Autonomy modes

The three pipeline autonomy modes — manual, semi_auto, and auto — what each lets the system do on its own, and how mode changes thaw and freeze work.

Autonomy mode answers one question: when the system is running, how much may the pipeline decide for itself? It is a three-way setting — manual, semi_auto, or auto — that gates which kinds of background work the scheduler is allowed to do without you.

This page is for any operator running the lab. It explains what each mode enables, how moving between modes freezes and thaws pending work, and why autonomy mode is a separate control from the system pause. You set the mode on the operations console; this page is the depth behind that switch.

Forven is a research tool. Autonomy mode governs a research process — it decides how much of that process runs unattended. It does not create an edge, no mode guarantees against loss, and nothing here is a prediction or financial advice.

Two switches, two questions

Before the modes themselves, hold one distinction firmly: autonomy mode and system pause are orthogonal. They answer different questions and neither overrides the other.

System pause answers "should anything run at all?" It is a binary halt. When paused, all trading and every autonomous scheduler job is skipped on the next tick, regardless of mode.
Autonomy mode answers "when the system is running, how much may it act on its own?" It is the three-way manual / semi_auto / auto setting.

You can be paused in any mode, and you can be running in the safest mode. Treat the pause as the emergency brake and the autonomy mode as the speed limit. The pause lives on the operations console; this page is only about the speed limit.

There is also a third, narrower lever — the generation pause — which freezes new-strategy creation independently of the mode. It is covered below under Generation pause.

The three modes

The mode is persisted as system_mode in the forven:system_state key-value store and set with POST /api/system/mode. The scheduler reads it on every tick through two checks: is_autonomy_paused() (true only in manual) and is_generation_paused() (derived from the mode).

Mode	Strategy generation	Hardening, testing & scanning	Use it when
`manual`	Frozen	Frozen	You want a fully operator-driven lab. The safe default.
`semi_auto`	Frozen	Runs	You want the system to harden and scan the existing backlog, but invent nothing new.
`auto`	Runs	Runs	You want the full autonomous pipeline.

`manual` — operator-driven (the safe default)

In manual, is_autonomy_paused() is true and all non-user system tasks are paused. Nothing in the pipeline advances on its own: no autonomous hardening, no new research generation, no autonomous promotion. Pending system tasks are frozen as paused_manual. The lab still does exactly what you tell it to — you can run backtests, drive the gauntlet, and promote strategies by hand — but the system invents and decides nothing without you.

This is the default because it is the conservative one. Start here, learn the lab's behaviour, and open the throttle only when you mean to.

`semi_auto` — hardening allowed, generation blocked

semi_auto is the middle setting. Autonomous hardening is allowed — the existing backlog can be tested, scanned, and pushed through the robustness battery — but research generation stays frozen. The system will not invent new hypotheses or spawn new strategy children; it works only the strategies that already exist.

This is the safe way to let a large backlog drain. The pipeline keeps moving the work in flight toward a verdict without piling more intake on top of it.

`auto` — full autonomy

In auto, generation is unfrozen and the whole pipeline runs: the research daemon invents hypotheses, the scheduler runs the promotion and verdict loops, the scanner runs, and strategies advance through their gates without you in the loop. Capital gates still apply — auto does not loosen any promotion gate — but the system drives the pipeline end to end.

Only run unattended in auto when the lab is healthy: a green health signal and a clean soak report on the operations console are the state you want before trusting it to run on its own.

auto is not a real-money bypass. Autonomy controls which jobs run, not what they check. Every promotion gate — and especially the strict paper → live capital gate — is enforced in all modes. In a beta build execution is paper-locked regardless of mode, so auto can run the full research loop with no live exposure at all.

How mode changes freeze and thaw

Switching mode is not just a flag flip — Forven moves the backlog with you so tasks are not orphaned or duplicated. The transition logic freezes and thaws pending work intelligently.

