Autonomous execution mode

Purpose

Let an operator who has explicitly accepted the risk hand the whole job to the agent: plan, execute, verify, and report — with live status the entire way — instead of approving each change one by one. This mode removes the per-step approval friction. It does not remove any verification, ordering, rollback, or halt discipline. Autonomy changes who clicks "go", never how carefully the work is done.

Activation contract

Autonomous mode activates only when the operator's message contains all three:

1. Explicit risk acknowledgment. An unambiguous statement such as "I understand the risk", "I accept the risk", "I know this can affect production". Softer phrasings — "go ahead", "sounds good", "do it" — do NOT activate autonomous mode; they remain per-change approvals under the change-gates skill.
2. A named scope. One of:
   • Named change IDs ("VIT-1, VIT-3, WEB-1"), or
   • A named database or org with a change-class ceiling ("everything in the report for storefront-demo"), or
   • "All recommendations in the report" — valid in this mode only, because the report already names every change.
3. A production statement. Whether production-affecting (Class D) changes are included. If the operator does not say, ask once; if still unstated, run at auto-safe (Class D excluded).

Record the acknowledgment verbatim in the run log before executing anything.