feat: Autopilots — scheduled/triggered automations for agents

[OneStepAt4time]

Autopilots — Scheduled/Triggered Automations

Why

"Set it and forget it" automation. Cron jobs for agents. Webhook triggers for CI/CD integration. Currently every Aegis session must be manually initiated. Autopilots enable recurring workflows without human intervention.

Concept

• An Autopilot is a recurring automation that assigns work to an agent or squad
• Triggers define when it fires: cron schedule, webhook, or API call
• Runs track each execution with status, output, and history
• Supports concurrency policies: skip (if previous still running), queue, or replace

DB Schema

CREATE TABLE autopilot (
  id TEXT PRIMARY KEY,
  workspace_id TEXT NOT NULL,
  title TEXT NOT NULL,
  description TEXT,
  assignee_type TEXT NOT NULL CHECK(assignee_type IN ('agent', 'squad')),
  assignee_id TEXT NOT NULL,
  execution_mode TEXT NOT NULL DEFAULT 'create_session' CHECK(execution_mode IN ('create_session', 'run_only')),
  concurrency_policy TEXT NOT NULL DEFAULT 'skip' CHECK(concurrency_policy IN ('skip', 'queue', 'replace')),
  issue_title_template TEXT,
  status TEXT NOT NULL DEFAULT 'active' CHECK(status IN ('active', 'paused', 'archived')),
  created_by TEXT NOT NULL,
  last_run_at TEXT,
  created_at TEXT NOT NULL DEFAULT (datetime('now')),
  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
);

CREATE TABLE autopilot_trigger (
  id TEXT PRIMARY KEY,
  autopilot_id TEXT NOT NULL REFERENCES autopilot(id) ON DELETE CASCADE,
  kind TEXT NOT NULL CHECK(kind IN ('schedule', 'webhook', 'api')),
  enabled INTEGER NOT NULL DEFAULT 1,
  cron_expression TEXT,
  timezone TEXT NOT NULL DEFAULT 'UTC',
  next_run_at TEXT,
  webhook_token TEXT,
  webhook_secret TEXT,  -- for signature verification
  label TEXT,
  last_fired_at TEXT,
  created_at TEXT NOT NULL DEFAULT (datetime('now')),
  updated_at TEXT NOT NULL DEFAULT (datetime('now'))
);

CREATE TABLE autopilot_run (
  id TEXT PRIMARY KEY,
  autopilot_id TEXT NOT NULL REFERENCES autopilot(id) ON DELETE CASCADE,
  trigger_id TEXT REFERENCES autopilot_trigger(id),
  source TEXT NOT NULL CHECK(source IN ('schedule', 'manual', 'webhook', 'api')),
  status TEXT NOT NULL DEFAULT 'pending' CHECK(status IN ('pending', 'session_created', 'running', 'skipped', 'completed', 'failed')),
  session_id TEXT,
  failure_reason TEXT,
  trigger_payload TEXT,  -- JSON
  result TEXT,  -- JSON
  triggered_at TEXT NOT NULL DEFAULT (datetime('now')),
  completed_at TEXT,
  created_at TEXT NOT NULL DEFAULT (datetime('now'))
);

API Endpoints

• GET /v1/autopilots — list autopilots
• POST /v1/autopilots — create autopilot
• GET /v1/autopilots/:id — get autopilot details
• PUT /v1/autopilots/:id — update autopilot
• DELETE /v1/autopilots/:id — delete autopilot
• POST /v1/autopilots/:id/triggers — add trigger
• PUT /v1/autopilots/:id/triggers/:triggerId — update trigger
• DELETE /v1/autopilots/:id/triggers/:triggerId — delete trigger
• GET /v1/autopilots/:id/runs — list runs
• POST /v1/autopilots/:id/run — manual trigger
• POST /v1/webhooks/:token — webhook receiver endpoint

Scheduler

• Use node-cron or similar in the Aegis server process
• On startup: load all enabled schedule triggers, register cron jobs
• On fire: check concurrency policy, create session, assign to agent/squad
• Next-run-at computed from cron expression + timezone

Webhook Receiver

• POST /v1/webhooks/:token — receives external payloads
• Optional signature verification (HMAC-SHA256)
• Idempotency key support
• Payload stored in autopilot_run.trigger_payload

Frontend

• Autopilots page: list with title, assignee, trigger type, last run, status
• Create/edit dialog: title, assignee picker, execution mode, concurrency
• Trigger config: cron picker, webhook URL display, enable/disable toggle
• Run history: list of runs with status, duration, output

Acceptance Criteria

• CRUD API for autopilots, triggers, and runs
• Cron scheduler that fires schedule triggers
• Webhook receiver with signature verification
• Concurrency policy enforcement (skip/queue/replace)
• Manual trigger endpoint
• Run history tracking
• Dashboard autopilots page with trigger config
• Tests for scheduler, webhook receiver, concurrency
• npm run gate passes

Reference

Competitive analysis: references/multica-competitive-analysis.md §2.3
Inspired by Multica Autopilots (concepts only, our own implementation)

[OneStepAt4time]

🚧 Blocked by: #3970 (Task Queue) — foundational state machine required before this feature can be implemented.