@codedology/code-forge 0.5.1 → 0.6.0

package/CHANGELOG.md

@@ -6,6 +6,43 @@ waits on a second real consumer (plan §10.4, Q17).
 
 ## [Unreleased]
 
+## [0.6.0] — 2026-10-06
+
+### Added
+
+- `code-forge autopilot start|status|stop` (issue #5): a time-boxed grant (at most 24 h) of owner decisions — allow
+  `waive:warning`, `waive:nit`, `round:extra`, `model:choose` — with a fixed deny list in code (critical or proof
+  waivers, skipping reviews, any limit or rule change incl. parent keys, plan/design approval, merges, destructive
+  actions, budget raises). Signed grant, stop and expire rows; expiry is checked at every command. Coders may not run
+  it.
+- `code-forge autopilot ask`: a closed-book delegate (never Codex) answers one owner question inside the grant; every
+  answer is one signed `autopilot.decision` row. It acts only when the question offers at least 2 options, the answer is
+  one of them, it is within scope, does not ask to escalate, and its confidence is at least `autopilot.min_confidence`
+  (default 0.7); otherwise the question goes to the owner (exit 3). `autopilot.*` counts as a limit key.
+- `code-forge autopilot waive|round|level`: actions that need the delegate's acted decision (`--decision <id>`, same
+  grant, scope and block/file/finding, at most 30 minutes old, with the matching word: `waive`, `allow` or the level).
+  Waivers cover warnings and nits only (severity read from the signed review rows) and are written `by: autopilot`; each
+  opens one tracked GitHub issue in the project's repo. The block gate accepts an autopilot waiver only under a grant
+  and decision that covered it. One extra fix round per file per grant; the coder level comes from the Jev lane, capped
+  at the plan level + 1 and L2.
+- Autopilot budget stop per category: with `--budget review=<usd>,coding=<usd>`, new sessions in a category are refused
+  once its spend since the grant started plus running reservations reaches `--stop-at` x cap ("autopilot paused: ...
+  waiting for the owner"), with one signed `autopilot.pause` row; `autopilot status` shows spend per category.
+  `code-forge autopilot approve --key --value --until` (owner only, in a terminal, no `--yes`) changes one setting until
+  a time and restores it automatically, crash-safe, with signed rows; a value changed by hand meanwhile is left alone.
+  While a grant is active, `run reload` refuses any limit key.
+- `code-forge autopilot binnacle` and `autopilot log`: the logbook of an autopilot run, in the shape of an overnight-run
+  page (status at a glance, decisions with why and what would reverse them, blocks, open questions, actions only you can
+  take, incidents, timeline newest first) plus a full log of every autopilot event. As JSON or as
+  `autopilot-binnacle.md` / `autopilot-log.md` in the run dir, rewritten after each delegate decision and scrubbed.
+  `--link <https url>` stores the live page's link.
+- Autopilot log page for your return: the skill (`skill/references/autopilot.md`) creates one Claude Docs doc per run
+  with a Binnacle tab (the title and byline, then 7 sections) and a Full log tab, stores its link first, updates only
+  the changed sections after each decision, block close or incident, and at stop adds the final rows and asks you to
+  review the open questions and your actions. `autopilot status` and `stop` print the link (or the Markdown file paths
+  without the Docs connector). Every owner stop in the skill says what autopilot may do there or that it is never
+  delegated. New `docs/autopilot.md`.
+
 ## [0.5.1] — 2026-10-04
 
 ### Changed

package/README.md

@@ -8,6 +8,18 @@ for cross-model, parallel, evidence-gated feature delivery — on Claude Code, C
 > `examples/` have all landed (`docs/reference/blocks.json` lists every build block). What changed
 > in each version is in [CHANGELOG.md](CHANGELOG.md).
 
