Add origin Autopilot verification contract.

Why:
Codex Autopilot yml-era runtimes load target verification only from
origin-default-branch autopilot.yml. Missing that file parks PR runs
as waiting_external_prereq / external_prereq.missing and is not skip.

Changed:
- add root autopilot.yml with verify.command npm test
- protect autopilot.yml, .agents/**, WORKFLOW.md, and package manifests
- give harness-contract exclusive ownership of autopilot.yml
- cover scripts/check_managed_skill_ownership.sh on that same manifest
- document the origin Autopilot gate in spec/agents.md,
  spec/build-and-test.md, and spec/project-structure.md

Verification:
- npm --prefix agent-harness run preflight -- --paths-file changed-paths.txt pass
- npm run agent:verify -- --profile spec-only pass
- public-front-door 18/18 pass
- managed-skill-ownership pass

Affected:
- autopilot.yml
- .agents/manifests/harness-contract.yaml
- spec/agents.md
- spec/build-and-test.md
- spec/project-structure.md

Refs:
- Autopilot target-contract origin yml

Session:
- task-sessions/autopilot-yml-origin-contract

Author: VladimirBrejcha

.agents/manifests/harness-contract.yaml

@@ -5,10 +5,12 @@ globs:
   - AGENTS.md
   - CLAUDE.md
   - WORKFLOW.md
+  - autopilot.yml
   - package-lock.json
   - package.json
   - scripts/agent_detached_status.cjs
   - scripts/bootstrap_agent_harness.sh
+  - scripts/check_managed_skill_ownership.sh
   - scripts/validate.sh
 owner: harness-maintainer
 required_skills:
@@ -27,10 +29,12 @@ allowed_paths:
   - AGENTS.md
   - CLAUDE.md
   - WORKFLOW.md
+  - autopilot.yml
   - package-lock.json
   - package.json
   - scripts/agent_detached_status.cjs
   - scripts/bootstrap_agent_harness.sh
+  - scripts/check_managed_skill_ownership.sh
   - scripts/validate.sh
   - spec/**
 forbidden_paths:

autopilot.yml

@@ -0,0 +1,10 @@
+version: 1
+verify:
+  command: npm test
+contract:
+  protectedPaths:
+    - .agents/**
+    - WORKFLOW.md
+    - autopilot.yml
+    - package-lock.json
+    - package.json

spec/agents.md

@@ -1,5 +1,5 @@
 # Agents
-Related: `spec/README.md`, `spec/harness-integration.md`, `spec/build-and-test.md`, `spec/project-structure.md`, `WORKFLOW.md`, `.agents/manifests/specs.yaml`, `.agents/manifests/harness-contract.yaml`, `.agents/manifests/agent-harness-runtime.yaml`, `.agents/manifests/broker-runtime.yaml`, `.agents/manifests/implementation-foundation.yaml`, `.agents/verify/implementation.yaml`, `.agents/verify/spec-only.yaml`
+Related: `spec/README.md`, `spec/harness-integration.md`, `spec/build-and-test.md`, `spec/project-structure.md`, `WORKFLOW.md`, `autopilot.yml`, `.agents/manifests/specs.yaml`, `.agents/manifests/harness-contract.yaml`, `.agents/manifests/agent-harness-runtime.yaml`, `.agents/manifests/broker-runtime.yaml`, `.agents/manifests/implementation-foundation.yaml`, `.agents/verify/implementation.yaml`, `.agents/verify/spec-only.yaml`
 
 ## Purpose
 
@@ -13,7 +13,7 @@ Maintainers and agent runs still use `agent:context` / `agent:verify` /
 
 ## Current routing
 
-- `harness-contract` exclusively owns `WORKFLOW.md`, `.agents/`, agent
+- `harness-contract` exclusively owns `WORKFLOW.md`, `autopilot.yml`, `.agents/`, agent
   instructions, the canonical validator, and harness setup files
 - `agent-harness-runtime` exclusively owns executable `agent-harness/` source,
   tests, and package metadata, so harness code changes run executable checks
@@ -47,6 +47,28 @@ project skill roots. Project-local skills remain source-owned in this repository
 - App workflow changes should route through the resolved skills above instead of ad hoc shell chains or undocumented local commands.
 - When the app needs desktop-only behavior that SwiftUI cannot express cleanly, document the exact gap first and keep the implementation covered by `swiftui-pro` and `xcode-build`.
 
