undo-cli/1

A machine contract with an approval boundary.

Workflow

undo capabilities --json
undo schema --json
undo check change.undo --root /workspace --json
undo plan change.undo --root /workspace --json
undo run change.undo --root /workspace --yes --json

JSON never grants mutation authority. Noninteractive run and recover require --yes.

Read structured results

Every response includes api_version and ok. Errors include stable code and message, plus source position, path, transaction ID, or recovery guidance where relevant. Whole-program runs return ordered statuses including committed, rolled back, failed preflight, recovery required/failed, and skipped.

Plan correctly

A selected transaction plan is exact. In a multi-transaction program only the first plan is exact; later state-sensitive work is deferred until preceding commits. Never translate safe_to_start into approval—present effects and obtain policy/human authorization.

On failure

If rollback succeeded, inspect the result and revise intent. If recovery is required, stop mutation and invoke recover --yes --json. If recovery failed or the journal is corrupt, retain state and escalate; do not delete .undo.