AI Coding Local and Cloud Execution Boundary: Code Residency, Capability Degradation, and Routing Credentials

Starting an Agent on your laptop doesn't mean inference happens locally; choosing a cloud workspace doesn't mean the entire Git history must be uploaded. Editor extensions, semantic indexing, crash reports, model gateways, and remote shells may each take different paths. Simply checking "will not train on customer data" on a procurement form cannot answer which files were actually sent for a given task, to which region, or for how long they are stored. Open-Source vs Closed LLM Selection discusses model strategy; this article only defines the executable data boundary for code tasks.

Repository Classification Must Be Compiled Into an Execution Contract

Security and engineering owners jointly publish coding.executionBoundary.v1. The contract fixes the repository ID, classification generation, allowed execution tier, model and region allowlist, sendable material types, derivative-artifact rules, network egress, identity audience, retention period, telemetry fields, and enforced degradation. Tiers must at least distinguish LOCAL_ONLY, CONTROLLED_CLOUD, and EXTERNAL_ALLOWED; unknown classifications default to local read-only and do not automatically inherit the looser policies of adjacent repositories.

schema: coding.executionBoundary.v1
repository: payments-core
classification: restricted-source
tier: LOCAL_ONLY
materials: [working-tree, local-symbol-index]
egress: { modelApi: deny, telemetry: aggregate-only }
fallback: local-readonly
policyGeneration: 12

Classification targets are not just source code. Git history, untracked fixtures, generated code, symbol graphs, embeddings, terminal output, test snapshots, issue bodies, and source maps can all recover business information. Each material carries a source, sensitivity level, and allowed transformations; converting source code into vectors cannot automatically downgrade it to non-sensitive. Agent Untrusted Data Taint Propagation handles trust labels from content to tool parameters; here the labels determine execution location and outbound eligibility.

VS Code Workspace Trust states that tasks, debugging, and extensions in untrusted repositories may execute code, which makes it suitable for local entry protection, but it does not replace organizational data routing. LOCAL_ONLY must also pin local model artifacts, the runner image, and a sandbox with no external network; CONTROLLED_CLOUD must bind the tenant, region, short-lived workload identity, encrypted storage, and destruction policy; external APIs need an explicit provider, endpoint, purpose, and retention evidence. The NIST Privacy Framework can help sort out data-processing risk, but actual enforcement still relies on machine-readable contracts.

Every Route Issues a Decision Credential

Before the Agent starts, it enumerates this run's materials and generates coding.executionRoute.v1: binding the task, base/tree digest, material manifest, requested capability, selected tier, runner/model revision, region, policy digest, expiresAt, and routeDecisionId. File-read agents, indexers, model gateways, and telemetry egress all verify the same decision; the UI must not show "local" while the indexer keeps calling cloud Embeddings.

There is a race between the route decision and the workspace snapshot creation. The executor obtains a short-lived permit after the material manifest is frozen; the permit only allows reading the listed blob digests and pre-registers a workspace ID before launching the remote environment. Any later new file or tree change invalidates the permit and forces a new decision. Remote runners use identities issued per-task audience; AI Platform Secrets Rotation handles the underlying credential lifecycle, and this contract forbids tools from falling back to personal long-lived tokens.

Cloud execution cannot end with just deleting the container. The control plane records uploaded objects, indexes, caches, logs, provider request IDs, and backup categories, reconciles by owner tag, and then issues a destruction receipt; UNKNOWN deletions enter a quarantine queue. The SLSA provenance subject/material approach can prove runner and input artifact identity, but it cannot replace the supplier's deletion evidence. Code content does not enter ordinary traces; only route, size, classification, and summary are retained. Prompt and Trace Redaction continues to control access and retention of the necessary logs.

Explicit Degradation When Capability Is Insufficient

When the local model cannot complete a cross-repository refactor, the safe action is not to silently switch to cloud, but to return CAPABILITY_UNAVAILABLE. The contract can pre-allow local-readonly, generate only search results, send only the human-selected minimal fragment to controlled cloud, or stop entirely. Each degradation has a visible capability gap and a new route receipt; user approval can only pick from already-computed candidates and cannot use a single popup to permanently loosen the repository classification. Coding Agent Sandbox Permissions restricts commands and network; this boundary further restricts which execution domain these operations happen in.

Fault-injection tests deliberately send marked files out via .git history, symlinks, submodules, LFS, crash dumps, terminal echo, Embedding cache, and extension auto-update; they then inject region drift, cloud endpoint DNS misconfiguration, tree changes after permit, lost deletion receipts, and provider fallback. Out-of-bounds sends are expected to be 0; unknown materials go to DENY_UNKNOWN_MATERIAL; sent-but-unconfirmed deletions go to QUARANTINED_RESIDUE, and these must never be rewritten as local success.

Enforcement gates require 100% material classification coverage, 100% consistency between route and actual network destination, 0 unregistered egress, 0 accepted expired permits, 100% reconciliation of remote owner-tag resources, destruction timeouts all entering quarantine, and local-degradation tasks not calling external models. Rollout first shadows current tools' real destinations, then blocks telemetry for restricted repositories, and only finally enforces model routing. If false blocks exceed 1%, the local runner is unstable, or the route verifier crashes, switch back to the previous policy generation and stop at local read-only; never temporarily open external sends to recover efficiency.