Reversibility policy
Autonomy is set by reversibility, not by a fixed approval level. This is the policy in force for this
project, read live from rewind/policy.yaml. Agents may not edit it: it is a protected path.
How every change is classified
first matching rule wins · unknown changes fail closed- cloud_run · updated
Traffic is pinned back to the checkpoint revision; Cloud Run keeps old revisions, so this takes seconds.
- feature_flag
Flag state and strategies are restored exactly.
- label
Project labels are recreated or removed exactly; memberships are restored on each issue and MR.
- branch
Unprotected branches are deleted or recreated at their checkpoint commit.
- tag · deleted
The tag is recreated on the same commit.
- release · updated
Release name and notes are restored.
- merge_request · updated
State, title, labels and draft status are restored.
- issue · updated
State, title, labels and assignees are restored.
- ci_variable · created
The new variable is deleted.
- ci_variable · updated
Variable settings (protected, masked, raw, type) are restored.
- repository · updated
A restore commit returns the default branch tree to the checkpoint; the agent's commits stay in history for audit.
- tag
The tag is removed; anyone who already fetched it keeps a copy.
- release
The release is removed or recreated; notifications already sent cannot be recalled.
- merge_request · when state = merged
A merge cannot be un-merged: the code is restored by the repository restore and the MR is annotated.
- merge_request · created
The MR is closed with a note instead of deleted, so the record stays.
- issue · created
The issue is closed with a note instead of deleted, so the record stays.
- cloud_run
A Cloud Run service appearing or disappearing is outside Rewind's inverse set.
- repository
The default branch itself was created or removed.
- branch · updated · when it was protected = true
Protected branches cannot be force-reset through the API.
- merge_request · deleted
A deleted merge request cannot be restored.
- issue · deleted
A deleted issue cannot be restored.
- ci_variable · updated · value_fp changed
Rewind stores only a keyed fingerprint of variable values, never the value, so it cannot put an old value back.
- ci_variable · deleted
The deleted value was never stored, so it cannot be recreated.
- any other change
No known inverse for this kind of change; Rewind fails closed.
The gate, before merge
runs on the exact commit that would ship · also a CI/CD componentA schema migration without downgrade() cannot be rolled back.
New code reaches an external system. Messages and calls that leave the system cannot be recalled.
How to ship it safely: Write the message to a queue or outbox instead of sending it, so the code stays undoable; sending becomes a separate step a human approves once.
User-visible pricing changes must ship behind a feature flag, so release stays reversible by a flag toggle.
What the agent is told to do instead: Do not change legacy_total(). Implement the new behaviour only in new_pricing_total(), which runs only when feature flag new_pricing is enabled. Turn it on for production by setting new_pricing: {production: true} in config/flags.yaml; the pipeline applies it after deploy.
Agents may not change their own guardrails or the delivery pipeline:
rewind/**service/**flows/**agents/**ci/**infra/**.gitlab-ci.yml.gitlab/**AGENTS.mdCLAUDE.mdAgent privileges, per step
least privilege · never granted: start_flows| Step | Privileges |
|---|---|
| plan | read_only_filesread_only_gitlabread_write_gitlabrun_mcp_tools |
| develop | read_write_filesread_only_gitlabread_write_gitlabuse_gitrun_commands |
| review | read_only_filesread_only_gitlabread_write_gitlab |
| fix | read_write_filesread_only_gitlabread_write_gitlabuse_gitrun_commands |
| secfix | read_write_filesread_only_gitlabread_write_gitlabuse_gitrun_commands |
Who can do what
- Undo a run
- Any project member with Developer or higher: comment
/rewind. Undo is safe and can itself be undone. - Stop a run
- Same: comment
/rewind stop. Stopping only removes autonomy. - Code review concerns
- When the agent can't resolve what Duo code review asks for and everything the change ships can be undone, Rewind ships it: it overrides the requested changes for that commit, says why on the merge request, and watches production. Never for anything irreversible. Set by
review.unresolved_when_reversible. - Accept the irreversible
- Only through Rewind's authenticated API (
rewind approve), never a comment: agents comment with your identity. Bound to one commit and to the findings shown.