. Editors, grep, and unit tests stay on disk. The wire is a burst lane for a scored sample.

A free server option helps when local CPU is busy. It also helps when you want a clean tree. It does not help when you cannot name the files.

It does not help during a network partition. Offline hours should keep shipping inside git. The assay will keep printing LOCAL, which is correct.

Limitations are part of the method, not a footnote. The byte cap is a proposal, not physics. Binary assets will blow the cap on purpose.

Generated folders will also blow the cap. Do not add dist or node_modules to the packet. If the diff includes them, stay local and clean.

Monorepos can produce twelve tiny files that still leak. File count is a weak proxy for coupling. Read the file list before you accept REMOTE.

This approach is a poor fit for several shops. Regulated datasets should not leave the disk at all. If legal review forbids any packet, skip the wire.

It is also a poor fit without a local test command. Remote green-light theater is not an assay. Teach the test to run offline first.

Do not use this gate as a secret scanner replacement. Regex tripwires miss custom tokens and cloud roles. Keep a real scanner in the local pre-commit path.

Do not use it to justify pasting logs into random chats. The tarball contract is narrower than a prompt box. Narrower is the point of the whole assay.

If your work is single-file and already local, skip the server. The assay will often print LOCAL instead. That result is a success, not a failed product moment.

The core loop stays short on purpose. Score the dirty paths before any hop. Refuse unlabeled cargo and ship only a judged sample.

Run the assay on one dirty branch. Keep the score next to the patch.

Clock the Hop Before You Leave Disk

Riley Wu — Thu, 17 Sep 2026 06:45:16 +0000

Local codegen still beats most remote hops on wall clock. A free server only wins after the laptop queue stalls. Printed token banners do not decide that race.

The rest of this article is a timing method. It treats the network as a cost, not a default. Offline remains the honest baseline for short edits.

Think of a bicycle versus a freight train. One page does not need steel rails. You board the train only when the street is jammed.

Public AI threads this week skip that street. They argue models already outcode most working developers. They rarely clock the path those tokens travel.

Vibe-coded hops hide delay inside chat chrome. Engineering writes a budget before the first paste. The tool is a clock, not a mood.

Keep the prompt on disk at the start. Keep the repo map and the secrets there too. Send bytes only after local wait crosses a written limit.

That limit is milliseconds you can defend later. It is not taste and not a slogan. Write it down before any remote call.

The harness below is an unexecuted example. Run it on your machine only. Do not treat the constants as measured truth.

#!/usr/bin/env python3
"""local_vs_hop.py — compare local wait against a remote RTT budget.

Unexecuted example. Fill LOCAL_CMD and REMOTE_URL for your setup.
The probe never ships source, secrets, or prompts.
"""
from __future__ import annotations

import argparse
import json
import statistics
import subprocess
import time
import urllib.error
import urllib.request
from pathlib import Path

DEFAULT_BUDGET_MS = 450.0  # written limit, not a published benchmark
HOP_PAD_MS = 80.0          # starting jitter pad; recalibrate on your route


def time_local(cmd: list[str], rounds: int) -> list[float]:
    samples: list[float] = []
    for _ in range(rounds):
        t0 = time.perf_counter()
        subprocess.run(cmd, check=False, capture_output=True)
        samples.append((time.perf_counter() - t0) * 1000.0)
    return samples


def time_hop(url: str, rounds: int, timeout: float) -> list[float]:
    samples: list[float] = []
    payload = b'{"ping":true}'  # health probe, not repository text
    for _ in range(rounds):
        req = urllib.request.Request(
            url,
            data=payload,
            method="POST",
            headers={"Content-Type": "application/json"},
        )
        t0 = time.perf_counter()
        try:
            with urllib.request.urlopen(req, timeout=timeout) as resp:
                resp.read()
            samples.append((time.perf_counter() - t0) * 1000.0)
        except (urllib.error.URLError, TimeoutError):
            samples.append(float("inf"))
    return samples


def decide(local_ms: float, hop_ms: float, budget_ms: float) -> str:
    if hop_ms == float("inf"):
        return "offline: keep work on disk"
    if local_ms <= budget_ms:
        return "local: laptop still inside the budget"
    if hop_ms + HOP_PAD_MS < local_ms:
        return "hop: remote queue is materially faster"
    return "local: hop does not pay the trip"


def main() -> None:
    parser = argparse.ArgumentParser()
    parser.add_argument("--local-cmd", nargs="+", default=["python3", "-c", "pass"])
    parser.add_argument("--remote-url", default="")
    parser.add_argument("--rounds", type=int, default=7)
    parser.add_argument("--budget-ms", type=float, default=DEFAULT_BUDGET_MS)
    parser.add_argument("--out", type=Path, default=Path("hop_budget.json"))
    args = parser.parse_args()

    local = time_local(args.local_cmd, args.rounds)
    hop = (
        time_hop(args.remote_url, args.rounds, timeout=2.0)
        if args.remote_url
        else [float("inf")] * args.rounds
    )
    finite_hop = [x for x in hop if x != float("inf")]
    hop_p50 = statistics.median(finite_hop) if finite_hop else float("inf")
    report = {
        "local_p50_ms": statistics.median(local),
        "hop_p50_ms": None if hop_p50 == float("inf") else hop_p50,
        "hop_failures": sum(1 for x in hop if x == float("inf")),
        "budget_ms": args.budget_ms,
        "decision": decide(statistics.median(local), hop_p50, args.budget_ms),
    }
    args.out.write_text(json.dumps(report, indent=2) + "\n")
    print(json.dumps(report, indent=2))


if __name__ == "__main__":
    main()

Point the local command at your real inference wrapper. Point the URL at a health endpoint you control. Never attach repository text to the probe body.

python3 local_vs_hop.py \
  --local-cmd python3 -c "import time; time.sleep(0.05)" \
  --remote-url https://example.invalid/health \
  --budget-ms 450 \
  --rounds 7

Replace the sleep with the wrapper you actually run. Replace the invalid host with a probe you own. Keep the JSON beside the repo, not inside a chat log.

The JSON file is the record that matters. Median latency beats a single lucky pulse. Failure counts belong beside those medians, always.

If hop_p50_ms is null, the wire failed closed. Stay on disk and keep editing. That brownout is the offline path doing its job.

A free remote path still has a narrow role. It is the train after the street jams. It is not the default driveway for every keystroke.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode is an open-source coding project with free model access and a free server option. Those two availability notes come from the operator; this article does not add quotas, model names, or hardware claims.

Use that remote path only after the clock agrees. Local p50 has already blown the written budget. Remote p50 plus a jitter pad still beats local, and the job carries no secrets.

The pad exists because TLS and DNS stack quietly. Eighty milliseconds is a starting guess only. Recalibrate it on the route you actually use.

Calibrate with a dry loop, not a real prompt. Use the same round count each morning. Record the decision string, then delete the probe logs.

mkdir -p /tmp/hop-clock
for i in 1 2 3; do
  python3 local_vs_hop.py \
    --rounds 7 \
    --budget-ms 450 \
    --out "/tmp/hop-clock/hop_$i.json"
done
python3 - <<'PY'
import json, pathlib, statistics
rows = [json.loads(p.read_text()) for p in pathlib.Path("/tmp/hop-clock").glob("hop_*.json")]
locals_ = [r["local_p50_ms"] for r in rows]
print("local_p50_spread_ms", max(locals_) - min(locals_))
print("decisions", [r["decision"] for r in rows])
PY

Spread tells you if the laptop is thermally honest. A cold first run can flatter local inference. Warm the machine before you trust the comparison.

Even when the hop wins, strip the tree. Send a packed task file you reviewed by hand. Leave .env, credentials, and private modules on disk.

Treat keys like a hotel safe, not checked luggage. Compute may ride after the clock says so. Identity documents stay in the room.

Offline laptops are not second class in this design. They are the control group for every later hop. If local work dies without Wi-Fi, the budget was fake.

Add a tiny guard so editors fail toward disk. The snippet is a proposal, not a shipped plugin. Wire it to your own wrapper only.

# proposal: refuse a hop when the budget file is missing
from pathlib import Path
import json

BUDGET = Path("hop_budget.json")

def allow_remote_job(has_secrets: bool) -> bool:
    if has_secrets:
        return False
    if not BUDGET.exists():
        return False
    data = json.loads(BUDGET.read_text())
    return data.get("decision", "").startswith("hop:")

The decide() checks below are also proposals. They encode the gates in code you can read. They do not prove production safety on your network.

def test_decide_stays_offline_on_dead_wire():
    assert decide(120.0, float("inf"), 450.0).startswith("offline")

def test_decide_stays_local_inside_budget():
    assert decide(200.0, 40.0, 450.0).startswith("local")

def test_decide_hops_only_when_remote_is_materially_faster():
    # 900ms local, 40ms hop, 80ms pad -> hop pays
    assert decide(900.0, 40.0, 450.0).startswith("hop")

def test_decide_rejects_a_marginal_hop():
    # 500ms local, 470ms hop, pad eats the gap
    assert decide(500.0, 470.0, 450.0).startswith("local")

Run those four assertions after each harness change. A broken decision function is worse than a slow laptop. The clock is only useful if the gates stay boring.

Limitations sit in the timing shape itself. The harness times a ping, not full generation. Full generation adds queue, decode, and retry tails.

Recheck the budget on a representative job size. A health endpoint can look fast and still starve. Probe the real job shape before you ship work.

Remote health is not remote codegen. A fast /health can hide a slow queue. Treat a green probe as necessary, never sufficient.

Do not use this method to justify leaking source. A faster hop that exports the tree is still a loss. Speed does not outrank the repo door.

People in regulated air gaps should skip the hop entirely. People who need a vendor SLA should skip a free server. People without a local baseline command should not compare.

Teams that cannot name their secrets should not hop either. If you cannot list what must never leave disk, stay local. Ambiguity is not a latency budget.

Write the budget in the repo and keep it dull. Re-run the harness when the route changes. Let the clock, not the feed, pick the path.

If a hop already earned that trip, MonkeyCode's free model access and free server option can host the reviewed job. Keep the probe, the secrets, and the default loop on disk.

Park the Prompt Until the Line Is Honest

Riley Wu — Wed, 16 Sep 2026 04:48:41 +0000

A dead network should not freeze a coding session. Park each prompt on local disk first. Flush it only when three conditions hold.

Those conditions are a live line, a clean secret boundary, and a job that actually needs remote capacity. AI-assisted coding made this placement problem louder. More diffs now start as prompts, not as keystrokes.

The laptop remains the source of truth. The cloud is a mill across town. You do not haul every board through traffic.

This week’s feeds keep arguing whether models already outcode most developers. Treat that as noise, not a deployment plan. The practical question is narrower. Where does this prompt run without stalling you or leaking the repo?

The offline window is the real constraint

Cafe wifi dies in the middle of a refactor. A train enters a tunnel. A hotel captive portal sits on the first hop. None of that is exotic. It is Tuesday.

If your editor blocks on a remote model, the session stops. If the prompt sits in a local queue, you keep moving. Local search, tests, and patches still run. The mill can wait.

Think of the queue as a mailbox on the porch. The courier only comes when the road is open. The letters stay yours until then.

Latency is not one number. It is a chain. DNS, TLS, queue time, tokens, and the trip home all add up. A local grep does not pay that chain.

Secrets make the chain sharper. .env files, cookies, and private keys live on disk for a reason. A free remote box does not erase that reason. Compute can travel. Credentials should not.

When a free server actually wins

A free remote path is not a personality. It is a burst lane. Use it when the laptop is the bottleneck, not when the prompt is small.

Heavy refactors across many files can justify the hop. Long generated tests can justify it. A thermally throttled fan can justify it. A one-line rename rarely does.

Offline work still wins the morning commute. Local work still wins the secret-touched path. Remote work wins only after the line is honest and the job is large.

Do not confuse “free” with “always on.” Shared capacity is a courtesy, not an SLA. Keep production traffic off that lane.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode offers free model access and a free server option for that burst path. This article does not name models, quote quotas, or invent hardware. The method below still works if you swap the remote target.

Artifact: a disk queue with three gates

The script below is a proposed workflow. It is not a measured bake-off. It stores prompts as JSONL on disk. It refuses a flush when any gate fails.

