@@ -48,6 +48,10 @@ OPENAI_API_KEY=
 ANTHROPIC_API_KEY=
 GROQ_API_KEY=
 
+# Inference.net Catalyst tracing (optional — no-op if CATALYST_OTLP_TOKEN is unset)
+CATALYST_OTLP_TOKEN=
+CATALYST_OTLP_ENDPOINT=https://telemetry.inference.net
+
 # Resend (for sending emails)
 RESEND_API_KEY=
 RESEND_FROM_SYSTEM= # e.g., noreply@mail.trycomp.ai
 
@@ -62,6 +62,7 @@
         "@aws-sdk/s3-request-presigner": "3.1013.0",
         "@browserbasehq/sdk": "2.6.0",
         "@browserbasehq/stagehand": "^3.2.1",
+        "@inference/tracing": "^0.0.21",
         "@maced/api-client": "^0.9.2",
         "@mendable/firecrawl-js": "^4.9.3",
         "@nestjs/common": "^11.0.1",
 
@@ -40,6 +40,7 @@ import { buildTools } from './assistant-chat-tools';
 import type { AssistantChatMessage } from './assistant-chat.types';
 import { RolesService } from '../roles/roles.service';
 import { ASSISTANT_OPENAI_PROVIDER_OPTIONS } from './openai-options';
+import { getAITelemetry } from '../inference-tracing';
 import { resolveAssistantChatContext } from './assistant-chat-context';
 
 @ApiTags('Assistant Chat')
@@ -124,6 +125,7 @@ Important:
         tools,
         providerOptions: ASSISTANT_OPENAI_PROVIDER_OPTIONS,
         stopWhen: stepCountIs(5),
+        experimental_telemetry: getAITelemetry('grc-assistant'),
       });
 
       const webResponse = result.toUIMessageStreamResponse({
 
@@ -0,0 +1,28 @@
+import * as ai from 'ai';
+import { setup, type CatalystTracing } from '@inference/tracing';
+import { createAISdkTelemetrySettings } from '@inference/tracing/ai-sdk';
+
+let tracing: CatalystTracing | null = null;
+
+export async function initTracing(): Promise<void> {
+  if (!process.env.CATALYST_OTLP_TOKEN) return;
+
+  tracing = await setup({
+    serviceName: 'compai-api',
+    modules: { aiSdk: ai },
+  });
+
+  console.log(
+    `Catalyst tracing enabled → ${tracing.endpoint} as ${tracing.serviceName}`,
+  );
+}
+
+export async function shutdownTracing(): Promise<void> {
+  if (!tracing) return;
+  await tracing.shutdown();
+}
+
+export function getAITelemetry(functionId: string) {
+  if (!tracing) return undefined;
+  return createAISdkTelemetrySettings(tracing.tracer, { functionId });
+}
@@ -363,7 +363,27 @@ export class DynamicIntegrationsController {
       throw new HttpException('Check not found', HttpStatus.NOT_FOUND);
     }
 
-    await this.dynamicCheckRepo.update(checkId, body);
+    // `source`/`note` are versioning metadata, not check columns — pull them out
+    // so they're never forwarded to the check update.
+    const { source, note, ...updateData } = body;
+
+    // Snapshot the current (pre-change) logic so this edit can be rolled back.
+    // Best-effort: a versioning failure must NEVER block the actual update.
+    try {
+      await this.dynamicCheckRepo.recordVersion({
+        checkId,
+        definition: check.definition as Prisma.InputJsonValue,
+        variables: check.variables as Prisma.InputJsonValue,
+        source: typeof source === 'string' ? source : 'api',
+        note: typeof note === 'string' ? note : undefined,
+      });
+    } catch (err) {
+      this.logger.error(
+        `Failed to record version for check ${checkId} (update proceeding): ${err}`,
+      );
+    }
+
+    await this.dynamicCheckRepo.update(checkId, updateData);
     await this.loaderService.invalidateCache();
 
     return { success: true };
@@ -388,6 +408,70 @@ export class DynamicIntegrationsController {
     return { success: true };
   }
 
