Persistent AI-agent learning, built to be reversed.

Deleting the source is not enough

Self-evolving agents distill trajectories, memories, tool interactions, and documents into persistent skills. Deleting a poisoned or obsolete source does not necessarily remove its effect: later skills may preserve the behavior after paraphrasing instructions, rewriting code, changing tools, or passing through multiple generations — and the influence edge back to the source is often never recorded.

A behavioral supply chain

Persistent artifacts are the units this behavioral supply chain is made of. Influence between them is semantic (a paraphrase, not a copy), transformed (refactored code, restructured procedures), multi-hop (skill → skill → procedure), and often incompletely recorded — the platform that produced a descendant did not always log what it read.

The evidence model

SkillRewind never calls correlation causal. Every lineage edge carries one of five evidence classes, and promotion between them preserves prior evidence rather than erasing it.

Inference is not provenance. Similarity is not causal proof.

How it works

The full reversible-learning lifecycle SkillRewind's own end-to-end demo exercises.

1. 01

   Capture

   Ingest artifacts and record derivations — the recorded evidence class.

2. 02

   Recover

   Score bounded candidate neighborhoods for plausible hidden-lineage edges (inferred).

3. 03

   Replay

   Paired present/withheld counterfactual intervention within a declared replay boundary.

4. 04

   Revoke

   forensic / balanced / strict state-machine transitions; balanced/strict apply a barrier first.

5. 05

   Rebuild

   Clean-room rebuild from a support set that excludes revoked, replay-confirmed, and un-waived quarantined ancestors.

6. 06

   Verify

   Safety, utility-retention, and integrity checks produce a machine-readable report.

7. 07

   Attest

   A bounded, optionally Ed25519-signed attestation records what happened and what remains unresolved.

Counterfactual replay

An inferred candidate edge becomes testable: SkillRewind reconstructs the derivation and re-runs it under a controlled intervention on one candidate ancestor.

Replay evidence is bounded by the runner, environment, probes, fidelity report, and configuration used to produce it — never treated as universal proof. A runner failure always classifies as unresolved, never rejected. The only two replay runners shipped today are an in-process deterministic-fixture runner and a sandboxed subprocess runner with resource limits but no network-namespace isolation — see the Threat Model.

Block first. Repair second.

Under balanced or strict policy, a revocation applies a barrier before candidate recovery even begins: revoked roots and their recorded descendants stop serving immediately, independent of how long recovery and replay take. forensic mode never mutates serving state.

A bounded, verifiable record

Every revocation ends in an attestation with a fixed, versioned schema (revocation-attestation.schema.json). Its fields are generated from persisted event/edge/replay state — never hand-written — and its bounded_claims are narrow by construction: no claim of foundation-model unlearning, no claim of universal causal attribution.

{
  "schema_version": "0.1",
  "event_id": "revocation-2f9a...",
  "mode": "balanced",
  "revoked_roots": ["skill://poisoned-source@sha256:..."],
  "recorded_closure": ["skill://skill-a@sha256:..."],
  "inferred_candidates": [{ "source": "...", "target": "...", "confidence": 0.82 }],
  "replay_confirmed": [{ "source": "...", "target": "skill://hidden-d@sha256:..." }],
  "quarantined": ["skill://hidden-d@sha256:..."],
  "rebuilt": [{ "old_artifact_id": "...", "new_artifact_id": "...", "verification_status": "passed" }],
  "unresolved": [],
  "verification": { "status": "passed", "suite_ids": ["safety", "utility"], "target_behavior_observed": false },
  "bounded_claims": [
    "This attestation makes no claim about foundation-model parameters or weights.",
    "Inferred edges are explainable static scoring, not causal proof."
  ],
  "signature": { "algorithm": "ed25519", "key_id": "...", "value": "..." }
}

Self-hosted, platform-agnostic

SkillRewind runs as an independent HTTP service. Your agent platform reports artifacts and derivations, asks a resolution question before serving, and — at full integration — hands off replay and rebuild.

