Meta's Autopilot runs maintenance as an always-on loop, and auto-land still needs two humans
Meta describes Autopilot, a system that keeps on-call and proactive maintenance moving with a lead agent, persistent task state, and evaluated specialist agents. Landing code stays behind two distinct human acceptances on the current revision, passing CI, and no blocking comment, enforced outside the model.
Source: From On-Call to Always-On
Sumeet Arora of Meta describes Autopilot, a system Meta is building to keep product maintenance moving continuously instead of waiting for someone on call to notice a problem. Work enters two ways: from the on-call queue (bug reports, regressions, alerts) and from "finder" agents that watch a bounded product surface and propose tasks with evidence, impact, confidence, and likely owner. Both feed one loop: classify, investigate, change, verify, learn.
The design choices are what make it run around the clock without losing the thread:
- Task state outlives any one agent run. A lead agent per on-call queue records findings, status, and next steps, and can snooze a blocked task on a condition, such as "check whether this change landed," then pick it up later.
- Product truth lives in reviewed files. Each team keeps a versioned "product pack" of triage rules, ownership, code pointers, and verification recipes. Arora notes a stale verification recipe "can make an ineffective change look successful," so maintaining the pack is part of operating the system.
- Agents are compared, not trusted. An internal arena runs two agent variants against a fixed suite built from closed bug-report tasks. Meta flags the limits itself: results are point estimates without significance testing, and a suite of already-solved tasks can't represent the whole queue.
- Recovery reads recorded state. A timeout doesn't prove a job failed, so the system checks what completed before starting another run, to avoid duplicate work.
Why it matters for code review
The landing boundary is the part to copy. Auto-land is opt-in and requires two distinct human acceptances on the current revision, no later blocking inline comment, and passing CI, all enforced outside the model in workflow and landing infrastructure. The loop runs continuously; the merge does not get easier. Arora also names the cost directly: more generated proposals can mean more review work, so the system should be judged on whether engineers spend less time reconstructing context, not on how many runs completed. The post gives no production numbers yet.