+  /**
+   * List a check's edit history (newest first). Includes the snapshotted
+   * definition/variables so a caller can preview or diff a prior version.
+   */
+  @Get(':id/checks/:checkId/versions')
+  async listCheckVersions(
+    @Param('id') id: string,
+    @Param('checkId') checkId: string,
+  ) {
+    const check = await this.dynamicCheckRepo.findById(checkId);
+    if (!check || check.integrationId !== id) {
+      throw new HttpException('Check not found', HttpStatus.NOT_FOUND);
+    }
+
+    const versions = await this.dynamicCheckRepo.listVersions(checkId);
+    return { versions };
+  }
+
+  /**
+   * Roll a check back to a previous version. Snapshots the current logic first
+   * (so the rollback is itself reversible), then restores the chosen version's
+   * definition + variables onto the live check.
+   */
+  @Post(':id/checks/:checkId/restore/:versionId')
+  async restoreCheckVersion(
+    @Param('id') id: string,
+    @Param('checkId') checkId: string,
+    @Param('versionId') versionId: string,
+  ) {
+    const check = await this.dynamicCheckRepo.findById(checkId);
+    if (!check || check.integrationId !== id) {
+      throw new HttpException('Check not found', HttpStatus.NOT_FOUND);
+    }
+
+    const version = await this.dynamicCheckRepo.findVersionById(versionId);
+    if (!version || version.checkId !== checkId) {
+      throw new HttpException('Version not found', HttpStatus.NOT_FOUND);
+    }
+
+    // Snapshot the current state first so a restore can itself be undone.
+    // Best-effort: never block the restore on a versioning failure.
+    try {
+      await this.dynamicCheckRepo.recordVersion({
+        checkId,
+        definition: check.definition as Prisma.InputJsonValue,
+        variables: check.variables as Prisma.InputJsonValue,
+        source: 'restore',
+        note: `Restored to version ${versionId}`,
+      });
+    } catch (err) {
+      this.logger.error(
+        `Failed to snapshot before restore for check ${checkId} (restore proceeding): ${err}`,
+      );
+    }
+
+    await this.dynamicCheckRepo.update(checkId, {
+      definition: version.definition as Prisma.InputJsonValue,
+      variables: version.variables as Prisma.InputJsonValue,
+    });
+    await this.loaderService.invalidateCache();
+
+    return { success: true, restoredFrom: versionId };
+  }
+
   // ==================== Activation ====================
 