Entering manual (freeze). Pending non-user system tasks are frozen to paused_manual. They are not cancelled or lost — they are held in place so nothing advances while you have the lab in your hands.
Leaving manual (thaw). Moving to semi_auto or auto resumes the frozen paused_manual tasks. As it thaws, the system cancels superseded duplicates — if a newer task has overtaken an older paused one, the stale one is dropped rather than re-run, so you do not get double execution after a long pause.

The aim is continuity: a mode change should leave you in a sensible state, not a pile of stranded or re-fired tasks.

Leaving manual is explicit — there is no back door. While the mode is manual, asking to resume generation alone is a no-op: the request is rejected and the mode stays manual. To re-enable any autonomous work you must set the mode to semi_auto or auto with POST /api/system/mode. This is deliberate. manual means operator-driven, and only an explicit mode change leaves it.

Generation pause: the narrow lever

Independently of the mode, you can freeze only the strategy-creation jobs — the crucible planner and ideation — while leaving testing, scanning, and execution running. This is the backlog throttle: the safe way to let intake drain without inventing more work on top of it.

# Freeze new-strategy generation; keep testing & scanning alive
Invoke-RestMethod -Method Post -Uri "http://127.0.0.1:8003/api/system/generation/pause"

# Resume generation (only takes effect outside manual mode)
Invoke-RestMethod -Method Post -Uri "http://127.0.0.1:8003/api/system/generation/resume"

The mode and the generation pause interact predictably, because the scheduler reads them through two independent checks:

manual forces generation paused — and resuming it alone is rejected (see the note above).
semi_auto keeps generation paused but lets testing, scanning, and hardening run.
auto unfreezes generation. Pausing generation in auto gives you "run everything except new intake" without dropping all the way back to semi_auto.

Steps: set the autonomy mode

You set the mode from the operations console. These actions are operator-gated — they touch autonomy — so they require FORVEN_OPERATOR_KEY if one is configured.

Open /ops and find the Autonomy Mode selector.
Choose manual, semi_auto, or auto. The UI calls POST /api/system/mode with, for example, {"mode": "semi_auto"}.
The system persists system_mode, derives the generation-pause flag from the mode, and freezes or thaws the backlog accordingly.
Confirm the new mode reads back on /ops. The next scheduler tick honours it through is_autonomy_paused() and is_generation_paused().

From the shell, the same change is:

# Set the pipeline autonomy mode (operator-gated)
Invoke-RestMethod -Method Post -Uri "http://127.0.0.1:8003/api/system/mode" `
  -Body '{"mode": "semi_auto"}' -ContentType "application/json"

What you'll see

On /ops, the Autonomy Mode selector reflects the current mode, and the system status shows whether you are also paused. After setting manual, autonomous scheduler jobs stop advancing on the next tick and previously pending system tasks read as paused_manual. After moving to semi_auto or auto, those tasks thaw and the scheduler list begins advancing next_run_at again — generation jobs (the crucible planner, ideation) start firing only in auto. The approvals queue is where autonomous promotion and dethrone decisions still surface for sign-off; raising the autonomy mode does not silence those gates unless auto_approve_promotions is on.

Caveats

Mode is not pause. Setting auto does nothing if the system is paused; a pause halts everything regardless of mode. Check both on /ops.
Leaving manual requires a mode change. Resuming generation alone is rejected in manual — set semi_auto or auto explicitly. There is no shortcut.
No mode loosens a gate. Autonomy controls which jobs run, never what they check. Capital gates are enforced in every mode, and testing_mode (a separate switch) only bypasses the non-capital gates.
Beta is paper-locked. In a packaged beta build, execution stays paper in all modes — auto runs the research loop with no live exposure.
A mode change is not instant. The scheduler applies the new mode on its next tick, and thawed tasks resume in order; give it a tick before concluding nothing happened.

Operations & system controls — where you flip the mode, plus the system pause and execution-mode switches.
Scheduler & jobs — the background jobs that autonomy mode gates, and how to tune their cadence.
The research daemon — the autonomous loop that runs when generation is unfrozen in auto.
Approvals — the sign-off queue for autonomous promotion and dethrone decisions.

On this page