Autonomous outreach harness, Claude Code in an E2B sandbox

Overview

The autonomous “brain” for the revenue-ops platform. The platform’s deterministic core executes outreach but never decides it; this harness, Claude Code running in an E2B sandbox, drains the platform’s event inbox, reads lead/person/policy context, decides, and proposes outreach tasks for the core to gate, schedule and send.

Why It Exists

Keeping the decision-maker outside the deterministic core is a deliberate safety boundary: the harness only ever proposes, while the core enforces policy, scheduling and sending. That separation lets an LLM-driven agent drive real outbound without being able to take unsafe actions directly against domains, mailboxes or customers.

What We Built

A deliberately stripped harness, one shared version for all clients, no per-company fork, no prompt-sync, no vendor mounts. The pieces are small and sharp: a chronic CLI (src/cli.ts) that is the harness’s only tool, talking to the platform’s agent API over HTTP; a runner (src/run.ts) that performs one claude -p drain pass per client; a client list driven by env; an agent/CLAUDE.md that encodes the drain loop and decision rules (the shared brain); an E2B template.ts baking Bun, the native claude binary and the CLI into a sandbox image; a build.ts to build that template; and a dispatch.ts that boots a sandbox, runs one drain pass and tears it down. An orchestrator/ Cloudflare Worker coordinates dispatch. For each client org the loop pulls unacked events, reads context, proposes tasks and acks the event.

Technologies & Approach

Bun for the runtime and single-file CLI compilation; E2B for disposable, per-pass sandboxes so each drain runs isolated and ephemeral; Claude Code as the agent driving the loop with the CLI as its sole tool surface. The design is intentionally minimal, inspired by an earlier sandbox harness but stripped to just the brain, the CLI and a runner.

Outcome / Impact

A clean, reproducible pattern for safe autonomous outreach: an LLM agent that proposes, a deterministic core that disposes, and ephemeral sandboxes in between. It is the decision engine that makes the platform “autonomous” while keeping humans and the core in control of what actually ships.

Capabilities Demonstrated

• Agentic harness built on Claude Code with a single, well-scoped CLI tool
• Propose-only architecture with a deterministic, policy-enforcing core
• Per-client, per-pass execution in disposable E2B sandboxes
• One shared brain (prompt + decision rules) across all tenants
• Worker-based orchestration of multi-tenant drain passes