diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
index 1c35b1a5f99..a44b83730b8 100644
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -7,6 +7,18 @@
 <!-- If this is an API or ABI breaking change, please apply the
 corresponding GitHub label. -->
 
+# Rollback safety impact
+
+<!--
+If this PR is safe to roll back after deployment and has no impact on the rollback safety of any prior PRs, write `n/a` below.
+
+Otherwise, list every prerequisite PR that must be included in a release before this PR can merge. This PR must not be deployed until each prerequisite has been deployed and sufficiently observed or tested in the live deployment that we are confident it will not be rolled back. Supported forms include #123, SpacetimeDB#123, clockworklabs/SpacetimeDB#123, and GitHub PR URLs.
+
+Consider whether this PR:
+- newly writes to a previously introduced but unused ControlDB table or reducer, system table, or on-disk data format; or
+- clears, deletes, incompatibly changes, or renders unsupported a previously available ControlDB table or reducer, system table, or on-disk data format.
+-->
+
 # Expected complexity level and risk
 
 <!--
diff --git a/.github/workflows/check-pr-base.yml b/.github/workflows/check-pr-base.yml
index 6c3f020dbe9..fc7e7afea49 100644
--- a/.github/workflows/check-pr-base.yml
+++ b/.github/workflows/check-pr-base.yml
@@ -2,10 +2,15 @@ name: Git tree checks
 
 on:
   pull_request:
-    types: [opened, edited]
+    types: [opened, reopened, edited]
+  # TODO: This isn't used, probably remove it?
   merge_group:
 permissions: read-all
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.inputs.pr_number || format('sha-{0}', github.sha) }}
+  cancel-in-progress: true
+
 jobs:
   check_base_ref:
     name: Based on `master`
@@ -18,3 +23,27 @@ jobs:
         run: |
           echo "This PR is not based on master. Please wait until the base PR merges."
           exit 1
+
+  release_dependencies:
+    if: ${{ github.event_name == 'pull_request' }}
+    name: Check release dependencies
+    runs-on: spacetimedb-new-runner-2
+    permissions:
+      contents: read
+      pull-requests: read
+    env:
+      GH_TOKEN: ${{ github.token }}
+      CARGO_TARGET_DIR: ${{ github.workspace }}/target
+      RUST_LOG: rollback_coordination=info
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # We inspect local tags and git commits in order to determine whether things have been released
+          fetch-depth: 0
+      - uses: dsherret/rust-toolchain-file@v1
+      - name: Check release dependencies
+        run: >-
+          cargo ci other-workflows check-release-deps
+          --current-repo .
+          --allowed-reference-repo .
+          --pr-number "${{ github.event.pull_request.number }}"
diff --git a/Cargo.lock b/Cargo.lock
index b8e349829b8..a1232b2b792 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -902,6 +902,16 @@ dependencies = [
  "duct",
 ]
 
+[[package]]
+name = "ci-check-release-deps"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "clap 4.5.50",
+ "rollback-coordination",
+ "tracing-subscriber",
+]
+
 [[package]]
 name = "ci-cla-assistant"
 version = "0.1.0"
@@ -6701,6 +6711,20 @@ dependencies = [
  "syn 2.0.107",
 ]
 
+[[package]]
+name = "rollback-coordination"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "duct",
+ "regex",
+ "semver",
+ "serde",
+ "serde_json",
+ "tempfile",
+ "tracing",
+]
+
 [[package]]
 name = "rolldown"
 version = "0.1.0"
diff --git a/Cargo.toml b/Cargo.toml
index 4c68e6146f0..f25a7c892ea 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -84,6 +84,7 @@ members = [
   "tools/ci/commands/cla-assistant",
   "tools/ci/commands/coordinate-internal-tests",
   "tools/ci/commands/workflow-watch",
+  "tools/ci/commands/check-release-deps",
   "tools/ci/common",
   "tools/keynote-bench-harness",
   "tools/license-check",
@@ -91,6 +92,7 @@ members = [
   "tools/generate-client-api",
   "tools/gen-bindings",
   "tools/release",
+  "tools/rollback-coordination",
   "tools/regen",
   "tools/xtask-llm-benchmark",
   "crates/bindings-typescript/test-app/server",
diff --git a/tools/ci/commands/check-release-deps/Cargo.toml b/tools/ci/commands/check-release-deps/Cargo.toml
new file mode 100644
index 00000000000..d0da2f2e655
--- /dev/null
+++ b/tools/ci/commands/check-release-deps/Cargo.toml
@@ -0,0 +1,13 @@
+[package]
+name = "ci-check-release-deps"
+version = "0.1.0"
+edition.workspace = true
+
+[dependencies]
+anyhow.workspace = true
+clap.workspace = true
+rollback-coordination = { path = "../../../rollback-coordination" }
+tracing-subscriber = { workspace = true, features = ["env-filter"] }
+
+[lints]
+workspace = true
diff --git a/tools/ci/commands/check-release-deps/src/main.rs b/tools/ci/commands/check-release-deps/src/main.rs
new file mode 100644
index 00000000000..911057f0bd3
--- /dev/null
+++ b/tools/ci/commands/check-release-deps/src/main.rs
@@ -0,0 +1,49 @@
+#![allow(clippy::disallowed_macros)]
+
+use anyhow::{Context, Result};
+use clap::Parser;
+use rollback_coordination::{earliest_rollback_point, Gh};
+use std::fs;
+use std::path::PathBuf;
+
+#[derive(Parser)]
+#[command(
+    about = "Checks the `Rollback safety impact` section and verifies that every referenced PR has been released."
