diff --git a/Documentation/config-gerrit.txt b/Documentation/config-gerrit.txt
index 35edf87..12e78a7 100644
--- a/Documentation/config-gerrit.txt
+++ b/Documentation/config-gerrit.txt
@@ -115,7 +115,7 @@
 [[accounts.caseInsensitiveLocalPart]]accounts.caseInsensitiveLocalPart::
 +
 When querying by email, the case sensitivity of the email local part depends on the domains
-specified in the this list.
+specified in this list.
 +
 Users can register emails with mixed case, and if the email’s domain matches one in the configured
 list, the local part is treated as case-insensitive.
@@ -549,13 +549,6 @@
 +
 If not set, HTTP request's domain is used.
 
-[[auth.cookieSecure]]auth.cookieSecure::
-+
-Sets "secure" flag of the authentication cookie.  If `true`, cookies
-will be transmitted only over HTTPS protocol.
-+
-By default, `false`.
-
 [[auth.cookieHttpOnly]]auth.cookieHttpOnly::
 +
 Sets "httpOnly" flag of the authentication cookie. If `true`, cookie
@@ -4009,7 +4002,7 @@
 the in-memory buffer fills, but only committed and guaranteed to be synced
 to disk when the process finishes.
 +
-Defaults to 300000 ms (5 minutes).
+Defaults to 5 minutes.
 
 
 [[index.name.maxMergeCount]]index.name.maxMergeCount::
@@ -4298,8 +4291,9 @@
 A timeout can be used to avoid blocking all of the SSH command start
 threads in case the LDAP server becomes slow.
 +
-By default there is no timeout and Gerrit will wait for the LDAP
-server to respond until the TCP connection times out.
+By default 1 minute.  If set to 0 there is no timeout and Gerrit
+will wait for the LDAP server to respond until the TCP connection
+times out.
 
 [[ldap.accountBase]]ldap.accountBase::
 +
@@ -4580,7 +4574,8 @@
 The value is in the usual time-unit format like "1 s", "100 ms",
 etc...
 +
-By default there is no timeout and Gerrit will wait indefinitely.
+By default 10 seconds. If set to 0 there is no timeout and Gerrit will
+wait indefinitely.
 
 [[ldap-connection-pooling]]
 ==== LDAP Connection Pooling
@@ -4854,7 +4849,7 @@
 result in a smaller overall transfer for the client, but requires
 more server memory and CPU time.
 +
-False (off) by default, matching Gerrit Code Review 2.1.4.
+False (off) by default.
 
 [[pack.threads]]pack.threads::
 +
@@ -5371,8 +5366,8 @@
 +
 Modification and deletion of existing rules are still allowed.
 +
-Default is `true`, to allow creation of prolog rules in projects
-not having any already.
+Default is `false`, disallowing creation of prolog rules in projects
+not having any already since prolog rules are now deprecated.
 
 [[rules.reductionLimit]]rules.reductionLimit::
 +
@@ -5434,12 +5429,12 @@
 
 [[execution.fanOutThreadPoolSize]]execution.fanOutThreadPoolSize::
 +
-Maximum size of thread pool to on which a serving thread can fan-out
-work to parallelize it.
+Maximum size of thread pool a serving thread can fan-out work on to
+parallelize it.
 +
-When set to 0, a direct executor will be used.
+When set to 0 the work happens directly in the caller thread.
 +
-By default, 25 which means that formatting happens in the caller thread.
+By default 25.
 
 [[performance]]
 === Section performance
@@ -5571,7 +5566,7 @@
 ('ms', 'sec', 'min', etc.).
 If no unit is specified, milliseconds is assumed.
 +
-Default is 0. A timeout of zero is interpreted as an infinite
+Default is 10 seconds. A timeout of zero is interpreted as an infinite
 timeout. The connection will then block until established or
 an error occurs.
 
@@ -5584,7 +5579,7 @@
 ('ms', 'sec', 'min', etc.).
 If no unit is specified, milliseconds is assumed.
 +
-Default is 0. A timeout of zero is interpreted as an infinite
+Default is 10 seconds. A timeout of zero is interpreted as an infinite
 timeout. With this config value set to a non-zero timeout,
 a read() call on the InputStream associated with this Socket
 will block for only this amount of time. Hence administrators
@@ -6499,7 +6494,8 @@
 especially over a WAN link, while 10-30 seconds is a much more
 reasonable timeout value.
 +
-Defaults to 0 seconds, wait indefinitely.
+Defaults to 1 minute. If set to 0 there is no timeout and Gerrit
+will wait indefinitely.
 
 
 [[upload]]
diff --git a/Documentation/rest-api-changes.txt b/Documentation/rest-api-changes.txt
index 0c30a73..7b6e5c5 100644
--- a/Documentation/rest-api-changes.txt
+++ b/Documentation/rest-api-changes.txt
@@ -3679,6 +3679,251 @@
 ----
 
 
+[[flow-endpoints]]
+== Flow Endpoints
+
+[[list-flows]]
+=== List Flows
+--
+'GET /changes/link:#change-id[\{change-id\}]/flows/'
+--
+
+Lists the flows of a change that are visible to the caller.
+
+As result a list of link:#flow-info[FlowInfo] entries is returned.
+
+The order of the returned flows is stable, but depends on the flow service
+implementation.
+
+.Request
+----
+  GET /changes/myProject~65178/flows/ HTTP/1.0
+----
+
+.Response
+----
+  HTTP/1.1 200 OK
+  Content-Disposition: attachment
+  Content-Type: application/json; charset=UTF-8
+
+  )]}'
+  [
+    {
+      "uuid": "zgcFrmAM",
+      "owner" {
+        "_account_id": 1000600
+      },
+      "created": "2025-06-03 09:59:32.126000000",
+      "stages": [
+        {
+          "expression": {
+            "condition": "com.google.gerrit[change:65779 is:merged]",
+            "action": {
+              "name: "MarkAsReady"
+            }
+          },
+          "status": "DONE"
+        }
+      ],
+      "last_evaluated": "2025-06-03 10:32:12.083000000",
+    },
+    {
+      "uuid": "XvcXrmjM",
+      "owner" {
+        "_account_id": 1000600
+      },
+      "created": "2025-06-03 10:55:36.133000000",
+      "stages": [
+        {
+          "expression": {
+            "condition": "com.google.gerrit[change:65178 label:Verified+1]",
+            "action": {
+              "name: "AddReviewer",
+              "parameters": {
+                "user": "foo@example.com"
+              }
+            }
+          },
+          "status": "FAILED",
+          "message": "user foo@example.com not found"
+        },
+        {
+          "expression": {
+            "condition": "com.google.gerrit[change:65178 label:Code-Review+2]",
+            "action": {
+              "name: "Submit",
+              "parameters": {
+                "change": "65178"
+              }
+            }
+          },
+          "status": "TERMINATED",
+          "message": "stage 1 has failed"
+        }
+      ],
+      "last_evaluated": "2025-06-03 12:12:10.084000000",
+    }
+  ]
+----
+
+Flows that are not visible to the caller are omitted from the result. Which
+permissions are required to see a flow depends on the flow service
+implementation.
+
+
+If no flow service is bound (i.e. if no plugin that provides a flow service is
+installed) `405 Method Not Allowed` is returned.
+
+[[create-flow]]
+=== Create Flow
+--
+'POST /changes/link:#change-id[\{change-id\}]/flows/'
+--
+
+Creates a flow on the change.
+
+The flow input must be provided as a link:#flow-input[FlowInput] entity in the
+request body.
+
+.Request
+----
+  POST /changes/ HTTP/1.0
+  Content-Type: application/json; charset=UTF-8
+
+  {
+    "stage_expressions": [
+      {
+        "condition": "com.google.gerrit[change:65178 label:Verified+1]",
+        "action": {
+          "name: "AddReviewer",
+          "parameters": {
+            "user": "foo@example.com"
+          }
+        }
+      }
+    ]
+  }
+----
+
+The created flow is returned as a link:#flow-info[FlowInfo] entity.
+
+.Response
+----
+  HTTP/1.1 200 OK
+  Content-Disposition: attachment
+  Content-Type: application/json; charset=UTF-8
+
+  )]}'
+  {
+    "uuid": "XvcXrmjM",
+    "owner" {
+      "_account_id": 1000600
+    },
+    "created": "2025-06-03 09:59:32.126000000",
+    "stages": [
+      {
+        "expression": {
+          "condition": "com.google.gerrit[change:65178 label:Verified+1]",
+          "action": {
+            "name: "AddReviewer",
+            "parameters": {
+              "user": "foo@example.com"
+            }
+          }
+        }
+        "status": "PENDING"
+      }
+    ]
+  }
+----
+
+If the caller is not allowed to create the flow `403 Forbidden` is returned.
+Which permissions are required for creating a flow depends on the flow service
+implementation.
+
+If no flow service is bound (i.e. if no plugin that provides a flow service is
+installed) `405 Method Not Allowed` is returned.
+
+[[get-flow]]
+=== Get Flow
+--
+'GET /changes/link:#change-id[\{change-id\}]/flows/link:#flow-id[\{flow-id\}]'
+--
+
+Gets a flow on the change.
+
+.Request
+----
+  GET /changes/myProject~65178/flow/XvcXrmjM HTTP/1.0
+----
+
+The flow is returned as a link:#flow-info[FlowInfo] entity.
+
+.Response
+----
+  HTTP/1.1 200 OK
+  Content-Disposition: attachment
+  Content-Type: application/json; charset=UTF-8
+
+  )]}'
+  {
+    "uuid": "XvcXrmjM",
+    "owner" {
+      "_account_id": 1000600
+    },
+    "created": "2025-06-03 09:59:32.126000000",
+    "stages": [
+      {
+        "expression": {
+          "condition": "com.google.gerrit[change:65178 label:Verified+1]",
+          "action": {
+            "name: "AddReviewer",
+            "parameters": {
+              "user": "foo@example.com"
+            }
+          }
+        }
+        "status": "PENDING"
+      }
+    ]
+  }
+----
+
+If the flow exists, but is not visible to the caller `404 Not Found` is
+returned. Which permissions are required to see a flow depends on the flow
+service implementation.
+
+If no flow service is bound (i.e. if no plugin that provides a flow service is
+installed) `405 Method Not Allowed` is returned.
+
+[[delete-flow]]
+=== Delete Flow
+--
+'DELETE /changes/link:#change-id[\{change-id\}]/flows/link:#flow-id[\{flow-id\}]'
+--
+
+Delete a flow on the change.
+
+.Request
+----
+  DELETE /changes/myProject~65178/flow/XvcXrmjM HTTP/1.0
+----
+
+.Response
+----
+  HTTP/1.1 204 No Content
+----
+
+If the flow exists, but is not visible to the caller `404 Not Found` is
+returned.
+
+If the caller can see the flow but is not allowed to delete it `403 Forbidden`
+is returned. Which permissions are required to delete a flow depends on the flow
+service implementation.
+
+If no flow service is bound (i.e. if no plugin that provides a flow service is
+installed) `405 Method Not Allowed` is returned.
+
 [[reviewer-endpoints]]
 == Reviewer Endpoints
 
@@ -6756,6 +7001,10 @@
 === \{draft-id\}
 UUID of a draft comment.
 
+[[flow-id]]
+=== \{flow-id\}
+UUID of a flow.
+
 [[label-id]]
 === \{label-id\}
 The name of the label.
@@ -8101,6 +8350,91 @@
 |`replacement`   |The content which should be used instead of the current one.
 |==========================
 
+[[flow-info]]
+=== FlowInfo
+The `FlowInfo` entity contains information about a flow. A flow is an automation
+rule on a change that triggers actions on the change when the flow conditions
+become satisfied. For example, a flow can be an automation rule that adds a
+reviewer to the change when the change has been verified by the CI.
+
+[options="header",cols="1,^1,5"]
+|==============================
+|Field Name       ||Description
+|`uuid`           ||The universally unique identifier that identifies the flow.
+|`owner`          ||The owner of the flow as an
+link:rest-api-accounts.html#account-info[AccountInfo] entity.
+|`created`        ||The link:rest-api.html#timestamp[timestamp] of when the flow
+was created.
+|`stages`         ||The stages of this flow as a list of
+link:#flow-stage-info[FlowStageInfo] entities (sorted by execution order).
+|`last_evaluated` |optional|The link:rest-api.html#timestamp[timestamp] of when
+the flow was last evaluated. Not set if the flow has not been evaluated yet.
+|==============================
+
+[[flow-action-info]]
+=== FlowActionInfo
+The `FlowActionInfo` entity contains information about a flow action. A flow
+action is an action that should be triggered when the condition of a
+link:#flow-expression-info[FlowExpressionInfo] becomes satisfied.
+
+[options="header",cols="1,6"]
+|=========================
+|Field Name   |Description
+|`name`       |The name of the action. Which actions are supported depends on
+the flow service implementation.
+|`parameters` |Parameters for the action as a key-value map. Which parameters
+are supported depends on the flow service implementation.
+|=========================
+
+[[flow-expression-info]]
+=== FlowExpressionInfo
+The `FlowExpressionInfo` entity contains information about a flow expression. A
+flow expression defines an action that should be triggered when a condition
+becomes satisfied.
+
+[options="header",cols="1,6"]
+|========================
+|Field Name  |Description
+|`condition` |The condition which must be satisfied for the action to be
+triggered. Can contain multiple conditions separated by comma. The syntax of the
+condition depends on the flow service implementation.
+|`action`    |The action that should be triggered when the condition is
+satisfied as a link:#flow-action-info[FlowActionInfo] entity.
+|========================
+
+[[flow-input]]
+=== FlowInput
+The `FlowInput` entity defines the properties for creating a new flow.
+
+[options="header",cols="1,6"]
+|================================
+|Field Name          |Description
+|`stage_expressions` |The expressions for the stages of the flow (sorted by
+execution order) as  a list of link:#flow-expression-info[FlowExpressionInfo]
+entities.
+|================================
+
+[[flow-stage-info]]
+=== FlowStageInfo
+The `FlowStageInfo` entity contains information about a stage in a flow. A flow
+stage consists out of a flow expression that defines an action that should be
+triggered when a condition becomes satisfied and a status.
+
+[options="header",cols="1,^1,5"]
+|==========================
+|Field Name   ||Description
+|`expression` ||The expression defining the condition and the action of
+this stage as a link:#flow-expression-info[FlowExpressionInfo] entity.
+|`status`     ||The status for this stage. Can be `PENDING` (the condition of
+the stage is not satisfied yet or the action has not been executed yet), `DONE`
+(the condition of the stage is satisfied and the action has been executed),
+`FAILED` (the stage has a non-recoverable error, e.g. performing the action has
+failed) or `TERMINATED` (the stage has been terminated without having been
+executed, e.g. because a previous stage failed or because it wasn't done within
+a timeout).
+|`message`    |optional|Optional message for the stage.
+|==========================
+
 [[git-person-info]]
 === GitPersonInfo
 The `GitPersonInfo` entity contains information about the
diff --git a/java/com/google/gerrit/acceptance/ExtensionRegistry.java b/java/com/google/gerrit/acceptance/ExtensionRegistry.java
index 4cbaea2..a753dbd 100644
--- a/java/com/google/gerrit/acceptance/ExtensionRegistry.java
+++ b/java/com/google/gerrit/acceptance/ExtensionRegistry.java
@@ -34,6 +34,7 @@
 import com.google.gerrit.extensions.events.RevisionCreatedListener;
 import com.google.gerrit.extensions.events.TopicEditedListener;
 import com.google.gerrit.extensions.events.WorkInProgressStateChangedListener;
+import com.google.gerrit.extensions.registration.DynamicItem;
 import com.google.gerrit.extensions.registration.DynamicMap;
 import com.google.gerrit.extensions.registration.DynamicSet;
 import com.google.gerrit.extensions.registration.PrivateInternals_DynamicMapImpl;
@@ -52,6 +53,7 @@
 import com.google.gerrit.server.change.FilterIncludedIn;
 import com.google.gerrit.server.change.ReviewerSuggestion;
 import com.google.gerrit.server.config.ProjectConfigEntry;
+import com.google.gerrit.server.flow.FlowService;
 import com.google.gerrit.server.git.ChangeMessageModifier;
 import com.google.gerrit.server.git.receive.PushOptionsValidator;
 import com.google.gerrit.server.git.validators.CommitValidationInfoListener;
@@ -126,6 +128,8 @@
   private final DynamicMap<UserInOperandFactory> userInOperands;
   private final DynamicMap<ReviewerSuggestion> reviewerSuggestions;
 
