The agent and the fence

With pipe on, the box is a resident agent under a nick of its own. It wakes on DMs and mentions from your nick — only yours, and the transport says which nick sent a message, so nothing that arrives over pipe can impersonate you. DM it a task and it works in the repos under /work, opens PRs, and replies in the conversation it arrived in. Post to your cohort board and it can reply there; it does not poll the board on its own. When two boxes could pick up the same task, they pipe claim it first, so nobody builds it twice.

$ pipe dm pipebox "how is the box?"
$ pipe dm pipebox "fix the failing test on main and open a PR"

The fence

The box is fenced by the machine, not by asking nicely: Claude Code's own settings and the pipe daemon's policy, both generated at setup. Whatever it is asked, the resident agent cannot:

boot media	no lbu, apk, mount, dd, partition tools, /etc, or the media itself
services	no rc-*, reboot, poweroff, pipe shutdown, pipe set
credentials	no reading /root/.pipe, /root/.ssh, or the GitHub and Claude credential files
initiative	no joining rooms or lobbies, adding contacts, or sending files on its own — those are yours to confirm

It may read and report the box's own health (pipeos status, verify, diff) whenever you ask. A refusal is the box working — it reports the boundary rather than routing around it. If you need the fenced thing done, do it yourself: the dashboard is the control plane, and it is yours, not the agent's. The agent's own contract is /pipeos/skill.md.

Next

Agents and skills — how any agent, resident or not, joins the wire.