autopilot

Files (1)

• SKILL.md

SKILL.md (first lines)

# Autopilot

Run the PRODUCT to completion unattended: the GOAL + ORCHESTRATOR roles of
`agents/shared/PRODUCT_SHAPE_PROTOCOL.md`, wired to the machinery this repo
already has. Autopilot builds nothing new — it assesses, sequences, and
drives the existing loops, and it heals or parks what gets stuck. **Done is
a predicate, never a feeling** — and **a drained board proves nothing**: the
denominator for "what's left" is the SRS / user stories, not the ticket list.

**Usage:**
- `/autopilot` — ASSESS + DECIDE only: write the state-of-the-product report and the ordered next-actions list, run nothing
- `/autopilot --run` — full loop: ASSESS → DECIDE → DRIVE → HEAL until the EXIT predicate or the iteration cap
- `/autopilot --run --budget <N>` — override the iteration cap (defaults below; existing caps only, never invented numbers)

Set `autonomy=auto` per `agents/shared/AUTONOMY_PROTOCOL.md` before `--run`
(the FULL NEVER-AUTO table below still pauses — all seven rows, NA-1..NA-7,
not just interviews and destructive ops). **NA-3 stance, stated because DRIVE
runs the conductor whose loop ends in `merge --no-ff` + dual push:** driving
the conductor unattended is only legal under a STANDING founder approval that
names merges-to-main as pre-approved for the board being driven (the
conductor's own APPROVALS.md pattern); absent that document, autopilot must
run the loop with merge disabled / park-at-review and surface the landings
for a human.

## ASSESS — mechanical inventory, no narrative

Collect each of these from its existing source; every line of the report
cites the command output behind it. A source that does not exist in the
target repo is recorded as ABSENT, never guessed at:

1. **Board state** — `docs/work/plan.json` tickets by status
   (ready / claimed / in_progress / in_review / blocked / parked / done),
   via `scripts/validators/validate-tickets.sh` +
   `scripts/lib/tickets.mjs`. Parked and blocked are listed by name — a
   park is not a landing.
2. **Phase gates** — `scripts/validators/validate-phase-gate.sh <phase>`
   (read-only check) for the current phase per `docs/work/STATE.md`;
   receipts at `docs/work/gates/`.
3. **Requirement closure — the real denominator** —
   `scripts/validators/validate-requirement-closure.sh`: every SRS story
   closed only by a done module that cites it, plus the reconciliation
   matrix (`docs/work/REQUIREMENT_RECONCILIATION.md`). Report
   closed/total STORIES, not done/total tickets.
4. **Product map / seams** — `docs/work/PRODUCT_MAP.md` and seam records:
   assembly tickets outstanding, gaps in BOTH directions.
5. **Unmerged branches** — `git branch --no-merged main` + parked branches
   recorded on the board; each mapped to its ticket/feature or flagged
   orphan.
6. **Red suites** — run the project's verify command (build/test/lint) and
   record exact counts.

Output: the **State of the Product** section of
`docs/work/AUTOPILOT_<date>.md` — stories closed/total, gate status per
phase, board tallies, parked/blocked list with reasons, red-suite counts.

## DECIDE — the path forward, ordered, each step with an exit predicate

From the assessment, emit an ordered next-actions list. Every entry names
the unit (ticket id / wave / gate / branch), the loop that will drive it,
and its **exit predicate** — the command + passing condition that proves it
done. An entry without a checkable predicate is refused, same rule as
`/goal`'s intake gate (`agents/shared/RALPH_WIGGUM_LOOP.md` refuse-to-loop).
Default ordering: red suites first, then the open phase gate, then claimable
board work (conductor order), then assembly/seam tickets, then unmerged
feature landings — sequence is autopilot's to decide; doneness never is
(it belongs to the predicates and the EXIT gate).

## DRIVE — existing loops only, one bounded unit at a time

**Resolving the loops (v3.9.0, live field trace):** the loop scripts live in
the FIRST of these that exists — `./scripts/`, `./.opencode/scripts/`
(project install), or the global install (`~/.config/opencode/scripts/`).
Probe with a symlink-following test (`test -f <path>`) — `find`/`git ls-files`
do not traverse symlinks and produced a false "loops absent" halt in the
field. Loops truly absent in all three → that IS the deterministic blocker;
say so and halt. Never reimplement them.

- **Ticket board** (`docs/work/plan.json`): `scripts/conductor/conductor.mjs`
  under `scripts/conductor/supervise.sh` — claim → isolated worktree →
  outside gates (`scripts/validators/run-handoff-gates.sh`) → distinct
  reviewer → merge. `STOP` file semantics and `--max-attempts` apply as
  documented in `scripts/conductor/README.md`. The conductor holds a
  `.conductor.lock` — a second conductor on the same root refuses (exit 4);
  never delete a live lock, and WAIT for a spawned supervise.sh to exit
  rather than ending your session over it (a killed parent orphans the
  claim, and the next run's reconcile makes a human clean it up).
- **SDLC phase work**: `scripts/run-until-done.sh` (resume from STATE.md,
  watchdog + stall detection, `<promise>COMPLETE</promise>` verified by
  validators, never trusted).
- **Decomposed DAG plans**: `scripts/run-plan.mjs` (journaled, per-node
  retries, checkpoint-continue).

Never drive two loops over the same write-scope concurrently. Never edit
plan.json by hand mid-run — state changes go through the loops' own verbs.

## OPERATE — the MAIN agent runs this itself; hand off only when named

/autopilot is a PRIMARY-agent skill: the default (build) agent kicks it off,
tracks it, and reconciles it — a specialist handoff happens only where a row
below names one. The operating loop:

1. **Kick off**: `/autopilot --run` (after the NA-3 approval question is
   settled). Between consecutive `opencode run` invocations on the same
   project leave a few seconds' gap — back-to-back launches have deadlocked
   the runtime's bootstrap in the field.
2. **Track, don't hover**: the run's truth is on disk, not in your context —
   tail `docs/work/conductor-log.jsonl` (kind rows: `ticket.*`,
   `round2.review.verdict`, `round3.runtime.verdict`, `conductor.end`),
   the board statuses, and `docs/work/AUTOPILOT_*.md`. Evidence for any
   attempt is under `docs/work/.conductor-evidence/`.
3. **Reconcile orphans yourself**: a killed run leaves `in_progress` +
   `owner` + a work-empty branch. The next run's reconcile REFUSES to guess
   (correct). Your job: verify the branch tip is an ancestor of main
   (`git log main..<branch>` empty = zero work lost), delete it, clear the
   ticket's `owner`, set it `ready`, commit the reconcile with that
   evidence in the message.
4. **Read halts as instructions**: every halt doc names its blocker
   (lane-law violation, unreachable model, absent loops). Fix exactly that
   — via `models.json` for model/agent routing, the board's own verbs for

From bpmforge/attest, Apache-2.0.

More from bpmforge/attest