   /**
 
@@ -0,0 +1,164 @@
+import { Test, TestingModule } from '@nestjs/testing';
+import { HttpException } from '@nestjs/common';
+import { DynamicIntegrationsController } from './dynamic-integrations.controller';
+import { InternalTokenGuard } from '../../auth/internal-token.guard';
+import { DynamicIntegrationRepository } from '../repositories/dynamic-integration.repository';
+import { DynamicCheckRepository } from '../repositories/dynamic-check.repository';
+import { ProviderRepository } from '../repositories/provider.repository';
+import { CheckRunRepository } from '../repositories/check-run.repository';
+import { DynamicManifestLoaderService } from '../services/dynamic-manifest-loader.service';
+
+jest.mock('@db', () => ({ db: {} }));
+jest.mock('@trycompai/integration-platform', () => ({
+  validateIntegrationDefinition: jest.fn(),
+  SyncDefinitionSchema: { parse: jest.fn() },
+}));
+
+describe('DynamicIntegrationsController — check versioning', () => {
+  let controller: DynamicIntegrationsController;
+
+  const INTEGRATION_ID = 'din_abc';
+  const CHECK_ID = 'dck_abc';
+
+  const oldCheck = {
+    id: CHECK_ID,
+    integrationId: INTEGRATION_ID,
+    definition: { steps: [{ type: 'code', code: 'OLD' }] },
+    variables: [{ key: 'region' }],
+  };
+
+  const dynamicCheckRepo = {
+    findById: jest.fn(),
+    update: jest.fn(),
+    recordVersion: jest.fn(),
+    listVersions: jest.fn(),
+    findVersionById: jest.fn(),
+  };
+  const loaderService = { invalidateCache: jest.fn() };
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+    dynamicCheckRepo.findById.mockResolvedValue(oldCheck);
+    dynamicCheckRepo.update.mockResolvedValue(oldCheck);
+    dynamicCheckRepo.recordVersion.mockResolvedValue({ id: 'dckv_1' });
+    loaderService.invalidateCache.mockResolvedValue(undefined);
+
+    const module: TestingModule = await Test.createTestingModule({
+      controllers: [DynamicIntegrationsController],
+      providers: [
+        { provide: DynamicIntegrationRepository, useValue: {} },
+        { provide: DynamicCheckRepository, useValue: dynamicCheckRepo },
+        { provide: ProviderRepository, useValue: {} },
+        { provide: CheckRunRepository, useValue: {} },
+        { provide: DynamicManifestLoaderService, useValue: loaderService },
+      ],
+    })
+      .overrideGuard(InternalTokenGuard)
+      .useValue({ canActivate: () => true })
+      .compile();
+
+    controller = module.get(DynamicIntegrationsController);
+  });
+
+  describe('updateCheck', () => {
+    it('snapshots the OLD logic before applying the update', async () => {
+      await controller.updateCheck(INTEGRATION_ID, CHECK_ID, {
+        definition: { steps: [{ type: 'code', code: 'NEW' }] },
+        source: 'agent',
+        note: 'fix project-scoped keys',
+      });
+
+      // version captured the pre-change definition/variables
+      expect(dynamicCheckRepo.recordVersion).toHaveBeenCalledWith({
+        checkId: CHECK_ID,
+        definition: oldCheck.definition,
+        variables: oldCheck.variables,
+        source: 'agent',
+        note: 'fix project-scoped keys',
+      });
+      // version recorded BEFORE the update
+      const verOrder =
+        dynamicCheckRepo.recordVersion.mock.invocationCallOrder[0];
+      const updOrder = dynamicCheckRepo.update.mock.invocationCallOrder[0];
+      expect(verOrder).toBeLessThan(updOrder);
+    });
+
+    it('strips source/note from the data forwarded to the check update', async () => {
+      await controller.updateCheck(INTEGRATION_ID, CHECK_ID, {
+        definition: { steps: [] },
+        source: 'agent',
+        note: 'x',
+      });
+      expect(dynamicCheckRepo.update).toHaveBeenCalledWith(CHECK_ID, {
+        definition: { steps: [] },
+      });
+    });
+
+    it('still applies the update if versioning fails (best-effort)', async () => {
+      dynamicCheckRepo.recordVersion.mockRejectedValueOnce(new Error('boom'));
+      const res = await controller.updateCheck(INTEGRATION_ID, CHECK_ID, {
+        definition: { steps: [] },
+      });
+      expect(res).toEqual({ success: true });
+      expect(dynamicCheckRepo.update).toHaveBeenCalled();
+    });
+
+    it('404s when the check does not belong to the integration', async () => {
+      dynamicCheckRepo.findById.mockResolvedValueOnce({
+        ...oldCheck,
+        integrationId: 'din_other',
+      });
+      await expect(
+        controller.updateCheck(INTEGRATION_ID, CHECK_ID, {}),
+      ).rejects.toBeInstanceOf(HttpException);
+      expect(dynamicCheckRepo.update).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('restoreCheckVersion', () => {
+    const version = {
+      id: 'dckv_1',
+      checkId: CHECK_ID,
+      definition: { steps: [{ type: 'code', code: 'RESTORED' }] },
+      variables: [],
+    };
+
+    it('snapshots current state, then restores the version logic', async () => {
+      dynamicCheckRepo.findVersionById.mockResolvedValue(version);
+
+      const res = await controller.restoreCheckVersion(
+        INTEGRATION_ID,
+        CHECK_ID,
+        'dckv_1',
+      );
+
+      expect(dynamicCheckRepo.recordVersion).toHaveBeenCalledWith(
+        expect.objectContaining({ checkId: CHECK_ID, source: 'restore' }),
+      );
+      expect(dynamicCheckRepo.update).toHaveBeenCalledWith(CHECK_ID, {
+        definition: version.definition,
+        variables: version.variables,
+      });
+      expect(res).toEqual({ success: true, restoredFrom: 'dckv_1' });
+    });
+
+    it('404s when the version belongs to a different check', async () => {
+      dynamicCheckRepo.findVersionById.mockResolvedValue({
+        ...version,
+        checkId: 'dck_other',
+      });
+      await expect(
+        controller.restoreCheckVersion(INTEGRATION_ID, CHECK_ID, 'dckv_1'),
+      ).rejects.toBeInstanceOf(HttpException);
+      expect(dynamicCheckRepo.update).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('listCheckVersions', () => {
+    it('returns the version history for the check', async () => {
+      dynamicCheckRepo.listVersions.mockResolvedValue([{ id: 'dckv_1' }]);
+      const res = await controller.listCheckVersions(INTEGRATION_ID, CHECK_ID);
+      expect(res).toEqual({ versions: [{ id: 'dckv_1' }] });
+    });
+  });
+});
@@ -37,6 +37,18 @@ class TestCandidateBody {
   checkId?: string;
 }
 