Gate A probes connectivity with a short TCP handshake. Gate B scans attached paths for secret-like names. Gate C compares payload size to a local-first threshold you set.

Save it as prompt_queue.py.

#!/usr/bin/env python3
"""Local-first prompt queue. Proposed workflow, not a vendor SDK."""
from __future__ import annotations

import argparse
import json
import socket
import time
from pathlib import Path

QUEUE = Path.home() / ".cache" / "prompt_queue" / "jobs.jsonl"
SECRET_NAMES = {
    ".env",
    ".env.local",
    "id_rsa",
    "id_ed25519",
    "credentials.json",
    "secrets.yaml",
}
SECRET_PARTS = {".pem", ".p12", "kubeconfig"}
LOCAL_FIRST_BYTES = 32_768  # tune per team; not a benchmark


def load_jobs() -> list[dict]:
    if not QUEUE.exists():
        return []
    rows = []
    for line in QUEUE.read_text(encoding="utf-8").splitlines():
        if line.strip():
            rows.append(json.loads(line))
    return rows


def save_jobs(rows: list[dict]) -> None:
    QUEUE.parent.mkdir(parents=True, exist_ok=True)
    payload = "".join(json.dumps(r) + "\n" for r in rows)
    QUEUE.write_text(payload, encoding="utf-8")


def secret_hits(paths: list[str]) -> list[str]:
    hits = []
    for raw in paths:
        p = Path(raw)
        name = p.name.lower()
        blob = str(p).lower()
        if name in SECRET_NAMES or any(part in blob for part in SECRET_PARTS):
            hits.append(str(p))
    return hits


def payload_bytes(prompt: str, paths: list[str]) -> int:
    total = len(prompt.encode("utf-8"))
    for raw in paths:
        p = Path(raw)
        if p.is_file():
            total += p.stat().st_size
    return total


def line_is_honest(host: str, port: int, timeout: float) -> tuple[bool, float]:
    start = time.perf_counter()
    try:
        with socket.create_connection((host, port), timeout=timeout):
            pass
        return True, time.perf_counter() - start
    except OSError:
        return False, time.perf_counter() - start


def decide(job: dict, host: str, port: int) -> dict:
    live, rtt = line_is_honest(host, port, timeout=1.5)
    hits = secret_hits(job.get("paths") or [])
    size = payload_bytes(job["prompt"], job.get("paths") or [])
    if hits:
        action = "HOLD_SECRETS"
    elif not live:
        action = "HOLD_OFFLINE"
    elif size <= LOCAL_FIRST_BYTES:
        action = "LOCAL"
    else:
        action = "FLUSH"
    return {
        "action": action,
        "rtt_s": round(rtt, 4),
        "secret_hits": hits,
        "payload_bytes": size,
    }


def cmd_add(args: argparse.Namespace) -> None:
    jobs = load_jobs()
    jobs.append(
        {
            "id": int(time.time() * 1000),
            "prompt": args.prompt,
            "paths": args.paths or [],
            "created_at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
        }
    )
    save_jobs(jobs)
    print(f"queued {jobs[-1]['id']} at {QUEUE}")


def cmd_status(args: argparse.Namespace) -> None:
    jobs = load_jobs()
    if not jobs:
        print("queue empty")
        return
    for job in jobs:
        verdict = decide(job, args.host, args.port)
        print(json.dumps({"id": job["id"], **verdict}, indent=2))


def cmd_flush(args: argparse.Namespace) -> None:
    jobs = load_jobs()
    kept = []
    for job in jobs:
        verdict = decide(job, args.host, args.port)
        if verdict["action"] != "FLUSH":
            kept.append(job)
            print(f"keep {job['id']}: {verdict['action']}")
            continue
        # Proposed remote call site. Wire your own runner here.
        print(
            json.dumps(
                {
                    "flushed_id": job["id"],
                    "rtt_s": verdict["rtt_s"],
                    "payload_bytes": verdict["payload_bytes"],
                    "note": "replace this print with your remote runner",
                }
            )
        )
    save_jobs(kept)


def main() -> None:
    parser = argparse.ArgumentParser(description="Park prompts on disk until the line is honest.")
    parser.add_argument("--host", default="1.1.1.1")
    parser.add_argument("--port", type=int, default=443)
    sub = parser.add_subparsers(dest="cmd", required=True)

    add_p = sub.add_parser("add")
    add_p.add_argument("prompt")
    add_p.add_argument("--paths", nargs="*")
    add_p.set_defaults(func=cmd_add)

    st_p = sub.add_parser("status")
    st_p.set_defaults(func=cmd_status)

    fl_p = sub.add_parser("flush")
    fl_p.set_defaults(func=cmd_flush)

    args = parser.parse_args()
    args.func(args)


if __name__ == "__main__":
    main()

Run it from a throwaway clone, not from a secrets directory.

chmod +x prompt_queue.py
python3 prompt_queue.py add "sketch a retry wrapper" --paths src/http_client.py
python3 prompt_queue.py status --host example.com --port 443
python3 prompt_queue.py flush --host example.com --port 443

The status command prints a verdict per job. It does not send the prompt. The flush command only drops jobs that passed every gate. Held jobs remain on disk for the next honest line.

A companion check belongs in your shell profile. It should fail closed when the probe host is unreachable.

# proposed helper; label it as unexecuted until you time it yourself
probe_line() {
  python3 - <<'PY'
import socket, sys
try:
    socket.create_connection(("example.com", 443), timeout=1.5)
except OSError:
    sys.exit(1)
PY
}

if ! probe_line; then
  echo "line is not honest; keep the queue on disk"
fi

How to read a verdict

HOLD_OFFLINE means the mill is unreachable. Keep typing locally. Re-run status after the tunnel.

HOLD_SECRETS means a attached path looks like a credential. Strip that path. Then queue a redacted slice. Do not “just this once” the flush.

LOCAL means the payload is small enough to finish on disk. Your editor, compiler, and tests already live there. Spending a round trip on a 2 KB hint is theatre.

FLUSH means the road is open, the envelope is clean, and the crate is heavy. That is the only time a free server is the rational mill. Even then, pin the work to a branch you can delete.

Notice the order. Secrets beat connectivity. Connectivity beats size. Size never overrides a secret hit. That order is the whole policy.

A short decision matrix you can copy

Keep this table next to the script. It is a method, not a scoreboard. Fill the last column with your own timings later.

Situation	Line	Secrets in paths	Payload	Action
Train tunnel	down	no	any	HOLD_OFFLINE
Cafe wifi, `.env` attached	up	yes	any	HOLD_SECRETS
Office net, 8 KB helper	up	no	small	LOCAL
Office net, multi-file refactor	up	no	large	FLUSH
Captive portal	down or fake	no	large	HOLD_OFFLINE

The captive portal row matters. A handshake to port 443 can still lie. If the portal returns HTML, treat the line as dishonest. Add an HTTP status check before you trust FLUSH in hotels.

# proposed extra gate; run only after TCP succeeds
import urllib.request

def http_looks_real(url: str) -> bool:
    try:
        with urllib.request.urlopen(url, timeout=2) as resp:
            return 200 <= resp.status < 400 and "text/html" not in resp.headers.get("Content-Type", "")
    except Exception:
        return False

That snippet is conservative on purpose. A false negative keeps work local. A false positive ships a prompt into a login page.

Limitations

This queue does not encrypt the JSONL file. Disk access still means laptop access. Use full-disk encryption and a locked screen.

Filename heuristics miss secrets in ordinary source. A hard-coded token in app.py will pass Gate B. Pair this with a real secret scanner before any flush.

The TCP probe is not a bandwidth test. A 200 ms handshake can still precede a terrible upload. Time a small PUT yourself if the payload is large.

There are no model names here, and no token budgets. Shared free capacity can vanish without notice. Do not build a release pipeline on it.

The script never proves that remote output is better. It only proves the hop was allowed. Review stays on you.

Who should not use this

Skip this approach if policy forbids any remote inference. Air-gapped shops should delete the flush command entirely.

Skip it if your working tree is patient data, unpublished keys, or unreleased exploits. A free server is the wrong mill for that timber.

Skip it if you need guaranteed GPUs and pinned regions. A courtesy box is not a contract.

Skip it if the team already streams the whole monorepo to a hosted agent. This workflow assumes the laptop is still the door.

Close the loop on disk

Start every prompt on disk. Let tests, diffs, and redaction happen there. Move compute only when the line is honest, the envelope is clean, and the crate is heavy.

That rule survives model hype cycles. It also survives a tunnel. If a hop already passed those gates, the free remote path is one mill you can try on a throwaway branch.

Secrets Stay Local, Compute Can Travel

Riley Wu — Mon, 14 Sep 2026 22:01:28 +0000

Secrets Stay Local, Compute Can Travel

Route by data class, not by vendor. Secrets and repo material stay on disk. Bulk text transformation can take the hop. That one rule settles most local-first arguments before they start.

Last week the DEV feed argued about whether AI writes better code than people. Useful heat, wrong question for me. My daily decision is narrower: this prompt, this laptop, this link — which side runs it? That question has a stopwatch answer, not an opinion.

Measure the hop before you trust it

A local model call pays almost no network cost. It pays in CPU contention instead. Your editor, test runner, and containers share the same cores. A remote call has the opposite profile: fixed overhead first, elastic capacity after. Small payloads lose that trade every time.

So measure both sides with the same harness. Keep it dependency-free and boring.

// route.js — measure first, route second. Node 18+, no dependencies.
const LOCAL  = process.env.LOCAL_URL  ?? "http://127.0.0.1:11434/v1/chat/completions";
const REMOTE = process.env.REMOTE_URL ?? ""; // fill from docs you have verified yourself
const MODEL  = process.env.MODEL ?? "local-default";

const SECRET_PATTERNS = [
  /-----BEGIN [A-Z ]*PRIVATE KEY-----/,
  /\b(sk|ghp|glpat)-[A-Za-z0-9_-]{16,}\b/,
  /\bAKIA[0-9A-Z]{16}\b/,
];

function classify(prompt) {
  // Fail closed: anything that looks like a credential stays local.
  return SECRET_PATTERNS.some((re) => re.test(prompt)) ? "secret" : "plain";
}

async function timed(url, prompt, timeoutMs) {
  const ctl = new AbortController();
  const timer = setTimeout(() => ctl.abort(), timeoutMs);
  const start = process.hrtime.bigint();
  try {
    const res = await fetch(url, {
      method: "POST",
      signal: ctl.signal,
      headers: { "content-type": "application/json" },
      body: JSON.stringify({ model: MODEL, messages: [{ role: "user", content: prompt }] }),
    });
    if (!res.ok) throw new Error(`HTTP ${res.status}`);
    await res.text();
    return Number(process.hrtime.bigint() - start) / 1e6;
  } finally {
    clearTimeout(timer);
  }
}

function route({ kind, bytes, localMs, remoteMs }) {
  if (kind === "secret") return { side: "local", why: "data class wins" };
  if (!REMOTE) return { side: "local", why: "no remote configured" };
  if (bytes < 4096) return { side: "local", why: "hop cost dominates" };
  return remoteMs * 1.4 < localMs
    ? { side: "remote", why: "remote wins by more than 40%" }
    : { side: "local", why: "margin too thin to risk" };
}

Run it against a fixed prompt set with a repeat count, then read the medians.

LOCAL_URL=http://127.0.0.1:11434/v1/chat/completions \
REMOTE_URL=https://your-endpoint.example/v1/chat/completions \
node route.js --prompts bench/*.md --repeat 5

The 1.4 multiplier is not decoration. A remote win under forty percent disappears when your connection hiccups. Local never retries because the train entered a tunnel.

The policy function is the whole product

Three inputs decide the route: data class, payload size, measured time. Everything else is commentary. Local-first is a default setting, never a religion.

Condition	Route	Reason
Credential pattern matched	local	fail closed, no exceptions
Payload under ~4 KB	local	hop overhead exceeds token cost
Offline or captive wifi	local	availability, not speed
50 KB refactor, remote measured 3x faster	remote	elastic capacity earns the hop
Remote ahead by less than 40%	local	noise and retries eat the margin
Regulated data, no signed agreement	local	policy, not latency

Cache those measurements on disk instead of memory. A cold editor start should not re-benchmark anything. Write route.json with the last medians plus a timestamp. Re-measure when the link changes, or on a fixed weekly schedule.

