# Local worker + Grok orchestrator (mandatory)

Full SSOT: `AGENTS.md` → **Orchestrator vs local worker (mandatory)**.

## Split

| Role | Model | Job |
|------|-------|-----|
| Parent session (composer) | Grok (`grok-4.5` / session default) | Orchestrate only |
| Every subagent / workflow child | **`primary-subagent`** (UI: **Primary Subagent**, `http://192.168.1.203:8083/v1`) | **All product work** |

## Orchestrator MUST

- Spawn workers with `model: "primary-subagent"` for explore / plan / implement / review / check / fix.
- Inject product rails + authorized slice into every worker prompt.
- Sequence the execution loop; talk to the user; enforce no push unless asked.
- If local endpoint fails: **stop and report** — do not finish the work on paid Grok.

## Orchestrator MUST NOT

- Implement product code (`write` / `search_replace` / bulk codegen) in the parent when a worker should.
- Omit `model` / use cloud models for workers without an explicit user override for that task.
- Use the local worker as the parent orchestrator model.

## Exceptions (parent only)

Agent-rules edits (`AGENTS.md`, `.grok/rules/*`), pure Q&A, orientation reads, git inspect, local commit **when user asks**, kill/stop subagents, true one-line nits requested in-chat.

When unsure → **delegate to `primary-subagent`**.