+)]
+struct Args {
+    #[arg(long)]
+    current_repo: PathBuf,
+    /// Paths to local clones of the repos that are allowed to be considered as release dependencies in the rollback safety PR section
+    #[arg(long = "allowed-reference-repo", required = true)]
+    allowed_reference_repos: Vec<PathBuf>,
+    #[arg(long)]
+    pr_number: u64,
+}
+
+fn main() -> Result<()> {
+    tracing_subscriber::fmt()
+        .with_env_filter(tracing_subscriber::EnvFilter::from_default_env())
+        .with_writer(std::io::stderr)
+        .init();
+    let args = Args::parse();
+    let template = fs::read_to_string(args.current_repo.join(".github/pull_request_template.md"))
+        .context("failed to read .github/pull_request_template.md")?;
+    let allowed_reference_repos = args
+        .allowed_reference_repos
+        .iter()
+        .map(PathBuf::as_path)
+        .collect::<Vec<_>>();
+    let point = earliest_rollback_point(
+        &Gh,
+        &args.current_repo,
+        &allowed_reference_repos,
+        Some(&template),
+        false,
+        &[args.pr_number],
+    )?;
+    match point {
+        Some(release) => println!("All mentioned PRs have been released. Earliest rollback point: {release}"),
+        None => println!("No PR mentions found, so trivially succeeding."),
+    }
+    Ok(())
+}
diff --git a/tools/ci/src/main.rs b/tools/ci/src/main.rs
index 0b113fe7996..00180577269 100644
--- a/tools/ci/src/main.rs
+++ b/tools/ci/src/main.rs
@@ -76,6 +76,10 @@ const COMMANDS: &[Command] = &[
         path: &["other-workflows", "watch"],
         package: "ci-workflow-watch",
     },
+    Command {
+        path: &["other-workflows", "check-release-deps"],
+        package: "ci-check-release-deps",
+    },
 ];
 
 fn print_help() {
diff --git a/tools/rollback-coordination/Cargo.toml b/tools/rollback-coordination/Cargo.toml
new file mode 100644
index 00000000000..dfb533bc3ef
--- /dev/null
+++ b/tools/rollback-coordination/Cargo.toml
@@ -0,0 +1,19 @@
+[package]
+name = "rollback-coordination"
+version = "0.1.0"
+edition.workspace = true
+
+[dependencies]
+anyhow.workspace = true
+duct.workspace = true
+regex.workspace = true
+semver.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+tracing.workspace = true
+
+[dev-dependencies]
+tempfile.workspace = true
+
+[lints]
+workspace = true
diff --git a/tools/rollback-coordination/src/gh.rs b/tools/rollback-coordination/src/gh.rs
new file mode 100644
index 00000000000..3bcd6bc7bb7
--- /dev/null
+++ b/tools/rollback-coordination/src/gh.rs
@@ -0,0 +1,47 @@
+//! Thin wrappers around GitHub API requests. Business logic belongs in the
+//! calling coordination modules, not here.