+  private final DynamicItem<FlowService> flowService;
+
   @Inject
   ExtensionRegistry(
       DynamicSet<AccountIndexedListener> accountIndexedListeners,
@@ -175,7 +179,8 @@
       DynamicSet<CommitValidationInfoListener> commitValidationInfoListeners,
       DynamicSet<RetryListener> retryListeners,
       DynamicSet<PushOptionsValidator> pushOptionsValidator,
-      DynamicMap<ReviewerSuggestion> reviewerSuggestions) {
+      DynamicMap<ReviewerSuggestion> reviewerSuggestions,
+      DynamicItem<FlowService> flowService) {
     this.accountIndexedListeners = accountIndexedListeners;
     this.changeIndexedListeners = changeIndexedListeners;
     this.groupIndexedListeners = groupIndexedListeners;
@@ -224,6 +229,7 @@
     this.retryListeners = retryListeners;
     this.pushOptionsValidators = pushOptionsValidator;
     this.reviewerSuggestions = reviewerSuggestions;
+    this.flowService = flowService;
   }
 
   public Registration newRegistration() {
@@ -481,6 +487,11 @@
       return add(reviewerSuggestions, reviewerSuggestion, exportName);
     }
 
+    @CanIgnoreReturnValue
+    public Registration set(FlowService flowService) {
+      return set(ExtensionRegistry.this.flowService, flowService);
+    }
+
     private <T> Registration add(DynamicSet<T> dynamicSet, T extension) {
       return add(dynamicSet, extension, "gerrit");
     }
@@ -499,6 +510,12 @@
       return this;
     }
 
+    private <T> Registration set(DynamicItem<T> dynamicItem, T extension) {
+      RegistrationHandle registrationHandle = dynamicItem.set(extension, "gerrit");
+      registrationHandles.add(registrationHandle);
+      return this;
+    }
+
     @Override
     public void close() {
       registrationHandles.forEach(h -> h.remove());
diff --git a/java/com/google/gerrit/acceptance/TestExtensions.java b/java/com/google/gerrit/acceptance/TestExtensions.java
index e5d9b26..b9901f3 100644
--- a/java/com/google/gerrit/acceptance/TestExtensions.java
+++ b/java/com/google/gerrit/acceptance/TestExtensions.java
@@ -14,6 +14,7 @@
 
 package com.google.gerrit.acceptance;
 
+import static com.google.common.collect.ImmutableList.toImmutableList;
 import static com.google.gerrit.server.update.context.RefUpdateContext.RefUpdateType.CHANGE_MODIFICATION;
 import static com.google.gerrit.server.update.context.RefUpdateContext.RefUpdateType.DIRECT_PUSH;
 import static java.util.Objects.requireNonNull;
@@ -24,11 +25,22 @@
 import com.google.common.collect.Iterables;
 import com.google.gerrit.common.Nullable;
 import com.google.gerrit.entities.BranchNameKey;
+import com.google.gerrit.entities.Change;
 import com.google.gerrit.entities.PatchSet;
 import com.google.gerrit.entities.Project;
+import com.google.gerrit.exceptions.StorageException;
+import com.google.gerrit.server.ChangeUtil;
 import com.google.gerrit.server.PluginPushOption;
 import com.google.gerrit.server.ValidationOptionsListener;
 import com.google.gerrit.server.events.CommitReceivedEvent;
+import com.google.gerrit.server.flow.Flow;
+import com.google.gerrit.server.flow.FlowCreation;
+import com.google.gerrit.server.flow.FlowExpression;
+import com.google.gerrit.server.flow.FlowKey;
+import com.google.gerrit.server.flow.FlowPermissionDeniedException;
+import com.google.gerrit.server.flow.FlowService;
+import com.google.gerrit.server.flow.FlowStage;
+import com.google.gerrit.server.flow.InvalidFlowException;
 import com.google.gerrit.server.git.validators.CommitValidationException;
 import com.google.gerrit.server.git.validators.CommitValidationInfo;
 import com.google.gerrit.server.git.validators.CommitValidationInfoListener;
@@ -37,8 +49,12 @@
 import com.google.gerrit.server.notedb.ChangeNotes;
 import com.google.gerrit.server.update.RetryListener;
 import com.google.gerrit.server.update.context.RefUpdateContext;
+import java.time.Instant;
 import java.util.ArrayList;
+import java.util.HashMap;
 import java.util.List;
+import java.util.Map;
+import java.util.Optional;
 
 /**
  * Class to host common test extension implementations.
@@ -151,6 +167,151 @@
     }
   }
 
+  /** Test implementation of a {@link FlowService} to be used by the flow integration tests. */
+  public static class TestFlowService implements FlowService {
+    public static final String INVALID_CONDITION = "invalid";
+
+    private final Map<FlowKey, Flow> flows = new HashMap<>();
+
+    /**
+     * Whether any flow creation should be rejected with a {@link FlowPermissionDeniedException}.
+     */
+    private boolean rejectFlowCreation;
+
+    /**
+     * Whether any flow deletion should be rejected with a {@link FlowPermissionDeniedException}.
+     */
+    private boolean rejectFlowDeletion;
+
+    /** Makes the flow service reject all flow creations. */
+    public void rejectFlowCreation() {
+      this.rejectFlowCreation = true;
+    }
+
+    /** Makes the flow service reject all flow deletions. */
+    public void rejectFlowDeletion() {
+      this.rejectFlowDeletion = true;
+    }
+
+    @Override
+    public Flow createFlow(FlowCreation flowCreation)
+        throws FlowPermissionDeniedException, InvalidFlowException, StorageException {
+      if (rejectFlowCreation) {
+        throw new FlowPermissionDeniedException("not allowed to create flow");
+      }
+
+      if (flowCreation.stageExpressions().stream()
+          .map(FlowExpression::condition)
+          .anyMatch(condition -> condition.endsWith(INVALID_CONDITION))) {
+        throw new InvalidFlowException(String.format("invalid condition: %s", INVALID_CONDITION));
+      }
+
+      FlowKey flowKey =
+          FlowKey.builder()
+              .projectName(flowCreation.projectName())
+              .changeId(flowCreation.changeId())
+              .uuid(ChangeUtil.messageUuid())
+              .build();
+      Flow flow =
+          Flow.builder(flowKey)
+              .createdOn(Instant.now())
+              .ownerId(flowCreation.ownerId())
+              .stages(
+                  flowCreation.stageExpressions().stream()
+                      .map(
+                          stageExpression ->
+                              FlowStage.builder()
+                                  .expression(stageExpression)
+                                  .status(FlowStage.Status.PENDING)
+                                  .build())
+                      .collect(toImmutableList()))
+              .build();
+      flows.put(flowKey, flow);
+      return flow;
+    }
+
+    @Override
+    public Optional<Flow> getFlow(FlowKey flowKey) throws StorageException {
+      return Optional.ofNullable(flows.get(flowKey));
+    }
+
+    @Override
+    public Optional<Flow> deleteFlow(FlowKey flowKey)
+        throws FlowPermissionDeniedException, StorageException {
+      if (rejectFlowDeletion) {
+        throw new FlowPermissionDeniedException("not allowed to delete flow");
+      }
+
+      return Optional.ofNullable(flows.remove(flowKey));
+    }
+
+    @Override
+    public ImmutableList<Flow> listFlows(Project.NameKey projectName, Change.Id changeId)
+        throws StorageException {
+      return flows.entrySet().stream()
+          .filter(
+              e ->
+                  e.getKey().projectName().equals(projectName)
+                      && e.getKey().changeId().equals(changeId))
+          .map(Map.Entry::getValue)
+          .collect(toImmutableList());
+    }
+
+    /**
+     * Updates the specified flow.
+     *
+     * <p>Sets the {@code lastEvaluatedOn} timestamp in the flow and updates the statuses and
+     * messages of the stages.
+     *
+     * @param flowKey the key of the flow that should be updated
+     * @param stageStatuses statuses to be set for the stages
+     * @param stageMessages messages to be set for the stages
+     * @throws IllegalStateException thrown if the specified flow is not found, or if the number of
+     *     given statuses/messages doesn't match with the number of stages in the flow
+     * @return the updated flow
+     */
+    public Flow evaluate(
+        FlowKey flowKey,
+        ImmutableList<FlowStage.Status> stageStatuses,
+        ImmutableList<Optional<String>> stageMessages)
+        throws IllegalStateException {
+      Optional<Flow> flow = getFlow(flowKey);
+      if (flow.isEmpty()) {
+        throw new IllegalStateException(String.format("Flow %s not found.", flowKey));
+      }
+      if (stageStatuses.size() != flow.get().stages().size()) {
+        throw new IllegalStateException(
+            String.format(
+                "Invalid number of stage statuses: got %s, expected %s",
+                stageStatuses.size(), flow.get().stages().size()));
+      }
+      if (stageMessages.size() != flow.get().stages().size()) {
+        throw new IllegalStateException(
+            String.format(
+                "Invalid number of stage messages: got %s, expected %s",
+                stageMessages.size(), flow.get().stages().size()));
+      }
+
+      List<FlowStage> stages = new ArrayList<>(flow.get().stages());
+      for (int i = 0; i < flow.get().stages().size(); i++) {
+        FlowStage updatedStage =
+            stages.get(i).toBuilder()
+                .status(stageStatuses.get(i))
+                .message(stageMessages.get(i))
+                .build();
+        stages.set(i, updatedStage);
+      }
+
+      Flow updatedFlow =
+          flow.get().toBuilder()
+              .lastEvaluatedOn(Instant.now())
+              .stages(ImmutableList.copyOf(stages))
+              .build();
+      flows.put(flowKey, updatedFlow);
+      return updatedFlow;
+    }
+  }
+
   /**
    * Private constructor to prevent instantiation of this class.
    *
diff --git a/java/com/google/gerrit/auth/ldap/Helper.java b/java/com/google/gerrit/auth/ldap/Helper.java
index c11d045..c9720cc 100644
--- a/java/com/google/gerrit/auth/ldap/Helper.java
+++ b/java/com/google/gerrit/auth/ldap/Helper.java
@@ -109,14 +109,14 @@
     String readTimeout = LdapRealm.optional(config, "readTimeout");
     if (readTimeout != null) {
       readTimeoutMillis =
-          Long.toString(ConfigUtil.getTimeUnit(readTimeout, 0, TimeUnit.MILLISECONDS));
+          Long.toString(ConfigUtil.getTimeUnit(readTimeout, 60000, TimeUnit.MILLISECONDS));
     } else {
       readTimeoutMillis = null;
     }
     String connectTimeout = LdapRealm.optional(config, "connectTimeout");
     if (connectTimeout != null) {
       connectTimeoutMillis =
-          Long.toString(ConfigUtil.getTimeUnit(connectTimeout, 0, TimeUnit.MILLISECONDS));
+          Long.toString(ConfigUtil.getTimeUnit(connectTimeout, 10000, TimeUnit.MILLISECONDS));
     } else {
       connectTimeoutMillis = null;
     }
diff --git a/java/com/google/gerrit/extensions/api/changes/ChangeApi.java b/java/com/google/gerrit/extensions/api/changes/ChangeApi.java
index f4f450c..6fe7216 100644
--- a/java/com/google/gerrit/extensions/api/changes/ChangeApi.java
+++ b/java/com/google/gerrit/extensions/api/changes/ChangeApi.java
@@ -28,6 +28,8 @@
 import com.google.gerrit.extensions.common.CommentInfo;
 import com.google.gerrit.extensions.common.CommitMessageInfo;
 import com.google.gerrit.extensions.common.CommitMessageInput;
+import com.google.gerrit.extensions.common.FlowInfo;
+import com.google.gerrit.extensions.common.FlowInput;
 import com.google.gerrit.extensions.common.MergePatchSetInput;
 import com.google.gerrit.extensions.common.PureRevertInfo;
 import com.google.gerrit.extensions.common.RebaseChainInfo;
@@ -93,6 +95,16 @@
    */
   ReviewerApi reviewer(String id) throws RestApiException;
 