+## What's new (next release)
+
+- **Autopilot.** Step away for up to 24 hours. `code-forge autopilot start` grants a delegate (a
+  fresh L2 or L3 session) a few of your decisions: waive a warning or a nit, one extra fix round,
+  the coder level. A fixed deny list keeps the rest yours: critical waivers, plan and design
+  approval, limits, budget raises, merges, destructive actions. Each category can pause at a
+  budget stop, and every answer is a signed ledger row.
+- **A live log for your return.** In Claude Code the orchestrator keeps one Claude Docs page per
+  run with two tabs: Binnacle (the summary) and Full log (every event, newest first).
+  `autopilot status` and `autopilot stop` print its link; without the connector they print the two
+  Markdown files. See [docs/autopilot.md](docs/autopilot.md).
+
 ## What's new in 0.5
 
 - **Parallel review.** The worker reviews `review.parallel_tickets` files at once (default 3), with
@@ -152,6 +164,7 @@ usage line.
 | `upgrade` | `code-forge upgrade [--source <path>]` |
 | `logs` | `code-forge logs [--last N] [--json]` · `logs summary [--days N] [--json]` · `logs clear [--yes]` · `logs path` — the local error log (`~/.code-forge/logs/errors.jsonl`): errors, warnings, and `[fixed in X.Y.Z]` marks |
 | `logs report` | `code-forge logs report [--last N] [--kind K] [--verb V] [--note "text"] [--include-warnings] [--with-doctor] [--no-ai] [--allow-old] [--force] [--dry-run] [--yes]` — share selected errors as a public GitHub issue; you see the full text first and say yes once. An error a newer version fixes is not filed unless `--force` |
+| `autopilot` | `code-forge autopilot start --run <id> --until <ISO-8601 with offset> --delegate <L2\|L3> --allow <scope,…> [--deny <scope,…>] [--budget <category>=<usd>,…] [--stop-at <0..1>] [--yes]` · `autopilot status\|stop --run <id>` (print the live log's link, or the two Markdown files) · `autopilot ask --run <id> --scope <scope> --question <text> [--options a,b,…] [--block <id>] [--file <path>] [--finding <id>] [--json]` · `autopilot waive\|round\|level … --decision <id>` · `autopilot approve --run <id> --key <dot.path> --value <json> --until <time>` (owner only, at a terminal) · `autopilot binnacle --run <id> [--json\|--markdown] [--link <https url>]` · `autopilot log --run <id> [--json\|--markdown]` — the owner's time-boxed grant to a delegate; see [docs/autopilot.md](docs/autopilot.md) |
 | `help` / `version` | `code-forge --help` (or no verb) · `code-forge --version` |
 
 `run`, `block`, `worker`, `spawn`, `s2`, `author`, `facts` and `review-file` are what the Agent

package/docs/README.md

@@ -14,6 +14,7 @@ disagree, the verb is right: each verb prints its own usage line when its argume
 | 4 | [getting-started.md](getting-started.md) | install it, answer `init`, run `doctor`, try the first commands, and read or report errors (`code-forge logs`) |
 | 5 | [tutorial-first-test.md](tutorial-first-test.md) | run one real end-to-end test: build the code-forge marketing site in a new repo |
 | 5a | [review-only.md](review-only.md) | only review code you already wrote: a branch, uncommitted work or some files, with CI exit codes |
+| 5b | [autopilot.md](autopilot.md) | step away while a run goes on: grant a delegate a few decisions for a set time, and review the live log (Binnacle and Full log) when you return |
 | 6 | [examples/marketing-site/brief.md](examples/marketing-site/brief.md) | copy the brief the tutorial uses |
 | 7 | [marketing.md](marketing.md) | read the product story: the problem, the promise, the honest limits |
 