+
+use anyhow::{Context, Result};
+use duct::cmd;
+use serde::de::DeserializeOwned;
+use serde::Deserialize;
+use std::path::Path;
+
+#[derive(Deserialize)]
+pub struct PullRequest {
+    pub body: Option<String>,
+}
+
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct RepositoryInfo {
+    pub name_with_owner: String,
+}
+
+pub trait Github {
+    fn get<T: DeserializeOwned>(&self, endpoint: &str) -> Result<T>;
+    fn repository_info(&self, path: &Path) -> Result<RepositoryInfo>;
+
+    fn pull_request(&self, repo: &str, number: u64) -> Result<PullRequest> {
+        self.get(&format!("repos/{repo}/pulls/{number}"))
+    }
+}
+
+pub struct Gh;
+
+impl Github for Gh {
+    fn get<T: DeserializeOwned>(&self, endpoint: &str) -> Result<T> {
+        let output = cmd!("gh", "api", endpoint)
+            .read()
+            .with_context(|| format!("failed to run `gh api {endpoint}`"))?;
+        serde_json::from_str(&output).with_context(|| format!("invalid response from {endpoint}"))
+    }
+
+    fn repository_info(&self, path: &Path) -> Result<RepositoryInfo> {
+        let output = cmd!("gh", "repo", "view", "--json", "nameWithOwner")
+            .dir(path)
+            .read()
+            .with_context(|| format!("failed to run `gh repo view` in {}", path.display()))?;
+        serde_json::from_str(&output).context("invalid response from `gh repo view`")
+    }
+}
diff --git a/tools/rollback-coordination/src/lib.rs b/tools/rollback-coordination/src/lib.rs
new file mode 100644
index 00000000000..8b941b8732a
--- /dev/null
+++ b/tools/rollback-coordination/src/lib.rs
@@ -0,0 +1,351 @@
+use anyhow::{anyhow, Context, Result};
+use duct::cmd;
+use std::collections::{BTreeMap, BTreeSet};
+use std::path::{Path, PathBuf};
+
+pub mod gh;
+mod pr_parsing;
+mod release;
+
+pub use gh::{Gh, Github};
+pub use release::Release;
+
+#[derive(Clone, Debug)]
+struct Repository {
+    path: PathBuf,
+    releases: Vec<Release>,
+}
+
+/// Loads compatible release tags from `path`, newest first.
+pub fn load_releases(repo_path: &Path, ignore_incompatible_tags: bool) -> Result<Vec<Release>> {
+    let output = cmd!("git", "tag", "--list")
+        .dir(repo_path)
+        .read()
+        .with_context(|| format!("failed to list tags in {}", repo_path.display()))?;
+    let mut releases = BTreeSet::new();
+    for tag in output.lines().filter(|tag| !tag.is_empty()) {
+        match Release::from_tag(tag) {
+            Ok(Some(release)) => {
+                releases.insert(release);
+            }
+            Ok(None) => {}
+            Err(error) if ignore_incompatible_tags => {
+                tracing::warn!(tag, "Ignoring incompatible release tag: {error:#}");
+            }
+            Err(error) => return Err(error).with_context(|| format!("incompatible release tag `{tag}`")),
+        }
+    }
+    Ok(releases.into_iter().rev().collect())
+}
+
+// Loads repos found a specific paths, and returns a mapping from repo name to repo
+fn load_repos(
+    github: &impl Github,
+    paths: &[&Path],
+    ignore_incompatible_tags: bool,
+) -> Result<BTreeMap<String, Repository>> {
+    let mut repositories = BTreeMap::new();
+    for &path in paths {
+        let path = path
+            .canonicalize()
+            .with_context(|| format!("failed to canonicalize repository path {}", path.display()))?;
+        let name = github
+            .repository_info(&path)
+            .with_context(|| format!("failed to identify repository at {}", path.display()))?
+            .name_with_owner;
+        let releases = load_releases(&path, ignore_incompatible_tags)?;
+        repositories.insert(name, Repository { path, releases });
+    }
+    Ok(repositories)
+}
+
+fn release_for_pr(repository: &Repository, repo: &str, pr_number: u64) -> Result<Option<Release>> {
+    tracing::info!("Looking up {repo}#{pr_number}");
+    for pair in repository.releases.windows(2) {
+        let [release, base] = pair else { unreachable!() };
+        tracing::info!("Checking commits {base}..{release} for release {release}");
+        if pull_requests_in_range(&repository.path, &base.to_string(), &release.to_string())?.contains(&pr_number) {
+            tracing::info!("Matched {release}");
+            return Ok(Some(release.clone()));
+        }
+    }
+    tracing::info!("No release tag contains {repo}#{pr_number}");
+    Ok(None)
+}
+
+/// Returns the unique PR numbers associated with commits in `base..head`.
