# Trying out autonomous agents

**URL:** https://andreskristensen.blog/post/trying-out-autonomous-agents

![A carefully built sandcastle standing intact in a wooden sandbox in early morning light.](https://cdn.sanity.io/images/i6gaeymf/production/e274b19435978f7e2d13a39d80e9c9fcaf4085e0-1024x1024.png)


---

**Summary:** Sandcastle is Matt Pocock’s workflow for running Claude Code unattended inside a Docker container. It assigns the agent a GitHub issue in a git worktree, then merges the resulting commits back into the user’s branch. Its init command quickly scaffolds the infrastructure, but useful results still depend on supplying clear, focused tickets.

Wayfinder fills that planning gap by breaking an idea that is too large for one session into a map issue and smaller decision tickets. Each ticket addresses a single unresolved question rather than a build segment, producing the self-contained, labeled issues Sandcastle needs. Without this map, vague issues led to equally vague pull requests.

Before queueing work, the author uses a grilling skill to challenge assumptions and force difficult decisions. Resolving uncertainty early prevents the agent from making costly guesses during unattended runs.

For secrets, the author replaces a plaintext .env file with Varlock and a committed .env.schema. Values are resolved through Doppler and exposed only through process.env during execution, although each secret must still be explicitly forwarded into the container configuration.

The author would use the setup again but stresses that ticket quality remains decisive. Every diff is still reviewed, tasks stay tightly scoped, and fully unattended overnight operation remains a future goal.

## The setup in one paragraph

Sandcastle is Matt Pocock's loop for running a coding agent unattended. It puts Claude Code in a Docker container, points it at a git worktree, gives it one GitHub issue, then merges the commits back to your branch. The init command scaffolds the whole thing in about a minute. Issues go in, branches come out.

## Wayfinder charts the map

The scaffold gives you a loop. It does not give you anything for the loop to eat. That is the part I underestimated.

Wayfinder is a planning skill that takes an idea too big for one session and turns it into a map issue with child decision tickets. Each ticket holds one question whose answer is a decision, not a slice of the build. You work them one at a time until nothing is left to decide.

That output is exactly what Sandcastle wants: small, self-contained, labelled issues. I did not plan the pairing, it just fell out. My first attempt without a map was three vague issues, and I got three vague pull requests back.

## Grill me before you commit

Before anything went in the queue I ran the grilling skill against the plan. It asks hard questions and does not accept the first answer. Ten uncomfortable minutes.

Then consider the alternative. A question you did not answer becomes a guess the agent makes at 3am, and you find out over coffee that it guessed wrong. A bad assumption caught at the keyboard costs one sentence. Caught in the morning it costs the whole run.

## Varlock so nothing lands on disk

The default is a plaintext .env file next to the config. I did not want credentials sitting on my laptop, so I used varlock instead.

You commit a .env.schema holding the shape of each variable and where to find it, never the value. Mine resolves through Doppler. The loop then runs behind varlock, which puts the resolved values in process.env for the length of the run and nowhere else.

Declaring a secret in the schema does not forward it into the container. That still needs its own line in main.mts. I learned this twice.

## Would I do it again

Yes, with the same caveat every time. The loop is only as good as the tickets. Sandcastle is solid infrastructure, and the thinking is still mine. It just moved earlier, into the map and the grilling, before any container starts.



I read every diff. So far that has been easy, because I only gave it small, tightly scoped tasks and sat and watched the runs while they happened. Unattended overnight is the pitch, and I am not there yet. But it did the work I handed it, and I did not have to type any of it.