Local only
Dispatch needs no account, no network service and no upload. The background watcher is one local process per project. Only the agents talk to their providers.
Trust and safety
Blocked Work stays out of your source, and nothing leaves your machine.
Dispatch runs locally, keeps its evidence on your machine, and uploads nothing. Agents talk to their own providers through their own logins.
Isolated workspace
Native runs work in a candidate workspace made from a frozen baseline. Attached Work runs in a workspace Dispatch makes, or in a separate worktree you name.
Blocked verdicts apply nothing
A REFRESH or STOP leaves your source unchanged and the review pending. The analysis has limits; your checks cover what it cannot see.
No silent spending
No paid fallback, credits or account switch is automatic. A funding refusal holds until setup re-authorizes the profile.
Source safety
Only accept, or a policy you turn on, changes your source.
dispatch accept applies through the safe apply path, gated by the coherence verdict, and records your acceptance only after it applies. Auto-apply applies only Work whose checks passed on the exact code it lands on, never overrides a verdict, and never records a human review. Work a Claude Code session registered is never applied by itself.
Coherence at accept time
If the source moved since S0, Dispatch recomputes whether the patch still applies and whether what the Work relied on still holds, then runs your checks on the merged tree in a scratch copy. dispatch check is read-only and stores nothing. --despite-refresh can override a REFRESH that comes only from the analysis, with your explanation and only when your checks run and pass on the merged tree; it never overrides STOP, a patch conflict or a failed check. Set coherence.accept: strict to refuse on any drift. The zero false CONTINUE and zero false REFRESH result is from our fixture matrix, not real repositories; see coherence validation.
Local execution is not a sandbox
Agents and project checks run with your operating-system permissions. Interactive runs ask for confirmation; --allow-unsafe-local is the explicit acknowledgement for scripts, and refresh requires it again. Dispatch clears most child environment variables; forwarding more needs --allow-forwarded-env, and their values are redacted from logs. Start with a repository you can restore.
Agents and their providers
Dispatch uses the installed, unmodified agent CLI and its own login. Claude Code and Codex CLI talk to their own providers, whose terms and data controls apply. Dispatch does not collect provider tokens or implement OAuth; see provider support.
Local data
Everything Dispatch records stays on your machine.
- State: ~/.dispatch/dispatch.db (override with --state-dir or DISPATCH_HOME)
- Per run: ~/.dispatch/runs/<run-id>/
- The frozen baseline and candidate workspace
- Bounded stdout and stderr, structured agent output, check output
- The patch, the event journal, coherence verdicts and your review
- Workspaces Dispatch made for attached Work: ~/.dispatch/workspaces/<run-id>/, kept until the Work is applied or you run dispatch clean, which asks first
- Claude Code hooks, if you install them: entries in ~/.claude/settings.json, with a backup kept beside it
Run your first local task.
Follow the quick start with a repository you can restore. The current 0.4.11 boundaries are listed at the end of it.