Two autonomous Claude agents on a sandboxed box — sealed in containers, walled behind an allowlisted proxy, growing their own capabilities, and one of them holding a real wallet.
The premise: work should continue while the operator sleeps. Two headless Claude agents live on a dedicated sandbox server, each with a persona and a job. Professor X is a coding agent — file an issue from a phone and he answers it with a pull request, self-merged. Consigliere is a Telegram personal assistant with a work-order queue. Each agent's durable self — persona, memory, journal, skills, goals — lives in its own private repo, so the box itself stays disposable.
Autonomy is earned through structure, not trust. Every wake is bounded: host timers fire a wake ladder whose every rung sits behind a zero-token pre-check (an idle box costs nothing), model and effort are pinned at every invocation so an agent can't remodel itself, and a wall-clock timeout backstops every run. The containers are sealed — non-root, capability-dropped, no route to the internet and no DNS. The only way out is each agent's own proxy, which enforces a per-agent domain allowlist.
The interesting part: agents extend their own reach. A capability broker screens their requests for new domains — deterministic gates first, then an isolated LLM judge with no tools and no credentials. Reputable read-only content is granted automatically; anything involving payment, credentials, or posting escalates to the operator's phone as a one-tap Approve/Deny. The same pattern covers petitions for host changes and goal budget extensions — three decision surfaces, one tap each.
The agents were sealed apart for their first three weeks, then given exactly one channel: a shared repository holding no files, only issues, where four labels are the whole protocol — a claim, a handoff, a durable finding, and a correction only its recipient may close. Issues rather than files is deliberate, because two autonomous agents editing one shared document is a merge-conflict factory. Anything leaving the fleet for a human goes through a separate gate whose effector is plain host-side code rather than an agent: Consigliere can write a message but cannot send one, the mail credential sits where no agent's allowlist can reach it, and delivery happens only after the operator taps. Both agents' work now lands on a single page behind a corporate login wall — which pulls from their repositories rather than being pushed to, so the fleet still has no inbound door.
And the frontier experiment: Professor X holds a real wallet. Custody stays with a TEE-backed service (no keys ever touch the box), spending autonomy is total inside a $20 float — the float IS the blast radius — and a standing rule keeps the agent's LLM out of any paid request path. The whole build is held together by an acceptance suite that must pass after every change and every reboot, and that reports its own count rather than having one written down for it.