package/docs/reference/blocks.json

@@ -4,7 +4,7 @@
     "plans/code-forge-plan-v1.3.md §10.4",
     "plans/NIGHT-LOG.md"
   ],
-  "block_count": 46,
+  "block_count": 52,
   "baseline_ids": ["B0", "B1", "B2", "B3", "B4", "B5", "B6", "B7", "B8"],
   "baseline_note": "Wave 0-1 blocks, landed before v1.3; depends_on may name them, but they have no entry under blocks.",
   "blocks": {
@@ -606,6 +606,101 @@
         "B43"
       ],
       "note": "root-added 2026-10-03; plan plans/parallel-review (approved in plan mode)"
+    },
+    "B45": {
+      "title": "Autopilot grants: autopilot start/status/stop, scopes with a fixed deny list (incl. parents of limit keys), lazy expiry with signed grant/stop/expire rows; coders may not run autopilot",
+      "wave": 11,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "src/autopilot/scopes.mjs",
+        "src/autopilot/grant.mjs",
+        "src/cli/autopilot.mjs",
+        "test/cli/autopilot.test.mjs",
+        "test/autopilot/grant.test.mjs"
+      ],
+      "depends_on": [
+        "B44"
+      ],
+      "note": "root-added 2026-10-06; plan plans/autopilot (issue #5), approved in plan mode"
+    },
+    "B46": {
+      "title": "Autopilot delegate: closed-book delegate role (never Codex, opt-in or not), askDelegate (grant first, one session, one signed autopilot.decision row; acts only with options, in scope, no escalation, confidence >= autopilot.min_confidence), autopilot ask, doctor delegate pings; autopilot.* is a limit key",
+      "wave": 11,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "src/autopilot/delegate.mjs",
+        "src/doctor/probes.mjs",
+        "test/autopilot/delegate.test.mjs"
+      ],
+      "depends_on": [
+        "B45"
+      ],
+      "note": "root-added 2026-10-06; plan plans/autopilot (issue #5)"
+    },
+    "B47": {
+      "title": "Autopilot delegated actions, each on the delegate's acted decision with the matching word (waive / allow / the level): autopilot waive (warning or nit read from signed review rows, never critical or proof; tracked gh issue in the project repo, exact-marker dedupe; no gh => waiver stands + autopilot.issue_failed), gate accepts by:autopilot waivers only under a covering grant and decision, autopilot round (one extra fix round per file per grant), autopilot level (lane capped at plan + 1, max L2; block open uses it); re-checked under the run lock before writing",
+      "wave": 11,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "src/autopilot/actions.mjs",
+        "src/review/gate-check.mjs",
+        "src/util/gh.mjs",
+        "test/autopilot/actions.test.mjs"
+      ],
+      "depends_on": [
+        "B46"
+      ],
+      "note": "root-added 2026-10-06; plan plans/autopilot (issue #5); also amends src/autopilot/delegate.mjs, src/cli/autopilot.mjs, src/cli/block.mjs, src/cli/logs.mjs, src/review/fixloop.mjs, src/worker/engine.mjs"
+    },
+    "B48": {
+      "title": "Autopilot budget stop per category (review/coding caps at --stop-at, refused at the spawn budget gate under the B41 lock, one signed autopilot.pause row per category per grant, grantFor paused, status spend) and expiring owner approvals (autopilot approve: terminal only, no --yes, fixed keys and __proto__/constructor/prototype refused, applied through the run reload path, signed approve/restore/restore_skipped rows, crash-safe lazy restore at autopilot, block and worker drain); run reload refuses limit keys while a grant is active",
+      "wave": 11,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "src/autopilot/limits.mjs",
+        "src/session/spawn.mjs",
+        "src/worker/loop.mjs",
+        "src/cli/block.mjs",
+        "src/cli/run.mjs",
+        "test/autopilot/expiry.test.mjs"
+      ],
+      "depends_on": [
+        "B47"
+      ],
+      "note": "root-added 2026-10-06; plan plans/autopilot (issue #5); also amends src/autopilot/grant.mjs, src/autopilot/scopes.mjs, src/cli/autopilot.mjs, src/state/run.mjs (reloadRun guard), src/config/load.mjs (slugFor moved from cli/run.mjs), src/cli/{author,facts,jev,plan,s2,spawn}.mjs (slugFor import), test/cli/autopilot.test.mjs"
+    },
+    "B49a": {
+      "title": "Autopilot binnacle and full log: autopilot binnacle builds the owner's 8-section logbook (status at a glance, decisions with why and reversal, blocks, open questions, actions only the owner can take, incidents, timeline) and autopilot log lists every autopilot row, as JSON or Markdown files in the run dir (rewritten after each decision, scrubbed with the workspace as <project>); --link stores the live page link with a signed row",
+      "wave": 11,
+      "level": "L1",
+      "status": "landed",
+      "owned": [
+        "src/autopilot/binnacle.mjs",
+        "test/autopilot/binnacle.test.mjs"
+      ],
+      "depends_on": [
+        "B48"
+      ],
+      "note": "root-added 2026-10-06; plan plans/autopilot (issue #5); also amends src/autopilot/delegate.mjs (refresh hook), src/cli/autopilot.mjs"
+    },
+    "B49b": {
+      "title": "Autopilot live log artifact and skill text: skill/references/autopilot.md (one Claude Docs doc per run with a Binnacle tab - title and byline, then 7 sections - and a Full log tab; link stored first; only changed sections updated; stop adds the final rows and asks the owner to review), Autopilot notes at every owner stop, the never-delegated list, autopilot status/stop print the link or the Markdown paths, docs/autopilot.md, README, concepts",
+      "wave": 11,
+      "level": "L2",
+      "status": "landed",
+      "owned": [
+        "skill/references/autopilot.md",
+        "docs/autopilot.md",
+        "test/skill/structure.test.mjs"
+      ],
+      "depends_on": [
+        "B49a"
+      ],
+      "note": "root-added 2026-10-06; plan plans/autopilot (issue #5); also amends src/cli/autopilot.mjs, skill/SKILL.md, skill/references/{decisions,review,harden,plan,code}.md, skill/references/adapters/claude-code.md, README.md, docs/README.md, docs/concepts.md, docs/getting-started.md"
     }
   }
 }

