+ Persistent AI-agent learning, built to be reversed. +
+ ++ AI agents accumulate skills, memories, and procedures that outlive any single session. When one of + those artifacts turns out to be poisoned, stale, or simply wrong, deleting the source is not enough — + its influence can already be baked into descendants. SkillRewind makes that influence traceable, + testable, revocable, and — within a declared boundary — rebuildable and verifiable. +
+ + +Deleting the source is not enough
++ Self-evolving agents distill trajectories, memories, tool interactions, and documents into persistent + skills. Deleting a poisoned or obsolete source does not necessarily remove its effect: later skills may + preserve the behavior after paraphrasing instructions, rewriting code, changing tools, or passing + through multiple generations — and the influence edge back to the source is often never recorded. +
+ +Traditional deletion
+Remove the source artifact. Everything downstream that inherited its behavior — through paraphrase, refactor, or multi-hop transformation — keeps running unexamined.
+ +SkillRewind
+Recover plausible hidden influence, test selected relationships through counterfactual replay, quarantine confirmed or high-risk descendants, rebuild them from clean support, and verify safety and retained utility.
+ +A behavioral supply chain
++ Persistent artifacts are the units this behavioral supply chain is made of. Influence between them is + semantic (a paraphrase, not a copy), transformed + (refactored code, restructured procedures), multi-hop (skill → skill → + procedure), and often incompletely recorded — the platform that + produced a descendant did not always log what it read. +
+ +{name}
+{desc}
+The evidence model
++ SkillRewind never calls correlation causal. Every lineage edge carries one of five evidence classes, and + promotion between them preserves prior evidence rather than erasing it. +
+Inference is not provenance. Similarity is not causal proof.
+ +{desc}
+How it works
++ The full reversible-learning lifecycle SkillRewind's own end-to-end demo exercises. +
+ +-
+ {[
+ ['Capture', 'Ingest artifacts and record derivations — the recorded evidence class.'],
+ ['Recover', 'Score bounded candidate neighborhoods for plausible hidden-lineage edges (inferred).'],
+ ['Replay', 'Paired present/withheld counterfactual intervention within a declared replay boundary.'],
+ ['Revoke', 'forensic / balanced / strict state-machine transitions; balanced/strict apply a barrier first.'],
+ ['Rebuild', 'Clean-room rebuild from a support set that excludes revoked, replay-confirmed, and un-waived quarantined ancestors.'],
+ ['Verify', 'Safety, utility-retention, and integrity checks produce a machine-readable report.'],
+ ['Attest', 'A bounded, optionally Ed25519-signed attestation records what happened and what remains unresolved.'],
+ ].map(([step, desc], i) => (
+
-
+ {String(i + 1).padStart(2, '0')}+
{step}
+{desc}
+
+ ))}
+
Counterfactual replay
++ An inferred candidate edge becomes testable: SkillRewind reconstructs the derivation and re-runs it + under a controlled intervention on one candidate ancestor. +
+ +present
+The candidate ancestor is included, as originally derived.
+withheld
+The candidate ancestor is removed from the reconstructed input.
+clean-control
+A control run establishes baseline behavior for comparison.
++ Replay evidence is bounded by the runner, environment, probes, fidelity report, and configuration used + to produce it — never treated as universal proof. A runner failure always classifies as + unresolved, never rejected. + The only two replay runners shipped today are an in-process deterministic-fixture runner and a + sandboxed subprocess runner with resource limits but no network-namespace + isolation — see the Threat Model. +
+Block first. Repair second.
++ Under balanced or strict + policy, a revocation applies a barrier before candidate recovery even begins: revoked roots and their + recorded descendants stop serving immediately, independent of how long recovery and replay take. + forensic mode never mutates serving state. +
+ +A bounded, verifiable record
++ Every revocation ends in an attestation with a fixed, versioned schema (revocation-attestation.schema.json). + Its fields are generated from persisted event/edge/replay state — never hand-written — and its + bounded_claims are narrow by construction: no claim of + foundation-model unlearning, no claim of universal causal attribution. +
+ +{`{
+ "schema_version": "0.1",
+ "event_id": "revocation-2f9a...",
+ "mode": "balanced",
+ "revoked_roots": ["skill://poisoned-source@sha256:..."],
+ "recorded_closure": ["skill://skill-a@sha256:..."],
+ "inferred_candidates": [{ "source": "...", "target": "...", "confidence": 0.82 }],
+ "replay_confirmed": [{ "source": "...", "target": "skill://hidden-d@sha256:..." }],
+ "quarantined": ["skill://hidden-d@sha256:..."],
+ "rebuilt": [{ "old_artifact_id": "...", "new_artifact_id": "...", "verification_status": "passed" }],
+ "unresolved": [],
+ "verification": { "status": "passed", "suite_ids": ["safety", "utility"], "target_behavior_observed": false },
+ "bounded_claims": [
+ "This attestation makes no claim about foundation-model parameters or weights.",
+ "Inferred edges are explainable static scoring, not causal proof."
