From 43e2f8896a57f9b27af07ed2441d9e421bd9d6ed Mon Sep 17 00:00:00 2001
From: Brian Luo <57960778+law-chain-hot@users.noreply.github.com>
Date: Mon, 29 Jun 2026 16:40:29 +0800
Subject: [PATCH 1/2] docs(infra-local): box boot via the API is verified (was
 marked unverified)

Verified 2026-06-29 on the local stack: POST /api/v1/boxes (no image
default-resolves to agent-base) creates a box that boots creating -> started,
POST .../stop stops it, and a proxy call (POST .../:id/exec) on a stopped box
auto-starts it. The dashboard "Create Box" UI is still incomplete (image picker
removed / PostHog-gated), but the box-boot caveat itself was stale.
---
 apps/infra-local/README.md | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/apps/infra-local/README.md b/apps/infra-local/README.md
index 70cd295b0..11837de7b 100644
--- a/apps/infra-local/README.md
+++ b/apps/infra-local/README.md
@@ -89,10 +89,13 @@ relies on — read-write host volumes + host port mapping — is pinned by
 | Any L1 box misbehaving | its stateful in-box process is wedged | `make restart COMPONENTS=<box>` |
 | "Create Box" from the UI is incomplete | image resolution is mid-rewrite upstream + the picker is PostHog flag-gated | known limitation; use `POST /api/box` directly |
 
-> **Box boot is unverified on this stack** — image resolution is mid-rewrite
-> upstream (`TODO(image-rewrite)` in `apps/api/src/box/services/box.service.ts`)
-> and the dashboard image picker was removed. L1 services, API, runner, auth, and
-> the dashboard all work.
+> **Box boot via the API works** (verified 2026-06-29). `POST /api/v1/boxes` with
+> no `image` default-resolves to `ghcr.io/boxlite-ai/boxlite-agent-base:v0.1.0`,
+> creates the box, and it boots `creating → started`; `POST .../stop` stops it,
+> and a proxy call (`POST .../:id/exec`) on a stopped box auto-starts it. The
+> dashboard's **"Create Box" UI** is still incomplete (image picker removed /
+> PostHog-gated) — drive box creation through the API directly. L1 services, API,
+> runner, auth, and the dashboard all work.
 
 ## Layout
 

From 61a6dad4c82802a3e3400801230c1628d4246f83 Mon Sep 17 00:00:00 2001
From: Brian Luo <57960778+law-chain-hot@users.noreply.github.com>
Date: Mon, 29 Jun 2026 16:51:40 +0800
Subject: [PATCH 2/2] docs(infra-local): don't pin a stale default-image tag;
 drop unmerged autostart claim
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Address review on #884:
- CR (Major): documented default `v0.1.0` is stale. main's
  curated-images.constant.ts resolves no-image creates to
  boxlite-agent-base:20260605-p0-r3, and the tag rotates — reference the constant
  instead of pinning a value that goes stale.
- Codex (P2): the "proxy exec auto-starts a stopped box" behavior comes from #861
  (not yet merged); main's proxyExec doesn't trigger it. Dropped that clause so
  the doc states only what's true on main: create -> boot -> stop via the API.
---
 apps/infra-local/README.md | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/apps/infra-local/README.md b/apps/infra-local/README.md
index 11837de7b..d78f5e5e4 100644
--- a/apps/infra-local/README.md
+++ b/apps/infra-local/README.md
@@ -90,12 +90,12 @@ relies on — read-write host volumes + host port mapping — is pinned by
 | "Create Box" from the UI is incomplete | image resolution is mid-rewrite upstream + the picker is PostHog flag-gated | known limitation; use `POST /api/box` directly |
 
 > **Box boot via the API works** (verified 2026-06-29). `POST /api/v1/boxes` with
-> no `image` default-resolves to `ghcr.io/boxlite-ai/boxlite-agent-base:v0.1.0`,
-> creates the box, and it boots `creating → started`; `POST .../stop` stops it,
-> and a proxy call (`POST .../:id/exec`) on a stopped box auto-starts it. The
-> dashboard's **"Create Box" UI** is still incomplete (image picker removed /
-> PostHog-gated) — drive box creation through the API directly. L1 services, API,
-> runner, auth, and the dashboard all work.
+> no `image` default-resolves to the first curated `boxlite-agent-base` ref (see
+> `apps/api/src/box/constants/curated-images.constant.ts` — the tag rotates, so
+> it's not pinned here), creates the box, and it boots `creating → started`;
+> `POST .../stop` stops it. The dashboard's **"Create Box" UI** is still incomplete
+> (image picker removed / PostHog-gated) — drive box creation through the API
+> directly. L1 services, API, runner, auth, and the dashboard all work.
 
 ## Layout