Anonymous sandbox environment. Two libvirt VMs (ashbox-gateway: Tor router, ashbox-workstation: isolated workspace) on sandbox-isolated network (10.99.99.0/24). Managed via Bob launcher (build/start/shutdown/destroy). Host-side socat forwards expose VM services on localhost. 9p storage passthrough at /mnt/ashbox-storage. Internal services: Transmission, SABnzbd, Prowlarr, Sonarr, Radarr, Unpackerr, SearXNG. Scripts: build.sh (full rebuild), start.sh (activate network + start VMs + mounts + forwards), shutdown.sh (graceful stop), destroy.sh (full teardown). Encrypted tooling (.age) contains Ansible playbooks for internal service installation.