+  /** Creates a new flow on the change. */
+  @CanIgnoreReturnValue
+  FlowInfo createFlow(FlowInput flowInput) throws RestApiException;
+
+  /** Look up a flow of this change by its UUID. */
+  FlowApi flow(String flowUuid) throws RestApiException;
+
+  /** Get the flows of this change/ */
+  List<FlowInfo> flows() throws RestApiException;
+
   default void abandon() throws RestApiException {
     abandon(new AbandonInput());
   }
diff --git a/java/com/google/gerrit/extensions/api/changes/FlowApi.java b/java/com/google/gerrit/extensions/api/changes/FlowApi.java
new file mode 100644
index 0000000..ca3612b
--- /dev/null
+++ b/java/com/google/gerrit/extensions/api/changes/FlowApi.java
@@ -0,0 +1,27 @@
+// Copyright (C) 2025 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.google.gerrit.extensions.api.changes;
+
+import com.google.gerrit.extensions.common.FlowInfo;
+import com.google.gerrit.extensions.restapi.RestApiException;
+
+/** API to call REST endpoints on flows. */
+public interface FlowApi {
+  /** Gets the flow. */
+  FlowInfo get() throws RestApiException;
+
+  /** Deletes a flow. */
+  void delete() throws RestApiException;
+}
diff --git a/java/com/google/gerrit/extensions/common/FlowActionInfo.java b/java/com/google/gerrit/extensions/common/FlowActionInfo.java
new file mode 100644
index 0000000..2b251c4
--- /dev/null
+++ b/java/com/google/gerrit/extensions/common/FlowActionInfo.java
@@ -0,0 +1,40 @@
+// Copyright (C) 2025 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.google.gerrit.extensions.common;
+
+import com.google.common.collect.ImmutableMap;
+
+/**
+ * Representation of a flow action in the REST API.
+ *
+ * <p>This class determines the JSON format of flow actions in the REST API.
+ *
+ * <p>An action to be triggered when the condition of a flow expression becomes satisfied.
+ */
+public class FlowActionInfo {
+  /**
+   * The name of the action.
+   *
+   * <p>Which actions are supported depends on the flow service implementation.
+   */
+  public String name;
+
+  /**
+   * Parameters for the action.
+   *
+   * <p>Which parameters are supported depends on the flow service implementation.
+   */
+  public ImmutableMap<String, String> parameters;
+}
diff --git a/java/com/google/gerrit/extensions/common/FlowExpressionInfo.java b/java/com/google/gerrit/extensions/common/FlowExpressionInfo.java
new file mode 100644
index 0000000..8355e57
--- /dev/null
+++ b/java/com/google/gerrit/extensions/common/FlowExpressionInfo.java
@@ -0,0 +1,37 @@
+// Copyright (C) 2025 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.google.gerrit.extensions.common;
+
+/**
+ * Representation of a flow expression in the REST API.
+ *
+ * <p>This class determines the JSON format of flow expressions in the REST API.
+ *
+ * <p>A stage flow expression defines an action that should be triggered when a condition becomes
+ * satisfied.
+ */
+public class FlowExpressionInfo {
+  /**
+   * The condition which must be satisfied for the action to be triggered.
+   *
+   * <p>Can contain multiple conditions separated by comma.
+   *
+   * <p>The syntax of the condition depends on the flow service implementation.
+   */
+  public String condition;
+
+  /** The action that should be triggered when the condition is satisfied. */
+  public FlowActionInfo action;
+}
diff --git a/java/com/google/gerrit/extensions/common/FlowInfo.java b/java/com/google/gerrit/extensions/common/FlowInfo.java
new file mode 100644
index 0000000..f50a636
--- /dev/null
+++ b/java/com/google/gerrit/extensions/common/FlowInfo.java
@@ -0,0 +1,61 @@
+// Copyright (C) 2025 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.google.gerrit.extensions.common;
+
+import com.google.common.collect.ImmutableList;
+import java.sql.Timestamp;
+import java.time.Instant;
+
+/**
+ * Representation of a flow in the REST API.
+ *
+ * <p>This class determines the JSON format of flows in the REST API.
+ *
+ * <p>A flow is an automation rule on a change that triggers actions on the change when the flow
+ * conditions become satisfied.
+ */
+public class FlowInfo {
+  /** The universally unique identifier that identifies the flow. */
+  public String uuid;
+
+  /** The owner of the flow as an {@link AccountInfo} entity. */
+  public AccountInfo owner;
+
+  // TODO(issue-40014498): Migrate timestamp fields in *Info/*Input classes from type Timestamp to
+  // Instant
+
+  /** The timestamp of when the flow was created. */
+  public Timestamp created;
+
+  @SuppressWarnings("JdkObsolete")
+  public void setCreated(Instant when) {
+    created = Timestamp.from(when);
+  }
+
+  /** The stages of this flow (sorted by execution order). */
+  public ImmutableList<FlowStageInfo> stages;
+
+  /**
+   * The timestamp of when the flow was last evaluated.
+   *
+   * <p>Not set if the flow has not been evaluated yet.
+   */
+  public Timestamp lastEvaluated;
+
+  @SuppressWarnings("JdkObsolete")
+  public void setLastEvaluated(Instant when) {
+    lastEvaluated = Timestamp.from(when);
+  }
+}
diff --git a/java/com/google/gerrit/extensions/common/FlowInput.java b/java/com/google/gerrit/extensions/common/FlowInput.java
new file mode 100644
index 0000000..9d802f2
--- /dev/null
+++ b/java/com/google/gerrit/extensions/common/FlowInput.java
@@ -0,0 +1,30 @@
+// Copyright (C) 2025 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.google.gerrit.extensions.common;
+
+import com.google.common.collect.ImmutableList;
+
+/**
+ * REST API input for creating a flow.
+ *
+ * <p>This class determines the JSON format of flow inputs in the REST API.
+ *
+ * <p>Clients send a flow input in the request body when calling {@code POST
+ * /change/<change-id>/flows}.
+ */
+public class FlowInput {
+  /** The expressions for the stages of the flow (sorted by execution order). */
+  public ImmutableList<FlowExpressionInfo> stageExpressions;
+}
diff --git a/java/com/google/gerrit/extensions/common/FlowStageInfo.java b/java/com/google/gerrit/extensions/common/FlowStageInfo.java
new file mode 100644
index 0000000..a6d6787
--- /dev/null
+++ b/java/com/google/gerrit/extensions/common/FlowStageInfo.java
@@ -0,0 +1,38 @@
+// Copyright (C) 2025 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.google.gerrit.extensions.common;
+
+/**
+ * Representation of a stage in a flow in the REST API.
+ *
+ * <p>This class determines the JSON format of stages in flows in the REST API.
+ *
+ * <p>A stage in a flow consists out of a flow expression that defines an action that should be
+ * triggered when a condition becomes satisfied and a status.
+ */
+public class FlowStageInfo {
+  /** The expression defining the condition and the action of this stage. */
+  public FlowExpressionInfo expression;
+
+  /** The status for this stage. */
+  public FlowStageStatus status;
+
+  /**
+   * Optional message for the stage.
+   *
+   * <p>May be unset.
+   */
+  public String message;
+}
diff --git a/java/com/google/gerrit/extensions/common/FlowStageStatus.java b/java/com/google/gerrit/extensions/common/FlowStageStatus.java
new file mode 100644
index 0000000..4b94e5d
--- /dev/null
+++ b/java/com/google/gerrit/extensions/common/FlowStageStatus.java
@@ -0,0 +1,33 @@
+// Copyright (C) 2025 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.google.gerrit.extensions.common;
+
+/** Status of a stage in a flow in the REST API. */
+public enum FlowStageStatus {
+  /** The condition of the stage is not satisfied yet or the action has not been executed yet. */
+  PENDING,
+
+  /** The condition of the stage is satisfied and the action has been executed. */
+  DONE,
+
+  /** The stage has a non-recoverable error, e.g. performing the action has failed. */
+  FAILED,
+
+  /**
+   * The stage has been terminated without having been executed, e.g. because a previous stage
+   * failed or because it wasn't done within a timeout.
+   */
+  TERMINATED;
+}
diff --git a/java/com/google/gerrit/extensions/common/testing/AccountInfoSubject.java b/java/com/google/gerrit/extensions/common/testing/AccountInfoSubject.java
index 8fa6617..bdf5088 100644
--- a/java/com/google/gerrit/extensions/common/testing/AccountInfoSubject.java
+++ b/java/com/google/gerrit/extensions/common/testing/AccountInfoSubject.java
@@ -16,9 +16,11 @@
 
 import static com.google.common.truth.Truth.assertAbout;
 
+import com.google.common.truth.ComparableSubject;
 import com.google.common.truth.FailureMetadata;
 import com.google.common.truth.IntegerSubject;
 import com.google.common.truth.Subject;
+import com.google.gerrit.entities.Account;
 import com.google.gerrit.extensions.common.AccountInfo;
 
 /** A Truth subject for {@link AccountInfo} instances. */
@@ -39,8 +41,12 @@
     this.accountInfo = accountInfo;
   }
 
-  public IntegerSubject id() {
-    return check("id").that(accountInfo()._accountId);
+  public IntegerSubject hasIdThat() {
+    return check("id()").that(accountInfo()._accountId);
+  }
+
+  public ComparableSubject<Account.Id> hasAccountIdThat() {
+    return check("accountId()").that(Account.id(accountInfo()._accountId));
   }
 
