### Autopilot-stack

**You own the stack, never the landing. Build and verify the queue with full autonomy, then hand the operator one linear base-branch stack to review and land.** The sibling of **Autopilot-full** (`playbooks/autopilot-full.md`).

**Scope in this release.** The scope of `playbooks/autopilot-full.md` applies unchanged. The root, this session, runs the program and launches every child. Each owner round is a fresh leaf child, and the root runs every swarm and watcher. The root audits at each child delivery, each stall or no-progress advisory, and on the operator's request, never on a timer. Pushing and creating or retargeting PRs each happen only under an operator grant that names that action. This playbook never merges.

1. **Run the owner loop unchanged.** GitHub only, through `gh`. Confirm `gh auth status` and `gh repo view` once for the program. Never require Graphite. Each PR's owner is a role whose rounds are fresh bare implementer children that share one retained owner worktree and one canonical PR branch, per Autopilot-full step 2: only the build round creates the worktree, each later round starts with `cwd` set to that retained path after the previous round has exited, and no round pushes a sibling branch. Together the rounds own the change end to end: build, first push, a ready PR opened before self-proof, self-proof (gates, CI, receipts), skeptical Bugbot triage per `references/bugbot-triage.md`, a slop-strip (a manual diff cleanup pass), `/skill:no-comments` (the **no-comments** skill), and babysit to green per `playbooks/babysit.md`. Owner rounds run in parallel when the work is self-contained. The build round starts a `decisions.tsv` trail per the **show-me-your-work** skill as its first unit, pushes its first branch snapshot early, and opens the PR ready, never draft. After that, it pushes its branch again after every verifiable unit (hooks on, a WIP commit is fine). Keep the trail uncommitted and return it in each round's report. The root keeps the child checklist of Autopilot-full step 2.
2. **Audit at every wake.** The root audits at each child delivery, each stall or no-progress advisory, and on the operator's request, per Autopilot-full step 6. Nothing schedules it, so never promise a timed cadence and never leave the audit to memory. At each audit, re-read this playbook from the installed pstack skill directory and audit the operation against it. Fix drift during that audit. Judge each owner by side effects only: commits, pushes, PR or check deltas, and reported trail rows. Treat a child that passes its expected runtime without a side effect, or that draws a no-progress advisory, as stuck. A watcher child still inside its declared wait bound is exempt, and is stuck only once that bound has passed (`references/fan-out.md` section 6). Cancel it with `subagent_cancel` and launch one fresh replacement at once. Do not wait for a polite return. Run the stuck test over the whole child checklist and end the program per Autopilot-full step 6.
3. **Hold the operator gates.** State-then-wait, so a request to state the plan is not a go. On the operator's stop, call `subagent_cancel` on every running child and launch nothing new.
4. **Verify each round.** The owner round reports its code-ready head SHA once the shipped code is final, and the root marks the PR STACK-READY at the exact head SHA when its loop is green. The root verifies each round per Autopilot-full step 4, with STACK-READY in place of merge-ready. Nothing enters the stack unverified.
5. **Append on a clean verdict, never ship.** No owner merges, arms auto-merge, or closes. A clean verdict appends the PR to the one linear base-branch stack, in verified order or an order the operator specified.
6. **Single writer on topology, parallel writers on builds.** Owner rounds push only their owner's canonical PR branch and report the tip, current base, and intended parent. The root is the only topology writer. To append a PR, fetch the intended parent, rebase the child branch onto that exact parent tip, push with `--force-with-lease` only after an `ls-remote` check and only under the push grant, and set the PR base to the parent branch. Create it with `gh pr create --base <parent-branch>` and retarget an existing PR with `gh pr edit <pr> --base <parent-branch>`, each only under the PR grant. Only the root PR targets trunk. Never submit or register the chain through Graphite.
7. **Absorb drift at the root, then re-verify what moved.** The root fetches current trunk and rebases the chain from bottom to top. When a rebase surfaces conflicts in an owner's files, a fresh round of that owner fixes its own slice and the root pushes the result. A rebase rewrites every SHA above it and voids verdicts at the old SHAs. Apply the patch-id rule in `playbooks/shipping.md` at each verdict SHA. Anything that is no longer valid goes back through this playbook's step 4 before delivery. Re-run mergeability and CI after every rewritten push even when the patch-id is unchanged. The countersign rule is unchanged from Autopilot-full. A genuinely new pin raises a stop for the root's fresh countersign. Absorbing drift of landed values is not a raise.
8. **Deliver the chain.** The deliverable is one linear chain of verified PRs, reviewable bottom-up on GitHub. Every link carries its verifier verdict, in the PR body or a comment when editing or commenting is authorized, and in your reply either way. The operator reviews and lands it, with their own clicks or by arming merge-when-ready.

**Choosing between the autopilots.** Autopilot-full when the PRs are independent and the operator's grant names merging. Autopilot-stack when the operator wants review before landing, the work is sequenced or coupled, or merge authority is withheld.

**Reply:** links to the stack root and tip, a one-line verdict summary per link, which external actions ran under which grant, and anything parked or excluded with the reason.