+class RerunCheckBody {
+  /** The check to re-run and persist. */
+  @IsString()
+  @IsNotEmpty()
+  checkId!: string;
+
+  /** The task this run belongs to (so task-scoped history stays correct). */
+  @IsOptional()
+  @IsString()
+  taskId?: string;
+}
+
 /**
  * Internal-token-gated diagnostic toolkit for dynamic integrations. Lets an
  * operator/agent do the full debug loop over HTTP — inspect any connection,
@@ -126,6 +138,25 @@ export class InternalIntegrationDebugController {
     });
   }
 
+  /**
+   * Re-run a single check for one connection AND PERSIST a fresh run. Called by
+   * the self-heal agent right after it applies a fix, for every connection that
+   * was held — a now-fixed check produces a fresh 'success' the customer sees,
+   * while one still failing our-side is re-held as 'inconclusive'. Unlike /run +
+   * /test (verification-only), this writes a real IntegrationCheckRun.
+   */
+  @Post('connections/:connectionId/rerun')
+  async rerunConnectionCheck(
+    @Param('connectionId') connectionId: string,
+    @Body() body: RerunCheckBody,
+  ) {
+    return this.debugService.rerunAndPersistCheck({
+      connectionId,
+      checkId: body.checkId,
+      taskId: body.taskId,
+    });
+  }
+
   /**
    * Read recently captured OAuth callback errors (recorded by the frontend on a
    * failed connect). Use this to diagnose "the integration won't connect" for
@@ -143,4 +174,22 @@ export class InternalIntegrationDebugController {
       limit: parseOptionalInt(limit),
     });
   }
+
+  /**
+   * The self-heal agent's work queue: check runs HELD as inconclusive (our-side /
+   * transient failures, never shown to the customer as red). The agent polls
+   * this, then diagnoses + fixes each. Filter by provider / org.
+   */
+  @Get('inconclusive-runs')
+  async listInconclusiveRuns(
+    @Query('providerSlug') providerSlug?: string,
+    @Query('organizationId') organizationId?: string,
+    @Query('limit') limit?: string,
+  ) {
+    return this.debugService.listInconclusiveRuns({
+      providerSlug,
+      organizationId,
+      limit: parseOptionalInt(limit),
+    });
+  }
 }