   private AccountInfo accountInfo() {
diff --git a/java/com/google/gerrit/extensions/common/testing/BUILD b/java/com/google/gerrit/extensions/common/testing/BUILD
index c126928..d30cb63 100644
--- a/java/com/google/gerrit/extensions/common/testing/BUILD
+++ b/java/com/google/gerrit/extensions/common/testing/BUILD
@@ -8,6 +8,8 @@
     deps = [
         "//java/com/google/gerrit/entities",
         "//java/com/google/gerrit/extensions:api",
+        "//java/com/google/gerrit/server",
+        "//java/com/google/gerrit/server/restapi",
         "//java/com/google/gerrit/truth",
         "//lib:guava",
         "//lib:jgit",
diff --git a/java/com/google/gerrit/extensions/common/testing/FlowActionInfoSubject.java b/java/com/google/gerrit/extensions/common/testing/FlowActionInfoSubject.java
new file mode 100644
index 0000000..52a46d4
--- /dev/null
+++ b/java/com/google/gerrit/extensions/common/testing/FlowActionInfoSubject.java
@@ -0,0 +1,55 @@
+// Copyright (C) 2025 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.google.gerrit.extensions.common.testing;
+
+import static com.google.common.truth.Truth.assertAbout;
+import static com.google.gerrit.truth.MapSubject.mapEntries;
+
+import com.google.common.truth.FailureMetadata;
+import com.google.common.truth.StringSubject;
+import com.google.common.truth.Subject;
+import com.google.gerrit.extensions.common.FlowActionInfo;
+import com.google.gerrit.truth.MapSubject;
+
+/** A Truth subject for {@link FlowActionInfo} instances. */
+public class FlowActionInfoSubject extends Subject {
+  private final FlowActionInfo flowActionInfo;
+
+  public static FlowActionInfoSubject assertThat(FlowActionInfo flowActionInfo) {
+    return assertAbout(flowActions()).that(flowActionInfo);
+  }
+
+  public static Factory<FlowActionInfoSubject, FlowActionInfo> flowActions() {
+    return FlowActionInfoSubject::new;
+  }
+
+  private FlowActionInfoSubject(FailureMetadata metadata, FlowActionInfo flowActionInfo) {
+    super(metadata, flowActionInfo);
+    this.flowActionInfo = flowActionInfo;
+  }
+
+  public StringSubject hasNameThat() {
+    return check("name()").that(flowActionInfo().name);
+  }
+
+  public MapSubject hasParametersThat() {
+    return check("parameters()").about(mapEntries()).that(flowActionInfo().parameters);
+  }
+
+  private FlowActionInfo flowActionInfo() {
+    isNotNull();
+    return flowActionInfo;
+  }
+}
diff --git a/java/com/google/gerrit/extensions/common/testing/FlowExpressionInfoSubject.java b/java/com/google/gerrit/extensions/common/testing/FlowExpressionInfoSubject.java
new file mode 100644
index 0000000..259a4d9
--- /dev/null
+++ b/java/com/google/gerrit/extensions/common/testing/FlowExpressionInfoSubject.java
@@ -0,0 +1,55 @@
+// Copyright (C) 2025 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.google.gerrit.extensions.common.testing;
+
+import static com.google.common.truth.Truth.assertAbout;
+import static com.google.gerrit.extensions.common.testing.FlowActionInfoSubject.flowActions;
+
+import com.google.common.truth.FailureMetadata;
+import com.google.common.truth.StringSubject;
+import com.google.common.truth.Subject;
+import com.google.gerrit.extensions.common.FlowExpressionInfo;
+
+/** A Truth subject for {@link FlowExpressionInfo} instances. */
+public class FlowExpressionInfoSubject extends Subject {
+  private final FlowExpressionInfo flowExpressionInfo;
+
+  public static FlowExpressionInfoSubject assertThat(FlowExpressionInfo flowExpressionInfo) {
+    return assertAbout(flowExpressions()).that(flowExpressionInfo);
+  }
+
+  public static Factory<FlowExpressionInfoSubject, FlowExpressionInfo> flowExpressions() {
+    return FlowExpressionInfoSubject::new;
+  }
+
+  private FlowExpressionInfoSubject(
+      FailureMetadata metadata, FlowExpressionInfo flowExpressionInfo) {
+    super(metadata, flowExpressionInfo);
+    this.flowExpressionInfo = flowExpressionInfo;
+  }
+
+  public StringSubject hasConditionThat() {
+    return check("condition()").that(flowExpressionInfo().condition);
+  }
+
+  public FlowActionInfoSubject hasActionThat() {
+    return check("action()").about(flowActions()).that(flowExpressionInfo().action);
+  }
+
+  private FlowExpressionInfo flowExpressionInfo() {
+    isNotNull();
+    return flowExpressionInfo;
+  }
+}
diff --git a/java/com/google/gerrit/extensions/common/testing/FlowInfoSubject.java b/java/com/google/gerrit/extensions/common/testing/FlowInfoSubject.java
new file mode 100644
index 0000000..f4c0d48
--- /dev/null
+++ b/java/com/google/gerrit/extensions/common/testing/FlowInfoSubject.java
@@ -0,0 +1,155 @@
+// Copyright (C) 2025 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.google.gerrit.extensions.common.testing;
+
+import static com.google.common.truth.Truth.assertAbout;
+import static com.google.gerrit.extensions.common.testing.AccountInfoSubject.accounts;
+import static com.google.gerrit.truth.ListSubject.elements;
+import static com.google.gerrit.truth.OptionalSubject.optionals;
+
+import com.google.common.collect.ImmutableMap;
+import com.google.common.truth.ComparableSubject;
+import com.google.common.truth.FailureMetadata;
+import com.google.common.truth.StringSubject;
+import com.google.common.truth.Subject;
+import com.google.gerrit.extensions.common.FlowExpressionInfo;
+import com.google.gerrit.extensions.common.FlowInfo;
+import com.google.gerrit.extensions.common.FlowInput;
+import com.google.gerrit.extensions.common.FlowStageInfo;
+import com.google.gerrit.extensions.common.FlowStageStatus;
+import com.google.gerrit.server.flow.Flow;
+import com.google.gerrit.server.flow.FlowStage;
+import com.google.gerrit.server.restapi.flow.FlowJson;
+import com.google.gerrit.truth.ListSubject;
+import com.google.gerrit.truth.OptionalSubject;
+import java.sql.Timestamp;
+import java.time.Instant;
+import java.util.Optional;
+
+/** A Truth subject for {@link FlowInfo} instances. */
+public class FlowInfoSubject extends Subject {
+  private final FailureMetadata metadata;
+  private final FlowInfo flowInfo;
+
+  public static FlowInfoSubject assertThat(FlowInfo flowInfo) {
+    return assertAbout(flows()).that(flowInfo);
+  }
+
+  public static Factory<FlowInfoSubject, FlowInfo> flows() {
+    return FlowInfoSubject::new;
+  }
+
+  private FlowInfoSubject(FailureMetadata metadata, FlowInfo flowInfo) {
+    super(metadata, flowInfo);
+    this.metadata = metadata;
+    this.flowInfo = flowInfo;
+  }
+
+  public StringSubject hasUuidThat() {
+    return check("uuid()").that(flowInfo().uuid);
+  }
+
+  public AccountInfoSubject hasOwnerThat() {
+    return check("owner()").about(accounts()).that(flowInfo().owner);
+  }
+
+  public ComparableSubject<Instant> hasCreatedThat() {
+    return check("created()").that(flowInfo().created.toInstant());
+  }
+
+  public ListSubject<FlowStageInfoSubject, FlowStageInfo> hasStagesThat() {
+    return check("stages()")
+        .about(elements())
+        .thatCustom(flowInfo().stages, FlowStageInfoSubject.flowStages());
+  }
+
+  public OptionalSubject<ComparableSubject<Instant>, ?> hasLastEvaluated() {
+    return check("lastEvaluated()")
+        .about(optionals())
+        .thatCustom(
+            Optional.ofNullable(flowInfo().lastEvaluated).map(Timestamp::toInstant),
+            (builder, value) -> new ComparableSubject<>(metadata, value) {});
+  }
+
+  /**
+   * Asserts that the properties of this {@link FlowInfo} match with the properties of the given
+   * {@link FlowInput} instance.
+   */
+  public void matches(FlowInput flowInput) {
+    hasUuidThat().isNotEmpty();
+    hasLastEvaluated().isEmpty();
+
+    hasStagesThat().hasSize(flowInput.stageExpressions.size());
+
+    for (int i = 0; i < flowInput.stageExpressions.size(); i++) {
+      FlowExpressionInfo flowExpressionInfo = flowInput.stageExpressions.get(i);
+      FlowStageInfoSubject stageSubject = hasStagesThat().element(i);
+      stageSubject.hasStatusThat().isEqualTo(FlowStageStatus.PENDING);
+      stageSubject.hasExpressionThat().hasConditionThat().isEqualTo(flowExpressionInfo.condition);
+      stageSubject
+          .hasExpressionThat()
+          .hasActionThat()
+          .hasNameThat()
+          .isEqualTo(flowExpressionInfo.action.name);
+      stageSubject
+          .hasExpressionThat()
+          .hasActionThat()
+          .hasParametersThat()
+          .isEqualTo(
+              flowExpressionInfo.action.parameters != null
+                  ? flowExpressionInfo.action.parameters
+                  : ImmutableMap.of());
+    }
+  }
+
+  /**
+   * Asserts that the properties of this {@link FlowInfo} match with the properties of the given
+   * {@link Flow} instance.
+   */
+  public void matches(Flow flow) {
+    hasUuidThat().isEqualTo(flow.key().uuid());
+    hasOwnerThat().hasAccountIdThat().isEqualTo(flow.ownerId());
+    hasCreatedThat().isEqualTo(flow.createdOn());
+    hasLastEvaluated().isEqualTo(flow.lastEvaluatedOn());
+
+    hasStagesThat().hasSize(flow.stages().size());
+
+    for (int i = 0; i < flow.stages().size(); i++) {
+      FlowStage flowStage = flow.stages().get(i);
+
+      FlowStageInfoSubject stageSubject = hasStagesThat().element(i);
+      stageSubject.hasStatusThat().isEqualTo(FlowJson.mapStatus(flowStage.status()));
+      stageSubject
+          .hasExpressionThat()
+          .hasConditionThat()
+          .isEqualTo(flowStage.expression().condition());
+      stageSubject
+          .hasExpressionThat()
+          .hasActionThat()
+          .hasNameThat()
+          .isEqualTo(flowStage.expression().action().name());
+      stageSubject
+          .hasExpressionThat()
+          .hasActionThat()
+          .hasParametersThat()
+          .isEqualTo(flowStage.expression().action().parameters());
+    }
+  }
+
+  private FlowInfo flowInfo() {
+    isNotNull();
+    return flowInfo;
+  }
+}
diff --git a/java/com/google/gerrit/extensions/common/testing/FlowStageInfoSubject.java b/java/com/google/gerrit/extensions/common/testing/FlowStageInfoSubject.java
new file mode 100644
index 0000000..4dba30c
--- /dev/null
+++ b/java/com/google/gerrit/extensions/common/testing/FlowStageInfoSubject.java
@@ -0,0 +1,55 @@
+// Copyright (C) 2025 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.google.gerrit.extensions.common.testing;
+
+import static com.google.common.truth.Truth.assertAbout;
+import static com.google.gerrit.extensions.common.testing.FlowExpressionInfoSubject.flowExpressions;
+
+import com.google.common.truth.ComparableSubject;
+import com.google.common.truth.FailureMetadata;
+import com.google.common.truth.Subject;
+import com.google.gerrit.extensions.common.FlowStageInfo;
+import com.google.gerrit.extensions.common.FlowStageStatus;
+
+/** A Truth subject for {@link FlowStageInfo} instances. */
+public class FlowStageInfoSubject extends Subject {
+  private final FlowStageInfo flowStageInfo;
+
+  public static FlowStageInfoSubject assertThat(FlowStageInfo flowStageInfo) {
+    return assertAbout(flowStages()).that(flowStageInfo);
+  }
+
+  public static Factory<FlowStageInfoSubject, FlowStageInfo> flowStages() {
+    return FlowStageInfoSubject::new;
+  }
+
+  private FlowStageInfoSubject(FailureMetadata metadata, FlowStageInfo flowStageInfo) {
+    super(metadata, flowStageInfo);
+    this.flowStageInfo = flowStageInfo;
+  }
+
+  public FlowExpressionInfoSubject hasExpressionThat() {
+    return check("expression()").about(flowExpressions()).that(flowStageInfo().expression);
+  }
+
+  public ComparableSubject<FlowStageStatus> hasStatusThat() {
+    return check("status()").that(flowStageInfo().status);
+  }
+
+  private FlowStageInfo flowStageInfo() {
+    isNotNull();
+    return flowStageInfo;
+  }
+}
diff --git a/java/com/google/gerrit/httpd/CacheBasedWebSession.java b/java/com/google/gerrit/httpd/CacheBasedWebSession.java
index 4ccd05a..89ae3c4 100644
--- a/java/com/google/gerrit/httpd/CacheBasedWebSession.java
+++ b/java/com/google/gerrit/httpd/CacheBasedWebSession.java
@@ -268,7 +268,6 @@
     outCookie.setSecure(isSecure(request));
     outCookie.setPath(path);
     outCookie.setMaxAge(ageSeconds);
-    outCookie.setSecure(authConfig.getCookieSecure());
     outCookie.setHttpOnly(authConfig.getCookieHttpOnly());
     response.addCookie(outCookie);
   }
diff --git a/java/com/google/gerrit/httpd/XsrfCookieFilter.java b/java/com/google/gerrit/httpd/XsrfCookieFilter.java
index 079efa4..7d01e48 100644
--- a/java/com/google/gerrit/httpd/XsrfCookieFilter.java
+++ b/java/com/google/gerrit/httpd/XsrfCookieFilter.java
@@ -18,7 +18,6 @@
 
 import com.google.gerrit.extensions.registration.DynamicItem;
 import com.google.gerrit.server.CurrentUser;
-import com.google.gerrit.server.config.AuthConfig;
 import com.google.inject.Inject;
 import com.google.inject.Provider;
 import com.google.inject.Singleton;
@@ -38,14 +37,11 @@
 public class XsrfCookieFilter implements Filter {
   private final Provider<CurrentUser> user;
   private final DynamicItem<WebSession> session;
-  private final AuthConfig authConfig;
 
   @Inject
-  XsrfCookieFilter(
-      Provider<CurrentUser> user, DynamicItem<WebSession> session, AuthConfig authConfig) {
+  XsrfCookieFilter(Provider<CurrentUser> user, DynamicItem<WebSession> session) {
     this.user = user;
     this.session = session;
-    this.authConfig = authConfig;
   }
 
   @Override
@@ -64,7 +60,7 @@
     String v = session != null ? session.getXGerritAuth() : null;
     Cookie c = new Cookie(XsrfConstants.XSRF_COOKIE_NAME, nullToEmpty(v));
     c.setPath("/");
-    c.setSecure(authConfig.getCookieSecure() && isSecure(req));
+    c.setSecure(isSecure(req));
     c.setMaxAge(
         v != null
             ? -1 // Set the cookie for this browser session.
diff --git a/java/com/google/gerrit/server/api/changes/ChangeApiImpl.java b/java/com/google/gerrit/server/api/changes/ChangeApiImpl.java
index ba95dee..62f1f4b 100644
--- a/java/com/google/gerrit/server/api/changes/ChangeApiImpl.java
+++ b/java/com/google/gerrit/server/api/changes/ChangeApiImpl.java
@@ -30,6 +30,7 @@
 import com.google.gerrit.extensions.api.changes.Changes;
 import com.google.gerrit.extensions.api.changes.CustomKeyedValuesInput;
 import com.google.gerrit.extensions.api.changes.FixInput;
+import com.google.gerrit.extensions.api.changes.FlowApi;
 import com.google.gerrit.extensions.api.changes.HashtagsInput;
 import com.google.gerrit.extensions.api.changes.IncludedInInfo;
 import com.google.gerrit.extensions.api.changes.MoveInput;
@@ -52,6 +53,8 @@
 import com.google.gerrit.extensions.common.CommentInfo;
 import com.google.gerrit.extensions.common.CommitMessageInfo;
 import com.google.gerrit.extensions.common.CommitMessageInput;
+import com.google.gerrit.extensions.common.FlowInfo;
+import com.google.gerrit.extensions.common.FlowInput;
 import com.google.gerrit.extensions.common.Input;
 import com.google.gerrit.extensions.common.InputWithMessage;
 import com.google.gerrit.extensions.common.MergePatchSetInput;
@@ -112,6 +115,9 @@
 import com.google.gerrit.server.restapi.change.SetWorkInProgress;
 import com.google.gerrit.server.restapi.change.SubmittedTogether;
 import com.google.gerrit.server.restapi.change.SuggestChangeReviewers;
+import com.google.gerrit.server.restapi.flow.CreateFlow;
+import com.google.gerrit.server.restapi.flow.FlowCollection;
+import com.google.gerrit.server.restapi.flow.ListFlows;
 import com.google.gerrit.util.cli.CmdLineParser;
 import com.google.inject.Inject;
 import com.google.inject.Injector;
@@ -132,9 +138,11 @@
   private final Changes changeApi;
   private final Reviewers reviewers;
   private final Revisions revisions;
+  private final FlowCollection flowCollection;
   private final ReviewerApiImpl.Factory reviewerApi;
   private final RevisionApiImpl.Factory revisionApi;
   private final ChangeMessageApiImpl.Factory changeMessageApi;
+  private final FlowApiImpl.Factory flowApi;
   private final ChangeMessages changeMessages;
   private final SuggestChangeReviewers suggestReviewers;
   private final ListReviewers listReviewers;
@@ -176,6 +184,8 @@
   private final SetReadyForReview setReady;
   private final GetMessage getMessage;
   private final PutMessage putMessage;
+  private final CreateFlow createFlow;
+  private final ListFlows listFlows;
   private final Provider<GetPureRevert> getPureRevertProvider;
   private final DynamicOptionParser dynamicOptionParser;
   private final Injector injector;
@@ -186,9 +196,11 @@
       Changes changeApi,
       Reviewers reviewers,
       Revisions revisions,
+      FlowCollection flowCollection,
       ReviewerApiImpl.Factory reviewerApi,
       RevisionApiImpl.Factory revisionApi,
       ChangeMessageApiImpl.Factory changeMessageApi,
+      FlowApiImpl.Factory flowApi,
       ChangeMessages changeMessages,
       SuggestChangeReviewers suggestReviewers,
       ListReviewers listReviewers,
@@ -229,6 +241,8 @@
       SetReadyForReview setReady,
       GetMessage getMessage,
       PutMessage putMessage,
+      CreateFlow createFlow,
+      ListFlows listFlows,
       Provider<GetPureRevert> getPureRevertProvider,
       DynamicOptionParser dynamicOptionParser,
       @Assisted ChangeResource change,
@@ -239,9 +253,11 @@
     this.revertSubmission = revertSubmission;
     this.reviewers = reviewers;
     this.revisions = revisions;
+    this.flowCollection = flowCollection;
     this.reviewerApi = reviewerApi;
     this.revisionApi = revisionApi;
     this.changeMessageApi = changeMessageApi;
+    this.flowApi = flowApi;
     this.changeMessages = changeMessages;
     this.suggestReviewers = suggestReviewers;
     this.listReviewers = listReviewers;
@@ -280,6 +296,8 @@
     this.setReady = setReady;
     this.getMessage = getMessage;
     this.putMessage = putMessage;
+    this.createFlow = createFlow;
+    this.listFlows = listFlows;
     this.getPureRevertProvider = getPureRevertProvider;
     this.dynamicOptionParser = dynamicOptionParser;
     this.change = change;
@@ -311,6 +329,33 @@
   }
 
