Autopilot

Autopilot

A thin autonomous conductor for large missions: autonomous scoping, self-drive, durable cross-session state/recovery, and a hard user STOP gate. It owns no lifecycle machinery itself; it delegates every bounded wave to orchestrate and every decision/software change to implement/deliver, then records the durable pointers. See Entry gate below for when to use this tier instead of orchestrate, implement or diagnose.

It is higher-authority than orchestrate's pre-scoped autonomous-implementation mode, which stops at a user PR gate; autopilot keeps going until a user writes STATUS: STOP.

Claude Code and Codex are equal operators; Codex operators read [codex-operator.md](references/codex-operator.md) first.

Entry gate

Needs all of: an open-ended mission too large for one bounded wave, a survivable-crash requirement, and an explicit user STOP gate as the only clean exit; otherwise use a lighter-weight skill.

Bootstrap

1. Run scripts/bootstrap-autopilot.sh , fill every CONFIG KNOB,

then rerun to substitute/validate. See [state-contract.md](references/state-contract.md) for the file set and .agent-run// location.

1. Use orchestrate for every bounded wave: it owns topology, provider

routing, Agent Fabric transport, the review ladder and degradation. Delegate decisions/software change to implement/deliver and record the returned route/result in QUEUE.md.

1. Operate one iteration at a time after reading

[operating-loop.md](references/operating-loop.md), [state-contract.md](references/state-contract.md), GOAL.md, STATE.md, QUEUE.md's head. Keep one conductor lease.

1. Interactive missions use Herdr and record owned panes. External-driver-only

missions record HERDR-NOT-USED: external driver; filesystem state is authoritative in STATE.md.

Bootstrap authorises only mission-declared isolation. The constitution pre-authorises source-repo implementation branches and worktrees, created via ${AGENTS_HOME:-$HOME/.agents}/scripts/worktree; deletion, integration and shared-branch pushes still need separate user authority.

Operating loop

Run RECONCILE -> READ -> SELECT -> DISPATCH -> RECORD -> PROPAGATE -> REORG-if-due -> STATE -> WAKE/STOP. Flip a QUEUE.md row to LEASED before launch. Delegate deep work; fan out independent contexts and serialise shared state. Bound retries; escalate stalls with evidence. An empty queue triggers one bounded re-enumeration pass, then an idle checkpoint and paused dispatch; only user STOP closes the mission. See [operating-loop.md](references/operating-loop.md) and [recovery-and-cadence.md](references/recovery-and-cadence.md) for detail.

Evidence and closure

STATE.md holds current recovery truth; QUEUE.md is the durable work queue and item-lease ledger. Durable decisions are delegated, not forked here; see [state-contract.md](references/state-contract.md).

Cleanup must classify first: never delete unknown files; prune only mission-owned, manifest-classified ephemeral payload with no live reference. STOP requires GOAL/STATE/HANDOFF agreement and reconciled, closed work; see [recovery-and-cadence.md](references/recovery-and-cadence.md) for the closure protocol.

References

Load one relevant reference: [state-contract.md](references/state-contract.md) (the file set + .agent-run// location), [cross-family-review.md](references/cross-family-review.md), or the loop/recovery/Codex files above.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: mblauberg
• Source: mblauberg/provenant
• License: MIT

Install and usage instructions live in the source repository linked above.