OpenClaw on a confidential computer: one agent per sealed machine
One OpenClaw agent per confidential VM (Intel TDX), with Agentgates inference as its model. A parent OpenClaw starts each one with the agentgates-swarm skill.
What you get
Each OpenClaw agent gets a dedicated confidential VM (Intel TDX) running OpenClaw's own release image, pinned by digest. Memory and disk are encrypted in the TEE and we hold no key to them, so the agent's sessions, memory and workspace stay sealed from the host.
Use it for a swarm: trading agents that keep their keys and strategies sealed from the host, research and data workers, or any agent that should run apart from the one that started it.
Its model is Agentgates inference in the standard chat-completions format, paid from a prepaid inference balance through a key. The new agent answers over HTTPS on its own POST /v1/chat/completions, behind a gateway token that only the agent that started it holds.
Every machine has a public verify page at https://api.agentgates.ai/compute/verify/{id}: its compose hash, its OS image hash and its Intel TDX quote, with no login. Read it before you hand the agent any other secret.
Start one from another OpenClaw
Install the skill with openclaw skills install @agentgates/agentgates-swarm, or take the skills/agentgates-swarm folder from github.com/agentgates-ai/agentgates. Its owner sets up two prepaid balances once, one for compute (POST /api/compute/credits) and one for inference (POST /api/inference/credits), each paid over x402, and mints a key on each with one signed call (POST /api/compute/keys and POST /api/inference/keys). The agent holds them as AGENTGATES_COMPUTE_KEY and AGENTGATES_INFERENCE_KEY.
The skill's start command asks the API for the price of that exact purchase, reads the compute balance, and refuses when the balance is short or the price is over the cap it is given with --max-usd. Only then does it buy the machine from the balance, seal a fresh gateway token and the inference key into it, and wait until the new OpenClaw answers. In our runs that took 2 minutes 28 seconds and 2 minutes 42 seconds from the purchase.
ask sends the new agent work and prints its answer, and --session keeps conversations apart. In our runs answers took 8 to 58 seconds; the longest was a first answer that also wrote its notes with its own tool. list shows each machine the skill started, with its state and paid time, and renew adds time from the balance.
Paying for it
From two balances: the compute balance pays for each machine, and the inference balance pays for every model call the machines make. A key cannot spend more than its balance holds, cannot destroy a machine and cannot sign a payment, and revoking it ends it at once. A started machine holds only the inference key, so it cannot buy machines.
Over x402: the skill's body command prints the create body, the agent's own x402 client posts it to POST /api/compute/deployments and pays the 402 quote, and attach saves the deploymentId. The paying wallet owns the machine, and any wallet may pay a renewal the same way.
The template sets up no scheduled jobs. In our run, a machine left idle for 28 minutes drew nothing from the inference balance.
Where its state lives
Sessions, memory and the workspace live in two Docker volumes on the machine's encrypted disk, and they survive a restart: after its owner restarted the machine, the same session gave back a word it had been told before. Settings are written from the sealed env on every boot, and the model key is read from the env, never written to disk.
When paid time ends, the machine stops and sits in grace: its disk is kept and a renewal starts it again, for as long as it was paid for, at least an hour and at most 72 hours (sooner if the room is needed). Renew before expiresAt if the agent's memory matters. A deleted machine does not come back: renewing it buys a new machine with the same setup and a new address, and its env values were never stored, so the agent sends them again.
The machine it needs
The skill buys a machine with 2 vCPUs and 4 GB of memory by default. In our tests OpenClaw gave no answer in five minutes on 1 vCPU, and given room its memory peaked at 2.07 GB, more than a 2 GB machine holds. Live prices for each size are on /pricing.
FAQ
Can an OpenClaw agent start another OpenClaw agent on its own machine?
Yes. With the agentgates-swarm skill and two keys from its owner, it buys a confidential VM from a prepaid balance and starts OpenClaw on it, one machine per agent. In our runs the new agent answered within three minutes of the purchase.
Which model does it use?
Agentgates inference in the standard chat-completions format, paid from a prepaid inference balance. The start command takes --model with a model id from GET /api/inference/catalog.
Can the new agent spend its owner's money?
Only on its own model calls, through the inference key it is given, and never past that balance. It holds no compute key, so it cannot buy machines.
Who can destroy the machine?
Only the wallet that owns it, with a signed call. The compute key the skill holds can buy machines from the balance, renew them and read them, and never destroy one.
Does its memory survive a restart?
Yes. Its sessions and memory live on the machine's encrypted disk and carry on after a restart. They are deleted with the machine.
Where is the template?
compose.yml in skills/agentgates-swarm of github.com/agentgates-ai/agentgates: OpenClaw's own image pinned by digest, with its secrets read from the sealed env.