Inspiration

Coding agents got fast enough this year that the bottleneck moved. Writing code is cheap now; the expensive part is trusting what comes back. An agent finishes, tells you “done, tests pass,” and you're interrogating a diff at midnight. What did it actually change? Did the tests pass on the version you're about to merge, or three edits ago? Did it quietly touch CI or a lockfile?

This began as our team's research question about auditing autonomous actions, and the metaphor that stuck was aviation: we don't trust planes because pilots are perfect; we trust them because there's a flight recorder. So we built one for coding agents.

What It Does

Rewind is a local-first flight recorder that supervises agent tasks in any Git repository. You start a task with a declared intent and a set of allowed paths.

While the agent works, Rewind takes real Git snapshots under private refs—your branch, index, and working tree are never touched—and records every check run as signed evidence bound to the exact tree it ran against.

When the task finishes, you get a deterministic receipt showing:

What changed
What escaped the declared scope
What touched dependencies or protected paths such as CI and deploy files
What changed after the last passing test
Which checkpoint to recover from

Recovery is branch-only, so it never resets or checks out anything.

Underneath, Rewind uses an append-only, Ed25519-signed, hash-chained event log with a narrow policy engine. It can replay any recorded action under the policy and roles that were active at that moment in history. This means it can prove that a record is authentic and still conclude that the deployment it describes was never authorized.

Change one character of history and verification fails on the exact line.

A single command reproduces the whole thing offline:

rewind demo

The demo includes a developer task receipt and four forensic scenarios.

How We Built It

We built Rewind end to end with Codex and GPT-5.6 Sol.

We started from our research brief and used fast mode to prototype several candidate directions in a few hours. We chose this one because it was the tool we would actually use ourselves.

During the day, we worked with Codex on the hard parts:

Git plumbing that snapshots through a temporary index using GIT_INDEX_FILE, so the developer's real state stays untouched
Canonical JSON signing envelopes with PyNaCl
The four-layer replay fold: record → integrity → binding → as-of authority

At night, we launched ultra-mode subagent runs that exercised Rewind against a real project while we slept. Each morning, we reviewed the output and decided what to build next.

We kept the stack small:

Python 3.10+
Typer and Rich for the CLI
PyNaCl for signatures
A stdio MCP server so Codex can drive the same functions as the CLI
No runtime model calls, keeping verification deterministic

We also dogfooded Rewind. After the documented genesis commit, the rest of the build was recorded as a Rewind task.

Challenges We Ran Into

Staying Non-Destructive

Staying non-destructive was harder than being correct.

Snapshotting a dirty working tree—including untracked files—without disturbing the developer's index, branch, HEAD, or staged changes required careful Git plumbing and repo-local locking for parallel agent processes.

Not Overclaiming

The tempting pitch is “tamper-proof audit trail.”

What we can actually stand behind is tamper-evident under a single trusted local recorder key.

We wrote the threat model down and built to it: no blockchain, no theater, and an explicit genesis exception, since a recorder cannot govern its own installation.

Fail-Closed Ordering

Replay evaluates four layers in strict order:

Record
Integrity
Binding
As-of authority

A broken signature blocks any binding claim, and missing binding blocks any authority claim. A partially valid record can therefore never produce a confident verdict.

The Recorder Flagging Itself

Late in testing, receipts kept flagging files that changed after the last passing check.

Those files turned out to be Python bytecode caches written by the test run that Rewind itself had invoked.

We fixed the issue at the receipt-analysis layer. Signed trees remain complete, while cache noise can no longer masquerade as post-check tampering.

Accomplishments We're Proud Of

The verdict sentence is the whole product in one line:

The record is authentic. The deployment was not authorized.

The signatures pass. The evidence passes. The approval is real. Replay still catches that the deployer's role had been revoked before the deployment.

Git cannot express that, and a dashboard cannot prove it.

Beyond that, we built:

A one-command, network-free judge demo
A 47-test suite covering:
- Event mutation
- Chain breaks
- Evidence tampering
- Index, branch, and working-tree preservation
- A real MCP round trip
Recovery that is structurally incapable of destroying work
A receipt trustworthy enough that we ran it on Rewind's own build

What We Learned

A few things stuck with us.

For trust tooling, an LLM judging another LLM only adds noise. Every signal on a receipt had to be reproducible and inspectable, with nothing left to a model's discretion.

Being explicit about the threat model improved the design rather than weakening the pitch. Writing down what a single-recorder setup cannot guarantee forced better decisions everywhere else.

Watching agents work under Rewind also taught us that the scope friction is the point. When an agent's task collides with its declared scope, the receipt surfaces that tension for a human to resolve.

That is exactly the review conversation teams currently have blind.

What's Next for Rewind: A Flight Recorder for Coding Agents

Near Term

Signed mid-task scope amendments—an allow-add operation that records the widening instead of forcing a warning
Always-excluded cache patterns learned from more ecosystems
Windows support

Structural Improvements

External anchoring, publishing selected content IDs to a transparency log or commit trailer so even a stolen recorder key cannot silently rewrite history
Multi-recorder identities for team non-repudiation