package/docs/reference/config.md

@@ -171,4 +171,6 @@ Every other key defaults as shown, or is entirely absent from a minimal file. `a
 | `keys.<key>` | string |  | — | user-defined key |
 | `tmp` | object |  | — |  |
 | `tmp.root` | string \| null |  | `null` |  |
+| `autopilot` | object |  | — |  |
+| `autopilot.min_confidence` | number |  | `0.7` | min 0; max 1; B46: the lowest confidence at which the autopilot delegate's answer is acted on; below it the question goes to the owner. |
 | `telemetry` | const `"off"` |  | `"off"` |  |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codedology/code-forge",
-  "version": "0.5.1",
+  "version": "0.6.0",
   "description": "Plan/harden/code/review orchestration CLI and Agent Skill for cross-model, parallel, evidence-gated feature delivery.",
   "repository": {
     "type": "git",

package/schema/code-forge.schema.json

@@ -306,6 +306,13 @@
         }
       }
     },
+    "autopilot": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "min_confidence": { "type": "number", "minimum": 0, "maximum": 1, "default": 0.7, "description": "B46: the lowest confidence at which the autopilot delegate's answer is acted on; below it the question goes to the owner." }
+      }
+    },
     "telemetry": { "type": "string", "const": "off", "default": "off" }
   },
   "$defs": {

package/skill/SKILL.md

@@ -77,4 +77,5 @@ State lives in the plan file's header — `facts → planned → hardened → co
 | takeover, base moves | `references/continuity.md` |
 | no Solo, no subagent tool, a level unavailable | `references/degraded.md` |
 | keys, the forbidden list, signed rows and their limit | `references/security.md` |
+| the owner is away: an autopilot grant, the delegate, the live log doc | `references/autopilot.md` |
 | spawning coders per engine | `references/adapters/solo.md`, `references/adapters/claude-code.md`, `references/adapters/subprocess.md` |

package/skill/references/adapters/claude-code.md

@@ -21,3 +21,17 @@ The plan goes to the owner through plan mode (`plan.md` §4.1): `EnterPlanMode`
 ## §3 What is lost and what is not
 
