Many boxes, one repository

The appeal is obvious. One agent's attempt at a hard problem is a sample from a distribution. Three attempts, from different angles, and you pick the best one. It is the same instinct that makes people run a test suite more than once.

In practice the hard part is not launching three agents. It is being able to say anything trustworthy about the three results afterwards.

The comparison problem

Suppose agent A finishes at 10:15 and agent B at 10:40, and in between somebody merged to the parent branch.

If the two boxes measured their diffs against a moving branch, B's diff now silently includes that merge, or excludes something A's included, and the two are no longer describing the same change to the same starting point. You are comparing a photograph to a slightly different photograph and calling one of them better.

Every naive version of parallel agent work hits this, usually without noticing, because the symptom is not an error. It is a comparison that quietly stopped being one.

Pinning is the whole mechanism

A box freezes its base revision at creation and pins it immutably. Nothing re-resolves it later. Create three boxes from the same HEAD and all three are describing changes to exactly the same tree, whatever anyone does to the branch in the meantime.

$ h5i box . --name try-a --profile agent-claude
$ h5i box . --name try-b --profile agent-codex
$ h5i box . --name try-c --from a3f9c2b   # or an explicit base

$ h5i box ls                            # every box on this clone
$ h5i box compare try-a try-b           # two, side by side
$ h5i box export try-b --out ./review

Drift does not disappear, it becomes visible. h5i box status reports how far a box has fallen behind its parent, and h5i box rebase re-pins onto the current tip or refuses if that would conflict. Refusing is the point: a silently wrong base is worse than a conflict you have to resolve.

Two agents, two boxes, two credential sets

Running Claude and Codex at the same problem is one of the more useful shapes here, and it has a security consequence people miss.

Each box is scoped to one runtime. agent-claude grants Claude's own HOME state and Anthropic egress; agent-codex grants Codex's state and OpenAI egress. A box holding both would let a prompt-injected session read the other runtime's token and spend it against a host the allowlist already permits.

So parallel attempts across runtimes are not just a diversity trick. Separate boxes are how the credentials stay separate.

What was cut, and why it is worth saying

h5i used to ship an orchestration layer: a team command, personas, a neutral verifier that replayed each candidate, tournament shapes, a scoring pass. It is gone, along with the provenance system it was built on.

Two reasons, and neither is that orchestration is a bad idea.

The verifier could not be trusted more than the workers. A neutral verifier is a model reading model output. It produced confident rankings, which is exactly the failure mode an ensemble is supposed to fix. Automating the judgement moved the problem rather than solving it, and the ranking got the authority of a number without earning it.

It was built on evidence the agents produced about themselves. The comparison read captured prompts and self-reported test results. When those turned out to be testimony rather than observation, everything computed from them inherited the problem.

What survived is the substrate: cheap independent boxes, a base nobody can move, and a receipt per box that was written where the box could not reach it. If you want an ensemble on top of that, you can build one, and you will be building it on evidence rather than on self-report.

How to actually pick a winner

Without a verifier, the ranking is yours. A workable order:

1. Drop any box whose report shows denied egress you cannot explain. That is the only signal in the export that makes a claim about the boundary, and an unexplained one disqualifies an attempt regardless of how good the diff looks.
2. Drop any box that did not run what it claims to have run. A report showing a build and no test run, under a summary saying the tests pass, is a four-second check.
3. Compare the survivors' diffs, which is now an ordinary code-review problem against a shared, fixed base.
4. Read each agent's proposal last, as context on intent rather than as an argument for its own work.

The honest limits of running three

• Three attempts cost three times as much, in tokens, in wall-clock and in your attention. The third is rarely the one you take.
• Correlated failures do not average out. Three agents given the same misleading README all misread it the same way. Diversity of runtime helps a little; diversity of prompt helps more; neither is a guarantee.
• Comparison is not verification. The best of three wrong answers is still wrong, and a side-by-side view makes it look considered.
• Boxes are cheap, not free. Each carries a workspace and a dependency install. h5i box cache exists because cold installs dominate that cost.

FAQ