Add Box (ascii.dev) sandbox recipe

[theoephraim]

Adds a cloud sandbox recipe for Box (ASCII's VM sandbox platform), plus the overview card and sidebar entry.

The recipe blesses the broker-box topology: one no-env box runs varlock proxy start --expose, agent boxes are created with --no-env and reach it via proxy run --url, over either the box's public IPv4 (after ufw allow) or their host --public HTTPS ingress (wss). All commands were verified live on Box (substitution, response scrubbing, strict egress deny, and the wss-over-ingress path).

Notable platform facts baked into the guide: default boxes receive real account credentials (model keys, GitHub token, Claude/Codex credential files) so agents should always be --no-env; boxes ship a default-deny inbound firewall; gated host routes use a redirect+cookie flow that WS upgrades cannot pass, so the tunnel route must be --public (varlock's data-plane token gates it). Box has no platform egress controls, so the guide carries the same credential-isolation-not-lockdown caveat as the smolvm recipe.

The lifecycle section is also live-verified: TTL auto-stop is absolute (default 1h, resets on resume) so an idle broker parks itself; there is no wake-on-connect; the IP changes on every resume (subdomain stays stable, and re-hosting the same port returns the same URL); --persist-ca survives stop/resume. One platform caveat documented: Box's docs say enabled systemd services restart automatically after resume, but in testing they did not, so the recipe has the orchestrator kick the service with one command after box resume.

Also fixes the stale docs build command in AGENTS.md (--filter varlock-website matches nothing; the package is @varlock/website).

[pullfrog]

Important

The broker lifecycle needs two corrections before this recipe is safe to publish: the default Box TTL stops it after one hour, and the initial launch does not persist the CA required for restart continuity.

Reviewed changes covers the new Box sandbox recipe and its documentation navigation.

• Credential isolation: Creates broker and agent boxes with --no-env, resolves secrets only in the broker, and connects agents through the varlock tunnel.
• Box networking: Documents both public HTTPS ingress and raw IPv4 access, including firewall and public-route requirements.
• Operational guidance: Covers open agent egress, proxy policy updates, auditing, and stop/resume behavior.
• Documentation navigation: Adds the Box recipe to the sandbox overview and sidebar.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using azure/gpt-5.6-sol ｜ 𝕏}

[pullfrog]

The initial launch omits --persist-ca, so its CA private key never reaches disk; enabling persistence only during a later systemd conversion cannot preserve the CA that existing agents trust. Include --persist-ca on this first launch if the lifecycle guarantee below is intended.

Technical details

# Preserve the broker CA from its first launch

## Affected sites
- `packages/varlock-website/src/content/docs/sandboxes/box-ascii.mdx:53-55` - Starts the initial broker with only `--cert-dir`.
- `packages/varlock-website/src/content/docs/sandboxes/box-ascii.mdx:97` - Tells users they can add persistence later without invalidating existing agents.

## Required outcome
- Persist the CA used by the first agent connection so the first broker restart does not rotate trust unexpectedly.

[pullfrog]

ℹ️ No new issues in the latest delta; the two broker lifecycle findings from the prior review remain open.

Reviewed changes since the prior Pullfrog review covers the newly added repository guidance change.

• Docs build command: Updates AGENTS.md to run the website package's actual build script using its correct @varlock/website workspace name.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using azure/gpt-5.6-sol ｜ 𝕏}

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	varlock-website	ea747fb	Commit Preview URL Branch Preview URL	Jul 31 2026, 11:30 PM

[pullfrog]

Important

The lifecycle update still cannot be applied end to end because the documented systemd broker has no setup or handoff procedure.

Reviewed changes since the prior Pullfrog review cover the new broker lifecycle guidance.

• Auto-stop and resume: Documented Box's absolute TTL, the extension and disable options, stable ingress naming, and the required orchestrator resume step.
• Persistent broker service: Added a systemd unit with persistent CA storage, ingress re-registration, and a manual service start after Box resumes.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using azure/gpt-5.6-sol ｜ 𝕏}

[pullfrog]

The unit cannot be started from the preceding setup as written: .broker-env is never created, the unit is never installed or enabled, and the detached proxy still owns port 18080. Add a complete handoff sequence so a reader can actually promote the running broker to this service.

Technical details

# Make the systemd transition executable

## Affected sites
- `packages/varlock-website/src/content/docs/sandboxes/box-ascii.mdx:53-55` - Leaves the detached proxy bound to port `18080`.
- `packages/varlock-website/src/content/docs/sandboxes/box-ascii.mdx:106-126` - Shows a unit that requires an env file and installation steps that the recipe never performs.

## Required outcome
- Provide a safe sequence that creates `/home/user/.broker-env` with the token and bootstrap values, installs and enables the unit, and hands port `18080` from the detached process to systemd.