 Lost: live observation of the coder (only the progress log and the final report), a resumable transcript (a lost subagent is re-dispatched with the fix history in a new brief — `continuity.md` §2). Not lost: session isolation, signed rows, the gate, the ladder, the facts rule, the convergence rule (`degraded.md` §2).
+
+## §4 Autopilot — the live log doc (Claude Docs connector)
+
+At `forge autopilot start` (`autopilot.md` §1) the run gets ONE doc through the Claude Docs connector. Follow the connector's own guide (`guide` → `topic.index`, `topic.tabs`). The steps:
+
+0. **One doc per run:** `forge autopilot status --run <r>` first. A link there ⇒ the doc exists (a lost session left it): continue in it from step 5, never birth a second one.
+1. **Birth, one `batch`:** a new doc named `<project> autopilot run — <date>`. The main tab **Binnacle** follows `forge autopilot binnacle --run <r> --json`: the title and byline, then 7 sections: Status at a glance, Decisions, Blocks, Open questions, Actions only you can take, Incidents, Timeline — one `pending` block per section. A second tab **Full log** is born in the same batch with one `pending` block for its table. The last member places both: Binnacle `order "a0"`, Full log `order "a1"`.
+2. **Store the link at once,** from the birth ack: `forge autopilot binnacle --run <r> --link <url>`.
+3. **Open it** with the Artifact tool's `open` action and that link (no `open` action: give the link in your next message, once).
+4. **Fill one section per `update`**, in reading order: replace each Binnacle pending block with `## <heading>` and its table or list from the JSON; then the Full log tab's pending block with one pipe table from `forge autopilot log --run <r> --json`, newest first.
+5. **During the window:** after each decision, block close or incident, one `update` per changed section — insert the new Decisions row, insert the new Timeline row at the top, replace only the Status cells that changed — and insert the new rows at the top of the Full log table. Never resend the whole doc. A refused edit (`guard_mismatch`, `find_none`) means the owner edited it: re-read that section, keep their edit, apply only the new row(s); never `force`.
+6. **At stop:** after `forge autopilot stop --run <r>`, insert the stop event as the newest Timeline row and the newest Full log row, then replace the Status at a glance section with the final values. The doc stays as the run's record. Tell the owner in chat: the link, and "review Open questions and Actions only you can take before work resumes".
+
+No Claude Docs connector: skip the doc. The Markdown files in the run dir are the record, and `status` and `stop` print their paths (`autopilot.md` §4).

package/skill/references/autopilot.md

@@ -0,0 +1,48 @@
+# Autopilot — the owner steps away; a delegate decides inside a grant; one live doc records it all
+
+Autopilot lets the owner leave for a set time. A delegate (a fresh L2 or L3 session) answers some owner questions inside a time-boxed grant. Everything it does is a signed ledger row, and one live doc shows it. You start nothing on your own: autopilot exists only when the owner asks for it.
+
+## §1 Start — only after the owner asks
+
+1. The owner asks for autopilot and names the window, the delegate level and the scopes. Run `forge autopilot start --run <r> --until <ISO-8601 with offset> --delegate <L2|L3> --allow <scope,…> [--deny <scope,…>] [--budget <category>=<usd>,…] [--stop-at <0..1>]`. The owner confirms it at the prompt. Never pass `--yes` unless the owner said so in chat.
+2. **One doc per run.** First run `forge autopilot status --run <r>`: a link there means the doc exists (a lost session left it) — continue in it, never create a second doc for the same run. No link: create ONE Claude Docs doc titled `<project> autopilot run — <date>` with two tabs, born in one call (the exact steps: `adapters/claude-code.md` §4).
+   - **Binnacle** (the main tab): its outline is `forge autopilot binnacle --run <r> --json` — the title and byline, then 7 sections: Status at a glance, Decisions, Blocks, Open questions, Actions only you can take, Incidents, Timeline. One pending block per section.
+   - **Full log**: one table from `forge autopilot log --run <r> --json` — Time, Event, Block, File, Detail, Link — newest first. One pending block for it.
+3. **Store the link first**, right after the birth (its ack gives the link): `forge autopilot binnacle --run <r> --link <url>`. From now on `forge autopilot status` and `forge autopilot stop` print it.
+4. Open the doc for the owner, then fill one section per call, in reading order: the 7 Binnacle sections, then the Full log table. Never write the whole doc in one call.
+
+## §2 During the window
+
+- **Every owner-level question goes to the delegate first**: `forge autopilot ask --run <r> --scope <scope> --question <text> --options <words> [--block <id>] [--file <path>] [--finding <id>]`. Use the fixed option words, or the action will refuse the answer: a waiver `waive,fix` · an extra round `allow,deny` · a coder level the candidate levels, e.g. `L1,L2`.
+- **Act only when it acted** (exit 0): run the action with `--decision <id>` from the answer — `forge autopilot waive|round|level … --decision <id>`. Exit 3 means the question goes to the owner: leave it open, it shows under Open questions. Exit 1 means the grant refused it: also the owner's.
+- **A paused category** (`autopilot paused: … waiting for the owner`): wait. Never raise the cap, never route around it.
+- **Keep the doc current — only what changed.** After every decision, block close or incident: re-read `forge autopilot binnacle --run <r> --json` and `forge autopilot log --run <r> --json`, then
+  - append the new row to the Binnacle's Decisions table;
+  - put the new row at the top of the Timeline (newest first);
+  - update the Status at a glance cells that changed (and Blocks, Open questions, Actions or Incidents when they changed);
+  - add the new rows to the Full log tab's table, at the top (it is newest first too).
+  Never rewrite the whole doc and never replace a section that did not change.
+- **A refused edit** (`guard_mismatch`, `find_none`) means the owner edited that section: re-read it, keep the owner's edit, and apply only the new row(s). Never force. Answer an owner's comment in its own thread.
+- **A lost session:** the next one reads the link from `forge autopilot status --run <r>` and continues in the same doc.
+
+## §3 Stop — at the owner's return or `until`
+
+1. `forge autopilot stop --run <r>` when the owner is back (at `until` the grant expires by itself; `forge autopilot status --run <r>` then says so).
+2. Add the stop (or expiry) event as the newest Timeline row and the newest Full log row, then write the final Status at a glance (the window's end, the result, the spend). Leave the doc as the record of the run; do not delete or move it.
+3. Tell the owner in chat: the link, and "review Open questions and Actions only you can take before work resumes".
+
+## §4 Without the Docs connector
+
+Another harness, or the connector is missing: the two Markdown files in the run dir are the record. At start, run `forge autopilot binnacle --run <r> --markdown` once: it creates `autopilot-binnacle.md` and `autopilot-log.md`; print both paths for the owner. After that the CLI rewrites both files by itself, after every delegate decision and at every `forge autopilot status` and `forge autopilot stop`, and those two commands print both paths. At stop, tell the owner the two paths and the same review line as §3.
+
+## §5 Never delegated — always the owner
+
+These never go to the delegate, whatever the grant says (the CLI's fixed deny list refuses them too):
+
+- plan approval (`plan.md` §4.1) and design approval;
+- a budget raise (`code.md` §6, `review.md` §7);
+- a threshold edit or any other limit or rule change — only the owner's own `forge autopilot approve` at a terminal;
+- a critical waiver, a proof waiver, or closing a block without its reviews;
+- merges and destructive actions.
+
+When one of these comes up during the window: stop that line of work, add it to Actions only you can take, and wait.

