RewindBPF
AI agents are useful because they can act directly on a project. That is also the problem: one incorrect command can remove a source directory, overwrite configuration, or expose a sensitive file before anyone notices.
RewindBPF gives an agent a reversible work session instead of direct access to the real workspace.
Before the agent starts, Rewind creates a disposable filesystem transaction. The original workspace becomes an immutable lower layer. The agent works in a merged view, while writes and deletes are kept in a temporary copy-on-write layer. Nothing reaches the real workspace unless a person explicitly accepts the reviewed result.
The operator can then:
- inspect the filesystem diff;
- follow the ordered event timeline;
- deny reads using user-defined patterns such as
**/*.env,**/*.pem, or project-specific sensitive paths; - roll back the complete transaction in one action; or
- commit a reviewed result after a destination-drift check.
The demo uses a synthetic project and disposable storage. A deliberately bad agent command removes src/, attempts to read a synthetic .env, and creates an output file. The deletion appears only inside the staged view. A second terminal still sees the original source file. The .env read is denied by policy. The Control Plane shows the event stream, policy decision, filesystem diff, evidence status, and rollback action. A separate scenario demonstrates explicit commit and conflict refusal when the destination changes during review.
RewindBPF protects the filesystem boundary, not every possible external side effect. It can rewind files, directories, generated assets, binaries, media, and other content inside the protected workspace. It does not undo database writes, cloud API calls, network actions, devices, or arbitrary kernel state.
What we built
RewindBPF is a CLI, local supervisor, and Control Plane UI. It is not an MCP server or a required agent SDK plugin. The agent command remains the operator’s command; Rewind supplies the safety boundary around it.
The reference enforcement path is Linux-first and runs in a disposable Ubuntu VM with eBPF telemetry, OverlayFS/FUSE copy-on-write, Landlock read enforcement, cgroup-v2 process scope, and policy-backed network controls.
The repository also includes a native macOS transaction path using APFS clone-backed staging and Seatbelt read policy, plus a fail-closed Windows platform contract. These native paths are described separately and are not presented as Linux-equivalent enforcement.
Built with Codex and GPT-5.6
I built and iterated RewindBPF in Codex with GPT-5.6 as an implementation and review partner. Codex helped shape the product boundary, split the runtime into small testable modules, implement the protected-run lifecycle, debug the ARM64 Ubuntu VM path, build the Control Plane UI and public site, normalize benchmark results, and prepare the release and judge test paths.
GPT-5.6 was also used to review failure cases, policy behavior, crash recovery, descendant cleanup, conflict-checked commit, evidence integrity, and platform limitations. During development we used real Go tests, VM smoke tests, fio/perf measurements, event journals, and manual disposable-fixture tests. The collaboration also helped identify and fix a dashboard bug where a policy-hidden .env file was incorrectly displayed as a deletion.
The final implementation decisions, commands, manual tests, and scope claims remained human-owned. GPT-5.6 is not a runtime dependency: RewindBPF does not call a model to make safety decisions and can protect Codex, OpenHands, Claude, or any other command launched through the same boundary.
Try it
Project site:
Source code and judge instructions:
https://github.com/cmlonder/rewind-bpf/
The fastest reference path is the disposable Ubuntu VM demo:
cd /home/vagrant/RewindBPF
REWIND_DEMO_CONFIRM=VM_ONLY make jury-demo-vm
For non-privileged checks:
go test ./...
make hackathon-preflight
Use only a disposable workspace when testing destructive commands.