| Field | \nBound contract | \n
|---|---|
| Trigger | \nA human explicitly invokes /autopilot with a feature description and an approved execution plan. | \n
| Authority | \nHuman-gated: previews the exact target and consequence before credentials, paid actions, data-at-rest changes, publication, deployment, remote bulk mutation, or irreversible deletion, continuing only when the invocation covers that consequence; every other write is reversible local, with version control as the rollback. Pass authorized push and PR targets to review-and-ship; do not publish directly. | \n
| Side effect | \nDelegates implementation, simplification, review, and finalization to their respective skills; local artifacts are written by work, commits and PR are created by review-and-ship. No mutation is performed by autopilot itself. | \n
| Done | \nReturn DONE only after the requested close-out state is observed. Otherwise return BLOCKED with a resumable handoff. | \n
Required: feature description, approved plan, repository, acceptance criteria, and close-out condition.
\nOptional: scope limits; assigned executor; target branch, remote, and PR destination; required checks; shipping instructions. Derive an omitted value only when repository evidence gives one safe, unique answer.
\nwork in orchestrated mode. Include acceptance criteria, constraints, repository evidence, required verifier, and the required structured return. work owns implementation and local verification; autopilot does not reproduce those steps. Apply the gate state machine in references/pipeline-gates.md: a failing work verifier gets one strike-the-root pass and one recheck; a second failure halts the chain. Done when: work returns a structured result with implementation summary and local verification passing, or the gate halts the chain with the verifier failure and diff recorded.simplify on the completed diff. Gate: simplify exits 0, 11, or 12 with behavior preserved. Halt on exit 14 (new bloat) or 15 (mixed-concern). Done when: simplify returns exit 0, 11, or 12 with behavior preserved confirmed by its output, or the chain halts on exit 14 or 15 with the exit code and cause recorded.review on the in-scope change. If critical or high findings remain, delegate one strike-the-root pass and re-review the changed files. Halt on residual critical or high findings. Done when: review returns zero critical and zero high findings on the changed files, or the chain halts with the residual findings listed.review-and-ship. Pass the reviewed diff, explicit delegated shipping authority, branch, remote, PR destination, required checks, and shipping instructions. The finalizer owns checks, commits, publication classification, push, and PR creation or update; autopilot performs none of them. Done when: review-and-ship returns its report with checks green and PR created or updated (full mode) or commits made and push skipped (local-only), or the finalizer returns blocked with its reason.work in orchestrated mode, repeat affected gates, and invoke review-and-ship for each authorized update. Do not merge, deploy, or publish elsewhere without matching authority. Done when: the close-out condition named in the inputs is observed in repository or remote state, or the run stops for absent authority.references/pipeline-gates.md are binding. Done when: the terminal result is DONE with the finalizer report attached and close-out state quoted, or BLOCKED with the failed stage, reason, and next action named.Stop on a missing approved plan, contradictory input, unavailable executor, ambiguous target, absent authority, failed gate, non-converging review, rejected remote mutation, or incomplete close-out. Preserve successful in-scope work and observed remote state. Recover only mutations made by this run, using reversible repository or hosting operations; never discard unrelated work.
\nReturn BLOCKED with the failed stage, exact reason, autofix result, partial artifacts, remote mutations, proof state, recovery state, and the single concrete requirement to resume. Never claim rollback, publication, or close-out without observing it.
Exactly one terminal result:
\nDONE: delivered behavior, changed artifacts, verification evidence, branch and PR, the complete review-and-ship report, and observed close-out state.BLOCKED: failed stage, reason, partial result, remote state, proof and recovery status, and the next required action.