+///
+/// PR numbers are read from the conventional `(#123)` commit-subject suffix.
+/// N.B. That this is just based on commit subject line, so it could be spoofed in principle.
+/// Each PR is logged as it is found, and commits without that suffix produce a warning.
+pub fn pull_requests_in_range(repo_path: &Path, base: &str, head: &str) -> Result<Vec<u64>> {
+    let subjects = cmd!("git", "log", "--format=%s", format!("{base}..{head}"))
+        .dir(repo_path)
+        .read()
+        .with_context(|| format!("failed to inspect commits {base}..{head} in {}", repo_path.display()))?;
+    let mut pull_requests = BTreeSet::new();
+    for subject in subjects.lines() {
+        let number = subject
+            .strip_suffix(')')
+            .and_then(|subject| subject.rsplit_once("(#"))
+            .and_then(|(_, number)| number.parse().ok());
+        if let Some(number) = number {
+            if pull_requests.insert(number) {
+                tracing::info!("Found PR #{number}");
+            }
+        } else {
+            tracing::warn!("Commit is not associated with a pull request: {subject}");
+        }
+    }
+    Ok(pull_requests.into_iter().collect())
+}
+
+/// Computes the earliest release to which all requested pull requests can safely be rolled back.
+pub fn earliest_rollback_point(
+    github: &impl Github,
+    current_repo: &Path,
+    allowed_reference_repos: &[&Path],
+    strict_template: Option<&str>,
+    ignore_incompatible_tags: bool,
+    pr_numbers: &[u64],
+) -> Result<Option<Release>> {
+    let repositories = load_repos(github, allowed_reference_repos, ignore_incompatible_tags)?;
+    let current_repo_path = current_repo
+        .canonicalize()
+        .with_context(|| format!("failed to canonicalize repository path {}", current_repo.display()))?;
+    let current_repo = github
+        .repository_info(&current_repo_path)
+        .with_context(|| format!("failed to identify repository at {}", current_repo_path.display()))?
+        .name_with_owner;
+
+    let results = pr_numbers
+        .iter()
+        .map(|&number| {
+            earliest_rollback_point_for_pr(github, &repositories, &current_repo, strict_template, number)
+                .with_context(|| format!("failed to determine rollback point for {current_repo}#{number}"))
+        })
+        .collect::<Vec<_>>();
+    Ok(results.collect_all()?.into_iter().flatten().max())
+}
+
+fn earliest_rollback_point_for_pr(
+    github: &impl Github,
+    repositories: &BTreeMap<String, Repository>,
+    current_repo: &str,
+    strict_template: Option<&str>,
+    number: u64,
+) -> Result<Option<Release>> {
+    let pr = github
+        .pull_request(current_repo, number)
+        .with_context(|| "failed to load PR")?;
+    let body = pr.body.as_deref().unwrap_or_default();
+    let Some(dependencies) = pr_parsing::rollback_dependencies(body, current_repo, strict_template)? else {
+        tracing::info!("PR {current_repo}#{number} has no dependencies");
+        return Ok(None);
+    };
+
+    let results = dependencies
+        .into_iter()
+        .map(|dependency| {
+            let repository = repositories.get(&dependency.repo).with_context(|| {
+                format!(
+                    "{}#{} is not in an allowed repository",
+                    dependency.repo, dependency.number
+                )
+            })?;
+            let release = release_for_pr(repository, &dependency.repo, dependency.number)
+                .with_context(|| format!("release lookup failed for {}#{}", dependency.repo, dependency.number))?
+                .with_context(|| format!("{}#{} has not been released", dependency.repo, dependency.number))?;
+            tracing::info!("{}#{} was released in {}", dependency.repo, dependency.number, release);
+            Ok(Some(release))
+        })
+        .collect::<Vec<Result<Option<Release>>>>();
+    Ok(results.collect_all()?.into_iter().flatten().max())
+}
+
+/// Collects every successful value, or combines every error into one error.