+ ],
+ "signature": { "algorithm": "ed25519", "key_id": "...", "value": "..." }
+}`}Self-hosted, platform-agnostic
++ SkillRewind runs as an independent HTTP service. Your agent platform reports artifacts and derivations, + asks a resolution question before serving, and — at full integration — hands off replay and rebuild. +
+ +-
+ {[
+ 'Open source (Apache-2.0).',
+ 'Self-hosted — you run the database, CAS root, and signing key.',
+ 'PostgreSQL integration is exercised in GitHub Actions CI, alongside SQLite for Lite mode.',
+ 'Model-agnostic — SkillRewind never inspects artifact content semantics.',
+ 'No mandatory telemetry beyond what you configure.',
+ ].map((item) => (
+
- {item} + ))} +
Beyond one implementation
++ SkillRewind is a specification with a reference implementation, not just a library. The specification + layer is an emerging draft — versioned separately from the reference implementation's release cadence. +
+ +{title}
+{desc}
+Integration levels
+{title}
+{desc}
+Research
++ To the best of our knowledge, based on the literature reviewed for this project, hidden-lineage + revocation for persistent agent artifacts — recovering influence that was never recorded, then testing + it through a controlled counterfactual intervention rather than similarity alone — has not been + addressed as a unified, implemented system elsewhere. This is a research proposal, not a claim of + priority or a published, peer-reviewed result. +
+ +RewindBench-core
++ A deterministic, reproducible benchmark generator/harness for hidden-lineage recovery, shipped in this + repository. make bench-smoke runs a real, offline 3-case + smoke preset — every number it produces is real output from the + harness, never fabricated, but sample sizes below 30 cases are explicitly reported as descriptive-only. +
+ +| Scenario family | +Status | +
|---|---|
| {name} | ++ {s} + | +
+ Baselines delete-root, recorded-closure, + static-multitrace, and exhaustive-replay + are all real and executable. No benchmark numbers are reproduced on this page — run make bench-smoke yourself. +
+Get started
++ SkillRewind is not yet published on PyPI — install it from source. The reference package has + already passed a clean, wheel-only install validation (import, CLI, packaged Alembic + migrations, and the full conformance self-test, run outside the repository with no + PYTHONPATH dependency) and is being prepared for its + first alpha release. +
+ +{`$ git clone ${githubUrl}.git && cd SkillRewind
+$ make bootstrap-service # uv venv + editable install with dev+service extras
+$ make demo # runs the full poisoned-descendant scenario end to end (Lite mode)`}+ make demo initializes an isolated workspace at + .skillrewind-demo/, ingests three Agent Skills directories, + recovers a hidden-lineage candidate that recorded closure misses, replay-confirms it, runs a + balanced revocation, quarantines the confirmed descendant, + rebuilds and verifies a clean successor, republishes it under the original alias, and writes a signed + attestation. Reset it with make demo-reset. +
+ +Minimal Service-mode API example
+{`$ skillrewind serve --database-url sqlite:///./service.db --port 8000 &
+$ curl -s -X POST localhost:8000/api/v1/artifacts \\
+ -H "Authorization: Bearer $API_KEY" \\
+ --data-binary @my-skill.md \\
+ -G --data-urlencode kind=agent-skill --data-urlencode logical_name=my-skill
+
+$ curl -s localhost:8000/api/v1/artifacts/$ARTIFACT_ID/resolve -H "Authorization: Bearer $API_KEY"`}CLI (Lite mode)
+{`$ skillrewind --workspace .skillrewind init
+$ skillrewind --workspace .skillrewind artifact-ingest-skill ./my-skill --alias my-skill
+$ skillrewind --workspace .skillrewind closure --root skill://my-skill@sha256:...
+$ skillrewind conformance describe
+$ skillrewind conformance self-test`}+ See docs/openapi-v1.json for the full schema and + docs/api-stability-v1.md for what's safe to build against. +
+Security & integrity
+-
+ {[
+ ['Content-addressed artifacts', 'Every object is content-addressed by SHA-256; retrieval verifies the digest and raises on corruption or tampering rather than returning it silently.'],
+ ['Hash-chained audit log', 'The audit log detects any row whose content or chain linkage has been altered after the fact.'],
+ ['Signed attestations', 'An optional Ed25519 signature covers the attestation\'s canonical-JSON digest; both digest and signature tampering are independently detected.'],
+ ['Scoped API keys', 'Callers hold scoped keys (ingest/read/replay/revoke/waive/admin); revoked keys are rejected fresh on every request.'],
+ ].map(([title, desc]) => (
+
-
+
{title}
+{desc}
+
+ ))}
+
What SkillRewind does not currently claim
++ Stated here prominently, not in footer text, because it matters as much as what the project does claim. +
+-
+ {[
+ 'Perfect unlearning or foundation-model weight/parameter erasure — SkillRewind revokes/rebuilds artifacts in its own store only.',
+ 'Universal causal attribution — inferred edges are explainable static scoring, not proof; only replay-confirmed edges have been tested via controlled intervention.',
+ 'Complete knowledge of hidden influence — recovery is bounded-neighborhood and best-effort, not exhaustive.',
+ 'Safety outside the declared verification boundary — every verification report states its own limitations and is never empty.',
+ 'Universal platform compatibility — integration requires a platform to implement the relevant Integration Contract responsibilities; there is no zero-config auto-discovery.',
+ 'A hardened, container-grade arbitrary-code replay sandbox — the sandboxed subprocess runner has no network-namespace isolation.',
+ ].map((item) => (
+
- + {item} + + ))} +
Roadmap
+Based on STATUS.md's immediate next milestones — no fixed dates, no partnerships.
+-
+ {[
+ 'Expand RewindBench-core to the remaining five scenario families and the remaining three provenance-loss operators.',
+ 'Build the offline calibration pipeline and re-derive the hidden-lineage scorer\'s default weights from it instead of hand-tuning.',
+ 'Wire remaining Service-mode job handlers (revocation/replay/rebuild/verification/attestation progression) for full checkpoint-resumable async execution.',
+ 'Web dashboard, Docker-based replay isolation, and packaged SDKs — not started.',
+ ].map((item, i) => (
+
-
+ {String(i + 1).padStart(2, '0')}
+
{item}
+
+ ))}
+