Rewind showcase

How Rewind works

Rewind runs beside GitLab Duo's agents. It doesn't need them to be perfect: it makes what they do undoable, stops what can't be undone, and takes everything back when production says no.

GITLAB REWIND GOOGLE CLOUD IssueDuo agent flows Merge requestCI/CD pipeline labelled rewind:autoplan · develop · review · fix gated before mergetests · scans · deploy · flag · monitor webhookstartspushes head SHAmergesresult deployssnapshot CheckpointStart flowsGate MergeWatch the release every kind of stateleast privilege all undoable?exact gated SHA monitor:production fails 2 · flag, code, MR, issue 3 · verify: zero drift 1 · traffic back, in seconds Cloud StorageCloud Run · the demo app snapshots · runs · ledgersstaging and production revisions
The only coloured path is the rewind, in mitigation order: traffic first, then the flag, code, merge request and issue, then a check against the checkpoint.

One run, start to finish

label an issue rewind:auto and walk away
  1. Checkpoint. Before any agent acts, Rewind snapshots everything they can touch: code, branches, merge requests, issues, labels, feature flags, CI/CD variables (fingerprints only), tags, releases, and which Cloud Run revision serves each environment.
  2. Agents build. Duo flows plan the work and open a merge request. Each step gets its own checkpoint, so every change is linked to the agent session that made it.
  3. The gate. Before merge, on the exact commit that would ship, every change is classified. Anything irreversible is blocked, with the file and line that caused it.
  4. Verify and review. Tests and security scans run on the merge request. Failures and findings go back to the agent, and every new commit is gated again. Duo reviews the code; what the agent can't resolve goes to the review policy.
  5. Merge and release. Rewind merges the exact commit it gated. The pipeline deploys behind a feature flag, and production monitoring watches.
  6. Rewind. If production regresses, Rewind opens an incident and undoes the whole change set: traffic and flags within seconds, then code, merge request and issue. It compares the project with the checkpoint again and closes its own incident when there's zero drift.

See a real one: #15 Weekend flash sale: $15 off every order, production back in 18s

Three kinds of change

autonomy is set by reversibility
Reversible

Rewind restores these exactly.

Code, feature flags, labels, Cloud Run traffic.

Compensatable

Neutralised by a new, recorded action; history is kept.

A merged merge request (reverted), a closed issue (reopened), a published release.

Irreversible

Cannot be undone, so the gate stops them.

An email or call that left the system, a changed secret value, a migration with no way down.

People only where it matters

Undoable work
Ships with nobody in the loop. Rewind can take it back.
Irreversible work
Stopped at the gate. Only a named person, through Rewind's authenticated API, can accept it, for one commit.
An agent with a question
When an agent stops instead of opening a merge request, Rewind puts its question on the issue and waits.
Review concerns
Go back to the agent first. What stays unresolved on a fully undoable change ships by policy and is watched; see Who can do what.
Anyone on the team
Can undo a run (/rewind) or stop one (/rewind stop) with a comment.

What it can't undo

  • A message that already left: an email, a webhook call, a payment. That's why the gate stops it before merge.
  • Data a migration destroyed with no way back. Migrations without a downgrade are blocked.
  • A CI/CD variable's old value. Rewind stores only a fingerprint, never the secret, so changing one is gated.

Connect your project · Read the policy in force