   @Override
+  public FlowInfo createFlow(FlowInput flowInput) throws RestApiException {
+    try {
+      return createFlow.apply(change, flowInput).value();
+    } catch (Exception e) {
+      throw asRestApiException("Cannot parse reviewer", e);
+    }
+  }
+
+  @Override
+  public FlowApi flow(String flowUuid) throws RestApiException {
+    try {
+      return flowApi.create(flowCollection.parse(change, IdString.fromDecoded(flowUuid)));
+    } catch (Exception e) {
+      throw asRestApiException("Cannot parse flow", e);
+    }
+  }
+
+  @Override
+  public List<FlowInfo> flows() throws RestApiException {
+    try {
+      return listFlows.apply(change).value();
+    } catch (Exception e) {
+      throw asRestApiException("Cannot list flows", e);
+    }
+  }
+
+  @Override
   public void abandon(AbandonInput in) throws RestApiException {
     try {
       @SuppressWarnings("unused")
diff --git a/java/com/google/gerrit/server/api/changes/ChangesModule.java b/java/com/google/gerrit/server/api/changes/ChangesModule.java
index 20a927b..038dc31 100644
--- a/java/com/google/gerrit/server/api/changes/ChangesModule.java
+++ b/java/com/google/gerrit/server/api/changes/ChangesModule.java
@@ -32,5 +32,6 @@
     factory(ChangeEditApiImpl.Factory.class);
     factory(ChangeMessageApiImpl.Factory.class);
     factory(AttentionSetApiImpl.Factory.class);
+    factory(FlowApiImpl.Factory.class);
   }
 }
diff --git a/java/com/google/gerrit/server/api/changes/FlowApiImpl.java b/java/com/google/gerrit/server/api/changes/FlowApiImpl.java
new file mode 100644
index 0000000..7e7a616
--- /dev/null
+++ b/java/com/google/gerrit/server/api/changes/FlowApiImpl.java
@@ -0,0 +1,62 @@
+// Copyright (C) 2025 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.google.gerrit.server.api.changes;
+
+import static com.google.gerrit.server.api.ApiUtil.asRestApiException;
+
+import com.google.gerrit.extensions.api.changes.FlowApi;
+import com.google.gerrit.extensions.common.FlowInfo;
+import com.google.gerrit.extensions.common.Input;
+import com.google.gerrit.extensions.restapi.RestApiException;
+import com.google.gerrit.server.restapi.flow.DeleteFlow;
+import com.google.gerrit.server.restapi.flow.FlowResource;
+import com.google.gerrit.server.restapi.flow.GetFlow;
+import com.google.inject.Inject;
+import com.google.inject.assistedinject.Assisted;
+
+public class FlowApiImpl implements FlowApi {
+  interface Factory {
+    FlowApiImpl create(FlowResource flowResource);
+  }
+
+  private final FlowResource flowResource;
+  private final GetFlow getFlow;
+  private final DeleteFlow deleteFlow;
+
+  @Inject
+  FlowApiImpl(GetFlow getFlow, DeleteFlow deleteFlow, @Assisted FlowResource flowResource) {
+    this.getFlow = getFlow;
+    this.deleteFlow = deleteFlow;
+    this.flowResource = flowResource;
+  }
+
+  @Override
+  public FlowInfo get() throws RestApiException {
+    try {
+      return getFlow.apply(flowResource).value();
+    } catch (Exception e) {
+      throw asRestApiException("Cannot get flow", e);
+    }
+  }
+
+  @Override
+  public void delete() throws RestApiException {
+    try {
+      deleteFlow.apply(flowResource, new Input());
+    } catch (Exception e) {
+      throw asRestApiException("Cannot delete flow", e);
+    }
+  }
+}
diff --git a/java/com/google/gerrit/server/config/AuthConfig.java b/java/com/google/gerrit/server/config/AuthConfig.java
index 1e7fa6a..e4008fa 100644
--- a/java/com/google/gerrit/server/config/AuthConfig.java
+++ b/java/com/google/gerrit/server/config/AuthConfig.java
@@ -61,7 +61,6 @@
   private final List<OpenIdProviderPattern> allowedOpenIDs;
   private final String cookiePath;
   private final String cookieDomain;
-  private final boolean cookieSecure;
   private final boolean cookieHttpOnly;
   private final SignedToken emailReg;
   private final boolean allowRegisterNewEmail;
@@ -92,7 +91,6 @@
     allowedOpenIDs = toPatterns(cfg, "allowedOpenID");
     cookiePath = cfg.getString("auth", null, "cookiepath");
     cookieDomain = cfg.getString("auth", null, "cookiedomain");
-    cookieSecure = cfg.getBoolean("auth", "cookiesecure", false);
     cookieHttpOnly = cfg.getBoolean("auth", "cookiehttponly", true);
     trustContainerAuth = cfg.getBoolean("auth", "trustContainerAuth", false);
     enableRunAs = cfg.getBoolean("auth", null, "enableRunAs", true);
@@ -220,10 +218,6 @@
     return cookieDomain;
   }
 
-  public boolean getCookieSecure() {
-    return cookieSecure;
-  }
-
   public boolean getCookieHttpOnly() {
     return cookieHttpOnly;
   }
diff --git a/java/com/google/gerrit/server/experiments/ExperimentFeaturesConstants.java b/java/com/google/gerrit/server/experiments/ExperimentFeaturesConstants.java
index eb81ee1..cd91745 100644
--- a/java/com/google/gerrit/server/experiments/ExperimentFeaturesConstants.java
+++ b/java/com/google/gerrit/server/experiments/ExperimentFeaturesConstants.java
@@ -60,12 +60,4 @@
   /** Whether we allow fix suggestions in HumanComments. */
   public static final String ALLOW_FIX_SUGGESTIONS_IN_COMMENTS =
       "GerritBackendFeature__allow_fix_suggestions_in_comments";
-
-  /**
-   * Whether the submit operation that is executed to auto-merge a change on push (see
-   * https://gerrit-review.googlesource.com/Documentation/user-upload.html#auto_merge) should use a
-   * {@code RefUpdateContext} with type {@code DIRECT_PUSH}.
-   */
-  public static String GERRIT_BACKEND_FEATURE_USE_DIRECT_PUSH_CONTEXT_FOR_SUBMIT_ON_PUSH =
-      "GerritBackendFeature__use_direct_push_context_for_submit_on_push";
 }
diff --git a/java/com/google/gerrit/server/flow/Flow.java b/java/com/google/gerrit/server/flow/Flow.java
index c81bc61..843db84 100644
--- a/java/com/google/gerrit/server/flow/Flow.java
+++ b/java/com/google/gerrit/server/flow/Flow.java
@@ -55,6 +55,9 @@
    */
   public abstract Optional<Instant> lastEvaluatedOn();
 
+  /** Creates a {@link Builder} for this flow instance. */
+  public abstract Builder toBuilder();
+
   /**
    * Creates a builder for building a flow.
    *
diff --git a/java/com/google/gerrit/server/flow/FlowPermissionDeniedException.java b/java/com/google/gerrit/server/flow/FlowPermissionDeniedException.java
new file mode 100644
index 0000000..d22b00f
--- /dev/null
+++ b/java/com/google/gerrit/server/flow/FlowPermissionDeniedException.java
@@ -0,0 +1,31 @@
+// Copyright (C) 2025 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.google.gerrit.server.flow;
+
+/**
+ * Exception to be thrown either directly or subclassed indicating that a flow operation was denied
+ * due to missing permissions.
+ */
+public class FlowPermissionDeniedException extends Exception {
+  private static final long serialVersionUID = 1L;
+
+  public FlowPermissionDeniedException(String reason) {
+    super(reason);
+  }
+
+  public FlowPermissionDeniedException(String reason, Throwable why) {
+    super(reason, why);
+  }
+}
diff --git a/java/com/google/gerrit/server/flow/FlowService.java b/java/com/google/gerrit/server/flow/FlowService.java
index 6353abf..32d8b56 100644
--- a/java/com/google/gerrit/server/flow/FlowService.java
+++ b/java/com/google/gerrit/server/flow/FlowService.java
@@ -39,17 +39,19 @@
    *
    * @param flowCreation parameters needed for the flow creation
    * @return the newly created flow
+   * @throws FlowPermissionDeniedException thrown if the caller is not allowed to create the flow
    * @throws InvalidFlowException thrown is the flow to be created is invalid
    * @throws StorageException thrown if storing the flow has failed
    */
   @CanIgnoreReturnValue
-  Flow createFlow(FlowCreation flowCreation) throws InvalidFlowException, StorageException;
+  Flow createFlow(FlowCreation flowCreation)
+      throws FlowPermissionDeniedException, InvalidFlowException, StorageException;
 
   /**
    * Retrieves a flow.
    *
    * @param flowKey the key of the flow
-   * @return the flow if it was found, otherwise {@link Optional#empty()}
+   * @return the flow if it was found and the user can see it, otherwise {@link Optional#empty()}
    * @throws StorageException thrown if accessing the flow storage has failed
    */
   Optional<Flow> getFlow(FlowKey flowKey) throws StorageException;
@@ -58,15 +60,20 @@
    * Deletes a flow
    *
    * @param flowKey the key of the flow
-   * @return the deleted flow, {@link Optional#empty()} if no flow with the given key was found
+   * @return the deleted flow, {@link Optional#empty()} if no flow with the given key was found or
+   *     if the flow is not visible to the current user
+   * @throws FlowPermissionDeniedException thrown if the caller can see the flow and is not allowed
+   *     to delete it
    * @throws StorageException thrown if deleting the flow has failed
    */
   @CanIgnoreReturnValue
-  Optional<Flow> deleteFlow(FlowKey flowKey) throws StorageException;
+  Optional<Flow> deleteFlow(FlowKey flowKey) throws FlowPermissionDeniedException, StorageException;
 
   /**
    * Lists the flows for one change.
    *
+   * <p>The order of the returned flows is stable, but depends on the flow service implementation.
+   *
    * @param projectName The name of the project that contains the change.
    * @param changeId The ID of the change for which the flows should be listed.
    * @return The flows of the change. The service may filter out flows that are not visible to the
diff --git a/java/com/google/gerrit/server/flow/FlowStage.java b/java/com/google/gerrit/server/flow/FlowStage.java
index 76d1a86..28feff1 100644
--- a/java/com/google/gerrit/server/flow/FlowStage.java
+++ b/java/com/google/gerrit/server/flow/FlowStage.java
@@ -52,6 +52,9 @@
   /** A message for this stage, e.g. to inform about execution errors. */
   public abstract Optional<String> message();
 
+  /** Creates a {@link Builder} for this flow stage instance. */
+  public abstract Builder toBuilder();
+
   public static FlowStage.Builder builder() {
     return new AutoValue_FlowStage.Builder();
   }
@@ -68,6 +71,9 @@
     /** Set a message for this flow stage, e.g. to inform about execution errors. */
     public abstract Builder message(String message);
 
+    /** Set a message for this flow stage, e.g. to inform about execution errors. */
+    public abstract Builder message(Optional<String> message);
+
     /** Builds the {@link FlowStage}. */
     public abstract FlowStage build();
   }
diff --git a/java/com/google/gerrit/server/git/TransferConfig.java b/java/com/google/gerrit/server/git/TransferConfig.java
index 728e4ed..caf03bf 100644
--- a/java/com/google/gerrit/server/git/TransferConfig.java
+++ b/java/com/google/gerrit/server/git/TransferConfig.java
@@ -39,7 +39,7 @@
                 "transfer",
                 null,
                 "timeout", //
-                0,
+                60,
                 TimeUnit.SECONDS);
     maxObjectSizeLimit = cfg.getLong("receive", "maxObjectSizeLimit", 0);
     maxObjectSizeLimitFormatted = cfg.getString("receive", null, "maxObjectSizeLimit");
diff --git a/java/com/google/gerrit/server/git/receive/ReceiveCommits.java b/java/com/google/gerrit/server/git/receive/ReceiveCommits.java
index 6bd191f..a458d6a 100644
--- a/java/com/google/gerrit/server/git/receive/ReceiveCommits.java
+++ b/java/com/google/gerrit/server/git/receive/ReceiveCommits.java
@@ -138,8 +138,6 @@
 import com.google.gerrit.server.config.ProjectConfigEntry;
 import com.google.gerrit.server.edit.ChangeEdit;
 import com.google.gerrit.server.edit.ChangeEditUtil;
-import com.google.gerrit.server.experiments.ExperimentFeatures;
-import com.google.gerrit.server.experiments.ExperimentFeaturesConstants;
 import com.google.gerrit.server.git.BanCommit;
 import com.google.gerrit.server.git.ChangeReportFormatter;
 import com.google.gerrit.server.git.GroupCollector;
@@ -149,7 +147,6 @@
 import com.google.gerrit.server.git.ReceivePackInitializer;
 import com.google.gerrit.server.git.TagCache;
 import com.google.gerrit.server.git.ValidationError;
-import com.google.gerrit.server.git.receive.ReceiveCommits.MagicBranchInput;
 import com.google.gerrit.server.git.receive.RejectionReason.MetricBucket;
 import com.google.gerrit.server.git.validators.CommentCountValidator;
 import com.google.gerrit.server.git.validators.CommentSizeValidator;
@@ -411,7 +408,6 @@
   private final CreateRefControl createRefControl;
   private final DeadlineChecker.Factory deadlineCheckerFactory;
   private final DiffOperationsForCommitValidation.Factory diffOperationsForCommitValidationFactory;
-  private final ExperimentFeatures experimentFeatures;
   private final DynamicMap<ProjectConfigEntry> pluginConfigEntries;
   private final DynamicSet<PushOptionsValidator> pushOptionsValidators;
   private final DynamicSet<PluginPushOption> pluginPushOptions;
@@ -513,7 +509,6 @@
       CreateRefControl createRefControl,
       DeadlineChecker.Factory deadlineCheckerFactory,
       DiffOperationsForCommitValidation.Factory diffOperationsForCommitValidationFactory,
-      ExperimentFeatures experimentFeatures,
       DynamicMap<ProjectConfigEntry> pluginConfigEntries,
       DynamicSet<PushOptionsValidator> pushOptionsValidators,
       DynamicSet<PluginPushOption> pluginPushOptions,
@@ -571,7 +566,6 @@
     this.createGroupPermissionSyncer = createGroupPermissionSyncer;
     this.deadlineCheckerFactory = deadlineCheckerFactory;
     this.diffOperationsForCommitValidationFactory = diffOperationsForCommitValidationFactory;
-    this.experimentFeatures = experimentFeatures;
     this.editUtil = editUtil;
     this.exceptionHooks = exceptionHooks;
     this.hashtagsFactory = hashtagsFactory;
@@ -1229,13 +1223,7 @@
       // RefUpdateContext to do the direct submit.
       Optional<String> justification =
           pushOptions.get(DIRECT_PUSH_JUSTIFICATION_OPTION).stream().findFirst();
-      try (RefUpdateContext ctx =
-          experimentFeatures.isFeatureEnabled(
-                  ExperimentFeaturesConstants
-                      .GERRIT_BACKEND_FEATURE_USE_DIRECT_PUSH_CONTEXT_FOR_SUBMIT_ON_PUSH,
-                  project.getNameKey())
-              ? RefUpdateContext.openDirectPush(justification)
-              : RefUpdateContext.open(CHANGE_MODIFICATION)) {
+      try (RefUpdateContext ctx = RefUpdateContext.openDirectPush(justification)) {
         try (TraceTimer traceTimer =
             newTimer(
                 "insertChangesAndPatchSets#submit",
diff --git a/java/com/google/gerrit/server/mail/send/SmtpEmailSender.java b/java/com/google/gerrit/server/mail/send/SmtpEmailSender.java
index 456c1e7..7e5855d 100644
--- a/java/com/google/gerrit/server/mail/send/SmtpEmailSender.java
+++ b/java/com/google/gerrit/server/mail/send/SmtpEmailSender.java
@@ -61,10 +61,10 @@
 @Singleton
 public class SmtpEmailSender implements EmailSender {
   /** The socket's connect timeout (0 = infinite timeout) */
-  private static final int DEFAULT_CONNECT_TIMEOUT = 0;
+  private static final int DEFAULT_CONNECT_TIMEOUT = 10000;
 
