Safety and rollback

Tenant and site scope

Orbitr checks account, tenant, and site ownership before provider reads, task actions, publishing, and rollback. A valid provider response is not accepted as proof that the resource belongs to the active site.

Approval

Material customer mutations require approval unless an eligible autonomy policy explicitly permits the task. Approval does not disable provider, budget, quality, or verification controls.

Snapshots

Supported publishing adapters capture the prior state before a write. The snapshot is tied to the site, task, and provider operation.

Public verification

After publishing, Orbitr checks the customer-visible URL for the expected result. HTTP 200 by itself is not proof that the expected content or structure is present.

Retries

Retries use the existing task and operation identity. This reduces the risk of duplicate provider writes after a timeout or partial response.

Rollback limits

Rollback can restore only state captured by a supported Orbitr publishing operation. It cannot guarantee restoration of unrelated manual edits made after the snapshot.

Provider and platform boundaries

If the connected platform does not expose a safe mutation or restoration path, Orbitr blocks the operation instead of claiming rollback support.