L5

/l5 — CEO autonomy, foreman + hetero implementer

Terse front-door into autopilot:ceo-agent at Level 5: identical to /l4 except the foreman leaf-dispatches the implementer to a heterogeneous engine via [../../scripts/dispatch-hetero.sh](../../scripts/dispatch-hetero.sh), and the adversarial review can run on a decorrelated reviewer engine instead of homogeneous Claude. The engine roster + loop policy are data, not a hand-typed prompt — resolved from [../../scripts/resolve-review-loop.sh](../../scripts/resolve-review-loop.sh) (per-project .claude/review-loop-config.md; template in [../../project-config-template/review-loop-config.md](../../project-config-template/review-loop-config.md)). Everything else — depth-0 control loop, qc@depth-0, merge-back, worktree GC — is unchanged from /l4.

After a one-time cp project-config-template/review-loop-config.md .claude/, the whole "subagent plan → reviewer xhigh loop → hetero impl → reviewer xhigh loop → qc-gate" pipeline is just /l5 — you don't re-type the roster.

On invocation

1. Invoke autopilot:ceo-agent with the four startup questions pre-filled

(same presets as /l3//l4).

1. Resolve the roster (don't hardcode): scripts/resolve-review-loop.sh →

{reviewer_engine, reviewer_effort, reviewer_runner, implementer_engine, implementer_effort, implementer_runner, loop_max_rounds, loop_convergence_verdict, spec_review, independent_harness, review_diff_scope}. These drive every dispatch below — never type model/effort/runner inline (CLAUDE.md rule).

1. Execution posture: offload with hetero impl + decorrelated review. Run the

foreman + depth-0 control loop per [../ceo-agent/references/level-front-door.md](../ceo-agent/references/level-front-door.md); the deltas vs /l4:

• Impl dispatched with `dispatch-hetero.sh --runner

--model --effort --base "$(git rev-parse )" (worktree-isolated, artifact-verified, **cgroup-contained**). Pass --base as an **immutable SHA**, not a ref like develop (a ref can advance after dispatch, breaking the post-impl probe range). Map its outcome via the **outcome→action table**; reap the worktree from the outcome JSON's worktree field on any non-success. The run-summary impl row records runner/model/containment` straight from the outcome JSON.

• Diff-domain telemetry (post-impl, telemetry ONLY — routes nothing): after a

committed outcome, record the impl's dominant work_domain via scripts/resolve-review-loop.sh --auto-domain .. where the base + commit fields come from the dispatch outcome JSON (base is the immutable SHA you passed via --base $(git rev-parse …), so it is a stable range endpoint — NOT ambient HEAD, which is wrong because the worktree is GC'd on success). Put work_domain in the run-summary ledger's impl row (canonical: [../ceo-agent/references/level-front-door.md](../ceo-agent/references/level-front-door.md) § Run-summary ledger). It selects no engine — domain routing is BACKLOG'd.

• Review (spec — if spec_review:on — and impl) runs the **decorrelated

reviewer**, not homogeneous Claude: codex exec -m -c model_reasoning_effort= reading the spec/diff, looping until its verdict reaches loop_convergence_verdict or loop_max_rounds (each round re-checks the prior round's fixes — [[feedback_dialectic-review]]).

• review_diff_scope controls what the impl-review reads each round:
• full (default) ⇒ the reviewer reads the whole ..HEAD diff every

round. Safe; cost grows O(n) as the diff accumulates.

• incremental-mitigated ⇒ the reviewer reads ..HEAD PLUS the

full content of every file touched this round PLUS a standing invariants/prior-findings checklist; do a full ..HEAD re-read every 3–5 rounds or whenever a round touches shared/critical logic (classifiers, schemas, fixtures, harness control flow); and ALWAYS a final full ..HEAD review before merge. Use only on long loops — naive incremental-only misses cross-file regressions in untouched files. When this mode is on, independent_harness MUST run the FULL test suite, not just touched-file tests (real lesson 2026-06-26: a stale-fixture regression in an untouched test file slipped a too-narrow per-round scope to the final sweep). Reference driver: resolve-review-loop.sh --field review_diff_scope.

• independent_harness:on ⇒ depth-0 ALSO builds its own adversarial harness

and never trusts the implementer's own green ([[feedback_delegate-selftest-false-green]]).

• Block-mode test-integrity override stays DEFERRED: a block-mode

executed_set_shrink hard-fails with no honored override (no local-only containment is malicious-proof against a same-user worker — sibling-scope escape; gpt-5.5 review 2026-06-26). Resolve a legit shrink by fixing the test or running that project in warn. Re-enable is BACKLOG'd behind real isolation.

1. --solo → fall back to the /l3 inline engine (also the automatic

degradation when the foreman or hetero dispatch returns precondition_failed).

Wired runners (set via implementer_runner / reviewer_runner in .claude/review-loop-config.md): codex (gpt-*/*codex*), agy/Gemini, grok (xAI Grok Build — grok-build/grok-composer-2.5-fast, implementer + reviewer), and cc-shim (the Claude Code CLI driving any Anthropic-compatible endpoint, e.g. MiniMax-M3/GLM — implementer only; EXPLICIT, needs ANTHROPIC_BASE_URL+ANTHROPIC_AUTH_TOKEN in env — see the review-loop-config Gotchas). Still deferred: the full role × task-type routing table; any further engine stays behind a per-engine smoke test. See [../../references/hetero-dispatch.md](../../references/hetero-dispatch.md) and [../ceo-agent/SKILL.md](../ceo-agent/SKILL.md).

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: cookys
• Source: cookys/autopilot
• License: MIT

Install and usage instructions live in the source repository linked above.