Rollback and removal
Rollback should stop new execution quickly while preserving enough evidence to understand what happened.
Immediate disablement
If the Tool behaves unsafely:
- stop new agent runs;
- disconnect the Tool from the agent or select a known-safe prior Tool version;
- keep sharing private;
- disable any retry automation;
- preserve execution history and economic records;
- revoke exposed credentials in their owning systems.
Do not delete evidence before reconciliation.
Roll back to a prior version
- Identify the last known-good Tool and agent versions.
- Compare manifest, inputs, API step, normalization, retry, and approval settings.
- Reconnect the agent to the known-good Tool version.
- run synthetic fixtures;
- confirm no production call or payment occurred;
- document the rollback time, reason, versions, and operator.
Remove the integration
For a complete private-workspace removal:
- disconnect the Tool from every agent;
- archive or disable the agent;
- archive or disable the Tool;
- revoke integration-specific secrets, if any;
- confirm scheduled or triggered runs no longer reference it;
- preserve required audit records according to policy;
- remove public links or claims that imply availability.
Deletion is the final step, not the first. Prefer reversible archive/disable controls until investigation and retention obligations are complete.
Repository rollback
Use a normal revert or corrective pull request. Do not rewrite shared branch history. Keep contract, fixtures, prompt, manifest, and documentation coherent. If a public docs page announces the faulty state, correct it in the same release or mark the integration unavailable.
Economic reconciliation
If an unintended live call occurred, record separately:
- quote creation;
- payment authorization;
- charge;
- settlement;
- refund or reversal;
- replay;
- duplicate-prevention result.
No response, source outage, or failure should be reported as a successful paid decision. Escalate unexplained economic mutations before re-enabling.
Recovery gate
Re-enable only after root cause is corrected, repository tests are green, all seven synthetic cases pass, approval and no-auto-payment are confirmed, and the new versions are recorded.