How it works

Prevention — the gate

Before an action runs, gmonk decides whether it could be undone — and can refuse it if not. This is prevention on physics, not a policy list someone has to keep correct.

The reversibility oracle

The oracle scores each action's recoverability into a band — automatic · assisted · manual · impossible — plus a 0–100 score, and computes a ceiling for the whole run. That score is what the gate acts on.

Gate modes

Set with GMONK_GATE:

Mode	Behavior
`advise`	Score and warn only — nothing is blocked. The default.
`block`	Refuse any action at or below the block floor.
`guarantee`	Prove-then-commit: capture + execute in one transaction, roll back unless the undo is provably reversible.
`off`	No gating.

bash

gmonk protect --backend-ref APP_DB_URL --guarantee

Guarantee mode gates on a proof of reversibility — a set of obligations (capture, invertible, retention, compensation, executor), each discharged or not — rather than the fuzzy band. When an undo can't be proven it holds for approval (default) or blocks, via GMONK_GATE_GUARANTEE_UNPROVABLE.

The guard policy engine

On top of the oracle, a declarative firewall matches tool/op/table/bucket/key/path/no-WHERE/min-rows and yields allow · warn · require_approval · block. Built-in blocks (DROP, TRUNCATE, no-WHERE UPDATE/DELETE) ship on by default; most-restrictive wins when composed with the gate.

GMONK_POLICY_FILE — a JSON file of extra rules, layered on the built-ins.
GMONK_GUARD_DEFAULTS=off — drop the built-in rules, keep only your policy file.

SQL is classified with a real Postgres parser (libpg_query) that sees through CTEs, multi-statement, and quoting — with a regex fallback. The gate is enforced at all three entry points: the SQL gateway, the object gateway, and the MCP proxy.

The shell gate

The agent hook also gates shell commands. The rule is principled, not a blocklist: gmonk can only recover file changes inside the working directory, so it pauses any command that reaches outside it (rm -rf /etc, writing to /…) or does a device-level op with no possible before-image (dd, mkfs, shred).

bash

GMONK_SHELL_GATE=ask     # default: pause unrecoverable commands for approval
GMONK_SHELL_GATE=deny    # hard-block them
GMONK_SHELL_GATE=off     # disable
GMONK_SHELL_ALLOW='^terraform ,^make deploy'   # always-run regexes

Honest scope: the shell gate is best-effort defense in depth — a string match can be evaded. It fails toward ask (a human decides) and open on error (never wedges the agent). For a hard guarantee, run the agent in an OS sandbox; gmonk is the seatbelt and the undo, the sandbox is the airbag.

Recoverability monitor

Recoverability can decay after capture — a later human edit can make an undo drift. The monitor diffs each run's live band against its baseline, classifies stable/degraded/lost, and alerts once per worsening transition. Note that operation-aware undos (e.g. col = col - n) don't degrade under concurrent writes — only state-based restores drift.

← Capture Recovery →