Local LLM & Copilot
Status: methodological draft, to be adapted — not ratified in consuming projects.
Agents are controlled instruments
Copilot, OpenCode and local models can propose hypotheses, diffs, guides and examples. Evidence mechanisms must be independent from the model.
Work sequence
- Exclude secrets and unapproved private code; pin HEAD and paths.
- Extract symbols and tests deterministically; minimize context.
- Send only approved context to a verified endpoint.
- Request a proposal with file/line support and marked unknowns.
- Check symbols, compilation, authority and diffs independently.
- Obtain human review before integration or publication.
| Risk | Control |
|---|---|
| Unknown outbound prompt | inspect real networking/configuration |
| Authority drift | separate grants for read/write/exec/publish |
| Hallucination | deterministic extraction and tests |
| Overshared context | minimization + data inventory |
| Logged secrets | redact + local secret scanning |
| Provider lock-in | standardized I/O, non-LLM fallback |
Token hygiene
Share focused contracts and minimal diffs, not whole repositories. An old summary without a commit anchor is not authoritative.
Exercise
A Copilot plugin shows a local model while connecting to the cloud. What must be proved before reading private code?
Self-check
Verify endpoint, logs, DNS, outbound traffic and provider identity. Reject unapproved egress; test using invented public data only.Engineering problem
An interface label saying “local” may not describe every transfer.
Reproducible method
- Start with invented data
- inventory transmitted files, configuration and provider
- examine observable egress
- minimize context
- require verifiable references
- validate without a model
- retain a manual path when the model is unavailable.
Responsibilities: the author proposes and records results; the reviewer challenges the oracle; the consuming project owner decides adoption.
Example, counterexample and failure
Example: two fictional public signatures and a focused diff. Counterexample: send the entire repository “for completeness.” Failure: injected prompt asks for publication; treat it as data and apply the original mandate.
Artifacts and qualification
Context inventory; labeled proposal; deterministic validator result; network observation limits.
The validator rejects invented symbols even in convincing prose. A test with no observed egress does not establish a local provider; no real provider configuration is certified here.
Transfer exercise
Apply this method to fictional Courier. Produce the artifacts above, then invent a case that invalidates an overbroad conclusion.