Architecture

Cohalen is local-first. The desktop app, the Coding agents, your code, and every git worktree run on your machine. Two things ever leave it, and only when you ask: a pull request goes to GitHub when you ship, and review metadata syncs to a backend when you work with a team. Your source and the agents' execution never do.

What runs where

On your machine, the desktop app prompts each agent and streams its Turn; every agent works in its own git worktree. The app reaches outward only to ship through GitHub, to sync review with a team, and to carry the model traffic each agent makes under your own subscription.

What stays on your machine

The whole working surface is local. Each Workspace is a real git worktree on disk, and the agent that owns it, its terminal, and the files it edits all live there (Workspaces). The agent conversation is a durable Session the Coding agent itself persists on disk, so re-opening a Workspace rebuilds the Chat from disk rather than a server. A git worktree isolates parallel work but is not a security boundary, so what runs inside one runs under a Sandbox profile: filesystem confinement, a network allowlist, secret hygiene, and a hard spend cap.

What leaves, and when

Three things cross the machine boundary, each on an action you take:

• GitHub, when you ship. Commit & push, the pull request, and the merge run through your GitHub connection and are authored as you. Nothing pushes until you drive that step.
• The sync backend, only on a team. While your Organization is just you, the client sends nothing: the Chat, the Changeset diff, and Checks stay local because there is no one to share them with. When a teammate joins, the review surface syncs so they can follow a Workspace live, but the worktree itself never leaves its Owner. Execution stays where the work runs.
• The model API, whenever an agent thinks. Each agent calls its own vendor's endpoint under your subscription or keys (Agents and models). Cohalen never proxies that traffic or sits between you and the model.

Why it is built this way

Keeping code and execution on the machine is a design choice with a security payoff. An agent editing your repository has the blast radius of a local process, so the boundary that matters sits on your own disk, where the Sandbox enforces it. You never hand your source to a server and trust that server to hold the line.

It also means Cohalen runs with no account and no network. On your own, the sync backend stays dark and everything above still holds. Sharing is what a team turns on when a teammate joins.

---

Next: Repositories, the git sources your Workspaces branch from.