autopilotlisted

# Autopilot — the unattended loop Autopilot runs the pipeline **without stopping at each ◆ gate for the user**, until the whole-product DONE predicate holds or the brake fires. It exists because the foundation for it is now real: a frozen GOAL that cannot move (`guard-state`), a north-star that survives compaction (`reinforce-goal`), and a DONE predicate that cannot be self-certified (evidence-gated criteria). **It is opt-in and OFF by default.** Only run this loop when the user has armed it this session with `/autopilot on`. Never arm it yourself because a task looks long. ## What autopilot changes — and what it must never change It changes **who approves the ◆ gates** �� autopilot approves them on the user's behalf. It changes **nothing** about what is mechanically forbidden. All of this stays in force, and you must never work around any of it: - `guard-bash` still hard-blocks dangerous shell (`rm -rf /`, `curl|bash`, force-push to `main`). - `guard-state` still refuses to mark a GOAL criterion `[x]` without a reproduced `verified:` signal. **Autopilot cannot certify its own work** — `claim-verifier` reproduces every proof, exactly as in human-gated mode. An autopilot that could tick its own boxes would terminate instantly and mean nothing. - `guard-autopilot` enforces the budget: **Budget is write-once while armed, Spent is increment-only.** Do not attempt to raise the ceiling or rewind the counter — both are hard-blocked, and trying is a bug in your reasonin