Where a free server changes the calculus

The harness needs a REMOTE_URL worth testing. Standing up your own GPU box is one answer, but it is slow to provision and idle most of the day. An idle box is a cost with no measurement attached.

MonkeyCode is an open-source project that documents free model access and a free server option, so the remote branch of that policy function has somewhere to point. Disclosure: This article was prepared as part of MonkeyCode's product outreach. I am deliberately not restating a model list, hardware spec, quota, or retention policy here, because those terms change. Read the project's own docs and copy the current limits into your runbook before you route real work.

That restriction matters for one specific reason. The free server is the cheapest way to fill REMOTE_URL and obtain a real remoteMs sample. Do not let it become the default route on day one. A free tier is a measuring instrument first and a production dependency second.

What this approach does not solve

Numbers from my laptop will not transfer to your network. Measure again, and measure with the prompt sizes you actually send. Long-context jobs change shape, because uploading 200 KB of source can cost more than the inference itself. Test that case explicitly, since the break-even rarely sits where intuition places it.

Skip this design if you handle regulated data without a processor agreement. Skip it if you need a per-call audit trail and cannot log locally. Skip it if you work offline by habit, because the remote branch never fires. And skip it if you cannot run the stopwatch — an unrouted guess is just a guess with extra steps.

The rule stays small on purpose. Secrets stay local, compute can travel, and the stopwatch decides. If you want to test the hop, point REMOTE_URL at the project's free server once and run the harness on your own prompts.

Keep the Key on Disk Until Burst Work Pays

Riley Wu — Sun, 13 Sep 2026 20:56:46 +0000

A remote hop is a cost, not a default. Secrets belong on disk, not on the wire. Offline work stays local until a clean burst justifies rent.

Most agent loops invert that order. They post context on the first tool call. The wire then holds both the prompt and the credential.

That pattern fails in three coupled ways. Latency compounds on every round trip. Secrets leak into logs you do not own. A dead link kills work that could have stayed on disk.

The fix is a gate, not a slogan. Scan the payload before DNS. Probe the link without the body. Send work only when the burst is large and the key stays home.

The split most loops skip

Think of the laptop as a locked workshop. The cloud is a rented mill down the road. You do not haul the safe to the mill. You haul lumber that carries no serial numbers.

Agent frameworks blur that line on purpose. A tool function looks local in the editor. The HTTP client still leaves the box. One header can lift an API token from .env and park it in a vendor log.

Offline is the second trap, not a rare edge. A café radio drop should not freeze a refactor. Local CPU can still lint, grep, and patch. The mill can wait until the radio returns.

A free remote server still has a narrow role. Large summaries burn local fans for little gain. A scrubbed corpus can ride a cheap hop. The key must never ride with that corpus.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode offers free model access and a free server option. Those two facts matter only after the gate below passes. They do not replace a local secret check, and they do not make a shared hop suitable for regulated data.

A preflight that refuses dirty hops

The following Node script is a worked example. It is not a benchmark and not a security audit. Run it as a gate in front of any remote client you already control.

// preflight-hop.mjs — example gate, not a security audit
import fs from "node:fs";
import http from "node:http";
import https from "node:https";
import { URL } from "node:url";

const SECRET_RE = [
  /api[_-]?key\s*[:=]\s*['"][^'"]+['"]/i,
  /secret\s*[:=]\s*['"][^'"]+['"]/i,
  /bearer\s+[a-z0-9._\-]{20,}/i,
  /-----BEGIN [A-Z ]*PRIVATE KEY-----/,
  /AKIA[0-9A-Z]{16}/,
];

const ENV_HINT = /\b(process\.env|Deno\.env|os\.environ)\b/;

export function findSecretHits(text) {
  const hits = [];
  for (const re of SECRET_RE) {
    if (re.test(text)) hits.push(re.source);
  }
  if (ENV_HINT.test(text)) hits.push("env-reference");
  return hits;
}

export function payloadBytes(text) {
  return Buffer.byteLength(text, "utf8");
}

// Example threshold only. Tune on your own traces.
const BURST_BYTES = 24 * 1024;

export function classifyHop({ text, online, allowRemote }) {
  const hits = findSecretHits(text);
  if (hits.length) {
    return { action: "local-only", reason: "secret-pattern", hits };
  }
  if (!online) {
    return { action: "local-only", reason: "offline" };
  }
  if (!allowRemote) {
    return { action: "local-only", reason: "policy" };
  }
  if (payloadBytes(text) < BURST_BYTES) {
    return { action: "local-only", reason: "small-burst" };
  }
  return { action: "remote-ok", reason: "clean-burst" };
}

The classifier is boring on purpose. Boring gates survive weekends. Fancy scorers tend to ship the key because a score looks like permission.

A hop probe must not include the prompt. Ping a health path with an empty body. Time that ping and store the result on disk. Reuse it for the next loop tick instead of probing on every token.

export function probeLink(rawUrl, timeoutMs = 800) {
  return new Promise((resolve) => {
    let settled = false;
    const u = new URL(rawUrl);
    const lib = u.protocol === "https:" ? https : http;
    const t0 = Date.now();
    const req = lib.request(
      {
        hostname: u.hostname,
        port: u.port || (u.protocol === "https:" ? 443 : 80),
        path: "/health",
        method: "HEAD",
        timeout: timeoutMs,
      },
      (res) => {
        if (settled) return;
        settled = true;
        resolve({ online: res.statusCode < 500, rttMs: Date.now() - t0 });
      }
    );
    req.on("timeout", () => {
      req.destroy();
      if (!settled) {
        settled = true;
        resolve({ online: false, rttMs: timeoutMs });
      }
    });
    req.on("error", () => {
      if (!settled) {
        settled = true;
        resolve({ online: false, rttMs: -1 });
      }
    });
    req.end();
  });
}

Wire those two functions in the agent entrypoint. Read the planned prompt from disk first. Classify it before any socket opens. Probe only if classification already says remote-ok.

import fs from "node:fs";
import { classifyHop, probeLink } from "./preflight-hop.mjs";

export async function planHop(promptPath, remoteHealthUrl) {
  const text = fs.readFileSync(promptPath, "utf8");
  const first = classifyHop({ text, online: true, allowRemote: true });
  if (first.action !== "remote-ok") return first;

  const link = await probeLink(remoteHealthUrl);
  return classifyHop({
    text,
    online: link.online,
    allowRemote: true,
  });
}

That order matters more than the regex list. Secrets fail closed before DNS. Offline fails closed before tokens spend. Small bursts stay on the fan you already paid for.

What a free server actually wins

A free remote hop wins on bulk, not on chat. Fold a large log into a summary after hosts are stripped. Cluster stack traces that no longer name customers. Draft a changelog from public diffs that already left the repo.

It loses when the file is a keyring. It loses when the train has no radio. It loses when the patch is twenty lines. Local grep still beats a long RTT on tiny work, even when the remote mill is priced at zero.

Zero price is not zero risk. A mill you did not rack still logs. A mill you did not rack still queues. Your gate still owns the key, and the mill still sees whatever you actually posted.

Do not treat free capacity as a reason to skip the scan. Treat it as burst overflow for already-clean text. If the classifier returns local-only, the mill does not get a vote.

If you need a remote burst without standing up hardware, MonkeyCode's free model access and free server option can sit behind planHop. Use them only after the local checks pass.

A tiny test you can rerun

Label this as a test plan, not a published metric. Save three fixtures beside the gate. Run the classifier and expect three different actions. The point is the branch table, not a scoreboard.

// preflight-hop.test.mjs — example assertions
import assert from "node:assert/strict";
import { classifyHop } from "./preflight-hop.mjs";

const secret = 'const k = "AKIAIOSFODNN7EXAMPLE";\n';
const tiny = "refactor the names in src/util.js\n";
const burst = "x".repeat(30 * 1024);

assert.equal(
  classifyHop({ text: secret, online: true, allowRemote: true }).action,
  "local-only"
);
assert.equal(
  classifyHop({ text: tiny, online: true, allowRemote: true }).reason,
  "small-burst"
);
assert.equal(
  classifyHop({ text: burst, online: false, allowRemote: true }).reason,
  "offline"
);
assert.equal(
  classifyHop({ text: burst, online: true, allowRemote: true }).action,
  "remote-ok"
);

console.log("preflight fixtures passed");

Run it with node preflight-hop.test.mjs. Add a fourth fixture that embeds process.env.OPENAI_KEY if your agents quote env names. The ENV_HINT branch exists because many prompts leak by reference, not by value.

Keep the fixtures in git. A gate without fixtures drifts. The next intern will raise BURST_BYTES and ship a .pem by accident.

Limitations the gate will not hide

Regex is not a vault, and it never will be. It misses custom headers and binary keystores. It misses secrets split across chunked tool calls. Rotate keys if a hop already fired with a dirty body.

The health HEAD can lie in ordinary networks. A 200 on /health does not mean spare capacity. A captive portal can look online while eating POST bodies. Keep a manual override on disk for travel days.

The byte threshold is an example, not science. Twenty-four kilobytes is a placeholder for “too small to rent the mill.” Measure your own local tokens per second if you need a real cutoff. Do not copy this number into policy documents.

This gate does not encrypt the disk under the prompt. Full-disk encryption is a separate control. So is OS keychain use. So is refusing to paste .env into any chat box, local or remote.

Shared free servers also do not provide tenancy you can point at in an audit. If a contract requires a VPC, this hop is the wrong mill. Price zero does not change the isolation story.

Who should skip this approach

Skip it if your runtime cannot read the prompt before send. Some hosted agent UIs fire the HTTP call inside a black box. A gate you cannot insert is theater, and theater ships keys.

Skip it if the workload is already a public corpus. Scrubbing empty air wastes a loop tick. Ship the public tarball and keep the keyring on the laptop.

Skip it if you need guaranteed isolation for customer data. A free shared server is still shared. Regulated transcripts should not take that hop. Use a contract, a private endpoint, and a review, not a health check.

Local-first is a default, not a vow. Keep the key on disk. Keep the loop alive when the radio dies. Rent the mill only for a clean burst that earned the wire.

Fail Closed at the Repo Door

Riley Wu — Sat, 12 Sep 2026 18:59:07 +0000

Local work remains the default path for every repo job. A free remote hop is a privilege the wire must earn. Three checks decide whether bytes may leave disk at all.

Those checks cover leak risk, round-trip time, and link state. Fail any check and the job stays on the laptop.

A repo is a house with keys still in the bowl. A remote model is a truck on a public road. The truck can haul a heavy crate across town.

It should never roll away with the house keys. Small local edits rarely justify sending that public truck. Twenty tool hops turn a modest ping into seconds.

Local grep does not pay a handshake tax today. Offline is not an exotic outage in real work. Trains, planes, and locked labs still cut the socket.

A workflow that dies without a link is already broken. Build the door so missing sockets keep keys home.

The bouncer does not send bytes

The gate is a small Node script beside the repo. It reads a job path and a few flags. It returns local or remote and then exits.

Think of it as a bouncer at a club door. The bouncer does not sing on stage. The bouncer only checks IDs and pockets.

Check one scans text for secret assignment shapes. Check two samples one round trip on the wire. Check three honors an explicit offline flag from the operator.

The scanner is deliberately dumb on purpose here. Dumb scanners fail closed more often than they boast. A vault team can replace the regex later without moving the door.

