Going Autonomous

Flow-next’s pipeline runs interactively today: spec, plan, review, work, review, PR. Autonomy is the same pipeline with the human moved to the edges. You concentrate judgment in the spec and the readiness gate, and a loop executes the mechanical middle. The quality bar does not move: the same adversarial review gates fire, the same receipts get written, and the loop stops waiting for you between stages.

This is the autonomous profile

Flow-Next runs fully without the loops. /flow-next:work is the human-driven equivalent and needs no loop primitive at all. Reach for the loops when there is a queue of blessed work and nobody who wants to sit through it. The review, QA, and tracker layers stop being optional here: with nobody watching, they are what replace the human. See Running Lean.

Optional chart sits before capture and outside pilot. Unattended chart work may resolve independent unattended D-IDs in parallel (separate invocations); attended decisions stop at CHART_VERDICT=NEEDS_HUMAN. Chart never sets ready and never enters the build loop, so get the briefing captured first.

Three loops, three slices of the lifecycle

Loop	Owns	Loop driver	Status
Pilot, the build loop	ready spec → plan → plan-review → work → [opt-in qa] → draft PR (opt-in backlog mode: widen selection to the whole open backlog)	your host’s /loop or /goal	shipped
Land, the ship loop	open PR → CI green → reviews resolved → merge → release	your host’s /loop cadence	shipped
Ralph, the hardened harness	a fully planned spec → work → reviews, at unattended scale (Ralph never plans; planning stays with you or pilot)	external ralph.sh shell loop	deprecated, still supported

Pilot + land are the default autonomy path. Together they cover the whole lifecycle from blessed spec to merged release, driven entirely by your host’s loop primitives. Ralph is the older alternative for the work segment: it consumes specs that are already planned, trades in-session convenience for fresh-session isolation and enforced guard hooks, and is never nested with pilot (pilot refuses to run under FLOW_RALPH). Land picks up where either stops: at the open PR.

The consent boundary

No loop selects work you haven’t blessed. The entry gate is the spec-level ready flag:

• Local repos. flowctl spec ready fn-12 is the blessing; flowctl spec unready revokes it.
• Tracker-connected repos. The board is the control plane: a Linear issue in your configured ready state (or a GitHub / GitLab issue carrying the ready label, or a Jira issue in the configured workflow status) blesses the spec, and moving it out starves the loop. See Readiness as the control plane.

A half-baked draft is never executed unattended, and a spec that stops advancing is automatically un-blessed (pilot’s two-strike guard) rather than retried forever.

Pilot’s opt-in backlog mode (default off) moves this boundary one step inside the loop: it manages the whole open backlog, and when it can’t safely proceed on an item it surfaces a precise async question rather than stalling. It still never authors a spec, never promotes (the ready flag stays the human’s act), and never merges. Readiness remains the human’s explicit signal; the only erosion of the consent boundary is an auditable question a human answers async.

Running the full pipeline

Pilot and land are designed to run concurrently: pilot builds spec N while land babysits spec N−1’s PR. Two topologies, with one rule that matters.

Same session, two loops. Simplest, zero setup:

/loop 10m /flow-next:pilot --review=codex
/loop 30m /flow-next:land

Ticks serialize (a loop fires only while the session is idle), so a long pilot work-tick delays land’s cadence. Good for draining a small backlog in one sitting.

Two instances, the assembly line. Run pilot in one Claude Code / Codex instance and land in another, on a cadence, indefinitely. Each instance needs its own clone (or git worktree) of the repo. Both loops mutate the working tree (pilot checks out spec branches; land checks out PR branches to fix CI), and two loops sharing one checkout trip each other’s dirty-tree guards into NEEDS_HUMAN noise. With separate clones, GitHub is the shared state: land pushes the spec close after merging, pilot pulls the base branch before planning, and the strike ledgers are per-clone by design (they live under .git/, never committed).

clone A:  /loop 10m /flow-next:pilot --review=codex     # builds: ready spec → draft PR
clone B:  /loop 30m /flow-next:land                     # ships: draft PR → merged + released
board:    drag issues to your ready state to feed the front of the line

The loops never fight over work: land only touches PRs whose authoring spec has all tasks done (in-flight specs stay pilot’s), authorship needs both the branch match and the make-pr breadcrumb, and pilot skips specs that already have an open PR. The board (or flowctl spec ready) is the only throttle you need.

The safety model

Hands-free is only useful if it can’t go off the rails. The same discipline applies across all three loops:

• Readiness gate. Loops select blessed work only; the human decision is structural, not skippable.
• Same review gates. Plan-review, impl-review, and spec-completion-review fire exactly as they do interactively; autonomy suppresses questions, never gates. The selected review backend loads its own mechanics, then continues directly into the shared fix loop in the same invocation. Terminal completion status is derived from the durable recorded attempt and live review cap, never from transient shell state.
• Delegation consent never stalls a tick. Work recognizes Ralph, receipt, FLOW_AUTONOMOUS=1, and literal mode:autonomous markers before the consent gate. Without persisted sandbox consent it disables Codex delegation and continues standard Work; it does not prompt, persist a choice, or widen authority.
• Draft-born PRs. Autonomous runs always open PRs as drafts; flipping to ready is land’s gated job or yours.
• Don’t-thrash. Pilot’s two-strike spec unready, Ralph’s auto-block, land’s bounded CI fixes: every loop has a stop-digging reflex that hands the problem back instead of burning tokens.
• Surface, don’t force. In backlog mode “stuck” becomes an async question written into the spec or tracker, never an interactive prompt and never an autonomous guess.
• Never nested. Pilot hard-errors under the Ralph harness; the autonomy signal (mode:autonomous / FLOW_AUTONOMOUS) is deliberately distinct from FLOW_RALPH and activates none of Ralph’s hooks.
• Evidence over narration. Advancement is judged on observed state (flowctl fields, gh-confirmed PR URLs), echoed into the transcript or written as receipts. A loop never grades its own homework.
• Generate, never poll. With the opt-in HTML render lenses active, loops still write artifacts at the same lifecycle touchpoints, never open a Lavish annotation session, and never poll for human feedback. At most you get a one-line note that a session has pending prompts.

Start here

flowctl spec ready fn-12     # or move its issue into your ready lane

/loop 10m /flow-next:pilot --review=codex

Each tick reports ADVANCED with its evidence, or NEEDS_HUMAN naming exactly where your judgment is needed. When the backlog drains, pilot prints NO_WORK and the loop idles until you bless more.

The rest of this section

Pilot - the build loop One tick advances one ready spec by one stage. The consent boundary, the don't-thrash guard, readiness as the control plane, and backlog mode.

Land - the ship loop The gate tree from draft PR to merged and released, the merge license, and every land.* config key.

Driving a loop The /goal and /loop snippets per host, why the verdict grammar is the driver contract, and the wrapper pattern for bridges that must not fail silently.

Unattended operation The queue policy above the loops: eligible scope, worktree isolation, overlap defers, hourly wakes, headless runners, and what to measure.

Ralph (deprecated) The repo-local shell harness: fresh session per iteration, hook-enforced rails, receipts on disk. Still supported, no longer the recommended path.