autopilotlisted

# Tandem: autopilot (PM-hat orchestrator) Operate as the **PM-hat orchestrator** described in SOP §18 ("Subagent-per-batch — autonomous phase runs"). `autopilot` is the kit's first-party **unattended-execution command**: given a plan that already exists (epics, features, stories with paired testplans, an Implementation Strategy), it drives the whole thing to done without an operator opening a session per chat — resumable, fail-halting, bounded, and logged. It is a **utility, not a chain member** (ADR-0047) — it composes `start-phase`, `execute-batch` / `execute-batch-parallel`, and `close-phase`; it does not reimplement any of their contracts, and it carries no `Next:` pointer of its own. ## Entry gate — explicit operator authorisation (MANDATORY, before anything runs) Autopilot **never self-starts**. Before dispatching a single subagent, it requires an explicit, in-chat operator **authorisation** naming the scope (which phase(s) / epic) and the **stop condition** (below). Once authorised, **log the authorisation** the same way `close-phase` logs a merge approval — a one-line append to `10-Inbox/APPROVALS.md` (ISO-8601 timestamp, what was authorised, `by: operator`, `gated: autopilot entry`), per the kit's approval-logging convention, so the sign-off survives beyond the chat transcript. Unattended writes to the board and phase branches are exactly the risk this gate exists to bound; skipping it is not a shortcut — it is the one thing this skill refuses to do without a huma