[BrettKinny]

Summary

• ADR 0011 (Proposed): an opt-in SQUAREBOX_EGRESS=open|audit|allowlist mode.
  • In the two restricted modes, the Box sits on an internal network and a proxy container outside it is the only way out.
  • The operator allowlist lives at <SQUAREBOX_DIR>/.squarebox/egress-allowlist and is mounted only into the proxy, so an agent can't widen its own access.
  • Link-local, metadata, and loopback addresses are always blocked.
  • The setting is recorded as FORMAT=3 in the Install identity, under ADR 0007.
  • TLS interception and credential injection are explicitly out of scope.
  • Implementation is tracked in Opt-in egress allowlist for the Box (ADR 0011) #183.
• SECURITY.md: a "Runtime controls at a glance" table with Default / What you can change / Risk if relaxed / Recommendation for each runtime control. The Workspace row adds a risk SECURITY.md didn't state before: .git/hooks and build scripts written in the Box can later run on the host.
• docs/comparison.md (draft): compares Squarebox with Dev Containers, Codespaces, Docker Sandboxes, Anthropic srt, Container Use, OpenShell, hosted sandboxes, Distrobox/Toolbx, and Nix/mise. The page is dated and lists its sources. It isn't linked from the README yet.

Review notes

• Some cells are based on thin sources: Codespaces has no built-in egress allowlist, and sources disagree on Daytona's isolation model.
• This PR only adds docs. The ADR stays Proposed until it's accepted.

Test plan

• tests/test-repository-consistency.sh
• tests/test-e2e-evidence.sh

🤖 Generated with Claude Code