// fail-closed-gate.mjs
import { readFile } from 'node:fs/promises';
import { resolve } from 'node:path';

const SECRET_RE = [
  /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/,
  /(?:API[_-]?KEY|SECRET|TOKEN|PASSWORD)\s*[:=]\s*['"][^'"]{8,}['"]/i,
  /AKIA[0-9A-Z]{16}/,
];

const DENY_NAMES = ['.env', '.env.local', 'credentials.json', 'id_rsa'];

export function pathDenied(filePath) {
  const base = filePath.split(/[\\/]/).pop();
  return DENY_NAMES.includes(base);
}

export function scanSecrets(text) {
  return SECRET_RE.some((re) => re.test(text));
}

export function decideHop({ denied, leaked, offline, rttMs, budgetMs }) {
  if (denied || leaked || offline) {
    return { route: 'local', reason: 'fail_closed' };
  }
  if (rttMs == null || rttMs > budgetMs) {
    return { route: 'local', reason: 'slow_or_unknown_link' };
  }
  return { route: 'remote', reason: 'burst_allowed' };
}

export async function inspectJob(filePath, opts = {}) {
  const offline = opts.offline ?? false;
  const rttMs = opts.rttMs ?? null;
  const budgetMs = opts.budgetMs ?? 150;
  const abs = resolve(filePath);
  const denied = pathDenied(abs);
  const text = denied ? '' : await readFile(abs, 'utf8');
  const leaked = denied || scanSecrets(text);
  const decision = decideHop({ denied, leaked, offline, rttMs, budgetMs });
  return { file: abs, denied, leaked, offline, rttMs, ...decision };
}

The function never opens a socket by itself. That separation is the whole point of a bouncer. Transport stays in a different file you can audit.

Denied names never even get read into a prompt buffer. That extra lock costs almost nothing on disk. It blocks the usual accident of shipping .env in a bundle.

Exercise the gate on a dotenv path with this command. Paste nothing into a remote form for this check. The printed route should stay local on that path.

node --input-type=module -e "import { inspectJob } from './fail-closed-gate.mjs'; console.log(JSON.stringify(await inspectJob('.env', { rttMs: 40 })))"

Sample the wire once, then log it

Do not guess latency from a hallway story. Sample one HEAD request against a host you already trust. Store that number next to the route decision.

// probe-rtt.mjs
export async function probeRtt(url, timeoutMs = 800) {
  const start = performance.now();
  const ctrl = new AbortController();
  const timer = setTimeout(() => ctrl.abort(), timeoutMs);
  try {
    await fetch(url, { method: 'HEAD', signal: ctrl.signal });
    return Math.round(performance.now() - start);
  } catch {
    return null;
  } finally {
    clearTimeout(timer);
  }
}

Wire the probe to the gate with a second command. Pass null through when the HEAD fails. The bouncer must see that miss as a local vote.

node --input-type=module -e "import { probeRtt } from './probe-rtt.mjs'; import { inspectJob } from './fail-closed-gate.mjs'; const rttMs = await probeRtt('https://example.com'); console.log(JSON.stringify(await inspectJob('README.md', { rttMs })))"

A null result means the link failed the job. The gate then stays on disk without debate. Fail-closed beats a lucky retry that leaks a key.

A 150 ms budget is a lab default only. Tune it on your actual route later. Keep the budget in the JSON log, not in folklore.

Head probes measure setup cost, not model quality. They tell you if the truck is even in the driveway. They do not tell you if the crate will be packed well.

Tests that do not need the internet

A gate without tests is only a mood. The cases below use Node's built-in test runner. They never touch a network stack in CI.

// fail-closed-gate.test.mjs
import test from 'node:test';
import assert from 'node:assert/strict';
import { decideHop, scanSecrets, pathDenied } from './fail-closed-gate.mjs';

test('env path never leaves disk', () => {
  assert.equal(pathDenied('/repo/.env'), true);
  const d = decideHop({
    denied: true,
    leaked: false,
    offline: false,
    rttMs: 40,
    budgetMs: 150,
  });
  assert.equal(d.route, 'local');
});

test('token assignment blocks the hop', () => {
  assert.equal(scanSecrets("API_KEY='w3x4y5z6a7b8c9d0'"), true);
});

test('offline vetoes a fast clean file', () => {
  const d = decideHop({
    denied: false,
    leaked: false,
    offline: true,
    rttMs: 20,
    budgetMs: 150,
  });
  assert.equal(d.route, 'local');
  assert.equal(d.reason, 'fail_closed');
});

test('clean fast online file may hop', () => {
  const d = decideHop({
    denied: false,
    leaked: false,
    offline: false,
    rttMs: 60,
    budgetMs: 150,
  });
  assert.equal(d.route, 'remote');
  assert.equal(d.reason, 'burst_allowed');
});

test('unknown rtt stays local', () => {
  const d = decideHop({
    denied: false,
    leaked: false,
    offline: false,
    rttMs: null,
    budgetMs: 150,
  });
  assert.equal(d.route, 'local');
});

Run the suite with one command on a quiet laptop.

node --test fail-closed-gate.test.mjs

The leak fixture must stay local in every run. The clean fixture may hop only when the probe is fast. The offline fixture never hops, even on a perfect sample.

That contract is the reproducible artifact for this workflow. If a later change softens the door, the test fails first. Do not skip the suite to ship a friendlier remote path.

When burst on a free server is rational

Local CPU still loses on large, secret-free bursts. Public fixtures and generated tests fit that shape. Long refactors of sample code can fit it too.

The laptop stays cool while the crate rides the truck. The hop is rational only after redaction succeeds. Strip dotenv files, private keys, and customer dumps before pack.

If redaction throws, cancel the hop at once. Keep those bytes on the laptop disk. A partial redact is a leak with extra steps.

MonkeyCode can sit on that remote branch when the gate returns burst_allowed. Disclosure: This article was prepared as part of MonkeyCode's product outreach. Free model access and a free server option are the claims used here.

Point the remote branch at that hop for a secret-free fixture. Keep the repo on disk after the burst. Use it only if you need a burst valve.

Do not read those lines as a quota or hardware promise. Those figures change without notice in this article. Measure your own jobs against your own log.

Who should not open the door

Air-gapped teams should leave the remote route compiled out. The offline flag already votes no on every job. Do not override it for a stage demo.

Regulated trees with customer data should stay on disk. A secret regex is not a DLP product. It will miss tokens in binaries and screenshots.

Tight inner loops should never take the truck. Formatters, typechecks, and unit tests still want milliseconds. They do not want a TLS handshake on each file.

If nobody can read the packed prompt, nobody should send it. A bouncer who cannot see the crate must stop the truck. Convenience is not allowed as a fourth check.

Log every decision like a brake

Write one JSON line per inspected job. Record path, reason, rtt_ms, budget_ms, and timestamp. You will argue with this file during the next incident.

The log is not a scoreboard for remote usage. It is a brake pedal on a downhill road. When remote volume grows, the log shows whether the wire earned the trip.

False negatives in the scanner remain the real hazard. A token in a binary can slip through quietly. Keep the denylist of file names as a second lock.

False positives waste a free hop and that is acceptable. Local work still finishes the original job on disk. A wasted truck is cheaper than a leaked key.

A flaky probe pins work to disk by design. Prefer a stuck laptop over a chatty leak. Retry policy belongs in the probe file, not in the bouncer.

// log-decision.mjs
import { appendFile } from 'node:fs/promises';

export async function logDecision(fileUrl, row) {
  const line = JSON.stringify({ ts: new Date().toISOString(), ...row }) + '\n';
  await appendFile(fileUrl, line);
}

Append a line after every inspect with one more command. Read the file during the next argument about remote volume. The brake pedal only works if the line exists.

node --input-type=module -e "import { inspectJob } from './fail-closed-gate.mjs'; import { logDecision } from './log-decision.mjs'; const row = await inspectJob('README.md', { rttMs: 60 }); await logDecision(new URL('./hop-decisions.jsonl', import.meta.url), row);"

That JSON logger is kept boring on purpose. Boring logs still get read during real failures. Fancy dashboards often hide the brake pedal.

Limits of the method

This gate does not replace human code review. It does not prove generated patches are correct. It only decides where bytes may travel today.

Remote inference can still be wrong on a clean crate. Treat every output as a candidate diff on disk. Run tests on disk before any merge.

The method assumes Node 18 or newer on the laptop. It assumes fail-closed is acceptable to the team. It assumes nobody pastes secrets to bypass the scan.

It also assumes the remote endpoint stays optional. If a vendor is mandatory, this runbook does not apply. Choose a controlled private path instead of this door.

Clock math is one-sided on purpose in the probe. You compare your sample to your own budget. You do not need synchronized hosts for that comparison.

Redaction scripts fail in boring ways as well. Filename denylists miss secrets copied into notes files. When in doubt, keep the route on local disk.

The door stays shut until the crate is clean

Disk remains the source of truth for secrets and tight loops. The wire is a burst valve with a lock on the handle. Open that lock only after leak, latency, and link all pass.

Keep the keys in the bowl by default. Rent the truck when the crate is clean. The bouncer still does not sing on stage.

Hold the Loop on Disk Until the Wire Earns It

Riley Wu — Fri, 11 Sep 2026 16:47:42 +0000

A remote hop without a local checkpoint is a dropped loop. The agent should write state to disk first. Only then may a remote path see a sanitized slice.

The pattern is older than current language models. Databases flush a write-ahead log before replicas. An agent loop needs that same habit on every exit.

Industry talk still paints agents as deep planners. Many production loops are tool calls wrapped around hope. Hope is not a recovery plan for hops.

This article stays local-first on every hop. It uses a checkpoint, a probe, and a short lease. The remote side is optional overflow, not the source of truth.

Cafe networks punish chat-shaped agents without local state. The first tool call stays local and cheap. The next call wants a model the laptop does not host.

The process posts a prompt and dies mid-flight. The outbound prompt vanishes with the broken socket. Partial tool output vanishes with the dying process.

Secrets in the buffer may already sit on the wire. That failure is not an intelligence gap at all. It is a storage and routing gap instead.

Treat the loop like a small database, not a chat window. Keep three records beside the repository root. The checkpoint stores the goal, the step index, and last output.

The lease stores a nonce and an expiry for one in-flight hop. The queue stores sanitized work that has not earned a hop. Think of the lease as a library card at the desk.

The book may leave while the card remains. The desk waits for a return or a timeout. Crash recovery should read those files before any new plan.

Replay starts from checkpoint.json, never from chat history. Chat history is a UI buffer and it lies after a kill. The checkpoint is the only record the next process should trust.

The JavaScript below is a proposal, not a shipped runtime. Comments mark example constants that you must replace. Do not treat the timeouts as measured SLAs.

// proposal: write-ahead checkpoint before any remote hop
import { createHash, randomBytes } from "node:crypto";
import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
import { join } from "node:path";

const DIR = join(process.cwd(), ".loop-state");
const EXAMPLE_PROBE_MS = 150; // example threshold, not a measured SLA
const EXAMPLE_LEASE_MS = 20_000; // example lease budget, replace in config

function ensureDir() {
  if (!existsSync(DIR)) mkdirSync(DIR, { recursive: true });
}

function atomicWrite(name, obj) {
  ensureDir();
  const tmp = join(DIR, `${name}.tmp`);
  const dest = join(DIR, name);
  writeFileSync(tmp, JSON.stringify(obj, null, 2));
  writeFileSync(dest, readFileSync(tmp));
}

function readJson(name, fallback) {
  const p = join(DIR, name);
  if (!existsSync(p)) return fallback;
  return JSON.parse(readFileSync(p, "utf8"));
}

const SECRET_RE =
  /\b(api[_-]?key|secret|token|password)\b\s*[:=]\s*\S+|bearer\s+[a-z0-9\-._~+/]+=*/gi;

function redact(text) {
  return String(text).replace(SECRET_RE, "[REDACTED]");
}

function fingerprint(text) {
  return createHash("sha256").update(text).digest("hex").slice(0, 12);
}

export function checkpoint(step) {
  const safe = {
    goal: redact(step.goal),
    index: step.index,
    lastOutput: redact(step.lastOutput || ""),
    localOnly: Boolean(step.localOnly),
    forbidRemoteSecrets: Boolean(step.forbidRemoteSecrets),
    needRemoteCapacity: Boolean(step.needRemoteCapacity),
    writtenAt: Date.now(),
  };
  atomicWrite("checkpoint.json", safe);
  return safe;
}

export function queueHop(payload) {
  const body = redact(payload);
  const item = {
    id: randomBytes(8).toString("hex"),
    body,
    bytes: Buffer.byteLength(body),
    fp: fingerprint(body),
    enqueuedAt: Date.now(),
  };
  const q = readJson("queue.json", []);
  q.push(item);
  atomicWrite("queue.json", q);
  return item;
}

Redaction stays blunt on purpose in this sketch. A regex will miss odd encodings and binary blobs. A blunt local filter still beats a raw paste into a remote form.

