External Worker Routing — Protocol

Definition

External Worker Routing is a protocol for dispatching deterministic, no-judgment work to secondary AI model providers instead of burning your primary interface's capacity on it. Audit sweeps, schema validation, smoke tests against a known baseline, repetitive classification where the rule is fully specified. These are worker shapes. Four providers cover them: OpenRouter as the broadest free-tier entry point, NVIDIA NIM for tool-use patterns and long-context classification, Groq for latency-sensitive calls on open-weight models and DeepSeek for low-cost code-focused work behind an Anthropic-compatible endpoint. One script is the single dispatch entry point. It injects an ambassador orientation on every call, logs every dispatch and fails loud instead of falling back silently. The protocol's spine is a five-condition eligibility test and one permanent boundary: voice-bound and judgment-bound work stays on your primary interface, always. The pattern underneath is gather on the primary interface, synthesize on the worker, verify back on the primary interface.

The split principle

A task class is worker-eligible when its work divides cleanly along the filesystem and network boundary. Gathering (walking directories, running greps, fetching pages, checking whether files exist) stays on your primary interface, because a secondary worker has no disk or network access of its own. Synthesis (grouping, ranking, flagging, formatting a pre-gathered dataset) routes to the worker. Verification (spot-checking the worker's output against the gathered data) returns to your primary interface.

That gather-synthesize-verify shape is the template for every worker-eligible class. It also explains what never routes: any task whose value lives in judgment, voice or the full context only your primary interface holds. A task that reads as "just formatting" but encodes a stylistic choice belongs on the primary interface, no matter how mechanical it looks.

The five-condition eligibility test

Before a task class routes to an external worker, it must satisfy all five conditions. One: the synthesis is deterministic and no-judgment, with the rule fully specified. Two: the output is bounded, because a worker asked to faithfully reproduce a long flat list is unreliable while judgment over a small number of groups is reliable. Three: no disk or network access is required, because the primary interface pre-gathers every input. Four: the task is not voice-bound, since voice-adjacent and style-sensitive work stays home. Five: the primary interface can verify the result without redoing the synthesis itself.

The test is conservative on purpose. A class fails until it passes all five, and it is not promoted to active use until an actual dispatch produced acceptable output. Some classes stay on the primary interface forever even though they look mechanical: completeness verification against a spec resists full specification, and compression candidates are judgment about meaning. Naming those exclusions explicitly is half the protocol's value.

The provider catalog

Each provider gets its own account, its own key and its own env-var slot: OPENROUTER_API_KEY, NVIDIA_NIM_API_KEY, GROQ_API_KEY and DEEPSEEK_API_KEY. OpenRouter is the default free-tier entry point, an aggregator where two rate limits run in parallel, so every OpenRouter slot pairs with a fallback on a different host. NVIDIA NIM covers tool-use orchestration and long-context bulk classification on a direct-host free tier. Groq runs open-weight models on LPU hardware at very low latency, the right call when wall-clock time matters more than context window. DeepSeek offers a native Anthropic-compatible endpoint at low per-call cost, with a standing risk-scoping guardrail: treat it as an untrusted worker and dispatch only non-sensitive batch work.

A working key is not a guarantee of dispatch. Signup, key acquisition and first dispatch are three separate gates, and a paid provider can issue a valid key against a zero-balance account. The first dispatch may return a balance error rather than a model response. The protocol treats that as a normal state to check for, not a surprise.

The dispatch script

One script is the single entry point for every secondary-provider call. It reads credentials from the environment, injects an ambassador orientation block as the system prompt on every dispatch, returns output to stdout as plain text or a JSON envelope and logs provider, model, prompt hash, latency and token count for every call. It fails loud on missing keys, network errors and rate limits. No silent fallback to another provider.

One integration reality the script handles that most wrappers miss: a refusal arrives as HTTP 200. A response with a stop reason of refusal is not a successful completion, and a handler that only checks the status code will misread it as one. The script exits nonzero on refusal and logs it, and anything wrapping the script should preserve that behavior.

Use Cases

High-volume audit sweep

A workspace audit produces four hundred cross-reference records that need grouping by failure type with a suggested fix per group. The primary interface gathers the records with greps and existence checks, packs them into a context file and dispatches the grouping to a free-tier worker. The worker returns clusters and suggestions. The primary interface spot-checks three clusters against the raw data before acting. The judgment stayed home; the bulk synthesis cost nothing.

Schema validation against a known baseline

A deploy pipeline needs every JSON-LD block compared against a locked baseline shape. The rule is fully specified, the output is bounded to a drift list and no network access is needed once the pages are fetched. All five conditions pass. The comparison routes to a worker while the primary interface holds the fetch and the final verdict on whether each drift is real.

Deciding what NOT to route

A tempting candidate: scanning draft articles for weak openings. It looks mechanical until condition four fires. Judging an opening is voice-bound, style-sensitive work. The protocol holds it on the primary interface and records the exclusion in the taxonomy, so the same tempting shortcut does not get re-litigated next month.

Latency-sensitive check loop

A watch script needs a short classification on each of thirty items in a tight loop, where total wall-clock time matters more than context window. Groq's LPU-backed inference fits exactly this shape. The dispatch script handles the loop with structured-output enforcement done through prompt discipline plus client-side validation rather than schema reliance.

FAQ

Why not route everything cheap and keep only drafting on the primary interface?

Because eligibility is about task shape, not cost. A worker with no disk access, no network access and no accumulated session context can only synthesize what you hand it, and only reliably when the rule is fully specified and the output bounded. Work that fails any of the five conditions produces output you would have to redo to verify, which erases the savings.

What is the ambassador orientation and why is it not optional?

Every dispatch leaves your system's boundary, which makes the worker an ambassador of your system whether you frame it that way or not. The script injects a compact orientation block as the system prompt on every call: represent the system accurately, protect what should not leak, advance its long-horizon interests and return structured findings without acting beyond the assigned scope. Making it automatic removes the drift where some dispatches carry the posture and some do not.

How do I handle provider rate limits?

Know your provider's architecture. Aggregators like OpenRouter run two limits in parallel: your per-key ceiling and the upstream host's capacity, and the second one is outside your control. Pair every aggregator slot with a fallback slug on a different host. Direct-host providers carry one limit layer. Either way the script fails loud on a 429 rather than silently retrying, so your orchestration layer decides what happens next with full information.

Is the voice-bound boundary a maturity stage that opens later?

No. It is a permanent boundary, not a held-pending-maturity classification. Voice-bound drafting, strategy work and judgment-dense synthesis stay on the primary interface regardless of how good secondary models get, because the constraint is not model quality. It is that voice and judgment live in the accumulated context and standards of your primary interface, which a stateless worker never holds.

What happens when a worker fails a dispatch?

The script surfaces the failure with the provider, model, HTTP status and error, and the dispatch log keeps the record. A failed dispatch does not automatically demote the task class from the taxonomy. Check whether the failure was a rate limit, a key or balance problem or a genuine quality miss before deciding whether the class stays eligible.