Constraints that compile.
You have seen an agent ignore the one rule that mattered. Asking nicely in a prompt did not fix it, because a prompt is a request. What you need is a rule that cannot be ignored.
On Boxcar, you write the rules in plain language, and they become the track your agents run on. A train does not promise to stay on the rails. The rails only go to safe places.
The question is not how to write a better prompt. It is how to build a track.
Every action gets a signal: green, yellow, or red.
Green · it goes
Safe, routine work runs right away. No waiting, no review line.
Yellow · it waits
Unclear work pauses and shows you why, so a person can make the call.
Red · it stops
Risky work is blocked before it happens, and the stop names the exact rule that triggered it.
Brakes are why cars go fast.
Boxcar's autonomy envelopes, deterministic halts, and audit trails are not there to slow you down. They are what let you be ambitious. Brakes are why cars go fast; rails are why trains run at speed.
And every green, yellow, and red is recorded. Replay any decision and get the same answer, which is what makes agent behavior something you can actually operate.
A rule you cannot read is asking for faith.
So the core is open source, Apache 2, and inspectable on purpose. Look at how the signals work, read the decision log, and test the track without talking to anyone. It runs fully offline on a laptop, peer-to-peer on a LAN, or in your own cloud with Postgres, RBAC, SSO, and audit logs. Local models or your own keys; we never sit between you and your provider's bill.
Three ways to run it. One product.
Local desktop · single user, fully offline
Works on a plane, in a SCIF, air-gapped. Local LLM or bring your own provider key. Apache 2.
LAN / collab · small team, owner-hosted
Peer-to-peer, no server tier. Local LLM agent or your own keys. Apache 2.
Enterprise Plane · server-mediated, governed
Postgres, RBAC, SSO, audit log, data residency, zero technical debt engine, support, IP indemnity.
No. Prompts are suggestions the model can route around. The track is enforcement outside the model: typed actions, compiled rules, and gates that hold no matter how persuasive the completion is.
Run it where you live
Evaluation on a laptop today, the Enterprise Plane when you scale. Either way the core is Apache 2 and the track is readable.