Fingerprint the redacted body before the hop. The hash is not a security proof by itself. It only blocks a second lease for the same payload after a crash.

Truncating SHA-256 to twelve hex characters is an example. Collisions are unlikely for a laptop queue. Raise the length if the queue lives longer than a day.

Atomic writes use a temp file then a replace. Node's writeFileSync on the dest is a simple stand-in. On POSIX you would rename the temp file over the dest.

Do not trust last week's cafe as health. Probe the host you intend to use. A short TCP connect with a hard timeout suffices here.

import net from "node:net";

export function probeHost(host, port, timeoutMs = EXAMPLE_PROBE_MS) {
  return new Promise((resolve) => {
    const started = Date.now();
    const socket = net.connect({ host, port });
    const timer = setTimeout(() => {
      socket.destroy();
      resolve({ ok: false, rttMs: Date.now() - started, reason: "timeout" });
    }, timeoutMs);
    socket.on("connect", () => {
      clearTimeout(timer);
      const rttMs = Date.now() - started;
      socket.end();
      resolve({ ok: true, rttMs, reason: "connect" });
    });
    socket.on("error", (err) => {
      clearTimeout(timer);
      resolve({
        ok: false,
        rttMs: Date.now() - started,
        reason: err.code || "error",
      });
    });
  });
}

The 150 millisecond figure is an example threshold. A transoceanic path will fail that probe every time. That failure is a signal to stay on disk.

Offline is not a special branch in this design. Offline is simply a probe that returns false. The queue keeps the sanitized payload until the wire earns another try.

Drain the queue in enqueue order after a green probe. Do not sort by model size or prompt drama. Fair order keeps fingerprints easy to reason about.

Once the probe passes, take a lease before bytes leave. A crash then leaves an expiry and a checkpoint, not a mystery. The next boot can replay the local step.

The next boot must not open a second remote call. Compare fingerprints against the leftover lease first. Wait out the hop if the lease is still alive.

export function takeLease(item, now = Date.now()) {
  const lease = {
    id: item.id,
    fp: item.fp,
    nonce: randomBytes(8).toString("hex"),
    until: now + EXAMPLE_LEASE_MS,
  };
  atomicWrite("lease.json", lease);
  return lease;
}

export function leaseAlive(lease, now = Date.now()) {
  if (!lease || !lease.until) return false;
  return now < lease.until;
}

export function decide(step, probe, lease, now = Date.now()) {
  if (step.localOnly) return "local";
  if (step.forbidRemoteSecrets && /\[REDACTED\]/.test(step.goal)) {
    return "local";
  }
  if (!probe.ok) return "queue";
  if (leaseAlive(lease, now)) return "wait";
  if (step.needRemoteCapacity) return "remote";
  return "local";
}

Read decide() as a gate rather than a score. Local work wins when the step is marked localOnly. Local work also wins when redaction still flags secrets and policy forbids travel.

The queue wins when the probe fails. Wait wins when a lease still owns the hop. Remote work wins only when local capacity is missing and the lease is free.

NeedRemoteCapacity is a boolean you set in the step. Do not hide it inside a magic latency number. A missing local model is a capacity miss.

A thermal throttle you can observe is a capacity miss. A vague belief that a cloud model is wiser is not. Keep that belief out of the gate.

A free remote server is still a hop. It wins inside a narrow window only. The laptop cannot host the model class the step needs.

The checkpoint must already exist on local disk. The payload must be redacted before the lease. The probe must be green and the lease must be free.

That window is real for small teams without a desk GPU. Shared overflow should not block on one laptop fan. A free server can hold overflow without a chat-shaped client.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode provides free model access and a free server option. Those two availability facts fit the overflow window above.

They do not replace the checkpoint, the probe, or the lease. Keep the vendor host in adapter config, not in the gate. The core protocol should still boot with the network unplugged.

export async function overflowHop(item, adapter) {
  const lease = takeLease(item);
  try {
    const result = await adapter.complete(item.body);
    atomicWrite("lease.json", { id: null, fp: null, until: 0 });
    checkpoint({
      goal: item.body,
      index: "overflow",
      lastOutput: redact(result.text || ""),
      localOnly: false,
    });
    return { ok: true, lease, result };
  } catch (err) {
    return { ok: false, lease, error: String(err) };
  }
}

The adapter is an injected function with one job. If the free server disappears, the checkpoint still boots. The queue still holds the redacted work.

Expired leases are not automatic retries. Read the checkpoint, then decide again with a fresh probe. A blind retry is how duplicate remote thoughts get born.

Tests should prove the gate, not a vendor. Node's assert module is enough for this sketch. Fail local redaction before you debug any remote adapter.

import assert from "node:assert/strict";
import {
  checkpoint,
  queueHop,
  decide,
  takeLease,
  leaseAlive,
} from "./loop_lease.js";

const step = checkpoint({
  goal: "summarize README; token=ghp_example",
  index: 0,
  lastOutput: "",
  localOnly: false,
  forbidRemoteSecrets: true,
});
assert.match(step.goal, /\[REDACTED\]/);
assert.equal(decide(step, { ok: true, rttMs: 40 }, null), "local");

const item = queueHop("explain the gate; api_key=abcd");
assert.equal(item.body.includes("abcd"), false);

assert.equal(decide(step, { ok: false, rttMs: 150 }, null), "queue");

const remoteStep = { ...step, forbidRemoteSecrets: false, needRemoteCapacity: true };
assert.equal(decide(remoteStep, { ok: true, rttMs: 40 }, null), "remote");

const lease = takeLease(item, 1_000);
assert.equal(leaseAlive(lease, 1_500), true);
assert.equal(leaseAlive(lease, 30_000), false);
assert.equal(
  decide(remoteStep, { ok: true, rttMs: 40 }, lease, 1_500),
  "wait",
);

Run the file with node --test loop_lease.test.js after you split modules. If redaction fails, stop the loop at once. Do not "just try" the hop to see what happens.

This design will not pass an air-gapped audit. If bytes must never leave the machine, drop the adapter. Set localOnly on every step and skip the lease.

A regex is not a complete secret scanner. Rotate any token that has lived in a prompt buffer. The fingerprint only prevents double hops after a crash.

This article claims no region, quota, or uptime for overflow. Treat that remote path as best-effort overflow. Do not park billing, medical, or identity flows on it.

Do not measure success by hop count. Measure success by crashes that reload the same checkpoint. Teams with a real inference SLA should buy that SLA.

The lease pattern still applies when the vendor changes. Cafe Wi-Fi will still lie about health. Captive portals accept TCP and then hijack HTTP.

If the adapter speaks HTTP, check the body, not only connect. Put that content check inside the adapter only. Keep the decide() gate boring and local.

Skip this approach if a single local model already covers the work. Skip it if compliance forbids every remote complete call. Skip it if the goal was a chat UI rather than a loop.

Use it if agents already write files and stall on flaky links. Use it if state belongs on disk even when overflow is free. Use it if a remote path is overflow, not identity.

The loop remains yours when the wire goes quiet. Checkpoint first, then probe, then take the lease. Hop last, and only with a redacted slice.

If checkpoints already sit on disk, overflow stays a config choice. Point the adapter at MonkeyCode's free server after a green probe. Keep the adapter injectable so the gate never leaves the box.

Weigh the Payload Before the Hop

Riley Wu — Wed, 09 Sep 2026 16:44:17 +0000

Remote models win on small, clean payloads. Local work wins on secrets and bulk. Mean latency is the wrong meter for that choice.

A working tree is not a prompt. It is a warehouse. You do not ship the warehouse to think. The hop fails in three distinct ways. Secrets leak. The payload bloats. The tail of the link spikes.

Any one of those should keep the job on disk. This article is a packing workflow. It is not a model review. The scripts below are proposals. Run them on a throwaway repo first.

Gate one is the secret class. Scan names, not contents, to start. A file named .env is already a veto. A *.pem is a veto. An id_rsa is a veto. Name checks miss secrets in code. They still catch the loud cases. Treat a hit as LOCAL_ONLY. Do not negotiate with the match.

Gate two is payload mass. Count the bytes you would send. Estimate tokens with a blunt heuristic. Character count divided by four is a guess. Label it as a guess in the log. A two-hundred kilobyte tree is not a chat. It is a cargo ship. Local summarizers can cut that ship into a barge. The barge is a unified diff plus a file list.

Gate three is tail latency. Ping is not enough. ICMP lies on many networks. Time a tiny HTTPS fetch several times. Sort the samples. Read p95, not the mean. A free remote looks cheap at the median. Noisy neighbors live in the tail. Your editor feels the tail.

When all three gates pass, a remote burst can help. Interactive secret work should stay local. Overnight non-secret refactors can drain a queue. Offline laptops should enqueue, not freeze. The queue is the local-first spine. The remote is overflow, not home.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode offers free model access and a free server option. Those two facts are the only product claims here. No quota, hardware, or model name is implied. Use that remote as an overflow drain. Do not point it at production secrets. Pack first. Then hop.

Start with a name veto. Keep it boring and fast. Fast vetoes beat clever parsers on a dirty tree.

# proposal: name-only secret veto, not a scanner product
from pathlib import Path

VETO_NAMES = {".env", ".env.local", "id_rsa", "id_ed25519"}
VETO_SUFFIX = {".pem", ".p12", ".key", ".kdbx"}
VETO_DIRS = {".git", "node_modules", ".venv", "__pycache__"}

def secret_hits(root: Path) -> list[str]:
    hits = []
    for p in root.rglob("*"):
        if any(part in VETO_DIRS for part in p.parts):
            continue
        if not p.is_file():
            continue
        if p.name in VETO_NAMES or p.suffix in VETO_SUFFIX:
            hits.append(str(p.relative_to(root)))
    return hits

A hit means the job never leaves disk. Absence of a hit is not clearance. It is only gate one. Move to packing only after this function returns empty.

Packing is the real work. Do not concatenate the repo. Ask git for the staged story. Untracked noise is not context. It is gravel in the gearbox.

# proposal: pack a barge, not a warehouse
git diff --cached --unified=3 > /tmp/barge.diff
git diff --cached --name-only > /tmp/barge.files
wc -c /tmp/barge.diff /tmp/barge.files

If the index is empty, refuse the hop. Empty packs look cheap and teach nothing. Force a local read of git status instead. The model should see intent, not your entire history.

Weigh the barge in the same process. Bytes are facts. Tokens are not facts here. The divide-by-four rule is a ruler drawn on a napkin.

# proposal: napkin token weight, labeled as estimate
from pathlib import Path

MAX_BYTES = 48_000          # policy you choose, not a product limit
MAX_EST_TOKENS = 12_000     # napkin cap, not a billed quota

def weigh(path: Path) -> dict:
    raw = path.read_bytes()
    text = raw.decode("utf-8", errors="replace")
    est = max(1, len(text) // 4)
    return {
        "bytes": len(raw),
        "est_tokens_napkin": est,
        "over_bytes": len(raw) > MAX_BYTES,
        "over_tokens": est > MAX_EST_TOKENS,
    }

CJK and minified JS break this ruler. Treat overflow as LOCAL_ONLY or recut the diff. Recut beats a blind hop. A barge that still sinks should stay in harbor.

Tail latency needs repeated samples. Seven is a start, not a lab. Use HTTPS to a host you already trust. Do not invent a health myth from one lucky fetch.

# proposal: p95 of tiny HTTPS fetches
import time, ssl, statistics
from urllib.request import urlopen, Request

def fetch_ms(url: str, timeout: float = 2.5) -> float:
    req = Request(url, method="GET")
    t0 = time.perf_counter()
    with urlopen(req, timeout=timeout, context=ssl.create_default_context()) as r:
        r.read(256)
    return (time.perf_counter() - t0) * 1000

def p95_ms(url: str, n: int = 7) -> dict:
    samples = []
    errors = 0
    for _ in range(n):
        try:
            samples.append(fetch_ms(url))
        except Exception:
            errors += 1
    if len(samples) < 5:
        return {"ok": False, "errors": errors, "samples": samples}
    samples.sort()
    idx = min(len(samples) - 1, int(round(0.95 * (len(samples) - 1))))
    return {
        "ok": True,
        "p50": statistics.median(samples),
        "p95": samples[idx],
        "errors": errors,
        "n": len(samples),
    }

Policy lives in one function. Keep it readable on a bad train network. Offline is a result, not an exception. Queue the job and walk away.