   /** The socket's socket read timeout (0 = infinite timeout) */
-  private static final int DEFAULT_SOCKET_TIMEOUT = 0;
+  private static final int DEFAULT_SOCKET_TIMEOUT = 10000;
 
   private static final FluentLogger logger = FluentLogger.forEnclosingClass();
 
diff --git a/java/com/google/gerrit/server/project/PrologRulesWarningValidator.java b/java/com/google/gerrit/server/project/PrologRulesWarningValidator.java
index e32100e..fa75ba7 100644
--- a/java/com/google/gerrit/server/project/PrologRulesWarningValidator.java
+++ b/java/com/google/gerrit/server/project/PrologRulesWarningValidator.java
@@ -47,7 +47,7 @@
 
   @Inject
   public PrologRulesWarningValidator(@GerritServerConfig Config cfg) {
-    this.allowNewRules = cfg.getBoolean("rules", "allowNewRules", true);
+    this.allowNewRules = cfg.getBoolean("rules", "allowNewRules", false);
   }
 
   @Override
diff --git a/java/com/google/gerrit/server/restapi/RestApiModule.java b/java/com/google/gerrit/server/restapi/RestApiModule.java
index 3bc5bb8..6982028 100644
--- a/java/com/google/gerrit/server/restapi/RestApiModule.java
+++ b/java/com/google/gerrit/server/restapi/RestApiModule.java
@@ -21,6 +21,7 @@
 import com.google.gerrit.server.restapi.change.ChangeRestApiModule;
 import com.google.gerrit.server.restapi.config.ConfigRestApiModule;
 import com.google.gerrit.server.restapi.config.RestCacheAdminModule;
+import com.google.gerrit.server.restapi.flow.FlowRestApiModule;
 import com.google.gerrit.server.restapi.group.GroupRestApiModule;
 import com.google.gerrit.server.restapi.project.ProjectRestApiModule;
 import com.google.inject.AbstractModule;
@@ -40,6 +41,7 @@
     install(new ChangeRestApiModule());
     install(new ConfigRestApiModule());
     install(new RestCacheAdminModule());
+    install(new FlowRestApiModule());
     install(new GroupRestApiModule());
     install(new PluginRestApiModule());
     install(new ProjectRestApiModule());
diff --git a/java/com/google/gerrit/server/restapi/flow/CreateFlow.java b/java/com/google/gerrit/server/restapi/flow/CreateFlow.java
new file mode 100644
index 0000000..a7c4f07
--- /dev/null
+++ b/java/com/google/gerrit/server/restapi/flow/CreateFlow.java
@@ -0,0 +1,79 @@
+// Copyright (C) 2025 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.google.gerrit.server.restapi.flow;
+
+import com.google.gerrit.extensions.common.FlowInfo;
+import com.google.gerrit.extensions.common.FlowInput;
+import com.google.gerrit.extensions.restapi.AuthException;
+import com.google.gerrit.extensions.restapi.BadRequestException;
+import com.google.gerrit.extensions.restapi.MethodNotAllowedException;
+import com.google.gerrit.extensions.restapi.Response;
+import com.google.gerrit.extensions.restapi.RestCollectionModifyView;
+import com.google.gerrit.server.CurrentUser;
+import com.google.gerrit.server.change.ChangeResource;
+import com.google.gerrit.server.flow.Flow;
+import com.google.gerrit.server.flow.FlowCreation;
+import com.google.gerrit.server.flow.FlowPermissionDeniedException;
+import com.google.gerrit.server.flow.FlowServiceUtil;
+import com.google.gerrit.server.flow.InvalidFlowException;
+import com.google.inject.Inject;
+import com.google.inject.Provider;
+import com.google.inject.Singleton;
+
+/**
+ * REST endpoint to create a flow .
+ *
+ * <p>This REST endpoint handles {@code POST /change/<change-id>/flows} requests.
+ */
+@Singleton
+public class CreateFlow
+    implements RestCollectionModifyView<ChangeResource, FlowResource, FlowInput> {
+  private final FlowServiceUtil flowServiceUtil;
+  private final Provider<CurrentUser> self;
+
+  @Inject
+  CreateFlow(FlowServiceUtil flowServiceUtil, Provider<CurrentUser> self) {
+    this.flowServiceUtil = flowServiceUtil;
+    this.self = self;
+  }
+
+  @Override
+  public Response<FlowInfo> apply(ChangeResource changeResource, FlowInput flowInput)
+      throws AuthException, BadRequestException, MethodNotAllowedException {
+    if (!self.get().isIdentifiedUser()) {
+      throw new AuthException("Authentication required");
+    }
+
+    if (flowInput == null) {
+      flowInput = new FlowInput();
+    }
+
+    FlowCreation flowCreation =
+        FlowJson.createFlowCreation(
+            changeResource.getProject(),
+            changeResource.getId(),
+            self.get().asIdentifiedUser().getAccountId(),
+            flowInput);
+
+    try {
+      Flow flow = flowServiceUtil.getFlowServiceOrThrow().createFlow(flowCreation);
+      return Response.created(FlowJson.format(flow));
+    } catch (FlowPermissionDeniedException e) {
+      throw new AuthException(e.getMessage(), e);
+    } catch (InvalidFlowException e) {
+      throw new BadRequestException(e.getMessage(), e);
+    }
+  }
+}
diff --git a/java/com/google/gerrit/server/restapi/flow/DeleteFlow.java b/java/com/google/gerrit/server/restapi/flow/DeleteFlow.java
new file mode 100644
index 0000000..07dc216
--- /dev/null
+++ b/java/com/google/gerrit/server/restapi/flow/DeleteFlow.java
@@ -0,0 +1,63 @@
+// Copyright (C) 2025 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.google.gerrit.server.restapi.flow;
+
+import com.google.errorprone.annotations.CanIgnoreReturnValue;
+import com.google.gerrit.extensions.common.FlowInfo;
+import com.google.gerrit.extensions.common.Input;
+import com.google.gerrit.extensions.restapi.AuthException;
+import com.google.gerrit.extensions.restapi.MethodNotAllowedException;
+import com.google.gerrit.extensions.restapi.Response;
+import com.google.gerrit.extensions.restapi.RestModifyView;
+import com.google.gerrit.server.CurrentUser;
+import com.google.gerrit.server.flow.FlowPermissionDeniedException;
+import com.google.gerrit.server.flow.FlowServiceUtil;
+import com.google.inject.Inject;
+import com.google.inject.Provider;
+import com.google.inject.Singleton;
+
+/**
+ * REST endpoint to delete a flow .
+ *
+ * <p>This REST endpoint handles {@code DELETE /change/<change-id>/flows/<flow-id>} requests.
+ */
+@Singleton
+public class DeleteFlow implements RestModifyView<FlowResource, Input> {
+  private final FlowServiceUtil flowServiceUtil;
+  private final Provider<CurrentUser> self;
+
+  @Inject
+  DeleteFlow(FlowServiceUtil flowServiceUtil, Provider<CurrentUser> self) {
+    this.flowServiceUtil = flowServiceUtil;
+    this.self = self;
+  }
+
+  @CanIgnoreReturnValue
+  @Override
+  public Response<FlowInfo> apply(FlowResource flowResource, Input input)
+      throws AuthException, MethodNotAllowedException {
+    if (!self.get().isIdentifiedUser()) {
+      throw new AuthException("Authentication required");
+    }
+
+    try {
+      flowServiceUtil.getFlowServiceOrThrow().deleteFlow(flowResource.getFlow().key());
+    } catch (FlowPermissionDeniedException e) {
+      throw new AuthException(e.getMessage(), e);
+    }
+
+    return Response.none();
+  }
+}
diff --git a/java/com/google/gerrit/server/restapi/flow/FlowCollection.java b/java/com/google/gerrit/server/restapi/flow/FlowCollection.java
new file mode 100644
index 0000000..ce703e9
--- /dev/null
+++ b/java/com/google/gerrit/server/restapi/flow/FlowCollection.java
@@ -0,0 +1,72 @@
+// Copyright (C) 2025 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.google.gerrit.server.restapi.flow;
+
+import com.google.gerrit.extensions.registration.DynamicMap;
+import com.google.gerrit.extensions.restapi.ChildCollection;
+import com.google.gerrit.extensions.restapi.IdString;
+import com.google.gerrit.extensions.restapi.MethodNotAllowedException;
+import com.google.gerrit.extensions.restapi.ResourceNotFoundException;
+import com.google.gerrit.extensions.restapi.RestView;
+import com.google.gerrit.server.change.ChangeResource;
+import com.google.gerrit.server.flow.Flow;
+import com.google.gerrit.server.flow.FlowKey;
+import com.google.gerrit.server.flow.FlowServiceUtil;
+import com.google.inject.Inject;
+import com.google.inject.Singleton;
+
+/** REST collection that serves requests to {@code /changes/<change-id>/flows}. */
+@Singleton
+public class FlowCollection implements ChildCollection<ChangeResource, FlowResource> {
+  private final FlowServiceUtil flowServiceUtil;
+  private final DynamicMap<RestView<FlowResource>> views;
+  private final ListFlows listFlows;
+
+  @Inject
+  FlowCollection(
+      FlowServiceUtil flowServiceUtil,
+      ListFlows listFlows,
+      DynamicMap<RestView<FlowResource>> views) {
+    this.flowServiceUtil = flowServiceUtil;
+    this.listFlows = listFlows;
+    this.views = views;
+  }
+
+  @Override
+  public RestView<ChangeResource> list() {
+    return listFlows;
+  }
+
+  @Override
+  public FlowResource parse(ChangeResource changeResource, IdString flowUuid)
+      throws ResourceNotFoundException, MethodNotAllowedException {
+    FlowKey flowKey =
+        FlowKey.create(changeResource.getProject(), changeResource.getId(), flowUuid.get());
+    Flow flow =
+        flowServiceUtil
+            .getFlowServiceOrThrow()
+            .getFlow(flowKey)
+            .orElseThrow(
+                () ->
+                    new ResourceNotFoundException(
+                        String.format("Flow %s not found.", flowUuid.get())));
+    return new FlowResource(flow);
+  }
+
+  @Override
+  public DynamicMap<RestView<FlowResource>> views() {
+    return views;
+  }
+}
diff --git a/java/com/google/gerrit/server/restapi/flow/FlowJson.java b/java/com/google/gerrit/server/restapi/flow/FlowJson.java
new file mode 100644
index 0000000..c926c29
--- /dev/null
+++ b/java/com/google/gerrit/server/restapi/flow/FlowJson.java
@@ -0,0 +1,184 @@
+// Copyright (C) 2025 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.google.gerrit.server.restapi.flow;
+
+import static com.google.common.collect.ImmutableList.toImmutableList;
+import static java.util.Objects.requireNonNull;
+
+import com.google.common.annotations.VisibleForTesting;
+import com.google.common.base.Strings;
+import com.google.gerrit.entities.Account;
+import com.google.gerrit.entities.Change;
+import com.google.gerrit.entities.Project;
+import com.google.gerrit.extensions.common.AccountInfo;
+import com.google.gerrit.extensions.common.FlowActionInfo;
+import com.google.gerrit.extensions.common.FlowExpressionInfo;
+import com.google.gerrit.extensions.common.FlowInfo;
+import com.google.gerrit.extensions.common.FlowInput;
+import com.google.gerrit.extensions.common.FlowStageInfo;
+import com.google.gerrit.extensions.common.FlowStageStatus;
+import com.google.gerrit.extensions.restapi.BadRequestException;
+import com.google.gerrit.server.flow.Flow;
+import com.google.gerrit.server.flow.FlowAction;
+import com.google.gerrit.server.flow.FlowCreation;
+import com.google.gerrit.server.flow.FlowExpression;
+import com.google.gerrit.server.flow.FlowStage;
+
+/**
+ * Produces flow-related entities, like {@link FlowInfo}s, which are serialized to JSON afterwards.
+ */
+public class FlowJson {
+  /** Formats the given {@link Flow} instance as a {@link FlowInfo}. */
+  public static FlowInfo format(Flow flow) {
+    requireNonNull(flow, "flow");
+
+    FlowInfo flowInfo = new FlowInfo();
+    flowInfo.uuid = flow.key().uuid();
+    flowInfo.owner = new AccountInfo(flow.ownerId().get());
+    flowInfo.setCreated(flow.createdOn());
+    flowInfo.stages = flow.stages().stream().map(FlowJson::format).collect(toImmutableList());
+
+    if (flow.lastEvaluatedOn().isPresent()) {
+      flowInfo.setLastEvaluated(flow.lastEvaluatedOn().get());
+    }
+
+    return flowInfo;
+  }
+
+  /** Formats the given {@link FlowStage} instance as a {@link FlowStageInfo}. */
+  private static FlowStageInfo format(FlowStage flowStage) {
+    requireNonNull(flowStage, "flowStage");
+
+    FlowStageInfo flowStageInfo = new FlowStageInfo();
+    flowStageInfo.expression = format(flowStage.expression());
+    flowStageInfo.status = mapStatus(flowStage.status());
+    flowStageInfo.message = flowStage.message().orElse(null);
+    return flowStageInfo;
+  }
+
+  /** Formats the given {@link FlowExpression} instance as a {@link FlowExpressionInfo}. */
+  private static FlowExpressionInfo format(FlowExpression flowExpression) {
+    requireNonNull(flowExpression, "flowExpression");
+
+    FlowExpressionInfo flowExpressionInfo = new FlowExpressionInfo();
+    flowExpressionInfo.condition = flowExpression.condition();
+    flowExpressionInfo.action = format(flowExpression.action());
+    return flowExpressionInfo;
+  }
+
+  /** Formats the given {@link FlowAction} instance as a {@link FlowActionInfo}. */
+  private static FlowActionInfo format(FlowAction flowAction) {
+    requireNonNull(flowAction, "flowAction");
+
+    FlowActionInfo flowActionInfo = new FlowActionInfo();
+    flowActionInfo.name = flowAction.name();
+    flowActionInfo.parameters = flowAction.parameters();
+    return flowActionInfo;
+  }
+
+  /**
+   * Maps the given {@link com.google.gerrit.server.flow.FlowStage.Status} to a {@link
+   * FlowStageStatus}.
+   */
+  @VisibleForTesting
+  public static FlowStageStatus mapStatus(FlowStage.Status flowStageStatus) {
+    requireNonNull(flowStageStatus, "flowStageStatus");
+
+    return switch (flowStageStatus) {
+      case DONE -> FlowStageStatus.DONE;
+      case PENDING -> FlowStageStatus.PENDING;
+      case FAILED -> FlowStageStatus.FAILED;
+      case TERMINATED -> FlowStageStatus.TERMINATED;
+    };
+  }
+
+  /**
+   * Create a {@link FlowCreation} from the given {@link FlowInput}.
+   *
+   * @throws BadRequestException thrown if mandatory properties are missing
+   */
+  public static FlowCreation createFlowCreation(
+      Project.NameKey projectName, Change.Id changeId, Account.Id ownerId, FlowInput flowInput)
+      throws BadRequestException {
+    requireNonNull(projectName, "projectName");
+    requireNonNull(changeId, "changeId");
+    requireNonNull(ownerId, "ownerId");
+    requireNonNull(flowInput, "flowInput");
+
+    if (flowInput.stageExpressions == null || flowInput.stageExpressions.isEmpty()) {
+      throw new BadRequestException("at least one stage expression is required");
+    }
+
+    FlowCreation.Builder flowCreationBuilder =
+        FlowCreation.builder().projectName(projectName).changeId(changeId).ownerId(ownerId);
+
+    for (FlowExpressionInfo flowExpressionInfo : flowInput.stageExpressions) {
+      flowCreationBuilder.addStageExpression(createFlowExpression(flowExpressionInfo));
+    }
+
+    return flowCreationBuilder.build();
+  }
+
+  /**
+   * Create a {@link FlowExpression} from the given {@link FlowExpressionInfo}.
+   *
+   * @throws BadRequestException thrown if mandatory properties are missing
+   */
+  public static FlowExpression createFlowExpression(FlowExpressionInfo flowExpressionInfo)
+      throws BadRequestException {
+    requireNonNull(flowExpressionInfo, "flowExpressionInfo");
+
+    if (Strings.isNullOrEmpty(flowExpressionInfo.condition)) {
+      throw new BadRequestException("condition in stage expression is required");
+    }
+    if (flowExpressionInfo.action == null) {
+      throw new BadRequestException("action in stage expression is required");
+    }
+
+    return FlowExpression.builder()
+        .condition(flowExpressionInfo.condition)
+        .action(createFlowAction(flowExpressionInfo.action))
+        .build();
+  }
+
+  /**
+   * Create a {@link FlowAction} from the given {@link FlowActionInfo}.
+   *
+   * @throws BadRequestException thrown if mandatory properties are missing
+   */
+  public static FlowAction createFlowAction(FlowActionInfo flowActionInfo)
+      throws BadRequestException {
+    requireNonNull(flowActionInfo, "flowActionInfo");
+
+    if (Strings.isNullOrEmpty(flowActionInfo.name)) {
+      throw new BadRequestException("name in action is required");
+    }
+
+    FlowAction.Builder flowActionBuilder = FlowAction.builder().name(flowActionInfo.name);
+
+    if (flowActionInfo.parameters != null) {
+      flowActionBuilder.parameters(flowActionInfo.parameters);
+    }
+
+    return flowActionBuilder.build();
+  }
+
+  /**
+   * Private constructor to prevent instantiation of this class.
+   *
+   * <p>This class contains only static methods and hence never needs to be instantiated.
+   */
+  private FlowJson() {}
+}
diff --git a/java/com/google/gerrit/server/restapi/flow/FlowResource.java b/java/com/google/gerrit/server/restapi/flow/FlowResource.java
new file mode 100644
index 0000000..7a45cb5
--- /dev/null
+++ b/java/com/google/gerrit/server/restapi/flow/FlowResource.java
@@ -0,0 +1,35 @@
+// Copyright (C) 2025 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.google.gerrit.server.restapi.flow;
+
+import com.google.gerrit.extensions.restapi.RestResource;
+import com.google.gerrit.extensions.restapi.RestView;
+import com.google.gerrit.server.flow.Flow;
+import com.google.inject.TypeLiteral;
+
+/** REST resource that represents members in the {@link FlowCollection}. */
+public class FlowResource implements RestResource {
+  public static final TypeLiteral<RestView<FlowResource>> FLOW_KIND = new TypeLiteral<>() {};
+
+  private final Flow flow;
+
+  public FlowResource(Flow flow) {
+    this.flow = flow;
+  }
+
+  public Flow getFlow() {
+    return flow;
+  }
+}
diff --git a/java/com/google/gerrit/server/restapi/flow/FlowRestApiModule.java b/java/com/google/gerrit/server/restapi/flow/FlowRestApiModule.java
new file mode 100644
index 0000000..bcc241f
--- /dev/null
+++ b/java/com/google/gerrit/server/restapi/flow/FlowRestApiModule.java
@@ -0,0 +1,37 @@
+// Copyright (C) 2025 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.google.gerrit.server.restapi.flow;
+
+import static com.google.gerrit.server.change.ChangeResource.CHANGE_KIND;
+import static com.google.gerrit.server.restapi.flow.FlowResource.FLOW_KIND;
+
+import com.google.gerrit.extensions.registration.DynamicMap;
+import com.google.gerrit.extensions.restapi.RestApiModule;
+
+/** Guice module to bind the flow REST API. */
+public class FlowRestApiModule extends RestApiModule {
+  @Override
+  protected void configure() {
+    bind(FlowCollection.class);
+
+    DynamicMap.mapOf(binder(), FLOW_KIND);
+
+    child(CHANGE_KIND, "flows").to(FlowCollection.class);
+    postOnCollection(FLOW_KIND).to(CreateFlow.class);
+
+    get(FLOW_KIND).to(GetFlow.class);
+    delete(FLOW_KIND).to(DeleteFlow.class);
+  }
+}
diff --git a/java/com/google/gerrit/server/restapi/flow/GetFlow.java b/java/com/google/gerrit/server/restapi/flow/GetFlow.java
new file mode 100644
index 0000000..da2fddb
--- /dev/null
+++ b/java/com/google/gerrit/server/restapi/flow/GetFlow.java
@@ -0,0 +1,33 @@
+// Copyright (C) 2025 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.google.gerrit.server.restapi.flow;
+
+import com.google.gerrit.extensions.common.FlowInfo;
+import com.google.gerrit.extensions.restapi.Response;
+import com.google.gerrit.extensions.restapi.RestReadView;
+import com.google.inject.Singleton;
+
+/**
+ * REST endpoint to get a flow .
+ *
+ * <p>This REST endpoint handles {@code GET /change/<change-id>/flows/<flow-id>} requests.
+ */
+@Singleton
+public class GetFlow implements RestReadView<FlowResource> {
+  @Override
+  public Response<FlowInfo> apply(FlowResource flowResource) {
+    return Response.ok(FlowJson.format(flowResource.getFlow()));
+  }
+}
diff --git a/java/com/google/gerrit/server/restapi/flow/ListFlows.java b/java/com/google/gerrit/server/restapi/flow/ListFlows.java
new file mode 100644
index 0000000..0c43e93
--- /dev/null
+++ b/java/com/google/gerrit/server/restapi/flow/ListFlows.java
@@ -0,0 +1,54 @@
+// Copyright (C) 2025 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.google.gerrit.server.restapi.flow;
+
+import static com.google.common.collect.ImmutableList.toImmutableList;
+
+import com.google.common.collect.ImmutableList;
+import com.google.gerrit.extensions.common.FlowInfo;
+import com.google.gerrit.extensions.restapi.MethodNotAllowedException;
+import com.google.gerrit.extensions.restapi.Response;
+import com.google.gerrit.extensions.restapi.RestReadView;
+import com.google.gerrit.server.change.ChangeResource;
+import com.google.gerrit.server.flow.Flow;
+import com.google.gerrit.server.flow.FlowServiceUtil;
+import com.google.inject.Inject;
+import com.google.inject.Singleton;
+import java.util.List;
+
+/**
+ * REST endpoint to list members of the {@link FlowCollection}.
+ *
+ * <p>This REST endpoint handles {@code GET /change/<change-id>/flows} requests.
+ */
+@Singleton
+public class ListFlows implements RestReadView<ChangeResource> {
+  private final FlowServiceUtil flowServiceUtil;
+
+  @Inject
+  ListFlows(FlowServiceUtil flowServiceUtil) {
+    this.flowServiceUtil = flowServiceUtil;
+  }
+
+  @Override
+  public Response<List<FlowInfo>> apply(ChangeResource changeResource)
+      throws MethodNotAllowedException {
+    ImmutableList<Flow> flows =
+        flowServiceUtil
+            .getFlowServiceOrThrow()
+            .listFlows(changeResource.getProject(), changeResource.getId());
+    return Response.ok(flows.stream().map(FlowJson::format).collect(toImmutableList()));
+  }
+}
diff --git a/javatests/com/google/gerrit/acceptance/api/change/ChangeIT.java b/javatests/com/google/gerrit/acceptance/api/change/ChangeIT.java
index e1a3044..8e4ce4e 100644
--- a/javatests/com/google/gerrit/acceptance/api/change/ChangeIT.java
+++ b/javatests/com/google/gerrit/acceptance/api/change/ChangeIT.java
@@ -3797,6 +3797,7 @@
   }
 
