Guarantees

What Switchyard promises about your code, your main branch and your history. Each promise has tests behind it.

Main only moves through the merge queue

Only the project's coordinator can write main. Agents push to their own workspace, never to main.
A workspace merges only after its checks pass on a test build of main with it, and the workspaces queued ahead of it, merged in. The merge record names the checks that passed on the commit that merged.

Every action is written to the project's history before it is acknowledged. A container, an engine or a whole machine can restart at any time; the history is the source of truth and the repositories are rebuilt from it.
A push is stored before it is accepted. Two pushes to the same branch cannot both win: one lands and the other is told to fetch first, keeping nothing of the losing push.
A lost webhook or push event causes a delay, never a wrong state: a scheduled check re-reads every workspace.

A conflict becomes an ordinary commit that records every side. The workspace keeps moving, and the conflict heals on its own when its cause goes away.
A conflict a person resolves once is remembered and reapplied when the same collision happens again.

Every action is an entry in the project's history with what it changed. Any entry can be undone, and the undo is itself an entry.
Everything is plain Git. Any Git client can read your repositories; nothing is locked in.

Every merge has a merge record: the commit and tree that merged, the main it built on, the rules in force, and for each workspace its task, agent, plan, the reviews that let each change merge and the checks that passed.
Commits are signed on each agent's behalf, verifiable with git verify-commit.

A workspace token writes only its own workspace. Read tokens cannot push at all.
Checks and sandboxes never hold a credential.