Where your code runs

By default, everything runs on your machine, and what crosses the boundary crosses it under an account you hold. Agents call their model vendors under your subscriptions. A pull request goes to GitHub when you ship. On a team, the chat and the changeset diff sync so teammates can review; that is the one rendering of your code that travels, and the worktree itself never does.

One choice moves execution: pick a box for a workspace, and that workspace's clone and agent run in your own sandbox vendor's account instead. Yours, not Cohalen's. No Cohalen server sits in any of these paths or holds your source, your keys, or your vendor credential.

What runs where

The desktop app prompts each agent and streams back what it's doing. Every agent works in its own git worktree, on your machine or in that workspace's box.

What stays on your machine

The working surface is local by default. Each workspace is a real git worktree on disk. The agent that owns it, its terminal, the files it edits, and the conversation itself all live there. Re-open a workspace and the chat rebuilds from disk, not from a server.

A git worktree keeps parallel work apart, but it isn't a security boundary. So whatever runs inside one runs under a sandbox profile. It reaches only the files and hosts you allow, keeps secrets out of the agent's way, and stops at a spend cap.

What leaves, and when

Four things cross the machine boundary, each under an account you hold:

• GitHub, when you ship. The commit and push, the pull request, and the merge all run through your GitHub connection, authored as you. Nothing pushes until you do that step.
• The sync backend, only on a team. Nothing syncs until a teammate joins, and then only the review surface, so they can follow a workspace live. The worktree never leaves its owner's custody.
• The model API, whenever an agent thinks. Each agent calls its own vendor's endpoint under your subscription or keys. Cohalen never proxies that traffic.
• Your sandbox vendor, only for a workspace you picked a box for. Its clone and agent run in your own vendor account, created and destroyed by your desktop, billed to you. The credential stays in your OS keychain, and Cohalen resells no compute.

Why it's built this way

Whoever holds the code and the keys is who you have to trust. Cohalen's answer is that it's you, in every case: your machine by default, your own vendor account when you choose one, your GitHub identity when you ship. Cohalen is never the party holding your source and promising to behave.

It also means Cohalen runs with no account and no network at all.