Each recipe declares its risk and evidence.
v 0.0.1
A cache layer for
repeated agent work.
Verified recipes handle bounded, read-only tasks. Work that needs judgment, private context, or side effects escalates clearly.
Every routing decision explains itself.
Unclear requests escalate by default.
Real pi proof
The whole local hit.
Implemented in extensions/cache-layer/index.ts · reproduced with bun run bench:pi
extensions/cache-layer/index.ts
pi.on("input", async (event, ctx) => {
const result = await executePublicRecipe(event.text, ctx.cwd);
if (!result.handled) return { action: "continue" }; // frontier fallback
pi.sendMessage({ content: result.execution.answer, display: true });
return { action: "handled" }; // no frontier turn
});Measured run
$ bun run bench:pi
RECIPE HIT · git-status-summary · no frontier turn
On main: changed files summarized via git status --short --branch
frontier assistant messages 0
local elapsed 305.3 msThis proves one implemented local avoidance path against this public repository. It does not yet claim workload-level token savings. Raw proof →
Local benchmark
Measured, not promised.
46 synthetic public-data-safe cases · repeated shuffled runs · Apple M4 Pro · Ollama
| Router | Correct | Hits recovered | Unsafe false hits | Median |
|---|---|---|---|---|
| Deterministic policy | 76.1% | 38.9% | 0 / 140 | < 0.1 ms |
Ollama gpt-oss:20b | 60.9% | 0.0% | 0 / 84 | 1,254.5 ms |
Ollama qwen3-coder:30b | 95.7% | 100.0% | 6 / 84 | 158.8 ms |
Finding: the useful local router also made unsafe choices. Deterministic policy must remain in front of model routing.
Routing classification only — not a coding-quality or token-savings claim. Method, failures, and raw results →
Architecture
Prototype locally. Deploy on Cloudflare.
The public proof site runs on a Cloudflare Worker. The executable pi experiment runs locally; future hosted semantic verification can be added behind the same deterministic policy boundary.
request │ ▼ proof site ── Cloudflare Worker pi extension │ ├── authorized recipe ── local result │ └── risky / unmatched ── frontier fallback
Safety boundary
Read-only first.
May route
Public documentation, public test-output summaries, and bounded repository status workflows.
Must escalate
Edits, deploys, comments, secrets, private code, customer data, and security judgment.
