Autopilot

Automatic analysis and preparation; final decisions stay with you.

Open Autopilot. It is OFF until an owner saves an enabled policy. Choose a check interval, summary interval, conditional planning strategy and separate currency limits. Zero disables new DRAFTs in that currency. Automatic monitoring uses local deterministic tools and makes no model call. Local AI remains an optional, separately qualified task-entry provider.

1. Changed recorded financial inputs trigger a forecast, source/missing-fact check and three bounded plan comparisons.
2. If the selected strategy is financially sufficient, within every currency limit and existing domain rules, prepare only its DRAFT batch. Otherwise show the blocker or no-sufficient-plan result honestly. No partial over-limit batch is created.
3. If enabled, prepare a forecast snapshot as a separate pending owner workflow. No snapshot is saved merely because Autopilot prepared it.
4. Action/workflow status changes trigger follow-up; unchanged data produces a periodic digest. The recorded ledger date never advances itself.
5. With a linked private Telegram account and explicit delivery opt-in, queue a summary and eligible exact decision cards. Approve DRAFT records owner approval only; it sends nothing. Snapshot approval saves only that reviewed local snapshot. Consent, observations and reconciliation remain separate.

Supported private Telegram tasks run reports or prepare DRAFT/pending work directly while Autopilot is ON. With it OFF, the existing preparation-review step remains. Use /autopilot for status, /autopilot on to enable/resume the saved policy and opt into Autopilot updates, and /autopilot off to stop future work and cancel unsent Autopilot deliveries. Other changes need detailed Web review.

Jobs have durable identities, an atomic ledger/effect journal, a ten-second local deadline and bounded restart recovery. Stale data, changed policy, disabled mode, expired workspace or lost claim rejects candidates. Preparing an unintended but permitted DRAFT remains possible; inspect exact terms before approval. Failed jobs are recorded rather than retried under invented new instructions.

The app must stay running. An enabled saved policy resumes on restart. Local bot startup still follows its separate private configuration rules; no saved token is exposed. Hosted visitor workspaces still expire after 24 hours; monitoring does not extend them. Public visitors cannot access the operator's private Telegram account. Browser Telegram practice remains simulated.

Limits: at most eight DRAFTs per batch, 48 jobs per workspace per rolling 24 hours, 300 invoice/bill records, and 1–120 forecast days. The shared job index is bounded. Four workspaces are checked per worker cycle. Notifications may be delayed or uncertain; queued is not delivered, and uncertain sends are not automatically repeated. No real banking, payment or business-counterparty transport is provided.