Michael Rishi Forrester

Agentic Covenants

Agentic Restorations Matrix

How do I get back to a known-good state and not repeat this?

Filter

All 15 In-agent (empty)Client-side rebuild Server-side restore Identity Authorization Blast radius Approval gating Supply chain

Layers, by what they can actually enforce

In-agent (empty) — none
The agent is the patient, not the surgeon. Empty for recovery.
Client-side rebuild — low-blast-radius
Operator-machine actions. Minutes. Reversible.
Server-side restore — high-blast-radius
Target-system actions. Minutes to hours. The only way to recover from cluster-level compromise.

Showing 3 of 15.

Approval gating at In-agent (empty)
(no enforcement)
Approval gating at Client-side rebuild
Restore PreToolUse config from VCS, reapply tier definitions, re-enable Auto Mode, re-establish out-of-band channel.
Approval gating at Server-side restore
Re-enable branch protection (enforce_admins true), re-add CODEOWNERS, audit bypass events from incident, unfreeze deployments only after rest of recovery is verified.