box-airgap-status

name	box-airgap-status
description	Report the air-gap trust boundaries for the current session. Confirms Box Drive backend state, disk encryption posture, and identifies which LLM provider is handling agent prompts. Read-only. Use at the start of any sensitive workflow, or when an auditor asks what's closed vs open in the trust model.
argument-hint	[--llm=<provider>] [--no-cache]

/box-airgap-status

If you see unfamiliar placeholders or need to check which tools are connected, see CONNECTORS.md.

Enumerate the trust boundaries currently closed (and currently open) in this agent session. Read-only — never modifies anything. Used as a pre-flight before sensitive workflows and as an audit artifact.

Usage

/box-airgap-status [--llm=<provider>] [--no-cache]

Examples:

• /box-airgap-status — full report; ask user about LLM provider once per session
• /box-airgap-status --llm=anthropic-bedrock — declare LLM upfront (skip the ask)
• /box-airgap-status --no-cache — re-probe everything, don't use cached values

What to do

Step 1 — Box data path

Read cached result from box-drive-detect (or run it if no cache). Report:

Box data path:        <CLOSED via Box Drive | OPEN — Box Drive not detected>
  Drive mount:          <path or "not found">
  Drive process:        <running | stopped | unknown>
  Sync state:           <idle | pending N files | offline | unknown>
  Account:              <email or "not detected">

The data path is CLOSED if Box Drive is detected, writable, and running. Otherwise OPEN — the plugin can't write at all (skills will fail). There's no "partially closed" — this is binary.

Step 2 — Disk encryption

Check disk encryption on the workspace's host. macOS:

fdesetup status

Parses to one of: FileVault is On, FileVault is Off, or unknown (e.g., insufficient permissions to query).

Report:

Disk encryption:      <ON via FileVault | OFF | unknown>

Don't claim it's ON if you can't verify. Report unknown if fdesetup requires sudo and isn't available.

Step 3 — LLM provider (the open trust boundary)

The plugin can't directly observe which LLM the agent is using (the agent runtime may or may not expose it). Approaches in order:

1. If --llm=<provider> was passed, use that. Trust the user's declaration.
2. Check session cache for a prior declaration in this session. If present, use it.
3. Probe agent metadata if available (e.g., environment variables like ANTHROPIC_MODEL, AWS_BEDROCK_MODEL, AZURE_OPENAI_*, or hostnames the agent's making calls to — only if observable without making outbound calls yourself).
4. Ask the user once: "Which LLM provider is handling this session? Options: anthropic-api-with-baa, aws-bedrock, azure-gov-ai-foundry, self-hosted, unknown." Cache the answer for the session.

Report:

LLM API path:         OPEN to <provider>
  Compliance posture:   <see lookup below>

Lookup table (mirror of references/supported-llm-configs.md):

Provider	Compliance posture summary
anthropic-api-with-baa	HIPAA-eligible if BAA signed; data leaves device to Anthropic
anthropic-api-no-baa	No HIPAA coverage; not suitable for regulated data
aws-bedrock	AWS attestations (HIPAA, FedRAMP Moderate by region)
azure-gov-ai-foundry	Azure Gov attestations (FedRAMP High, IL4/IL5 by tenant)
self-hosted	True air-gap if running on same device / private LAN
unknown	User has not declared; treat as worst-case for now

Step 4 — Trust boundary summary

Trust boundaries (this session):

CLOSED:
  Box content read/written by this plugin's skills: local FS only
  (No outbound calls to Box from this plugin's skills)

OUT OF SCOPE for this plugin:
  Box Drive's own sync to Box cloud: <handled by Box Drive, attested by Box>
  Agent prompts to LLM (may contain memory content): <provider above>
  Other agent tools (audit separately)

USER RESPONSIBILITY:
  Disk encryption: <status above>
  Physical device security
  Box Drive vendor trust
  LLM provider compliance posture for your data class

Step 5 — Flag mismatches

If the user has declared a compliance regime in _box-memory.json.compliance_target (e.g., hipaa, fedramp-moderate, fedramp-high, itar) AND the LLM provider's posture doesn't cover that regime, flag it:

⚠ Compliance mismatch:
  Declared target:    fedramp-high
  LLM provider:       anthropic-api-with-baa (covers HIPAA, not FedRAMP High)
  → Switch LLM to azure-gov-ai-foundry or self-hosted, OR
  → Update _box-memory.json.compliance_target if your scope is narrower than declared

Step 6 — Report timestamp

End with a timestamp the user/auditor can cite:

Status as of: <ISO-8601 UTC timestamp>

When to invoke

• At session start for sensitive workflows
• Before a box-write of regulated content (preferably automatically by box-write itself; users can also call manually)
• When an auditor asks "what's the trust posture?"
• After Box Drive is started/stopped (use --no-cache)

Don't

• Don't make any outbound network calls to probe LLM provider. Use only locally-observable signals.
• Don't claim a trust boundary is CLOSED that you can't verify. Report unknown honestly.
• Don't modify any files. Status is read-only.
• Don't cache the user's LLM declaration across sessions — they might switch providers between sessions.