+pub trait CollectAll<T> {
+    fn collect_all(self) -> Result<Vec<T>>;
+}
+
+impl<T> CollectAll<T> for Vec<Result<T>> {
+    fn collect_all(self) -> Result<Vec<T>> {
+        let mut values = Vec::new();
+        let mut errors = Vec::new();
+
+        for result in self {
+            match result {
+                Ok(value) => values.push(value),
+                Err(error) => errors.push(error),
+            }
+        }
+
+        if errors.is_empty() {
+            Ok(values)
+        } else {
+            Err(anyhow!(
+                "{}",
+                errors
+                    .into_iter()
+                    .map(|error| format!("{error:#}"))
+                    .collect::<Vec<_>>()
+                    .join("\n")
+            ))
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde::de::DeserializeOwned;
+    use serde_json::{json, Value};
+    use std::collections::HashMap;
+    use std::process::Command;
+    use tempfile::TempDir;
+
+    struct FakeGithub {
+        names: HashMap<PathBuf, String>,
+        responses: HashMap<String, Value>,
+    }
+
+    impl Github for FakeGithub {
+        fn get<T: DeserializeOwned>(&self, endpoint: &str) -> Result<T> {
+            serde_json::from_value(
+                self.responses
+                    .get(endpoint)
+                    .unwrap_or_else(|| panic!("unexpected endpoint {endpoint}"))
+                    .clone(),
+            )
+            .map_err(Into::into)
+        }
+
+        fn repository_info(&self, path: &Path) -> Result<gh::RepositoryInfo> {
+            let name_with_owner = self
+                .names
+                .get(path)
+                .cloned()
+                .with_context(|| format!("unexpected repository path {}", path.display()))?;
+            Ok(gh::RepositoryInfo { name_with_owner })
+        }
+    }
+
+    fn git(path: &Path, args: &[&str]) {
+        let status = Command::new("git").args(args).current_dir(path).status().unwrap();
+        assert!(status.success(), "git {args:?} failed");
+    }
+
+    fn repository(tags: &[&str]) -> TempDir {
+        let directory = tempfile::tempdir().unwrap();
+        git(directory.path(), &["init", "-q"]);
+        git(directory.path(), &["config", "user.name", "Test"]);
+        git(directory.path(), &["config", "user.email", "test@example.com"]);
+        std::fs::write(directory.path().join("file"), "base").unwrap();
+        git(directory.path(), &["add", "file"]);
+        git(directory.path(), &["commit", "-qm", "base"]);
+        for tag in tags {
+            git(directory.path(), &["tag", tag]);
+        }
+        directory
+    }
+
+    fn commit(path: &Path, contents: &str, subject: &str) {
+        std::fs::write(path.join("file"), contents).unwrap();
+        git(path, &["add", "file"]);
+        git(path, &["commit", "-qm", subject]);
+    }
+
+    #[test]
+    fn release_is_canonical_and_uses_hotfix_ordering() {
+        let base = Release::from_tag("v2.8.0").unwrap().unwrap();
+        let hotfix_2 = Release::from_tag("v2.8.0-hotfix2").unwrap().unwrap();
+        let hotfix_10 = Release::from_tag("v2.8.0-hotfix10").unwrap().unwrap();
+        assert_eq!(base.to_string(), "v2.8.0");
+        assert!(base < hotfix_2);
+        assert!(hotfix_2 < hotfix_10);
+        assert!(Release::from_tag("2.8.0").unwrap().is_none());
+        assert!(Release::from_tag("v2.8.0-rc1").is_err());
+        assert!(Release::from_tag("v2.8.0-hotfix01").is_err());
+        assert!(Release::from_tag("v2.8.0+build").is_err());
+        let release = Release::from_tag("v2.8.1").unwrap().unwrap();
+        assert_eq!((release.major(), release.minor(), release.patch()), (2, 8, 1));
+    }
+
+    #[test]
+    fn loads_newest_releases_and_applies_cutoff_before_suffix_validation() {
+        let repository = repository(&["v2.6.1-bad", "v2.7.0", "v2.7.0-hotfix2", "v2.8.0", "not-a-release"]);
+        let releases = load_releases(repository.path(), false).unwrap();
+        assert_eq!(
+            releases.iter().map(ToString::to_string).collect::<Vec<_>>(),
+            ["v2.8.0", "v2.7.0-hotfix2", "v2.7.0"]
+        );
+    }
+
+    #[test]
+    fn errors_or_ignores_incompatible_release_tags() {
+        let repository = repository(&["v2.7.0", "v2.8.0-rc1"]);
+        assert!(load_releases(repository.path(), false).is_err());
+        assert_eq!(
+            load_releases(repository.path(), true).unwrap(),
+            vec![Release::from_tag("v2.7.0").unwrap().unwrap()]
+        );
+    }
+
+    #[test]
+    fn finds_a_pr_in_its_exact_adjacent_release_range() {
+        let repository = repository(&["v2.7.0"]);
+        commit(repository.path(), "change", "The change (#42)");
