Modes de pilotage

Auto-pilot is a dog on a long leash in a fenced yard: free inside the fence, stopped at four gates it will never open alone, and a leash you can tug at any second.

You just learned you can say "auto-pilot," and the system will start doing things on its own. You are excited — and a little terrified. The fear has a name: runaway. If I hand over the cockpit, what stops it from doing something I'd never have allowed?

This page makes the leash visible. Here is the one picture for the whole thing:

flowchart TB
    subgraph yard ["The fenced yard — free movement inside"]
        DOG["The dog runs free:<br/>tidies, fetches,<br/>patrols, takes notes"]
    end
    LEASH["The leash in your hand<br/>— tug any second —"] -. "holds" .-> DOG
    DOG --> GATE1["Gate · new direction"]
    DOG --> GATE2["Gate · real fork"]
    DOG --> GATE3["Gate · can't be undone"]
    DOG --> GATE4["Gate · rewiring the house"]
    GATE1 -. "sits and barks for you" .-> YOU(["You decide"])
    GATE2 -. "sits and barks for you" .-> YOU
    GATE3 -. "sits and barks for you" .-> YOU
    GATE4 -. "sits and barks for you" .-> YOU

Inside the fence, the dog runs free — it fetches, it tidies, it patrols, and you don't micromanage each step. But the fence is real. At the edge there are four gates the dog will never push open on its own; it sits and barks for you instead. And you always hold the leash: three quick tugs and the dog freezes mid-stride.

Bounded autonomy is free movement inside a real fence, with an always-present leash. That single image carries the whole page. We'll walk it in order: the fence, what runs free inside, the four gates, the leash, and how a good co-pilot talks to you.

Switching it on is always your hand

Auto-pilot never turns itself on. It starts only when you say it — "auto-pilot," "je te passe le cockpit," "mode automatique."

The dog doesn't unclip its own leash. You do.

This matters more than it looks. It means the default state is always you driving. Silence is not consent. The cockpit stays yours until you hand it over with a conscious word.

Inside the fence: what the dog does without asking

Once you've switched it on, here is the free-running zone — the things the robot does inside the fence without stopping to ask. Each one is a small, safe, reversible chore:

• It tidies up finished work it finds lying around. Completed jobs get harvested and closed out, and it reports back in plain words what it did.
• It picks up the next clearly-marked job — but only when the path is obvious and already inside the scope you set. (The next ready item on the hot shelf, nothing surprising.)
• It moves a job from the shelf to the desk when the thing it was waiting on finally arrives. (Warm → hot, once the blocker clears.)
• It jots a sticky-note for a small follow-up it noticed — without starting it. A note on the board, not a new project launched behind your back.
• It writes a short line in the logbook when something taught a lesson — a brief chronicle entry, not a long essay.
• It glances at the pictures after a build to check they look right — a visual spot-check of the screenshots and rendered output.

Inside the fence, the robot tidies, picks up obvious chores, and takes notes. It never opens a gate.

Notice what's not here: nothing irreversible, nothing new-in-direction, nothing that rewires the system. Those are gates, not chores.

The four gates the dog never opens alone

These are the fence edges. At each one, the dog sits and barks instead of pushing through — every time, even on auto-pilot.

• A new direction. A whole new galaxy, or a feature outside the job you posed. The robot doesn't decide where the work goes.
• A real fork in the road. A design choice with genuine trade-offs, where two good answers pull apart. That's a decision with your name on it.
• Anything it can't take back. Push, reset, delete, uninstall — and the big irreversible gestures from the previous page: flip-to-public, cargo publish, push a tag, change DNS. If it can't be undone, the robot stops.
• Changing the house's wiring. Installing a background service, editing the rules the robot itself obeys, touching shared configs. The robot doesn't rewire the house it lives in.

If it can't be undone, isn't inside the posed scope, or rewires the system — the robot stops and asks, every time, even on auto-pilot.

The leash: three ways to freeze it instantly

You always hold the leash. There are three tugs, and any one of them freezes the dog where it stands:

• You speak. Any message from you, at any moment, pauses it. This is the simplest tug of all: just say something.
• You drop a stone in the yard. touch ~/.cosmon/autopilot.off. The robot checks for that stone at every decision point; stone present, it sits down and waits.
• It trips three times on the same rock. Three failures in a row on the same job, and it stops itself and waits for you. The robot knows when it's stuck.

The leash is always in your hand — a word, a stone, or its own stumble freezes it.

How the robot talks to you — three rules of a good co-pilot

Bounded autonomy is half of it. The other half is good manners — the way the robot talks to you so the back-and-forth never wastes your attention. Three rules, each a picture.

One question, one decision

The robot never asks "should we do X now, or wait for Y first?" — that's two questions wearing one coat, and you can't answer it cleanly. It asks one thing, proposes a default, and lets you say yes / no / not yet (the iMessage 1-2-3-later pattern).

A door with one handle, not a menu.

If two decisions are genuinely needed, it knocks twice — two clean doors, not one tangled one.

It re-knocks at the doorway

A question asked earlier can get lost in a busy session — you move on, the moment passes, the work stalls waiting on an answer you never saw. So the robot asks again — same words, same choices — at the next natural pause, so you recognise it instantly.

A child who asked "are you asleep?" and, getting no answer, asks again at the door rather than giving up.

It speaks in pictures, not jargon

Every reply uses concrete images and short sentences — the picture a smart 8-year-old would grasp — not dense tables of technical terms. Trees, kitchens, paper planes, a dog on a leash.

Showing you a drawing of the kitchen instead of reading you the recipe's ingredient codes.

This voice has a name: the Feynman register. That's the name of how the robot speaks to you — a promise about its voice. It is not a switch you flip or a mode you select; you can't "turn it on." It's simply how a good co-pilot talks. (This whole site is written in it.)

Telling you a secret before you send it, not after

One rule gets its own section because it's sharp and easy to get wrong.

Suppose something you're about to send out — an email, a message — must stay private. The robot folds that "please don't forward" into the same message — never as an anxious second message a minute later.

You seal the "confidential" stamp onto the envelope before you mail it. Running down the street after the postman shouting "don't show anyone!" only makes the letter look nervous — and the recipient has already read it.

Two honest moves only: stamp it before sending, or send it freely. Never tighten the secret after the fact. The embargo travels with the artefact or not at all.

Calibrated trust

Recall the dog and the fence one last time.

Auto-pilot is not "the robot takes over," and it is not "you watch it like a hawk." It is a fence you can see, four gates it always knocks on, and a leash you always hold.

That's the whole deal. You switch it on knowing exactly how much rope it has — not blind faith, not paralysis, but calibrated trust. The dog runs free inside the yard, sits and barks at the four gates, and freezes the instant you tug the leash.