   @Test
+  @GerritConfig(name = "rules.allowNewRules", value = "true")
   public void uploadingRulesPlIsNotAllowed() throws Exception {
     GitUtil.fetch(testRepo, RefNames.REFS_CONFIG + ":config");
     testRepo.reset("config");
diff --git a/javatests/com/google/gerrit/acceptance/api/config/ListExperimentsIT.java b/javatests/com/google/gerrit/acceptance/api/config/ListExperimentsIT.java
index 19c1b81..fe3cb00 100644
--- a/javatests/com/google/gerrit/acceptance/api/config/ListExperimentsIT.java
+++ b/javatests/com/google/gerrit/acceptance/api/config/ListExperimentsIT.java
@@ -52,9 +52,7 @@
                 .GERRIT_BACKEND_FEATURE_ALWAYS_REJECT_IMPLICIT_MERGES_ON_MERGE,
             ExperimentFeaturesConstants.GERRIT_BACKEND_FEATURE_ATTACH_NONCE_TO_DOCUMENTATION,
             ExperimentFeaturesConstants.GERRIT_BACKEND_FEATURE_CHECK_IMPLICIT_MERGES_ON_MERGE,
-            ExperimentFeaturesConstants.GERRIT_BACKEND_FEATURE_REJECT_IMPLICIT_MERGES_ON_MERGE,
-            ExperimentFeaturesConstants
-                .GERRIT_BACKEND_FEATURE_USE_DIRECT_PUSH_CONTEXT_FOR_SUBMIT_ON_PUSH)
+            ExperimentFeaturesConstants.GERRIT_BACKEND_FEATURE_REJECT_IMPLICIT_MERGES_ON_MERGE)
         .inOrder();
 