package/skill/references/code.md

@@ -45,7 +45,7 @@ The coder's report is a claim sheet. The gate reproduces each number in the meas
 
 ## §6 Budget — the stop is the feature (R6)
 
-`budget.block_lines` and `budget.block_cases` bind the plan; the gate's 1.25 × stop binds the block. A coder that overruns and stops before expanding did the right thing: never compress or defer coverage to fit. One raise per run, by the human, logged; a second overrun in the same run re-decomposes at the architect level. A post-acceptance ruling that adds required lines re-baselines the cap at ruling time, priced from the assertions it orders; a STOP defined mid-turn binds from the coder's next reported boundary. A coder never trims to fit; landing exactly on a cap is a tell that is checked. Review tokens count toward `budget.block_tokens_soft` / `budget.block_tokens_hard` (`review.md` §7).
+`budget.block_lines` and `budget.block_cases` bind the plan; the gate's 1.25 × stop binds the block. A coder that overruns and stops before expanding did the right thing: never compress or defer coverage to fit. One raise per run, by the human, logged; a second overrun in the same run re-decomposes at the architect level. **Autopilot:** a budget raise is never delegated, and neither is `--no-require-reviews` or a merge (`autopilot.md` §5). A post-acceptance ruling that adds required lines re-baselines the cap at ruling time, priced from the assertions it orders; a STOP defined mid-turn binds from the coder's next reported boundary. A coder never trims to fit; landing exactly on a cap is a tell that is checked. Review tokens count toward `budget.block_tokens_soft` / `budget.block_tokens_hard` (`review.md` §7).
 