+        git(repository.path(), &["tag", "v2.8.0"]);
+        commit(repository.path(), "later", "A later change (#43)");
+        git(repository.path(), &["tag", "v2.8.1"]);
+        let repository = Repository {
+            path: repository.path().to_owned(),
+            releases: load_releases(repository.path(), false).unwrap(),
+        };
+        assert_eq!(
+            release_for_pr(&repository, "o/r", 42).unwrap(),
+            Some(Release::from_tag("v2.8.0").unwrap().unwrap())
+        );
+    }
+
+    #[test]
+    fn enumerates_prs_and_unmatched_commits_since_a_release() {
+        let repository = repository(&["v2.7.0"]);
+        commit(repository.path(), "first", "First (#42)");
+        commit(repository.path(), "duplicate", "Follow-up (#42)");
+        commit(repository.path(), "unmatched", "Merge branch");
+
+        let pull_requests = pull_requests_in_range(repository.path(), "v2.7.0", "HEAD").unwrap();
+        assert_eq!(pull_requests, vec![42]);
+    }
+
+    #[test]
+    fn reports_all_unsatisfied_dependencies() {
+        let repository = repository(&["v2.7.0", "v2.8.0"]);
+        let path = repository.path().canonicalize().unwrap();
+        let github = FakeGithub {
+            names: HashMap::from([(path, "o/r".into())]),
+            responses: HashMap::from([
+                (
+                    "repos/o/r/pulls/1".into(),
+                    json!({ "body": "# Rollback safety impact\n#41" }),
+                ),
+                (
+                    "repos/o/r/pulls/2".into(),
+                    json!({ "body": "# Rollback safety impact\n#42" }),
+                ),
+            ]),
+        };
+        let error = earliest_rollback_point(&github, repository.path(), &[repository.path()], None, false, &[1, 2])
+            .unwrap_err();
+        assert!(error.to_string().contains("o/r#41 has not been released"));
+        assert!(error.to_string().contains("o/r#42 has not been released"));
+    }
+
+    #[test]
+    fn collect_all_combines_every_error() {
+        let results: Vec<Result<u64>> = vec![Err(anyhow!("first")), Ok(42), Err(anyhow!("second"))];
+        let error = results.collect_all().unwrap_err();
+        assert_eq!(error.to_string(), "first\nsecond");
+    }
+}
diff --git a/tools/rollback-coordination/src/pr_parsing.rs b/tools/rollback-coordination/src/pr_parsing.rs
new file mode 100644
index 00000000000..bcf236b7a74
--- /dev/null
+++ b/tools/rollback-coordination/src/pr_parsing.rs
@@ -0,0 +1,183 @@
+use anyhow::{anyhow, bail, Context, Result};
+use regex::Regex;
+use std::collections::BTreeSet;
+use std::sync::OnceLock;
+
+const ROLLBACK_SAFETY_HEADING: &str = "Rollback safety impact";
+
+#[derive(Clone, Debug, Eq, Ord, PartialEq, PartialOrd)]
+pub(crate) struct PullRequestRef {
+    // fully-qualified repo name in owner/repo format
+    pub(crate) repo: String,
+    pub(crate) number: u64,
+}
+
+pub(crate) fn rollback_dependencies(
+    body: &str,
+    current_repo: &str,
+    // If specified, do extra strict verification against this default PR template
+    verify_by_strict_template: Option<&str>,
+) -> Result<Option<BTreeSet<PullRequestRef>>> {
+    let Some(section) = rollback_safety_section(body) else {
+        if verify_by_strict_template.is_some() {
+            bail!("PR description is missing the `{ROLLBACK_SAFETY_HEADING}` section");
+        }
+        return Ok(None);
+    };
+    let dependencies = references(section, current_repo)?;
+
+    if let Some(template) = verify_by_strict_template {
+        let template_section = rollback_safety_section(template)
+            .context("pull request template is missing the `{ROLLBACK_SAFETY_HEADING}` section")?;
+        if normalized_section(section) == normalized_section(template_section) {
+            bail!(
+                "the `{ROLLBACK_SAFETY_HEADING}` section is unchanged from the pull request template; add `n/a` or list prerequisite PRs"
+            );
+        }
+        if dependencies.is_empty() && !contains_na(section) {
+            bail!("the `{ROLLBACK_SAFETY_HEADING}` section must contain `n/a` or at least one prerequisite PR");
+        }
+    }
+
+    Ok(Some(dependencies))
+}
+
+fn rollback_safety_section(body: &str) -> Option<&str> {
+    let mut start = None;
+    let mut level = 0;
+    let mut offset = 0;
+    for line in body.split_inclusive('\n') {
+        let trimmed = line.trim_end_matches(['\r', '\n']);
+        let hashes = trimmed.bytes().take_while(|byte| *byte == b'#').count();
+        let heading = hashes > 0 && trimmed.as_bytes().get(hashes) == Some(&b' ');
+        if heading
+            && trimmed[hashes + 1..]
