Autopilot — Supervised Autonomy

Agenties can run a goal's issues in sequence without waiting for you to issue each next command. This is supervised autonomy — not full automation. The orchestrator picks the next issue, spawns a builder agent, validates the result, and continues; but it stops at defined checkpoints so you remain in control.

Modes

Start a run from the Goals panel: select a goal that has open issues, then press Run Autopilot. The run always starts in supervised-step mode — one issue, then a checkpoint.

The observe → decide → execute → verify → persist loop

Each iteration of the autopilot loop follows these steps:

Guardrails

The following guardrails are enforced on every run. They cannot be disabled.

Concurrent run guard

If another autopilot run for the same goal is already active (status running or verifying), the new run is blocked immediately. This prevents two agents editing the same files simultaneously.

Scope declaration

Before a builder is spawned, the task must have all required fields: issue ID, sequence number, title, declared files, and extracted acceptance criteria. A spawn without a valid scope declaration stops the run rather than proceeding blind.

Evidence-required close

An issue is only marked done when the agent summary contains at least one observable signal:

• Test output:  PASS / ✓ / "N tests passing"
• Runtime:      verified / confirmed / observed / rendered / persisted
• HTTP:         "responded with" / "curl response:" / "output:"
• Commit:       commit 7-char hash / git diff --stat

If none of these patterns are present in the summary, the issue is marked blocked instead of done, and the consecutive-failure counter increments.

Journal mandatory

The continuity journal must be updated after every iteration. If the write fails, the run stops with reason checkpoint-required so you can investigate the disk state before continuing.

Drift detection

If the agent summary mentions CL-NNN references that do not include the expected issue sequence number, the autopilot treats the result as a drift event and marks the issue blocked. This catches agents that completed a different issue from the one they were assigned.

Scope containment

The loop implements a 50% out-of-scope threshold: if the majority of files edited by an agent fall outside the declared scope, the issue is marked blocked. In the current implementation the declared file list is always empty (acceptance criteria text is extracted, but file paths are not parsed out of it), so this guardrail is not enforced in practice. It is wired and unit-tested for when the feature is completed.

Budget limits

Every run has a budget cap. Defaults:

Budget overrides are accepted by the backend IPC endpoint but the Goals panel UI does not yet expose them. The budget is checked before every new iteration, not just at the start.

Stop reasons

Autopilot status in the Goals panel

While a run is active, the Goals panel shows a live autopilot status card:

Controls:

Frugal self-improvement signals

At the end of every run, Agenties reads the local signal aggregator for improvement candidates. This is a pure file read — no model is invoked, no agent is spawned, no action is taken automatically. If the aggregator finds a signal pattern with a count above the threshold (default 3), it surfaces a one-line hint alongside the stop event:

improvementSuggestion: "autopilot_iteration:CL-428 (4 signals — confirm before acting)"

Acting on the hint always requires explicit user confirmation. The autopilot will never create a skill, open an issue, or spawn an agent to act on self-improvement data without asking first.