Usage autopilot

With more than one subscription linked for a provider, Autopilot decides which account each run goes out on. It spends windows that are about to reset, keeps work off accounts that cannot finish it, and never leaves a run waiting while another account has room.

Turning it on

Settings > Harness > Subscriptions has the Autopilot switch. It is on by default. With it off, each run goes out on the account its terminal is set to. See choosing an account.

Autopilot works on whatever model a terminal is set to, and it never changes that model. A run only moves between the linked subscriptions of its own provider. Claude runs share your Claude accounts and Codex runs share your Codex accounts.

While it is on, the model picker’s Account line reads Usage Pooled and cannot be changed. The account cells in the orchestrator’s lists read the same.

Only subscription accounts are pooled. A run on a custom endpoint goes straight to its endpoint. API keys never take a pooled run.

The other rows

• Blast effort bump is how many reasoning levels a run gains when it lands on a nearly spent window. It takes 0 to 3 and is 1 by default. At 0 a run keeps the effort it had.
• Models in the router lists the models with a switch each. A provider takes part while at least one of its models is on. Turn off every model of a provider and its accounts leave the rotation without being unlinked. By default one Claude model and one Codex model are on, so both providers take part.

A provider whose command line tool is not installed is never pooled either. A run for a provider with no account Autopilot can use goes out on that provider’s active account.

The queue

Autopilot runs from every terminal and every project share one queue. A run is priced once, when it joins. Warshall estimates how many tokens it will take, and that estimate stays with it. When the estimate service cannot be reached, a cautious default is used. The queue lives in memory and does not survive an app restart.

Autopilot looks at the queue when a run arrives, when any turn ends and once a minute. The minute check is how a window that has reset opens up again. Each time, it reads every account’s windows fresh from the provider, takes off what the runs already working are expected to spend, and sends out the first queued run of each idle terminal, in queue order.

Where a run lands prints nothing in the transcript. A run that has to wait prints one line starting Autopilot · waiting, with the minutes until the next window opens when a reset time is known.

How it chooses

An account has to accept a run before it is ranked. Warshall treats Claude as letting a run that has started finish past the limit, and Codex as cutting a run off at the limit.

• A Claude account accepts any run while more than half a percent of its window is left.
• A Codex account accepts any run until its last 10 percent, even when the estimate is bigger than what is left. Inside the last 10 percent it is strict. A run that overshoots by up to 3 percent still goes, since it has a real chance of finishing. Anything bigger is held back rather than wasted.
• An account past its ceiling accepts nothing.

Among the accounts that accept it, the order is as follows.

1. A window resetting within the next 45 minutes wins. Its capacity is about to expire.
2. A subscription that has never been messaged gets one run, because on some providers the window clock only starts on the first message.
3. A Claude account inside its last 10 percent, and not about to reset, becomes the preferred place for runs. Each run sent there has its reasoning effort raised by the Blast effort bump, so the last of the window goes to the deepest work.
4. An account the estimate fits in with room to spare beats one where it is a gamble. Headroom breaks the remaining ties, and an account that is the only safe home for runs queued behind is kept for them.

When no account accepts a run, it is skipped in place. Runs behind it still go out, and it is tried again on the next check.

Switching provider

As shipped, a run never leaves its provider. Warshall can turn on pooling across providers from its side. Then a run may land on another provider’s account, on that provider’s model of the same tier, and the conversation starts cold there, since each provider keeps its own sessions. See Auto conversations. A cost warning tells you before that happens, unless you have switched it off.