 ## §7 The PR contract — a draft PR only after independent review
 

package/skill/references/decisions.md

@@ -51,3 +51,5 @@ A fresh L3 session receives the failure evidence — the last attempt's diff, th
 ## §7 What reaches the human
 
 `next = stop`, `review.over_budget`, an orphan file, `worker_down`, `review_cap`, `redecompose`, `ask_human`, a security question, consensus unavailable, and one budget raise per run. Everything else is decided by S1, S2 or the rules above and recorded.
+
+**Autopilot:** while a grant is active, a warning or nit waiver, one extra round at `review_cap` and a coder level go first to the delegate (`forge autopilot ask`, then `forge autopilot waive|round|level --decision <id>` only when it acted, `autopilot.md` §2). Never delegated: `next = stop`, `ask_human`, a security question, a critical finding, a budget raise, `redecompose` — they wait for the owner (`autopilot.md` §5).

package/skill/references/harden.md

@@ -4,7 +4,7 @@
 
 `forge author --job harden --brief <brief> --facts <sheet> --draft <plan> [--answers <file>] --out <plan>` runs a fresh L3 closed-book session over the brief, the facts sheet, the current draft and the answers so far. It returns `{draft, questions: [{id, question, options[], why, blocking}], cost}`.
 
-Loop: write the draft to the plan file → print `questions[]` to the human in chat (and to the Solo scratchpad when present) → collect answers into `<answers file>` → re-run with `--draft` and `--answers`. Stop when **no blocking question is left**: `questions[]` is empty, or every remaining item is non-blocking and the human chose to skip it — a skipped question is written into the plan's Q&A as `skipped` with the human's word, never silently dropped. Each round prints its cost. **The human answers; the orchestrator never answers for them.** Under Solo the human may run harden as an interactive L3 session (`harness.solo.interactive_harden`).
+Loop: write the draft to the plan file → print `questions[]` to the human in chat (and to the Solo scratchpad when present) → collect answers into `<answers file>` → re-run with `--draft` and `--answers`. Stop when **no blocking question is left**: `questions[]` is empty, or every remaining item is non-blocking and the human chose to skip it — a skipped question is written into the plan's Q&A as `skipped` with the human's word, never silently dropped. Each round prints its cost. **The human answers; the orchestrator never answers for them.** **Autopilot:** never delegated — harden questions wait for the owner, grant or not (`autopilot.md` §5). Under Solo the human may run harden as an interactive L3 session (`harness.solo.interactive_harden`).
 
 ## §2 What the L3 session interrogates (so you can judge its questions)
 

package/skill/references/plan.md

@@ -47,6 +47,8 @@ A plan that passed `forge plan check` still needs the owner's yes before any blo
 
 Never treat a chat summary of the plan as the approval step, and never start `forge block open` before it.
 
+**Autopilot:** plan approval is never delegated. Under a grant the plan waits for the owner (`autopilot.md` §5).
+
 ## §5 Cost
 
 One L0 session per plan for the facts (typically a claim list of 40–80 items) and one L3 session per author round; `forge report --slug <slug>` shows both as `facts $` and coder/review splits.

