Autopilot

Autopilot

Autopilot is BMO’s headless long-lived runtime. The inspect family answers three operator questions without mutating the process: is the runtime up, which pillars are healthy, and what were the most recent bounded lifecycle events?

Quick inspect

Surface	Command
CLI	bmo config show-autopilot
TUI	/autopilot_status or sidebar Autopilot
HTTP (bmo serve)	GET /v1/autopilot/status and GET /v1/autopilot/recent
Native agent	autopilot_status
MCP	bmo_autopilot_status

/autopilot is the neighboring control surface for starting or stopping the headless runtime. It is distinct from /autopilot_status, which is read-only.

What the snapshot shows

• Posture state: up, starting, degraded, down, or unknown
• Pillars: manifest, scheduler, server, and auth
• Local process markers: autopilot.pid, scheduler.pid, stale-PID detection, and the manifest path
• Recent lifecycle ring: bounded autopilot.fired events such as startup_ready, partial_startup_unwound, scheduler_drain_timeout, and posture_degraded

The snapshot is metadata-only. It uses hashed data-directory identifiers for cross-surface correlation and does not expose auth tokens or raw bind-address payloads.

Tracing

Autopilot lifecycle emits through the bounded autopilot.fired lane. To inspect the raw event stream:

bmo logs --tail 1000 | jq -c 'select(.msg=="autopilot.fired")'

For failure and degraded-only arms:

bmo logs --tail 1000 | jq -c 'select(.msg=="autopilot.fired" and (.action=="startup_failed" or .action=="pid_conflict" or .action=="auth_mode_invalid" or .action=="partition_invalid" or .action=="scheduler_start_failed" or .action=="server_bind_failed" or .action=="partial_startup_unwound" or .action=="scheduler_drain_timeout" or .action=="executable_drift_grace" or .action=="executable_drift_cancel" or .action=="posture_degraded"))'

Maintainer detail: Autopilot mode and Agent tracing.