# proposal: three-gate decision, no hidden I/O
P95_BUDGET_MS = 350  # your budget, not a vendor SLA

def decide(hits, weight, probe) -> str:
    if hits:
        return "LOCAL_ONLY_SECRETS"
    if weight["over_bytes"] or weight["over_tokens"]:
        return "LOCAL_ONLY_PAYLOAD"
    if not probe.get("ok"):
        return "QUEUE_OFFLINE"
    if probe["p95"] > P95_BUDGET_MS:
        return "QUEUE_TAIL"
    return "REMOTE_OK"

REMOTE_OK still does not mean paste the tree. It means the packed barge may leave. Log the decision with hashes. Tomorrow you will not remember the p95.

Persist the queue in SQLite. Files vanish. Rows do not, if you sync. Store the diff path, the napkin weight, and the verdict.

# proposal: local queue, remote is a drain target
import sqlite3, hashlib, time
from pathlib import Path

DDL = """CREATE TABLE IF NOT EXISTS hops (
  id INTEGER PRIMARY KEY,
  created REAL NOT NULL,
  diff_sha TEXT NOT NULL,
  verdict TEXT NOT NULL,
  bytes INTEGER NOT NULL,
  est_tokens INTEGER NOT NULL,
  drained INTEGER NOT NULL DEFAULT 0
);"""

def enqueue(db: Path, diff: Path, verdict: str, weight: dict) -> None:
    sha = hashlib.sha256(diff.read_bytes()).hexdigest()
    con = sqlite3.connect(db)
    con.execute(DDL)
    con.execute(
        "INSERT INTO hops(created, diff_sha, verdict, bytes, est_tokens) VALUES (?,?,?,?,?)",
        (time.time(), sha, verdict, weight["bytes"], weight["est_tokens_napkin"]),
    )
    con.commit()
    con.close()

Drain only REMOTE_OK rows. Leave QUEUE_TAIL for a quieter window. Leave LOCAL_ONLY_SECRETS forever. A free server does not wash a secret. It multiplies the copies.

Think of the link as a loading dock. The dock has a scale and a clock. Overloaded docks queue trucks. They do not flatten the warehouse onto one trailer. Your prompt pipeline should act the same.

A local-first loop still needs a clock. Wall time on the laptop is the scarce good. Battery and heat are cousins of that clock. If the fan climbs, overflow non-secret work. If the lid is shut, do not pretend the GPU is free.

# proposal: optional thermal glance on Linux, skip if absent
if [ -r /sys/class/thermal/thermal_zone0/temp ]; then
  awk '{print $1/1000}' /sys/class/thermal/thermal_zone0/temp
fi

Missing thermal files mean skip the gate. Do not fake a number. Unknown heat is not a remote excuse. It is a missing sensor.

Test the workflow like a brake check. You want refusal, not eloquence. Seed a repo with a fake .env and a tiny staged diff. The verdict must be LOCAL_ONLY_SECRETS. Remove the file. Oversized the diff with a minified vendor blob. The verdict must be LOCAL_ONLY_PAYLOAD. Unplug the network. The verdict must be QUEUE_OFFLINE.

# proposal: brake-check the packer
set -e
mkdir -p /tmp/barge-demo && cd /tmp/barge-demo
git init -q
echo 'secret=nope' > .env
echo 'print("ok")' > app.py
git add app.py
# run secret_hits() against $PWD; expect a hit on .env
# then: rm .env && python -c 'print("x"*80000)' > vendor.js && git add vendor.js
# weigh vendor.js; expect over_bytes or over_tokens

If any brake fails, stop shipping. A packer that cannot refuse is a firehose. Firehoses feel productive until the leak report arrives.

Limitations sit in the open. Name vetoes miss inline keys. Napkin tokens drift on Asian source and on bundled JS. Seven HTTPS samples are a weather vane, not a climate model. SQLite on a laptop is not a cluster queue. Free remote capacity can vanish without notice. Packed diffs hide unread files the model still needs. This workflow will under-inform a large architectural change.

Who should not use it is equally plain. Do not use it on regulated patient or card data. Do not use it as a production SLA. Do not use it when the model version must be pinned by contract. Do not use it to launder secrets through a “temporary” host. Do not use it as a substitute for code review.

Local-first is a failure-domain choice. Your disk and your link fail on different days. A packed barge respects both. Average RTT stories hide that split. Payload mass does not.

Keep the tree. Ship the slice. Log the napkin weight. Read p95. If a free remote is handy and the row says REMOTE_OK, drain one non-secret job and compare the log to your editor’s feel. That comparison is the whole experiment.

Stopwatch First: Local Work or a Remote Hop

Riley Wu — Mon, 07 Sep 2026 15:11:59 +0000

Guessing local versus remote wastes both battery and tokens. Measure three gates before any prompt leaves disk. Connectivity, secret residue, and wall-clock cost decide the hop.

A laptop is a workshop on your desk. A remote model is a mill across town. You do not crate the shop for one cut.

House keys do not travel with the lumber. Secrets inside a prompt are those house keys. A free mill still sits far across town.

This article is a measurement workflow, not a bake-off. The script below is a labeled example only. Run it locally and trust only its clocks.

Coding agents now plan, search, and generate together. Local context is cheap to read from disk. Completion on a cold CPU can stall hard.

Remote completion can still win on that stall. It can also leak residue or hang offline. Extra latency can erase the time it saves.

Weekly agent glossaries rename the same moving parts. The useful question stays narrower than weekly branding. When does a remote hop beat a local stall?

Three gates before the mill

Three gates answer that without slogans or dashboards. Gate one is reachability on the open wire. Gate two is leftover secret material in text.

Gate three is a stopwatch on both sides. Skip any gate and the decision is folklore. Folklore is how keys leave working laptops daily.

The wire is a hard constraint, not a preference. If the socket fails, stay on local disk. Offline work does not negotiate with a mill.

Secret residue is the second hard stop today. Clean the text or refuse the send. A price of zero does not change that physics.

Only then time the work with a cheap stub. Walk the tokens on CPU and probe RTT. Remote wins when CPU dominates a thin payload.

Arithmetic beats instinct on that last gate check. A long round trip cannot beat a short stub. A throttled laptop can still lose on decode.

Do not assume which machine is slower today. Thermal state and queue time both move around. Measure the hop on the machine you have.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode offers free model access and a free server option. Those two availability facts are the only product claims used here.

No model names, quotas, or hardware figures appear above. The workflow holds if you never rent that mill. Use remote capacity only after the three gates pass.

Treat the product as optional rented mill time. The workshop remains on local disk until then. Thin, clean, slow-at-the-bench work may leave later.

Example stopwatch script

Save this example artifact as local_remote_gate.py on disk. It prints a verdict and the supporting clocks. It does not call any vendor network API.

#!/usr/bin/env python3
"""Proposal: local-first gate for LLM payloads.

Example only. Not a DLP product. Not a latency SLA.
Run: python3 local_remote_gate.py path/to/prompt.txt
"""
from __future__ import annotations

import argparse
import re
import socket
import time
from pathlib import Path

SECRET_HINTS = (
    re.compile(r"AKIA[0-9A-Z]{16}"),
    re.compile(r"-----BEGIN (?:RSA |OPENSSH |EC )?PRIVATE KEY-----"),
    re.compile(r"(?i)api[_-]?key\s*[:=]\s*['\"]?[A-Za-z0-9_\-]{20,}"),
    re.compile(r"(?i)secret\s*[:=]\s*['\"]?[A-Za-z0-9_\-]{16,}"),
    re.compile(r"ghp_[A-Za-z0-9]{20,}"),
    re.compile(r"xox[baprs]-[A-Za-z0-9-]{10,}"),
)


def read_payload(path: Path) -> str:
    return path.read_text(encoding="utf-8", errors="replace")


def gate_wire(host: str, port: int, timeout: float) -> tuple[bool, float]:
    started = time.perf_counter()
    try:
        with socket.create_connection((host, port), timeout=timeout):
            rtt_ms = (time.perf_counter() - started) * 1000.0
            return True, rtt_ms
    except OSError:
        rtt_ms = (time.perf_counter() - started) * 1000.0
        return False, rtt_ms


def gate_secrets(text: str) -> list[str]:
    hits = []
    for rx in SECRET_HINTS:
        if rx.search(text):
            hits.append(rx.pattern)
    return hits


def gate_clock(text: str) -> dict[str, float]:
    started = time.perf_counter()
    tokens = text.split()
    acc = 0
    for tok in tokens:
        acc ^= hash(tok.lower())
        acc &= 0xFFFFFFFF
    local_ms = (time.perf_counter() - started) * 1000.0
    bytes_len = len(text.encode("utf-8"))
    return {
        "local_ms": local_ms,
        "approx_tokens": float(len(tokens)),
        "bytes": float(bytes_len),
        "checksum": float(acc),
    }


def decide(
    wire_ok: bool,
    rtt_ms: float,
    hits: list[str],
    local_ms: float,
    bytes_len: float,
) -> str:
    if not wire_ok:
        return "LOCAL_OFFLINE"
    if hits:
        return "LOCAL_SECRETS"
    # Labeled heuristics, not a vendor benchmark.
    remote_floor_ms = rtt_ms + max(40.0, bytes_len / 4000.0)
    if local_ms < remote_floor_ms:
        return "LOCAL_FASTER"
    if bytes_len > 120_000:
        return "LOCAL_PAYLOAD_FAT"
    return "REMOTE_OK"


def main() -> None:
    parser = argparse.ArgumentParser()
    parser.add_argument("payload")
    parser.add_argument("--host", default="1.1.1.1")
    parser.add_argument("--port", type=int, default=443)
    parser.add_argument("--timeout", type=float, default=1.5)
    args = parser.parse_args()

    text = read_payload(Path(args.payload))
    wire_ok, rtt_ms = gate_wire(args.host, args.port, args.timeout)
    hits = gate_secrets(text)
    clock = gate_clock(text)
    verdict = decide(wire_ok, rtt_ms, hits, clock["local_ms"], clock["bytes"])

    print(f"verdict={verdict}")
    print(f"wire_ok={wire_ok} rtt_ms={rtt_ms:.1f}")
    print(f"secret_hits={len(hits)}")
    print(f"local_ms={clock['local_ms']:.2f}")
    print(
        f"approx_tokens={int(clock['approx_tokens'])} "
        f"bytes={int(clock['bytes'])}"
    )
    if verdict != "REMOTE_OK":
        print("action=keep_payload_on_disk")
    else:
        print("action=remote_hop_allowed_after_human_review")


if __name__ == "__main__":
    main()

Run it against a prompt file you already own. Keep real secrets out of the sample file. The command below uses a boring refactor note.

printf 'refactor the parser in src/parse.ts\n' > /tmp/prompt.txt
python3 local_remote_gate.py /tmp/prompt.txt

Now prove the secret gate with a fake string. Confirm the verdict becomes LOCAL_SECRETS on that file. Never paste a live credential into the scratch path.

printf 'api_key=not-a-real-key-0123456789abcdef\n' > /tmp/dirty.txt
python3 local_remote_gate.py /tmp/dirty.txt

Point the host flag at an unreachable address next. Confirm the verdict becomes LOCAL_OFFLINE without further debate. A mill you cannot reach is not faster.

python3 local_remote_gate.py /tmp/prompt.txt --host 192.0.2.1 --timeout 0.4

Read local_ms as a stub, not full inference. Full local generation needs your own runtime stack. This script asks eligibility before any heavy decode.

Replace gate_clock with a real tokenizer later on. Keep the same decide function and printed fields. Stable gates matter more than a fancy clock source.

Fat repo dumps should fail LOCAL_PAYLOAD_FAT on purpose. Remote hops like thin diffs, not whole monorepos. Mail a cut list, never the whole lumberyard.