package/skill/references/review.md

@@ -30,7 +30,7 @@ Per file, per block:
 3. **Strictly shrinking**: the open `fix_now` set after round n is smaller than after round n−1, counting closures minus new in-hunk findings. Equal or larger ⇒ `review_stall` (rule 2b), a trigger at once.
 3a. **Heavy rounds climb at once** (`review_warnings`, `decisions.md` §5 rule 3a): below L2, a round — round 1 included — that leaves ≥ `escalation.warning_threshold` (2) warnings or any `critical` open, `escalation.after_rounds_with_warnings` (1) times at the current level, climbs one level for the next fix. One round with a stronger model is faster and cheaper than three with a cheap one. The per-file cap (step 5) stays the outer limit.
 4. **Ladder**: the running ceiling is `min(L2, escalation.stop_at)` — L3 is never a *running* level. A trigger — rule 1 (`retries`), rule 2 (`escalation.review_rounds_per_level` exhausted with an open `fix_now`), rule 2b (`review_stall`) or step 3a (`review_warnings`) — below the ceiling climbs one level, coded by a fresh session with the open findings and the fix history in its brief (an L1 block's rounds 3–4 run at L2). At the ceiling — an L2 block, or an L1 block that has climbed to L2 — it takes the **L3 rung**: a patch ≤ 80 lines, owned files only, reviewed as a `patch_check` round outside the cap. Under `escalation.l3_mode: code` (opt-in) the rung is instead one L3 coding turn. Either way the rung fires **once per block** and the same post-patch order follows it. After it, in order: `patch_check` clean ⇒ complete; open set not smaller than before the patch ⇒ `stopped: l3_patch_exhausted` (`review_stall`); round ≥ `review.max_rounds_per_file` ⇒ `stopped: review_cap`; otherwise the fixes continue at L2 with `rounds_at_level` reset and the patch in the brief. Any later trigger in that block stops with its named reason (`l3_patch_exhausted`, `review_cap`) and never patches again.
-5. **Cap — four rounds per file** (`review.max_rounds_per_file`, default 4, range 2–6). Round 4 still open ⇒ the L3 rung if the block has not used it (same post-patch order as step 4), else `stopped: review_cap`. A stop means the block cannot close, the ledger lists the open findings, and the human decides — fix by hand, `forge block waive <id> <finding-id> --run <r> --file <path> --reason <text>` (a signed `review.waived` row, `by: human`), or re-decompose. The coder never sees a `waive` verb; it is on the forbidden list.
+5. **Cap — four rounds per file** (`review.max_rounds_per_file`, default 4, range 2–6). Round 4 still open ⇒ the L3 rung if the block has not used it (same post-patch order as step 4), else `stopped: review_cap`. A stop means the block cannot close, the ledger lists the open findings, and the human decides — fix by hand, `forge block waive <id> <finding-id> --run <r> --file <path> --reason <text>` (a signed `review.waived` row, `by: human`), or re-decompose. The coder never sees a `waive` verb; it is on the forbidden list. **Autopilot:** under a grant, a warning or nit finding may be waived by the delegate (`forge autopilot waive … --decision <id>`, written `by: autopilot`) and a file at the cap may get one extra round (`forge autopilot round`); a critical or proof waiver is never delegated (`autopilot.md`).
 6. **Block-close sweep**: `forge block close` batches the `late_findings` per file to one L3 judge ruling (`fix_now | nit`); a `fix_now` opens a round on that file at the block's current level and counts toward its cap.
 7. Ledger: one `review.round` row per round with `open_before`, `closed`, `new_in_hunks`, `late`, `open_after`; `forge report` prints rounds per file and rounds that stalled.
 
@@ -42,7 +42,7 @@ Two L2 reviewers, one per effective provider (`resolve(L2)` and `review.second_l
 
 ## §7 The review budget per block
 
-`review.block_budget_tokens` (and optionally `review.block_budget_usd`) bounds every review, recheck, judge and S2 session made for the block. When the forecast exceeds it the worker degrades one step at a time, cheapest first: batch small files of one tier into one packet (`review.batch_small_files`) → one judge per block instead of per file → standard band `full` → `quick` → high tier `A + B + judge` → one `full` L2 + judge, the floor. Tools-only is never a review; a light `quick` stays `quick`. Still over ⇒ `review.over_budget`: raise the budget once per run (a config edit by the human, on record) or split the block — never silently, never below the floors. The ledger keeps `depth_unconstrained` and `depth_chosen` per file so `forge report` can show `missed_after_degrade`.
+`review.block_budget_tokens` (and optionally `review.block_budget_usd`) bounds every review, recheck, judge and S2 session made for the block. When the forecast exceeds it the worker degrades one step at a time, cheapest first: batch small files of one tier into one packet (`review.batch_small_files`) → one judge per block instead of per file → standard band `full` → `quick` → high tier `A + B + judge` → one `full` L2 + judge, the floor. Tools-only is never a review; a light `quick` stays `quick`. Still over ⇒ `review.over_budget`: raise the budget once per run (a config edit by the human, on record) or split the block — never silently, never below the floors. **Autopilot:** a budget raise is never delegated; a paused category waits for the owner (`autopilot.md` §5). The ledger keeps `depth_unconstrained` and `depth_chosen` per file so `forge report` can show `missed_after_degrade`.
 
 ## §7a Parallel tickets
 

package/skill/scripts/forge

@@ -10,7 +10,7 @@
 #      copied install with no package next to it); `test/skill/shim.test.mjs` asserts the pin
 #      equals package.json's version.
 # The shim holds no logic of its own: every verb, flag and message is the CLI's.
-PINNED_VERSION="0.5.1"
+PINNED_VERSION="0.6.0"
 set -eu
 
 self="$0"