About

The Tao of Runback.

Not a mission statement — the actual rules we build against. If a feature can't be justified by one of these, we don't ship it.

verify it without us shipped
a dashboard that looks busynot shipped
Reproduce, don't recount.

A log tells you what happened, not why — and it can't be re-run. Every mechanism we build starts from re-execution: hold the context fixed, run the model fresh, see if behavior actually changed. A description of a decision is not the decision.

Prove it, or it didn't happen.

"Trust us" is not evidence. Every run seals into a hash-chained record that verifies independently of Runback — you can check our math without asking our permission. If a claim can't be verified by someone who doesn't trust us yet, we don't get to make it.

Block before it ships, not after it breaks.

Catching a regression in a retro is catching it too late. A policy simulated against real production history, then enforced as a release gate, stops the bad deploy before a customer sees it — the same control, moved earlier.

Your agents, your perimeter.

We don't need your data to prove the product works — we need your agents to keep running inside your boundary. Self-hosting isn't a compliance checkbox we bolted on; it's the default we'd want if we were the customer.

Every failure is a future test.

An incident that doesn't turn into a regression test is a lesson that gets relearned. The failures your team already survived are the highest-signal test suite you have — we'd rather mine them than write synthetic ones from scratch.

Open where trust is cheap. Guarded where it's expensive.

Standard GenAI OpenTelemetry ingestion is open — there's nothing defensible about a span format. The replay and audit core is not, because that's the part that has to be right every single time, and giving it away wouldn't make it more correct, just less maintained.

How we actually work

Small, and not pretending otherwise.

We're a small team building a product we'd bet a production incident on. No account managers, no layers between you and the code — a few practical consequences of that:

The tests are public, not a claim

Every layer of the replay engine is proven in public CI ↗. We don't get to say "it works" without also showing you the run that proves it.

Security review, no hand-off

When you send a security questionnaire, the person answering it is the person who wrote the code you're asking about — not a sales engineer relaying answers from Slack.

No customer logos here — yet

We're early. Rather than dress that up with stock-photo testimonials, we'd rather you judge the product on the worked incident on /how-it-works and the code that runs it.

Small is a constraint, not a pitch

It means slower feature sprawl and a shorter roadmap than a funded team would ship. It also means every decision on this page was actually argued about by the people who build the product, not handed down from a deck.

Judge it on the work.

Walk a real incident, or read the spec the ledger is built on.