SchemaRewind

Prove your database migration before production.

Comment

Inspiration

A database migration can succeed syntactically and still destroy information. SQL linters rarely see application-level business rules, test databases are often too clean, and a down migration cannot reconstruct data that was already rounded or discarded.

SchemaRewind turns migration confidence into executable evidence.

What it does

SchemaRewind is a local-first developer tool for PostgreSQL and Prisma. GPT-5.6 reads bounded migration, schema, application-code, and test slices to propose typed business invariants. A deterministic runner then starts disposable PostgreSQL, seeds adversarial data, executes the real migration, captures before/after/recovery snapshots, and proves or disproves each listed invariant.

It never says a migration is universally safe. A result reports exactly how many declared invariants passed in which recorded scenarios.

Canonical proof

The included fixture changes orders.total from NUMERIC(30,10) to DOUBLE PRECISION. PostgreSQL accepts the migration, but SchemaRewind proves:

  • 2 of 6 adversarial monetary values changed
  • converting back to NUMERIC does not restore the original values
  • severity: CRITICAL
  • recovery: RESTORE_REQUIRED
  • an allowlisted preserve-numeric safe plan passes when rerun

This produces the demo's core moment: before, after migration, and after recovery are shown side by side.

How GPT-5.6 and Codex are used

GPT-5.6 uses the Responses API with Structured Outputs and medium reasoning. It can only propose known invariant kinds, bounded fixture values, source citations, a recovery hypothesis, and an allowlisted repair intent. It has no shell tools, cannot emit executable SQL into the runner, uses store: false, and never decides PASS or FAIL.

The recorded live canonical run used provider-returned model ID gpt-5.6-sol and discovered exact_decimal_preserved. A ten-case live eval found the primary expected invariant in 10/10 cases; 8/10 returned only the expected kind. This is reported as primary-invariant discovery and exact-only rate—not “100% AI accuracy.”

Codex built the majority of the core functionality in one repository workflow: product scoping, deterministic fixture, Docker lifecycle, invariant DSL, OpenAI contract, CLI, local dashboard, evidence reports, safe-plan rerun, security controls, tests, and release/provenance tooling.

Architecture and safety

  • bounded local Git collector with secret/path filtering
  • Zod-validated Structured Outputs
  • five implemented invariant compilers
  • fixed SQL templates; model output never becomes shell or free-form SQL
  • PostgreSQL 16 containers with no outbound network, CPU/memory/time limits, and cleanup verification
  • immutable JSON and self-contained HTML evidence
  • local dashboard bound to 127.0.0.1
  • SQLite metadata only; no production database connection
  • source-tag-bound release provenance, SHA-256, fresh install verification, and packaged showcase test

Verification maturity

exact_decimal_preserved is end-to-end verified on real PostgreSQL. row_count_preserved, foreign_key_integrity, not_null_after_backfill, and old_new_schema_compatibility are implemented but experimental and are not claimed as generally end-to-end verified.

Verified platform: Linux x86_64. macOS and WSL2 are not yet verified.

Try it

The public repository includes setup instructions, sample data, committed live GPT-5.6 evidence, screenshots, and a prebuilt GitHub Release. Judges can verify the release checksum, install the tarball without rebuilding SchemaRewind, and run the deterministic showcase with Docker.

Built With

Share this project:

Updates