+## Autopilot origin contract
+Related: `autopilot.yml`, `WORKFLOW.md`, `spec/build-and-test.md`, `spec/project-structure.md`, `.agents/manifests/harness-contract.yaml`
+
+Codex Autopilot loads target verification only from repository-root `autopilot.yml` on the origin default branch. It does not read `.agents` or `WORKFLOW.md` as the Autopilot gate. Local Symphony/agent runs still use `WORKFLOW.md` `validation.command` (`./scripts/validate.sh`) and `.agents`.
+
+In scope: origin Autopilot verification command, protected verifier paths, and `harness-contract` ownership of `autopilot.yml`. Out of scope: replacing `agent:complete`, GitHub CI, or `scripts/validate.sh`; authorizing Autopilot-labeled product PR merges.
+
+- `version` is integer `1`, not float `1.0`.
+- `verify.command` is `npm test`.
+- `contract.protectedPaths` includes `autopilot.yml`, `.agents/**`, `WORKFLOW.md`, `package.json`, and `package-lock.json`.
+- The `harness-contract` manifest is the single primary owner of `autopilot.yml`.
+- `autopilot.yaml` is invalid. Do not add a sibling alias.
+
+| ID | Requirement | Verifier |
+|----|-------------|----------|
+| SB-AP-001 | Origin default branch contains regular-file `autopilot.yml` | Autopilot origin inspect `ready_on_origin`; `verify:spec-only` |
+| SB-AP-002 | `verify.command` is `npm test` | `autopilot.yml` contents; `verify:spec-only` |
+| SB-AP-003 | Worker edits under `.agents/**` and `WORKFLOW.md` are Autopilot protected paths | `autopilot.yml` `protectedPaths` |
+| SB-AP-004 | `autopilot.yml` has exactly one primary manifest (`harness-contract`) | `npm run agent:preflight -- --paths-file` / config-contract |
+
+Missing origin `autopilot.yml` → Autopilot `waiting_external_prereq` / `external_prereq.missing`. Uncovered or overlapping `autopilot.yml` → spec-only / config-contract fail.
+
 ## Verification model
 
 Use `npm run agent:verify -- --profile <profile-id> --paths <files> --session-dir <dir>` for deterministic checks.

spec/build-and-test.md

@@ -70,6 +70,13 @@ A first extracted implementation slice now exists:
 
 The current deterministic verification contract includes implementation tests plus spec integrity.
 
+Codex Autopilot is a separate origin-default-branch gate. It runs only the
+command in `autopilot.yml` (`npm test`). Autopilot does not read `.agents` or
+`WORKFLOW.md` as its contract. Missing origin `autopilot.yml` is not skip.
+Local full-repo validation remains `./scripts/validate.sh`. GitHub-hosted CI
+stays the split Ubuntu/macOS jobs and still does not run `test:app` or
+`verify:public-surface`.
+
 Generated agent harness commands:
 
 <!-- agent-harness-commands:start -->

spec/project-structure.md

@@ -1,5 +1,5 @@
 # Project Structure
-Related: `spec/README.md`, `spec/global-simulator-broker.md`, `references/README.md`
+Related: `spec/README.md`, `spec/global-simulator-broker.md`, `references/README.md`, `autopilot.yml`
 
 ## Top-level layout
 
@@ -8,6 +8,8 @@ Related: `spec/README.md`, `spec/global-simulator-broker.md`, `references/README
 - `.codex/environments/` — Codex environment bootstrap and Run actions
 - `WORKFLOW.md` — public-safe repo-owned Symphony execution, validation,
   protected-path, and handoff contract
+- `autopilot.yml` — Codex Autopilot origin verification contract; Autopilot
+  does not read `.agents` or `WORKFLOW.md` as that gate
 - `CHANGELOG.md` — published version history for tagged releases
 - `.github/workflows/` — public Node test CI and tag-driven CLI release
 - `Formula/` — Homebrew CLI formula for the tagged Alpha tarball. Source of