Give a local model one bounded job. Keep the final decision in Copilot.

Some work is useful to offload to a local model: reading a few files you already chose, drafting a structured answer, or naming missing evidence. That can keep private files on your machine and avoid spending frontier capacity on narrow preparation.

The risk is also real. A fluent local answer is still only a proposal. If the local process can see too much, use too many tools, or quietly "decide" a release, merge, or security outcome, the handoff becomes unsafe.

Sealed Delegation is the narrow pattern that keeps the useful part and rejects the unsafe part:

• you choose one small job and the exact files it may see;
• a local Copilot CLI child works only inside that packet;
• a separate check verifies the answer;
• Copilot keeps the final decision.

This is not autonomous local development. It is not a savings claim.

The installable skill is still named local-agent-delegation.

Give a local model three selected test reports and ask it to identify missing release evidence.

What happens:

1. Copilot seals only those three files into an isolated workspace.
2. The local child may read those files and nothing else.
3. It returns a structured proposal, such as "blocked until joined runtime and rollback evidence exists for the predeclared 30-day windows."
4. A separate gate checks the answer against the sealed evidence.
5. Copilot decides whether to keep, edit, reject, or escalate the proposal.

The local model never authorizes a release. It only prepares a checked answer from the files you allowed.

The synthetic version of this example ships in examples/evidence-check/.

Requirements:

• Windows with PowerShell 7
• Node.js 20 or newer
• GitHub Copilot CLI 1.0.79 or 1.0.80; any other version needs a successful preflight first
• Foundry Local CLI 0.10.3
• cached qwen2.5-7b-instruct-generic-gpu with at least a 16K practical context budget

Static checks:

pwsh .\run-checks.ps1 -SkipLive

Full live check (staged-file canary + sealed evidence example + independent gate):

pwsh .\run-checks.ps1

Success ends with:

PASS: full sealed-delegation checks

New here? Start with the tutorial. It walks one scenario from setup through what you delegate, what the local agent returns, and what Copilot verifies.

Install the skill:

copilot skill add .\.github\skills\local-agent-delegation

Optional agentic demo (transport + format + gate wiring, not a semantic benchmark):

pwsh .\examples\evidence-check\run-agentic-demo.ps1

In plain language first:

1. Seal the job. Copilot writes one task and copies only the approved files into a temporary workspace. Each file is hashed so the receipt can prove what the child saw.
2. Run locally. A second Copilot CLI process uses the local model. By default it can only view the sealed files.
3. Return a proposal. The child prints an answer plus receipts. Exit code 0 means "the child finished," not "accept this."
4. Verify separately. A gate re-checks hashes and compares the answer to an expected result or another independent check. Only then does Copilot keep, edit, reject, or escalate.

Copilot (frontier session)
  -> seals one task and approved files
  -> launcher hashes files into an isolated workspace
  -> local Copilot CLI child uses a minimal tool list
  -> child returns a proposal plus receipts
  -> separate gate accepts, edits, rejects, or escalates

Safe operating rule: use local only when the task is bounded, the evidence is explicit, and the result has a cheap independent check. Never treat process exit zero, confidence, or fluent prose as authority.

Only exact routes in .github/skills/local-agent-delegation/references/approved-routes.json run as qualified by default. Starting LM Studio, Ollama, or another local server does not make it available automatically. An unlisted runtime, model, profile, stream mode, or prompt budget fails before inference.

-AllowUnqualifiedRoute is a loud research override. Receipts record that the route was unqualified; it must not inherit qualified claims.

This allowlist is technical evidence only. It is not employer, legal, privacy, export-control, or procurement approval. Follow your organization's policies even when a route is technically qualified here.

Terms appear after plain language above. Use this when a receipt or deeper doc uses the shorter label.

Public research preview. The qualified route is intentionally narrow. The Session API adapter is an unqualified experiment and does not replace the approved shimmed route. Read QUALIFICATION.md before changing the model, runtime, Copilot CLI version, tool set, or token budget.

MIT

Participation is governed by the Contributor Covenant Code of Conduct.