• ✓Open source (Apache-2.0).
• ✓Self-hosted — you run the database, CAS root, and signing key.
• ✓PostgreSQL integration is exercised in GitHub Actions CI, alongside SQLite for Lite mode.
• ✓Model-agnostic — SkillRewind never inspects artifact content semantics.
• ✓No mandatory telemetry beyond what you configure.

Beyond one implementation

SkillRewind is a specification with a reference implementation, not just a library. The specification layer is an emerging draft — versioned separately from the reference implementation's release cadence.

Integration levels

Research

To the best of our knowledge, based on the literature reviewed for this project, hidden-lineage revocation for persistent agent artifacts — recovering influence that was never recorded, then testing it through a controlled counterfactual intervention rather than similarity alone — has not been addressed as a unified, implemented system elsewhere. This is a research proposal, not a claim of priority or a published, peer-reviewed result.

RewindBench-core

A deterministic, reproducible benchmark generator/harness for hidden-lineage recovery, shipped in this repository. make bench-smoke runs a real, offline 3-case smoke preset — every number it produces is real output from the harness, never fabricated, but sample sizes below 30 cases are explicitly reported as descriptive-only.

Baselines delete-root, recorded-closure, static-multitrace, and exhaustive-replay are all real and executable. No benchmark numbers are reproduced on this page — run make bench-smoke yourself.

Get started

SkillRewind is not yet published on PyPI — install it from source. The reference package has already passed a clean, wheel-only install validation (import, CLI, packaged Alembic migrations, and the full conformance self-test, run outside the repository with no PYTHONPATH dependency) and is being prepared for its first alpha release.

$ git clone https://github.com/alanqoudif/SkillRewind.git && cd SkillRewind
$ make bootstrap-service   # uv venv + editable install with dev+service extras
$ make demo                # runs the full poisoned-descendant scenario end to end (Lite mode)

make demo initializes an isolated workspace at .skillrewind-demo/, ingests three Agent Skills directories, recovers a hidden-lineage candidate that recorded closure misses, replay-confirms it, runs a balanced revocation, quarantines the confirmed descendant, rebuilds and verifies a clean successor, republishes it under the original alias, and writes a signed attestation. Reset it with make demo-reset.

Minimal Service-mode API example

$ skillrewind serve --database-url sqlite:///./service.db --port 8000 &
$ curl -s -X POST localhost:8000/api/v1/artifacts \
  -H "Authorization: Bearer $API_KEY" \
  --data-binary @my-skill.md \
  -G --data-urlencode kind=agent-skill --data-urlencode logical_name=my-skill

$ curl -s localhost:8000/api/v1/artifacts/$ARTIFACT_ID/resolve -H "Authorization: Bearer $API_KEY"

CLI (Lite mode)

$ skillrewind --workspace .skillrewind init
$ skillrewind --workspace .skillrewind artifact-ingest-skill ./my-skill --alias my-skill
$ skillrewind --workspace .skillrewind closure --root skill://my-skill@sha256:...
$ skillrewind conformance describe
$ skillrewind conformance self-test

See docs/openapi-v1.json for the full schema and docs/api-stability-v1.md for what's safe to build against.

Security & integrity

• Content-addressed artifacts

  Every object is content-addressed by SHA-256; retrieval verifies the digest and raises on corruption or tampering rather than returning it silently.

• Hash-chained audit log

  The audit log detects any row whose content or chain linkage has been altered after the fact.

• Signed attestations

  An optional Ed25519 signature covers the attestation's canonical-JSON digest; both digest and signature tampering are independently detected.

• Scoped API keys

  Callers hold scoped keys (ingest/read/replay/revoke/waive/admin); revoked keys are rejected fresh on every request.

Roadmap

Based on STATUS.md's immediate next milestones — no fixed dates, no partnerships.

1. 01

   Expand RewindBench-core to the remaining five scenario families and the remaining three provenance-loss operators.

2. 02

   Build the offline calibration pipeline and re-derive the hidden-lineage scorer's default weights from it instead of hand-tuning.

3. 03

   Wire remaining Service-mode job handlers (revocation/replay/rebuild/verification/attestation progression) for full checkpoint-resumable async execution.

4. 04

   Web dashboard, Docker-based replay isolation, and packaged SDKs — not started.