The loop has been running every six hours for a week. It reads the dependency manifest, checks what has moved upstream, and writes what it found into a state file. It changes nothing. On Friday somebody asks whether it is autonomous, and the question turns out to have no answer. Next week the same loop will start applying updates, but only inside one directory, and only to files it opened itself. It will not be supervised and it will not be unsupervised. It has been running at a setting all along, and the setting has a number.

The line comes off in three stages

Three settings, in practice. At the first the loop only reports: it reads, it watches, it writes to state files and logs, and it touches nothing in production. At the second it makes assisted fixes — it proposes changes and applies them, usually restricted to a named subset of files, patch-only. At the third it runs unattended: it acts without anyone reviewing that particular run, inside limits fixed before it started.

A dog on a short lead in the yard is doing nothing you did not decide. Clip on a thirty-foot line in a fenced field and it can range, pick its own direction, get something wrong — and you still have the end in your hand. Off the line on an open trail is a different animal only in what you know about it. You have watched the recall work in that field a hundred times, on a line you never once had to pull. The line was never restraint. It was how you collected the evidence before you spent it.

What has to be standing before you climb

Two mistakes live here, and both look like efficiency. The first is going from report straight to unattended because the loop has been quiet. The middle setting is not a formality: it is where you find out what the thing does when it is wrong and allowed to act, in a blast radius small enough to read on a Monday morning. The second mistake is confusing the highest setting a pattern supports with the setting it is actually configured at. A dependency sweeper can run unattended; in its first week it is held at patch-only, and a triage loop is held at report by an instruction that says so in the command itself — no auto-fix in week one.

The other thing that changes as you climb is who reads the output. At the reporting setting a person reads every line, which is the most reliable checker you will ever have, and also the reason that run can be cheap: most routine work — one team puts the routine share at around eighty percent — comes out much the same on a smaller model. Unattended, nobody reads the individual run. The last reader left is the verifier, and putting your cheapest model there is the quietest way to make the whole arrangement worthless. That is why harnesses let you set the model for sub-agents separately from the model for the main loop, and why the setting can be changed mid-session without a restart.

The step above acts on the harness

There is a step past unattended that gets mistaken for it. A meta-agent does not do the task. It watches a worker agent fail — a broken build, a failing suite, a regression — and then edits the instructions, the tools and the strategies the worker will use on the next attempt, again and again, with no human inside each iteration. A verifier accepts or rejects one output. A meta-agent changes the process that produces the outputs after it, which is the harness improving itself.

The Confucius Code Agent carries one. Between February and May of 2026 its SWE-Bench-Pro score went from 59% to 71% Resolve@1, and the gain is credited to that automated build-test-improve cycle rather than to a stronger model underneath. Which is also what the ladder is for. Low down, your evidence is a diff you can read. Higher up nobody reads every run, and what you have instead is a number measured across many of them. The step you can stand on is decided by the kind of proof you are able to collect there.

Autonomy is not a switch. It is a line you let out one length at a time, against evidence you already have in hand.