Whitespace token counts are not model tokenizer output. They still catch oversized context before the wire. That cheap signal is the entire point here.

The 40ms floor is a labeled heuristic constant. The 4000 bytes per millisecond factor is also heuristic. Replace both after you sample your own path.

Secret residue remains the quiet production failure mode. Latency-only routing is how keys leave buildings. Free remote capacity is still fully remote capacity.

Free does not mean unlogged or magically local. Free does not mean a promise of zero retention. If cleanliness is unproven, ignore the stopwatch completely.

The remote floor inside decide() stays conservative on purpose. It adds RTT plus a bytes-derived floor value. It assumes no queue and no TLS handshake tax.

Queue time can erase an apparent remote win fast. DNS, TLS, and auth add still more delay. Swap --host to the real endpoint before trusting RTT.

Limits and non-goals

Here is who should run this gate first. Solo developers on mixed-offline laptops benefit first here. Small teams that already redact git secrets also fit.

Here is who should skip this entire approach. Residency rules can forbid the hop even now. Certified DLP suites sit outside this example's class.

Air-gapped work must never open the probe socket. Novel secret formats will slip past these regexes. Docs that quote fake keys will false-positive often.

REMOTE_OK is permission to consider a remote hop. It is not an order to send any bytes. Keep a human on the first weeks of verdicts.

Log decisions locally and omit the payload bodies. Do not wrap the gate as a silent sidecar. Silent retries around LOCAL_SECRETS create messy incident reports.

Attach a remote client only to files that passed. Send a diff, not the tree that produced it. Retry after cleaning source, never after ignoring hits.

A default probe to 1.1.1.1 only tests public reachability. That address is not your model host. Wrong RTT data will invert the last gate.

Local hash-walking is not thermal telemetry either. A fan-loud laptop can still print a tiny local_ms. Plug a real generate() clock in before you claim a remote win.

Agent vocabulary will keep shifting through this quarter. Planner, tool, memory, and hop are fresh labels. Disk proximity and wire delay are not labels.

Keep the workshop local until clocks and scans agree. Rent a mill for the clean, thin, slow cut. That is the whole local-first trade in practice.

Need rented mill time after a REMOTE_OK verdict. MonkeyCode is one option to try then. The three gates remain yours either way here.

When Local CPU Loses to RTT

Riley Wu — Mon, 07 Sep 2026 14:11:27 +0000

Local inference loses when the laptop CPU saturates. A measured remote hop can be faster then. This article shows a break-even harness, not a slogan.

Teams treat local-first as a moral rule. Morals alone do not shrink tail latency. A cheap remote path sometimes wins on warm links.

Think of the machine as a harbor. Local work is a dinghy you already own. A free remote hop is a scheduled ferry.

You pick the boat after you time the crossing. Guesswork here creates flaps and wasted tokens. A clock on the envelope beats a slogan on the wiki.

Agent loops multiply model calls across a workday. Each call still pays CPU, network, or both. Cheap generation does not make the hop free.

Recent architecture posts often skip this accounting. They assume the network is an infinite hallway. Hallways still have doors, locks, and weather.

Tight latency budgets punish chatty tool loops. Secret material punishes any hop that leaves disk. True offline work punishes every remote model call.

The same feature can fail all three tests. A public summarizer may still miss the budget. A private refactor must never board the ferry.

MonkeyCode provides free model access and a free server option. Disclosure: This article was prepared as part of MonkeyCode's product outreach. Treat that remote path as overflow, not a default brain.

The method is simple and reproducible on one laptop. Time a local stub on your actual hardware. Time a remote complete on your real link.

Keep the faster path for that payload class. Do not copy sample timings into production configs. Hardware and networks drift across a single afternoon.

The harness below is a method, not a vendor benchmark. Numbers inside comments are labeled examples only. Replace the origin with your own measured endpoint.

#!/usr/bin/env node
/**
 * budget.mjs
 * Example harness. Unexecuted until OVERFLOW_URL is a real origin.
 * Local hashing is a CPU stand-in, not a language model.
 */
import { createHash } from "node:crypto";
import { appendFile, mkdir, readFile } from "node:fs/promises";
import { argv, env } from "node:process";

function parseArgs(args) {
  const out = { origin: env.OVERFLOW_URL || "", sample: "", trials: 5 };
  for (let i = 2; i < args.length; i += 1) {
    if (args[i] === "--origin") out.origin = args[++i];
    if (args[i] === "--sample") out.sample = args[++i];
    if (args[i] === "--trials") out.trials = Number(args[++i]);
    if (args[i] === "--secret") out.secret = true;
    if (args[i] === "--offline") out.offline = true;
  }
  return out;
}

function classify(text, flags) {
  const secret =
    Boolean(flags.secret) ||
    /api[_-]?key|BEGIN (RSA |OPENSSH )?PRIVATE/i.test(text);
  const bytes = Buffer.byteLength(text, "utf8");
  const offline = Boolean(flags.offline);
  const classId = secret ? "secret" : bytes > 4000 ? "public-heavy" : "public-light";
  return { secret, bytes, offline, classId };
}

function localWork(text) {
  const start = performance.now();
  let digest = text;
  for (let i = 0; i < 2500; i += 1) {
    digest = createHash("sha256").update(digest).digest("hex");
  }
  const tokens = text.split(/\s+/).filter(Boolean).length;
  return { ms: performance.now() - start, tokens, digest: digest.slice(0, 12) };
}

async function remoteWork(origin, text, envelope) {
  if (!origin) throw new Error("missing origin");
  const start = performance.now();
  const res = await fetch(origin, {
    method: "POST",
    headers: { "content-type": "application/json" },
    body: JSON.stringify({
      classId: envelope.classId,
      bytes: envelope.bytes,
      text,
    }),
  });
  const body = await res.text();
  return { ms: performance.now() - start, status: res.status, bytesOut: body.length };
}

function median(values) {
  const sorted = [...values].sort((a, b) => a - b);
  const mid = Math.floor(sorted.length / 2);
  if (sorted.length === 0) return Number.POSITIVE_INFINITY;
  return sorted.length % 2 ? sorted[mid] : (sorted[mid - 1] + sorted[mid]) / 2;
}

class Breaker {
  constructor({ limit = 3, coolMs = 60_000 } = {}) {
    this.limit = limit;
    this.coolMs = coolMs;
    this.breaches = 0;
    this.preferRemote = false;
    this.openedAt = 0;
  }

  observe({ localMs, remoteMs }) {
    if (remoteMs + 8 < localMs) this.breaches += 1;
    else this.breaches = Math.max(0, this.breaches - 1);

    if (this.breaches >= this.limit) {
      this.preferRemote = true;
      this.openedAt = Date.now();
    }
    if (this.preferRemote && Date.now() - this.openedAt > this.coolMs) {
      this.preferRemote = false;
      this.breaches = 0;
    }
    return this.preferRemote;
  }
}

async function enqueue(job) {
  await mkdir(".harbor", { recursive: true });
  await appendFile(".harbor/queue.jsonl", `${JSON.stringify(job)}\n`, "utf8");
}

async function main() {
  const opts = parseArgs(argv);
  const text = opts.sample
    ? await readFile(opts.sample, "utf8")
    : "public summary of a build log";
  const envelope = classify(text, opts);

  if (envelope.secret) {
    const local = localWork(text);
    console.log(JSON.stringify({ path: "local-forced", envelope, local }));
    return;
  }

  if (envelope.offline) {
    await enqueue({ at: Date.now(), envelope, bytes: envelope.bytes });
    console.log(JSON.stringify({ path: "queued", envelope }));
    return;
  }

  const localSamples = [];
  const remoteSamples = [];
  for (let i = 0; i < opts.trials; i += 1) {
    localSamples.push(localWork(text).ms);
    if (!opts.origin) continue;
    try {
      remoteSamples.push((await remoteWork(opts.origin, text, envelope)).ms);
    } catch {
      remoteSamples.push(Number.POSITIVE_INFINITY);
    }
  }

  const localMs = median(localSamples);
  const remoteMs = median(remoteSamples);
  const preferRemote = new Breaker().observe({ localMs, remoteMs });
  console.log(JSON.stringify({ envelope, localMs, remoteMs, preferRemote }, null, 2));
}

main().catch((err) => {
  console.error(err);
  process.exit(1);
});

A local stub should resemble real CPU work. Token splitting is a decent public proxy. Hashing a buffer is another honest stand-in.

Avoid empty functions that return in one millisecond. They flatter local-first without teaching anything. The ferry always loses a fake race like that.

Remote timing must include DNS and TLS cost. A localhost mock lies about the crossing. Point the client at a real origin when you can.

Secret payloads must never ride the remote ferry. Mark them in the envelope before timing starts. The breaker should refuse the hop, not retry it.

Offline mode is a closed harbor mouth. Queue only public jobs on local disk. Flush them when the link returns under budget.

Hysteresis stops the fleet from flapping boats. One slow sample should not flip the default. Require several breaches before you leave local.

// hysteresis.mjs — example only, same clock, slower hands
export function shouldFlip(samples, { marginMs = 8, need = 3 } = {}) {
  let remoteWins = 0;
  for (const row of samples) {
    if (row.remoteMs + marginMs < row.localMs) remoteWins += 1;
    else remoteWins = Math.max(0, remoteWins - 1);
  }
  return remoteWins >= need;
}

Start with a public sample under four kilobytes. Run five trials on an idle core. Then rerun on the same origin after a pause.

chmod +x budget.mjs
node budget.mjs --origin "$OVERFLOW_URL" --sample ./public.txt --trials 5
node budget.mjs --origin "$OVERFLOW_URL" --sample ./public.txt --trials 5
node budget.mjs --sample ./private.env --secret
node budget.mjs --sample ./public.txt --offline

Record both samples with the class name attached. Compare medians, not a single lucky trip. Lucky trips make a poor routing law.

Walk a hypothetical afternoon, labeled as fiction. A two thousand character prompt remains public text. Local CPU then spends one hundred sixty milliseconds.

The remote ferry returns in one hundred ten milliseconds. Those figures are story numbers, not measurements. Your laptop will disagree by a wide margin.

The breaker would prefer remote for that class. The same prompt on train Wi-Fi might take nine hundred milliseconds. Local wins again without a code change.

A secret environment chunk stays in the dinghy. The remote timer never runs for that class. The offline queue also skips it during flush.

Payload size changes the race in quiet ways. Tiny completions often die in TLS handshake cost. Large embeddings often die on laptop cores instead.

That is why a single global default fails. Class the envelope, then time that class. Store the winner with a measured expiry.

{
  "classId": "public-heavy",
  "localMs": 160,
  "remoteMs": 110,
  "preferRemote": true,
  "expiresAt": "labeled-example-not-a-measurement",
  "notes": "Story numbers. Replace after five idle trials."
}

Run the harness from a cold shell first. Then run it again on a warm DNS cache. The gap between those runs is the lie.

Cheap model calls raise volume, not wisdom. Volume makes the wrong boat expensive at scale. A wrong default taxes every later agent hop.

A free overflow origin can absorb public bursts. It cannot absorb a secret, a policy, or a dead link. Those remain local problems with strictly local answers.

Flush is not a second brain either. It is a delayed ferry for cargo already cleared. Uncleared cargo waits on disk without a ticket.

// flush.mjs — example queue drain, still not a model client
import { readFile, writeFile } from "node:fs/promises";

export async function flushPublic(origin, now = Date.now()) {
  const raw = await readFile(".harbor/queue.jsonl", "utf8").catch(() => "");
  const rows = raw.split("\n").filter(Boolean).map((line) => JSON.parse(line));
  const kept = [];
  for (const job of rows) {
    if (job.envelope.secret) {
      kept.push(job);
      continue;
    }
    if (now - job.at > 86_400_000) continue;
    await fetch(origin, {
      method: "POST",
      headers: { "content-type": "application/json" },
      body: JSON.stringify(job),
    });
  }
  await writeFile(".harbor/queue.jsonl", kept.map((j) => JSON.stringify(j)).join("\n"), "utf8");
}

Limitations matter more than the happy path. This harness does not rank model quality. It does not prove any vendor uptime claim.