+                .trim()
+                .eq_ignore_ascii_case(ROLLBACK_SAFETY_HEADING)
+        {
+            start = Some(offset + line.len());
+            level = hashes;
+        } else if start.is_some() && heading && hashes <= level {
+            return Some(&body[start.expect("checked")..offset]);
+        }
+        offset += line.len();
+    }
+    start.map(|start| &body[start..])
+}
+
+fn normalized_section(section: &str) -> String {
+    section
+        .lines()
+        .map(str::trim_end)
+        .collect::<Vec<_>>()
+        .join("\n")
+        .trim()
+        .to_owned()
+}
+
+fn contains_na(section: &str) -> bool {
+    static NA: OnceLock<Regex> = OnceLock::new();
+    NA.get_or_init(|| Regex::new(r"(?i)(?:^|[^A-Za-z0-9_])n/a(?:$|[^A-Za-z0-9_])").unwrap())
+        .is_match(&strip_ignored_markdown(section))
+}
+
+fn references(section: &str, current_repo: &str) -> Result<BTreeSet<PullRequestRef>> {
+    static REFERENCE: OnceLock<Regex> = OnceLock::new();
+    let regex = REFERENCE.get_or_init(|| {
+        Regex::new(r"(?x)(?:https?://github\.com/)?(?:(?<owner>[A-Za-z0-9_.-]+)/)?(?:(?<repo>[A-Za-z0-9_.-]+))?\#|https?://github\.com/(?<url_owner>[A-Za-z0-9_.-]+)/(?<url_repo>[A-Za-z0-9_.-]+)/pull/").unwrap()
+    });
+    let (current_owner, _) = current_repo
+        .split_once('/')
+        .ok_or_else(|| anyhow!("repo must be in owner/name form"))?;
+    let cleaned = strip_ignored_markdown(section);
+    let mut result = BTreeSet::new();
+    for captures in regex.captures_iter(&cleaned) {
+        let after = &cleaned[captures.get(0).expect("whole match").end()..];
+        let digits = after.bytes().take_while(u8::is_ascii_digit).count();
+        if digits == 0 {
+            continue;
+        }
+        let number = after[..digits].parse()?;
+        let repo = if let (Some(owner), Some(repo)) = (captures.name("url_owner"), captures.name("url_repo")) {
+            format!("{}/{}", owner.as_str(), repo.as_str())
+        } else if let Some(repo) = captures.name("repo") {
+            let owner = captures.name("owner").map_or(current_owner, |owner| owner.as_str());
+            format!("{owner}/{}", repo.as_str())
+        } else {
+            current_repo.to_owned()
+        };
+        result.insert(PullRequestRef { repo, number });
+    }
+    Ok(result)
+}
+
+fn strip_ignored_markdown(input: &str) -> String {
+    let mut output = String::with_capacity(input.len());
+    let mut in_comment = false;
+    let mut in_fence = false;
+    for line in input.lines() {
+        let trimmed = line.trim_start();
+        if trimmed.starts_with("```") || trimmed.starts_with("~~~") {
+            in_fence = !in_fence;
+            output.push('\n');
+            continue;
+        }
+        let mut remaining = line;
+        while !in_fence && !remaining.is_empty() {
+            if in_comment {
+                if let Some(end) = remaining.find("-->") {
+                    remaining = &remaining[end + 3..];
+                    in_comment = false;
+                } else {
+                    break;
+                }
+            } else if let Some(start) = remaining.find("<!--") {
+                output.push_str(&remaining[..start]);
+                remaining = &remaining[start + 4..];
+                in_comment = true;
+            } else {
+                output.push_str(remaining);
+                break;
+            }
+        }
+        output.push('\n');
+    }
+    output
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn extracts_and_validates_rollback_dependencies() {
+        const REPO: &str = "clockworklabs/SpacetimeDB";
+        let template = "# Rollback safety impact\n\n<!-- instructions -->\n";
+        assert_eq!(rollback_dependencies("", REPO, None).unwrap(), None);
+        assert!(
+            rollback_dependencies("# Rollback safety impact\nN/A", REPO, Some(template))
+                .unwrap()
+                .unwrap()
+                .is_empty()
+        );
+        assert_eq!(
