Glossary

ACP (Agent Client Protocol). The protocol an editor uses to drive a coding agent as a subprocess over stdio. boxer acp <harness> starts the harness's ACP server inside the guest. See running the harness inside.

Adherence. How often a live model follows the brief when nothing enforces it and the prompt never mentions boxer. It has its own evaluation layer.

Allowlist. The default network.mode, under which the guest reaches only allow_hosts and the registry hosts its image pull needs. Only smolvm enforces it. See network.

Backend. The runtime that runs sandboxes: smolvm (the default), Apple container, docker or podman. See backends.

boxed agent. The subagent that ships in the plugin package. It has no shell tool and runs everything through boxer_run. See skills and plugins.

Branch source. A smolvm sandbox restarted by boxer fork --prepare so it can be forked. See forking.

Brief. The generated summary of how this checkout runs commands: the mount, the mode, the intercept and passthrough lists, and the declared tasks. boxer brief prints it, the hooks inject it, and the MCP server serves it at boxer://brief.

Capsule. A capsule.toml that records the last command run in a scope, the commit, the relevant configuration and the exit that counts as reproducing it. boxer capsule replay exits 0 when the failure still happens. See capsules.

Container. A sandbox that shares your machine's kernel with every other container. docker and podman run containers. Lighter than a microVM, with a weaker boundary. See Backends.

Cell. One row of an evaluation matrix. A cell is one harness at one integration level running one task in its own worktree and sandbox. See the matrix tier.

Degraded scope. A scope that fell back to a coarser isolation because the harness supplied no session or agent id. See degradation.

Enforcement. Which mechanisms keep commands in the sandbox: hook, shim, both or audit. See enforcement.

Environment pack. The pack boxer caches automatically after image_setup, keyed by the image and the configuration that shapes it, so the next worktree starts from it. gc reclaims old ones. See packs.

Fork. A copy-on-write child of a running smolvm sandbox, sharing the parent's worktree. See forking.

Guest. The inside of the sandbox. The host is your machine.

Harness. A coding agent's CLI, such as Claude Code, Codex or OpenCode. See harnesses.

Hook. A harness callback that runs boxer hook <harness> before each shell call, so boxer can rewrite or deny it. See hooks.

image_setup and setup. Two command lists that run in the guest. image_setup changes the image and is cached in the environment pack. setup prepares one worktree and runs in each. See environment.

Inside and outside. Where the harness runs. Outside, the default, the harness runs on the host and boxer sandboxes the commands it issues. Inside (integration = "inside"), the harness itself runs in the guest. See running the harness inside.

Integration level. One of the ways a harness's commands reach the guest: hook rewrite, plugin, tool mode, PATH shims, shell substitution, inside mode, or skill and MCP tool only. A harness uses every one it supports at once. See Integration levels.

Kernel. The core of an operating system, which controls processes, files and the network. A microVM has its own. Containers share yours.

Intercept. The list of programs whose commands boxer sandboxes. Passthrough is the list that always stays on the host. See what gets sandboxed.

Isolation. What a scope is keyed to: repo, worktree (the default), session or subagent. See scope.

microVM. A small virtual machine with its own kernel, which boots in about a second. smolvm runs one per sandbox, which keeps each task's processes and system changes apart from the others and from your machine.

Mode. What a hook does with a command it catches. rewrite turns it into boxer run, tool denies it and points to the boxer_run MCP tool, and off does nothing.

Named pack. A pack saved with boxer pack save and started from with boxer pack use. gc never removes it. See packs you name.

Orchestrator. A tool that creates a worktree per task and starts a harness in it, such as Conductor or OpenHands. See orchestrators.

Pack. A snapshot of a smolvm guest's filesystem, not its processes. boxer manages environment packs. You manage named packs. See packs.

Placement. Inside or outside. It is part of the scope key, so the two placements of one worktree get two sandboxes. See placement.

Plugin. One of two things. The OpenCode plugin rewrites commands in-process. The Agent Plugins package, installed with npx plugins add BarakChamo/boxer, carries the skill and the boxed agent and no hooks. See skills and plugins.

portless. The local reverse proxy boxer uses to give forwarded ports stable names, on port 1355 by default. See URLs.

Prep. The [prep] command list, which runs on the host in the worktree while the sandbox boots. It is opt-in and only safe for packages with prebuilt binaries. See prep.

Rewrite. Replacing a command with boxer run -c '<command>' before it runs, so the agent sees the command's output instead of a refusal.

Run record. What the last command in a scope did: the command, directory, exit, git state, output tails and test results. boxer status --json shows it and boxer capsule new captures it. See JSON output.

Sandbox. A separate place for commands to run, so what they install, start or change stays out of your machine and out of other tasks. boxer gives each worktree one.

Scope. The identity of one sandbox, sb- plus twelve hex characters. It is also the sandbox's name. The two words printed beside it (swift-crab) come from the same hash. See scopes and packs.

Shim. A file on PATH named after a program. It reruns the command in the guest. It needs no harness support and works as long as the shim directory stays on PATH. See PATH shims.

Skill. The Agent Skill that tells an agent how commands run in this repository. It gives instructions and enforces nothing. See skills and plugins.

smolvm. The microVM runtime boxer uses by default, one kernel per sandbox. See backends.

Task. A named command line in [tasks], run with boxer run --task <name>. See tasks.

Tier. One layer of evaluation, such as smoke, t1, t2, adherence, flow, sdlc or matrix. See evaluation strategy.

Worktree. An extra checkout of a git repository in its own folder, on its own branch, so two tasks can edit the same project at once. Agents and orchestrators create them for you. It is boxer's default unit of isolation. See Parallel worktrees.