It also does not replace a secret scanner. Classification is only as honest as the caller. A missed flag will ship text you meant to keep.

The method fails when every prompt contains secrets. Air-gapped shops should not open the harbor. Teams without clocks cannot run a break-even test.

Quality-sensitive work needs evals beside this timer. Fast and wrong is still wrong for reviews. The ferry is a latency tool, not a judge.

A busy shared laptop also distorts the race. Background builds will steal the local core. The dinghy looks slower than it is.

So pin the test to an idle machine. Close the extra browsers before you measure. Otherwise you time contention instead of completion.

Expiry must stay short on mobile links. A cafe winner can be a tunnel loser. Re-time after the network class changes.

A free remote origin wins on public bulky jobs. It wins when several developers share one warm path. It loses when the link is the product risk.

Local still wins for secrets, silence, and tight loops. Measure first, and then pick the boat. Keep the dinghy for cargo that cannot sink.

Public jobs may need an overflow origin. Time MonkeyCode's free server against this harness.

Score Agent Hops Before They Leave Disk

Riley Wu — Mon, 07 Sep 2026 03:50:29 +0000

Agent loops fail at the first unplanned hop. The failure is architectural, not model quality. Default remote calls treat every thought as cargo.

That default burns latency on work that never left disk. It also ships secret-shaped text that needed no network. A hop score reverses the order before any client opens a socket.

Think of each agent step as a package at a loading dock. Some packages never leave the building. Some wait for a clean truck and a clear road. The dock does not ship first and audit later.

Three signals decide the dock on every step. Latency budget is the first signal. Secret contact is the second. Offline need is the third. A free remote server wins only when all three stay green.

The assumption that breaks agent loops

Public agent write-ups keep repeating one quiet pattern. The loop assumes a reachable model for every thought. It also assumes tools can wait on that round trip. Both assumptions collapse on a laptop with flaky wifi.

A planner that waits on the WAN feels clever in a demo. The same wait feels broken inside a tight tool cycle. File edits, test runs, and env reads are local events. They should not queue behind a remote token stream.

Treat the rest of this article as a lab proposal. No production traffic was measured for these notes. Copy the scorer, then record timings on your own box.

Inner loops and outer loops need different patience. Tool steps live in the inner loop. Planning steps live in the outer loop. Mixing those budgets is how agents start assuming the network is free.

A kitchen analogy holds better than a cloud slide. The stove still cooks when the delivery van is stuck. Local tools are the stove. Remote plans are the van. You do not halt dinner because a van might be faster on Sundays.

A hop score, not a vibe

Give every step an integer score that starts at three. Subtract one point when a check fails. A score of three may hop. Any lower score stays on the machine.

The three checks map to the three signals above. Probe TCP latency against a budget you own. Scan the payload for secret-shaped tokens. Confirm the process still has a network path. Missing any check keeps the package inside.

Save this as hop_score.py. It is a router, not a benchmark.

#!/usr/bin/env python3
"""Hop scorer for local-first agent loops. Lab proposal, not a benchmark."""
from __future__ import annotations

import argparse
import json
import os
import re
import socket
import time
from dataclasses import asdict, dataclass, field

SECRET_RE = re.compile(
    r"(?i)(api[_-]?key|authorization:|bearer\s+\S+|-----BEGIN|"
    r"aws_secret|x-api-key|password\s*=)"
)

PLAN_STEPS = {"plan", "decompose", "summarize_public"}
LOCAL_STEPS = {"apply_patch", "run_tests", "read_env", "git_status"}

@dataclass
class HopDecision:
    score: int
    route: str
    reasons: list[str] = field(default_factory=list)
    probe_ms: float | None = None
    step: str = ""

def probe_latency(host: str, port: int, timeout: float) -> float | None:
    start = time.perf_counter()
    try:
        with socket.create_connection((host, port), timeout=timeout):
            return (time.perf_counter() - start) * 1000.0
    except OSError:
        return None

def score_payload(payload: str, host: str, port: int, budget_ms: float) -> HopDecision:
    score = 3
    reasons: list[str] = []
    probe_ms = probe_latency(host, port, timeout=0.4)

    if probe_ms is None:
        score -= 1
        reasons.append("offline_or_unreachable")
    elif probe_ms > budget_ms:
        score -= 1
        reasons.append(f"latency_{probe_ms:.0f}ms_over_{budget_ms:.0f}ms")

    if SECRET_RE.search(payload):
        score -= 1
        reasons.append("secret_shaped_payload")

    if os.getenv("FORCE_LOCAL_HOPS") == "1":
        score = 0
        reasons.append("forced_local")

    route = "remote" if score == 3 else "local"
    return HopDecision(score=score, route=route, reasons=reasons, probe_ms=probe_ms)

def route_step(kind: str, decision: HopDecision) -> HopDecision:
    if kind in LOCAL_STEPS:
        decision.route = "local"
        decision.reasons.append("step_pinned_local")
    elif kind not in PLAN_STEPS:
        decision.route = "local"
        decision.reasons.append("step_not_in_plan_allowlist")
    decision.step = kind
    return decision

def main() -> None:
    parser = argparse.ArgumentParser(description="Score one agent hop")
    parser.add_argument("--host", required=True)
    parser.add_argument("--port", type=int, required=True)
    parser.add_argument("--budget-ms", type=float, default=150.0)
    parser.add_argument("--payload-file", required=True)
    parser.add_argument("--step", default="plan")
    args = parser.parse_args()
    payload = open(args.payload_file, encoding="utf-8").read()
    decision = score_payload(payload, args.host, args.port, args.budget_ms)
    decision = route_step(args.step, decision)
    print(json.dumps(asdict(decision), sort_keys=True))

if __name__ == "__main__":
    main()

The regex is a tripwire, not a vault. Treat a match as stay local and stop. Do not redact and forward in the same breath. Redaction bugs are how secrets still leave the dock.

Remote is allowed only at score three. That is stricter than a soft threshold. One failed check is enough to keep the step local. Local-first means the truck stays parked on doubt.

Commands that make the score honest

A score without a probe is a slogan. Run a cheap TCP check before any HTTP client wakes. Keep the timeout under half a second so a dead hop fails fast.

printf '%s\n' 'summarize public test logs' > /tmp/public_plan.txt
printf '%s\n' 'Authorization: Bearer sk-demo' > /tmp/secret_step.txt

python3 hop_score.py --host 127.0.0.1 --port 8080 --budget-ms 150 \
  --step plan --payload-file /tmp/public_plan.txt

python3 hop_score.py --host 127.0.0.1 --port 8080 --budget-ms 150 \
  --step read_env --payload-file /tmp/secret_step.txt

FORCE_LOCAL_HOPS=1 python3 hop_score.py --host 127.0.0.1 --port 8080 \
  --budget-ms 150 --step plan --payload-file /tmp/public_plan.txt

Point --host at whatever remote hop you already run. Do not hard-code a vendor hostname into the scorer. The router should not know the truck's paint color.

Log every decision as one JSON line. A week of lines beats a single anecdote. You will see which steps never deserved a hop in the first place.

python3 hop_score.py --host 127.0.0.1 --port 8080 --budget-ms 150 \
  --step plan --payload-file /tmp/public_plan.txt >> hops.jsonl

Choose budgets by loop, not by hope. Inner tool hops can use 150 ms as a lab default. Outer plan hops can use 800 ms without pretending that is science. Change the numbers after you watch probe_ms for a day.

Four steps, four dock decisions

Walk a short agent through the scorer before wiring a framework. Step one plans over a public README. Step two reads .env. Step three applies a patch. Step four summarizes a public test log.

Step one may hop if the probe is green. Step two stays local because the payload is secret-shaped. Step three stays local because patching is a stove job. Step four may hop again if the log has no credentials.

That split is the architecture. Planning tokens can ride the van. Tool execution stays in the kitchen. Retry and critique stay local if the last probe drifted past budget.

The allow-list in PLAN_STEPS is small on purpose. Agent frameworks grow flags faster than they grow taste. A short list keeps the dock boring, which is the point.

Unknown step kinds fall local. That is not a bug in the router. It is the cost of refusing to assume a network. New step names must earn a place on the van.

When a free server actually wins

Local-first is not local-only. Some steps are large, slow, or idle on a laptop CPU. Planning over a public repository summary is one case. Summarizing a public test log is another case.

Those steps still need a green score. No secret-shaped text in the payload. A stable path. A latency budget that matches the outer loop, not the demo.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. MonkeyCode offers free model access and a free server option. Those two facts are the only product claims used here. Put the scorer in front of that server the same way you would front any other remote hop.

The server is a truck at the dock. It does not get the package until the score says the road is clear. Free does not change that order. It only changes whether a clean plan step has a place to go.

Offline still wins when the probe returns nothing. A local model process can keep tools moving. The van can wait. The stove should not.

A tiny reproducibility check

Do not trust the scorer without a failing case. Save tests next to the script and run them on every change.

# test_hop_score.py
# run: python3 -m pytest test_hop_score.py -q
from hop_score import route_step, score_payload

def test_secret_payload_stays_local(monkeypatch):
    monkeypatch.setattr("hop_score.probe_latency", lambda *a, **k: 40.0)
    d = score_payload("Authorization: Bearer sk-demo", "example.test", 443, 150)
    assert d.route == "local"
    assert "secret_shaped_payload" in d.reasons

def test_slow_probe_stays_local(monkeypatch):
    monkeypatch.setattr("hop_score.probe_latency", lambda *a, **k: 400.0)
    d = score_payload("summarize public logs", "example.test", 443, 150)
    assert d.route == "local"
    assert d.score == 2

def test_offline_probe_stays_local(monkeypatch):
    monkeypatch.setattr("hop_score.probe_latency", lambda *a, **k: None)
    d = score_payload("summarize public logs", "example.test", 443, 150)
    assert d.route == "local"
    assert "offline_or_unreachable" in d.reasons

def test_clean_plan_may_hop(monkeypatch):
    monkeypatch.setattr("hop_score.probe_latency", lambda *a, **k: 55.0)
    d = score_payload("summarize public logs", "example.test", 443, 150)
    d = route_step("plan", d)
    assert d.route == "remote"
    assert d.score == 3

def test_apply_patch_never_hops(monkeypatch):
    monkeypatch.setattr("hop_score.probe_latency", lambda *a, **k: 20.0)
    d = score_payload("apply the patch in memory", "example.test", 443, 150)
    d = route_step("apply_patch", d)
    assert d.route == "local"
    assert "step_pinned_local" in d.reasons

If the secret test ever goes remote, stop the agent. The dock is broken. If apply_patch ever goes remote, the allow-list is broken. Those two asserts are the architecture review in code form.

Limitations

The scorer does not understand your threat model. Regex misses vault paths and custom header names. A TCP probe ignores TLS, auth, and queue time on the far side. A green score can still be a bad idea.

Remote hops still copy tokens off the box. Free does not mean private. Do not send customer source, credentials, or regulated records through a clean score. Offline mode is only as strong as the local process you actually run.

This workflow also adds a decision point on the hot path. That is extra code and extra logs. Teams with one always-on remote model may find the branch noisy. Measure the branch or delete it.

Payload size is out of scope here. A huge public context can still be a bad hop on a metered link. Add a byte cap in your fork if upload cost matters. Do not pretend the current scorer sees that cost.

Who should not use this

Skip the hop score if policy already forbids remote models. Skip it for hard real-time loops under a few milliseconds. Skip it if you cannot run the fixture tests above.

Air-gapped builds should not keep a remote host in the config. Delete the route instead of scoring it. A dead truck at the dock is still a truck, and someone will start it later.

Skip it for agents that must touch production secrets on every step. Those agents need a local-only path with no remote branch. A score that can return remote is the wrong shape.

What to log for a week

Record step kind, score, probe_ms, and route. Count how often remote would have fired on secret-shaped text. Count how often the probe failed while the agent kept talking to itself.

Those two counts are the review. They beat a slide about using models more. If remote never wins a clean plan step, drop the hop. If local never wins a tool step, the split is fiction.

A free server earns its keep on the remaining clean plans. Everything else stays in the building. If you already front a free server, drop this scorer in and keep a week of JSON lines.