SafeCommit: your agent can act, now it can undo

5 min read Original article ↗

00Free launch test · no account

How many users can
your app survive?

Paste a URL. SafeCommit finds its breaking point by sending a growing crowd of visitors through it all at once, then hands you the one number that matters and a card worth posting. No account, no card, no access to your code.

00A brake for autonomous change

SafeCommit wraps every deployment and database migration an agent proposes in a protected run. Checkpoint first. Gates in isolation. Apply, then watch the monitors, and restore the checkpoint automatically the moment one of them breaks.

5

Steps in every protected run

11s

Exposure before automatic rollback

$6.20

A protected production deploy

What this actually does

Your agent broke the site.
It was fixed before you noticed.

No dashboards to learn, no pipeline to configure. Your agent asks first, ships second, and SafeCommit undoes it if the live site gets worse. Everything below is from a real run.

your agent

I want to ship this change to the live site.

safecommit

That's a production deploy. Slightly risky. $6.20 to protect it.

safecommit

Your site just got 36 times slower. Undoing it now.

safecommit

Old version is back. Site is fine. Here's exactly what happened.

Two API calls. That is the whole integration.

meanwhile, behind the scenes

  1. 1

    Saves what's working

    Remembers the exact version your site is running right now.

  2. 2

    Tries the new one first

    Did it build? Does it actually load a page? If not, it stops here.

  3. 3

    Ships it

    Your change goes live to real visitors.

  4. 4

    Keeps watching

    Loads your real site over and over, comparing it to before.

  5. 5

    Puts it back

    Something got worse, so the old version is restored. No pager, no panic.

undone automaticallyYour visitors saw the slow version for 11 seconds.

An agent asks SafeCommit to protect a change before shipping it and is quoted six dollars twenty. On approval, SafeCommit remembers the version currently running, confirms the new version builds and loads, ships it, then repeatedly loads the real site and compares it to before. The site slows from 0.08 seconds to 3.06 seconds, so SafeCommit restores the previous version automatically and confirms the site is back to 0.09 seconds. Visitors saw the slow version for eleven seconds.

Just want a price first? Ask without naming a deployment and nothing ships. You get the cost and a risk score, and your site is never touched. Useful for letting an agent think out loud.

Changing your database? Send the SQL and SafeCommit runs it in a way it can take back. If the change quietly deletes something it was never asked to delete, it is undone before it is ever made real.

01What changed when agents got write access

Review was the safety net. Agents move faster than review.

It ships

An agent with deploy access does not hesitate. The change is live before anyone has read the diff, and the first signal that it was wrong comes from a customer.

It migrates

A schema change is not covered by your deployment rollback. Once the column is dropped, the previous build has nothing left to read.

It cannot undo

Retrying is not reverting. Without a checkpoint taken before the change, there is nothing to go back to, only a second guess on top of the first.

02Five phases, one guarantee

Nothing applies until it can be taken back

01

Checkpoint

Before anything is touched: an exact record of your database's tables and row counts, or a pin to the build currently serving production.

02

Gate

Every test runs against an isolated copy. A new build is measured on its own URL before it takes real traffic, and a migration runs inside a transaction, so nothing outside it can see the change while we check it.

03

Apply

Only once the gates are green. If any of them fail, nothing reaches the target environment at all.

04

Watch

Error rate, latency and saturation are compared against the pre-change baseline for the length of the monitoring window.

05

Settle

Clean window: the change is held. A breach: the checkpoint is restored automatically, with the evidence written to the run.

Every run ends in one of three states

Committed

Gates passed, monitors stayed inside baseline. The change is held and the checkpoint is retained in case you want it later.

Rolled back

The change went out, a monitor breached, and SafeCommit restored the checkpoint without waiting to be asked. Evidence attached.

Failed

A gate caught it before apply. Nothing reached the target environment, and the checkpoint is retained so the change can be re-attempted against a known state.

03You set the ceiling, not the agent

A token that cannot exceed its brief

Every agent gets its own token with a per-run ceiling, a daily ceiling, an explicit list of approved repositories, and a production switch that is off by default. Spending draws down a prepaid credit balance, so an agent in a retry loop runs out of money long before it runs out of things to break.

Manage tokens

Sample runs from the demo ledger

  • Add idempotency keys to the payment capture endpoint

    Committedelevated45Vercel deployment$6.95

  • Retire the legacy shipping address text column constraint

    Rolled backhigh64Supabase migration$8.50

  • Rebuild the events table under the new partition scheme

    Failedcritical100Supabase migration$10.30

  • Rotate the session cookie name and shorten its TTL

    Rolled backhigh55Vercel deployment$7.45

04Quote, execute, poll, undo

Four endpoints your agent already knows how to call

Quote a change to learn its price and risk before committing to anything. Execute to authorize payment and run it. Poll for status. Roll back on demand if something the monitors could not see turns out to matter.

Full API reference

quote → execute

# 1. price the change and read the risk assessment
curl -X POST https://safecommit.dev/api/quote \
  -H "Authorization: Bearer $SAFECOMMIT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "kind": "supabase_migration",
    "repository": "northwind/checkout-api",
    "target": "production",
    "summary": "Retire the legacy shipping address constraint",
    "payload": "BEGIN; ALTER TABLE orders DROP CONSTRAINT …; COMMIT;"
  }'

# → { "run_id": "run_9c2f5e10",
#     "risk":  { "level": "high", "score": 64, "factors": [ … ] },
#     "quote": { "total_cents": 850 } }

# 2. authorize from the credit balance and run it
curl -X POST https://safecommit.dev/api/execute \
  -H "Authorization: Bearer $SAFECOMMIT_TOKEN" \
  -d '{ "run_id": "run_9c2f5e10", "max_price_cents": 1000 }'

# → { "status": "rolled_back",
#     "rollback": { "trigger": "monitor_breach",
#                   "restored_checkpoint_id": "ckpt_…" } }

Not our words

What people are saying about SafeCommit

“Love it, well done. This is great, and I love the UX.”
James

Give your agent an undo button.

Open the dashboard