[BunsDev]

LM-5 (#380), slice 2. This makes the no-cloud-fallback rule for local threads hold where each auxiliary call is made, instead of relying on every caller to check. main still doesn't construct LocalExecution, so product behaviour is unchanged.

Why

Before this, each caller checked thread.localTarget itself:

• the runner skipped Auto, follow-ups, naming and credit fallback;
• the approval gate skipped Jev.

A new caller that forgot the check would leak a local thread to a cloud model or to Jev.

What changes

• localOnly(thread) in engine/local-models/run-policy.ts is true for any persisted local target, valid or not.
• Jev: the runner registers it through Decisions.guardThreads. Decisions.connect then returns no connection for a question naming a local thread (routing, follow-up or approval), before any key is resolved or CLI probed. Settings' Try it names no thread and is unaffected.
• Credit fallback: creditFallback and recentCreditFallback return nothing for a local thread.
• Naming: nameThread never asks a title model about a local thread.
• Routines: sendUnattended refuses a local thread, and does not reroute it to a cloud model.
• The callers' existing checks stay.

Tests

One new regression in runner-local-models.test.ts calls each chokepoint directly, with cloud controls. Disabling each of the five guards in the compiled output made it fail, and it passed again after a byte-for-byte restore.

A stub router in runner-routing-ceiling.test.ts gained the decisions seam.

Check	Result
Focused (runner-local-models, local-run-policy, routing)	56/56
pnpm build && pnpm test, run 1	1 failure: the stub router above, now fixed
pnpm build && pnpm test, run 2	2,089 passed, 20 skipped, 1 failed (see below)
pnpm build && pnpm test, run 3 (head 6fbec39)	exit 0; desktop 2,090 passed, 20 skipped, 0 failed; every other package green

The run 2 failure was companion-network, "each supported address has a reachable advertised listener", with a request timeout. This change doesn't touch that code, and it passed 12/12 in each of 5 isolated reruns.

No UI changes.

Docs: docs/local-models.md, docs/status.md, and the review record.

Still open on #380:

• AC2, the network-denied offline canary, which needs Val;
• AC6, runtime context evidence;
• AC4, real-runtime OOM, overflow and restart handling;
• product admission of LocalExecution, which is Val's decision.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
modex	Ready	Preview	Oct 31, 2026 5:08am UTC

[github-code-quality]

Code coverage overview

Languages: TypeScript

TypeScript / code-coverage-agent

main 21f6a70	lm5-local-policy 95c2485	+/-
66%	66%	0%

ℹ️ Calculations represent line coverage. Results may change as calculations are updated.

---

_{Updated October 31, 2026 05:34 UTC}