+            rollback_dependencies("# Rollback safety impact\n#12", REPO, Some(template)).unwrap(),
+            Some(BTreeSet::from([PullRequestRef {
+                repo: REPO.into(),
+                number: 12,
+            }]))
+        );
+    }
+
+    #[test]
+    fn recognizes_references_and_ignores_comments_and_fences() {
+        let section =
+            "#12 SpacetimeDBPrivate#13 other/repo#14 https://github.com/x/y/pull/15\n<!-- #16 -->\n```\n#17\n```";
+        let refs = references(section, "clockworklabs/SpacetimeDB").unwrap();
+        assert_eq!(refs.len(), 4);
+        assert!(refs.contains(&PullRequestRef {
+            repo: "x/y".into(),
+            number: 15
+        }));
+    }
+}
diff --git a/tools/rollback-coordination/src/release.rs b/tools/rollback-coordination/src/release.rs
new file mode 100644
index 00000000000..39498c675cb
--- /dev/null
+++ b/tools/rollback-coordination/src/release.rs
@@ -0,0 +1,92 @@
+use anyhow::{bail, Context, Result};
+use semver::Version;
+use std::cmp::Ordering;
+use std::fmt;
+
+/// A canonical SpacetimeDB release tag.
+///
+/// Releases are either `vMAJOR.MINOR.PATCH` or
+/// `vMAJOR.MINOR.PATCH-hotfixN`. Their tag is derived from the parsed version;
+/// there is no independent string representation.
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct Release {
+    version: Version,
+    hotfix: Option<u64>,
+}
+
+impl Release {
+    pub fn from_tag(tag: &str) -> Result<Option<Self>> {
+        let Some(version) = tag.strip_prefix('v') else {
+            tracing::debug!("Not parsing tag that does not start with `v`");
+            return Ok(None);
+        };
+        let Ok(version) = Version::parse(version) else {
+            tracing::debug!("Not parsing tag that is not a semver");
+            return Ok(None);
+        };
+
+        // Ignore releases that are too old.
+        // This cutoff shortly predates the rollback-safety coordination system, so
+        // ignoring older tags avoids needless history traversal. It is also after the
+        // public and private repositories began using the same release tags.
+        // We compare only the core version here. SemVer orders prereleases before
+        // their base release, whereas our hotfix tags come after it.
+        if Version::new(version.major, version.minor, version.patch) < Version::new(2, 7, 0) {
+            tracing::debug!("Not parsing tag that is too old");
+            return Ok(None);
+        }
+
+        if !version.build.is_empty() {
+            bail!("release versions may not contain build metadata");
+        }
+
+        let hotfix = if version.pre.is_empty() {
+            None
+        } else {
+            let prerelease = version.pre.as_str();
+            let number = prerelease
+                .strip_prefix("hotfix")
+                .and_then(|number| number.parse::<u64>().ok())
+                .with_context(|| format!("unsupported release suffix `-{prerelease}`; expected `-hotfixN`"))?;
+            // Reject things that start with 0, include separators, etc.
+            if format!("hotfix{number}") != prerelease {
+                bail!("release suffix `-{prerelease}` is not a canonical form");
+            }
+            Some(number)
+        };
+
+        Ok(Some(Self { version, hotfix }))
+    }
+
+    pub fn major(&self) -> u64 {
+        self.version.major
+    }
+
+    pub fn minor(&self) -> u64 {
+        self.version.minor
+    }
+
+    pub fn patch(&self) -> u64 {
+        self.version.patch
+    }
+}
+
+impl fmt::Display for Release {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(formatter, "v{}", self.version)
+    }
+}
+
+impl Ord for Release {
+    fn cmp(&self, other: &Self) -> Ordering {
+        (self.version.major, self.version.minor, self.version.patch)
+            .cmp(&(other.version.major, other.version.minor, other.version.patch))
+            .then_with(|| self.hotfix.cmp(&other.hotfix))
+    }
+}
+
+impl PartialOrd for Release {
+    fn partial_cmp(&self, other: &Self) -> Option<Ordering> {
+        Some(self.cmp(other))
+    }
+}