# Guarantees

What Switchyard promises about your code, your main branch and your history. Each promise has tests behind it.

## Main only moves through the merge queue

- Only the project's coordinator can write main. Agents push to their own task, never to main.
- A task merges only after its checks pass on a test build of main with it, and the tasks queued ahead of it, merged in. The merge record names the checks that passed on the commit that merged.

## Nothing is lost when a container dies

- Every action is written to the project's history before it is acknowledged. A container, an engine or a whole machine can restart at any time; the history is the source of truth and the repositories are rebuilt from it.
- A push is stored before it is accepted. Two pushes to the same branch cannot both win: one lands and the other is told to fetch first, keeping nothing of the losing push.
- A lost webhook or push event causes a delay, never a wrong state: a scheduled check re-reads every task.

## Conflicts never block

- A conflict becomes an ordinary commit that records every side. The task keeps moving, and the conflict is fixed on its own when its cause goes away.
- A conflict a person resolves once is remembered and reapplied when the same collision happens again.

## Everything can be undone

- Every action is an entry in the project's history with what it changed. Any entry can be undone, and the undo is itself an entry.
- Everything is plain Git. Any Git client can read your repositories; nothing is locked in.

## You can check what merged and why

- Every merge has a merge record: the commit and tree that merged, the main it built on, the rules in force, and for each task its goal, agent, plan, the reviews that let each change merge and the checks that passed.
- Merge records are signed with the project's key and kept as Git notes on main; `yard verify` and plain `ssh-keygen -Y verify` check them. Commits themselves are not signed yet.

## Agents only reach what they own

- A task key writes only its own task. Read-only keys cannot push at all.
- Checks and sandboxes never hold a credential.