     // "GerritBackendFeature__check_implicit_merges_on_merge",
diff --git a/javatests/com/google/gerrit/acceptance/api/flow/BUILD b/javatests/com/google/gerrit/acceptance/api/flow/BUILD
new file mode 100644
index 0000000..24aea20
--- /dev/null
+++ b/javatests/com/google/gerrit/acceptance/api/flow/BUILD
@@ -0,0 +1,23 @@
+load("//javatests/com/google/gerrit/acceptance:tests.bzl", "acceptance_tests")
+
+acceptance_tests(
+    srcs = glob(["*IT.java"]),
+    group = "api_flow",
+    labels = ["api"],
+    deps = [
+        ":flow-test-util",
+    ],
+)
+
+java_library(
+    name = "flow-test-util",
+    testonly = True,
+    srcs = glob(["FlowTestUtil.java"]),
+    deps = [
+        "//java/com/google/gerrit/acceptance:lib",
+        "//java/com/google/gerrit/entities",
+        "//java/com/google/gerrit/extensions:api",
+        "//java/com/google/gerrit/server",
+        "//lib:guava",
+    ],
+)
diff --git a/javatests/com/google/gerrit/acceptance/api/flow/CreateFlowIT.java b/javatests/com/google/gerrit/acceptance/api/flow/CreateFlowIT.java
new file mode 100644
index 0000000..85ea2db
--- /dev/null
+++ b/javatests/com/google/gerrit/acceptance/api/flow/CreateFlowIT.java
@@ -0,0 +1,241 @@
+// Copyright (C) 2025 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.google.gerrit.acceptance.api.flow;
+
+import static com.google.common.truth.Truth.assertThat;
+import static com.google.gerrit.acceptance.api.flow.FlowTestUtil.createTestFlowInputWithInvalidCondition;
+import static com.google.gerrit.acceptance.api.flow.FlowTestUtil.createTestFlowInputWithMultipleStages;
+import static com.google.gerrit.acceptance.api.flow.FlowTestUtil.createTestFlowInputWithOneStage;
+import static com.google.gerrit.extensions.common.testing.FlowInfoSubject.assertThat;
+import static com.google.gerrit.testing.GerritJUnit.assertThrows;
+
+import com.google.common.collect.ImmutableList;
+import com.google.common.collect.ImmutableMap;
+import com.google.common.collect.Iterables;
+import com.google.gerrit.acceptance.AbstractDaemonTest;
+import com.google.gerrit.acceptance.ExtensionRegistry;
+import com.google.gerrit.acceptance.ExtensionRegistry.Registration;
+import com.google.gerrit.acceptance.TestAccount;
+import com.google.gerrit.acceptance.TestExtensions;
+import com.google.gerrit.acceptance.TestExtensions.TestFlowService;
+import com.google.gerrit.acceptance.testsuite.change.ChangeOperations;
+import com.google.gerrit.acceptance.testsuite.request.RequestScopeOperations;
+import com.google.gerrit.entities.Change;
+import com.google.gerrit.extensions.common.FlowInfo;
+import com.google.gerrit.extensions.common.FlowInput;
+import com.google.gerrit.extensions.restapi.AuthException;
+import com.google.gerrit.extensions.restapi.BadRequestException;
+import com.google.gerrit.extensions.restapi.MethodNotAllowedException;
+import com.google.gerrit.server.flow.FlowKey;
+import com.google.gerrit.server.flow.FlowService;
+import com.google.inject.Inject;
+import java.time.Instant;
+import org.junit.Test;
+
+/**
+ * Integration tests for the {@link com.google.gerrit.server.restapi.flow.CreateFlow} REST endpoint.
+ */
+public class CreateFlowIT extends AbstractDaemonTest {
+  @Inject private ChangeOperations changeOperations;
+  @Inject private RequestScopeOperations requestScopeOperations;
+  @Inject private ExtensionRegistry extensionRegistry;
+
+  @Test
+  public void createFlowIfNoFlowServiceIsBound_methodNotAllowed() throws Exception {
+    Change.Id changeId = changeOperations.newChange().project(project).create();
+    MethodNotAllowedException exception =
+        assertThrows(
+            MethodNotAllowedException.class,
+            () ->
+                gApi.changes()
+                    .id(project.get(), changeId.get())
+                    .createFlow(createTestFlowInputWithOneStage(accountCreator, changeId)));
+    assertThat(exception).hasMessageThat().isEqualTo("No FlowService bound.");
+  }
+
+  @Test
+  public void createFlowWithoutStages_badRequest() throws Exception {
+    Change.Id changeId = changeOperations.newChange().project(project).create();
+    FlowService flowService = new TestExtensions.TestFlowService();
+    try (Registration registration = extensionRegistry.newRegistration().set(flowService)) {
+      FlowInput flowInput = createTestFlowInputWithOneStage(accountCreator, changeId);
+      flowInput.stageExpressions = null;
+      BadRequestException exception =
+          assertThrows(
+              BadRequestException.class,
+              () -> gApi.changes().id(project.get(), changeId.get()).createFlow(flowInput));
+      assertThat(exception).hasMessageThat().isEqualTo("at least one stage expression is required");
+
+      flowInput.stageExpressions = ImmutableList.of();
+      exception =
+          assertThrows(
+              BadRequestException.class,
+              () -> gApi.changes().id(project.get(), changeId.get()).createFlow(flowInput));
+      assertThat(exception).hasMessageThat().isEqualTo("at least one stage expression is required");
+    }
+  }
+
+  @Test
+  public void createFlowWithoutConditionInStageExpression_badRequest() throws Exception {
+    Change.Id changeId = changeOperations.newChange().project(project).create();
+    FlowService flowService = new TestExtensions.TestFlowService();
+    try (Registration registration = extensionRegistry.newRegistration().set(flowService)) {
+      FlowInput flowInput = createTestFlowInputWithOneStage(accountCreator, changeId);
+      Iterables.getOnlyElement(flowInput.stageExpressions).condition = null;
+      BadRequestException exception =
+          assertThrows(
+              BadRequestException.class,
+              () -> gApi.changes().id(project.get(), changeId.get()).createFlow(flowInput));
+      assertThat(exception).hasMessageThat().isEqualTo("condition in stage expression is required");
+
+      Iterables.getOnlyElement(flowInput.stageExpressions).condition = "";
+      exception =
+          assertThrows(
+              BadRequestException.class,
+              () -> gApi.changes().id(project.get(), changeId.get()).createFlow(flowInput));
+      assertThat(exception).hasMessageThat().isEqualTo("condition in stage expression is required");
+    }
+  }
+
+  @Test
+  public void createFlowWithoutActionInStageExpression_badRequest() throws Exception {
+    Change.Id changeId = changeOperations.newChange().project(project).create();
+    FlowService flowService = new TestExtensions.TestFlowService();
+    try (Registration registration = extensionRegistry.newRegistration().set(flowService)) {
+      FlowInput flowInput = createTestFlowInputWithOneStage(accountCreator, changeId);
+      Iterables.getOnlyElement(flowInput.stageExpressions).action = null;
+      BadRequestException exception =
+          assertThrows(
+              BadRequestException.class,
+              () -> gApi.changes().id(project.get(), changeId.get()).createFlow(flowInput));
+      assertThat(exception).hasMessageThat().isEqualTo("action in stage expression is required");
+    }
+  }
+
+  @Test
+  public void createFlowWithoutNameInAction_badRequest() throws Exception {
+    Change.Id changeId = changeOperations.newChange().project(project).create();
+    FlowService flowService = new TestExtensions.TestFlowService();
+    try (Registration registration = extensionRegistry.newRegistration().set(flowService)) {
+      FlowInput flowInput = createTestFlowInputWithOneStage(accountCreator, changeId);
+      Iterables.getOnlyElement(flowInput.stageExpressions).action.name = null;
+      BadRequestException exception =
+          assertThrows(
+              BadRequestException.class,
+              () -> gApi.changes().id(project.get(), changeId.get()).createFlow(flowInput));
+      assertThat(exception).hasMessageThat().isEqualTo("name in action is required");
+
+      Iterables.getOnlyElement(flowInput.stageExpressions).action.name = "";
+      exception =
+          assertThrows(
+              BadRequestException.class,
+              () -> gApi.changes().id(project.get(), changeId.get()).createFlow(flowInput));
+      assertThat(exception).hasMessageThat().isEqualTo("name in action is required");
+    }
+  }
+
+  @Test
+  public void createFlowWithSingleStage() throws Exception {
+    Change.Id changeId = changeOperations.newChange().project(project).create();
+    FlowService flowService = new TestExtensions.TestFlowService();
+    try (Registration registration = extensionRegistry.newRegistration().set(flowService)) {
+      Instant beforeInstant = Instant.now();
+      FlowInput flowInput = createTestFlowInputWithOneStage(accountCreator, changeId);
+      FlowInfo flowInfo = gApi.changes().id(project.get(), changeId.get()).createFlow(flowInput);
+      assertFlowInfoForNewlyCreatedFlow(flowInfo, flowInput, admin, beforeInstant);
+      assertThat(flowService.getFlow(FlowKey.create(project, changeId, flowInfo.uuid))).isPresent();
+    }
+  }
+
+  @Test
+  public void createFlowWithMultipleStage() throws Exception {
+    Change.Id changeId = changeOperations.newChange().project(project).create();
+    FlowService flowService = new TestExtensions.TestFlowService();
+    try (Registration registration = extensionRegistry.newRegistration().set(flowService)) {
+      Instant beforeInstant = Instant.now();
+      FlowInput flowInput = createTestFlowInputWithMultipleStages(accountCreator, changeId);
+      FlowInfo flowInfo = gApi.changes().id(project.get(), changeId.get()).createFlow(flowInput);
+      assertFlowInfoForNewlyCreatedFlow(flowInfo, flowInput, admin, beforeInstant);
+      assertThat(flowService.getFlow(FlowKey.create(project, changeId, flowInfo.uuid))).isPresent();
+    }
+  }
+
+  @Test
+  public void createFlowWithoutParametersInAction() throws Exception {
+    Change.Id changeId = changeOperations.newChange().project(project).create();
+    FlowService flowService = new TestExtensions.TestFlowService();
+    try (Registration registration = extensionRegistry.newRegistration().set(flowService)) {
+      Instant beforeInstant = Instant.now();
+      FlowInput flowInput = createTestFlowInputWithOneStage(accountCreator, changeId);
+      Iterables.getOnlyElement(flowInput.stageExpressions).action.parameters = null;
+      FlowInfo flowInfo = gApi.changes().id(project.get(), changeId.get()).createFlow(flowInput);
+      assertFlowInfoForNewlyCreatedFlow(flowInfo, flowInput, admin, beforeInstant);
+      assertThat(flowService.getFlow(FlowKey.create(project, changeId, flowInfo.uuid))).isPresent();
+
+      Iterables.getOnlyElement(flowInput.stageExpressions).action.parameters = ImmutableMap.of();
+      flowInfo = gApi.changes().id(project.get(), changeId.get()).createFlow(flowInput);
+      assertFlowInfoForNewlyCreatedFlow(flowInfo, flowInput, admin, beforeInstant);
+      assertThat(flowService.getFlow(FlowKey.create(project, changeId, flowInfo.uuid))).isPresent();
+    }
+  }
+
+  @Test
+  public void createFlowWithInvalidCondtition_badRequest() throws Exception {
+    Change.Id changeId = changeOperations.newChange().project(project).create();
+    FlowService flowService = new TestExtensions.TestFlowService();
+    try (Registration registration = extensionRegistry.newRegistration().set(flowService)) {
+      FlowInput flowInput = createTestFlowInputWithInvalidCondition(accountCreator, changeId);
+      assertThrows(
+          BadRequestException.class,
+          () -> gApi.changes().id(project.get(), changeId.get()).createFlow(flowInput));
+    }
+  }
+
+  @Test
+  public void createFlow_authenticationRequired() throws Exception {
+    requestScopeOperations.setApiUserAnonymous();
+    Change.Id changeId = changeOperations.newChange().project(project).create();
+    TestFlowService testFlowService = new TestExtensions.TestFlowService();
+    testFlowService.rejectFlowCreation();
+    try (Registration registration = extensionRegistry.newRegistration().set(testFlowService)) {
+      FlowInput flowInput = createTestFlowInputWithOneStage(accountCreator, changeId);
+      AuthException exception =
+          assertThrows(
+              AuthException.class,
+              () -> gApi.changes().id(project.get(), changeId.get()).createFlow(flowInput));
+      assertThat(exception).hasMessageThat().isEqualTo("Authentication required");
+    }
+  }
+
+  @Test
+  public void createFlow_permissionDenied() throws Exception {
+    Change.Id changeId = changeOperations.newChange().project(project).create();
+    TestFlowService testFlowService = new TestExtensions.TestFlowService();
+    testFlowService.rejectFlowCreation();
+    try (Registration registration = extensionRegistry.newRegistration().set(testFlowService)) {
+      FlowInput flowInput = createTestFlowInputWithOneStage(accountCreator, changeId);
+      assertThrows(
+          AuthException.class,
+          () -> gApi.changes().id(project.get(), changeId.get()).createFlow(flowInput));
+    }
+  }
+
+  private static void assertFlowInfoForNewlyCreatedFlow(
+      FlowInfo flowInfo, FlowInput flowInput, TestAccount owner, Instant beforeInstant) {
+    assertThat(flowInfo).matches(flowInput);
+    assertThat(flowInfo).hasOwnerThat().hasAccountIdThat().isEqualTo(owner.id());
+    assertThat(flowInfo).hasCreatedThat().isAtLeast(beforeInstant);
+  }
+}
diff --git a/javatests/com/google/gerrit/acceptance/api/flow/DeleteFlowIT.java b/javatests/com/google/gerrit/acceptance/api/flow/DeleteFlowIT.java
new file mode 100644
index 0000000..bdbc47b
--- /dev/null
+++ b/javatests/com/google/gerrit/acceptance/api/flow/DeleteFlowIT.java
@@ -0,0 +1,92 @@
+// Copyright (C) 2025 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.google.gerrit.acceptance.api.flow;
+
+import static com.google.common.truth.Truth.assertThat;
+import static com.google.gerrit.acceptance.api.flow.FlowTestUtil.createTestFlowCreationWithOneStage;
+import static com.google.gerrit.testing.GerritJUnit.assertThrows;
+
+import com.google.gerrit.acceptance.AbstractDaemonTest;
+import com.google.gerrit.acceptance.ExtensionRegistry;
+import com.google.gerrit.acceptance.ExtensionRegistry.Registration;
+import com.google.gerrit.acceptance.TestExtensions;
+import com.google.gerrit.acceptance.TestExtensions.TestFlowService;
+import com.google.gerrit.acceptance.testsuite.change.ChangeOperations;
+import com.google.gerrit.acceptance.testsuite.request.RequestScopeOperations;
+import com.google.gerrit.entities.Change;
+import com.google.gerrit.extensions.restapi.AuthException;
+import com.google.gerrit.server.flow.Flow;
+import com.google.gerrit.server.flow.FlowCreation;
+import com.google.gerrit.server.flow.FlowService;
+import com.google.inject.Inject;
+import org.junit.Test;
+
+/**
+ * Integration tests for the {@link com.google.gerrit.server.restapi.flow.DeleteFlow} REST endpoint.
+ */
+public class DeleteFlowIT extends AbstractDaemonTest {
+  @Inject private ChangeOperations changeOperations;
+  @Inject private RequestScopeOperations requestScopeOperations;
+  @Inject private ExtensionRegistry extensionRegistry;
+
+  @Test
+  public void deleteFlow() throws Exception {
+    Change.Id changeId = changeOperations.newChange().project(project).create();
+    FlowService flowService = new TestExtensions.TestFlowService();
+    FlowCreation flowCreation =
+        createTestFlowCreationWithOneStage(accountCreator, project, changeId);
+    Flow flow = flowService.createFlow(flowCreation);
+    try (Registration registration = extensionRegistry.newRegistration().set(flowService)) {
+      gApi.changes().id(project.get(), changeId.get()).flow(flow.key().uuid()).delete();
+      assertThat(flowService.getFlow(flow.key())).isEmpty();
+    }
+  }
+
+  @Test
+  public void deleteFlow_authenticationRequired() throws Exception {
+    requestScopeOperations.setApiUserAnonymous();
+    Change.Id changeId = changeOperations.newChange().project(project).create();
+    FlowService flowService = new TestExtensions.TestFlowService();
+    FlowCreation flowCreation =
+        createTestFlowCreationWithOneStage(accountCreator, project, changeId);
+    Flow flow = flowService.createFlow(flowCreation);
+    try (Registration registration = extensionRegistry.newRegistration().set(flowService)) {
+      AuthException exception =
+          assertThrows(
+              AuthException.class,
+              () ->
+                  gApi.changes()
+                      .id(project.get(), changeId.get())
+                      .flow(flow.key().uuid())
+                      .delete());
+      assertThat(exception).hasMessageThat().isEqualTo("Authentication required");
+    }
+  }
+
+  @Test
+  public void deleteFlow_permissionDenied() throws Exception {
+    Change.Id changeId = changeOperations.newChange().project(project).create();
+    TestFlowService testFlowService = new TestExtensions.TestFlowService();
+    FlowCreation flowCreation =
+        createTestFlowCreationWithOneStage(accountCreator, project, changeId);
+    Flow flow = testFlowService.createFlow(flowCreation);
+    testFlowService.rejectFlowDeletion();
+    try (Registration registration = extensionRegistry.newRegistration().set(testFlowService)) {
+      assertThrows(
+          AuthException.class,
+          () -> gApi.changes().id(project.get(), changeId.get()).flow(flow.key().uuid()).delete());
+    }
+  }
+}
diff --git a/javatests/com/google/gerrit/acceptance/api/flow/FlowTestUtil.java b/javatests/com/google/gerrit/acceptance/api/flow/FlowTestUtil.java
new file mode 100644
index 0000000..787924e
--- /dev/null
+++ b/javatests/com/google/gerrit/acceptance/api/flow/FlowTestUtil.java
@@ -0,0 +1,129 @@
+// Copyright (C) 2025 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.google.gerrit.acceptance.api.flow;
+
+import com.google.common.collect.ImmutableList;
+import com.google.common.collect.ImmutableMap;
+import com.google.gerrit.acceptance.AccountCreator;
+import com.google.gerrit.acceptance.TestExtensions.TestFlowService;
+import com.google.gerrit.entities.Change;
+import com.google.gerrit.entities.Project;
+import com.google.gerrit.extensions.common.FlowActionInfo;
+import com.google.gerrit.extensions.common.FlowExpressionInfo;
+import com.google.gerrit.extensions.common.FlowInput;
+import com.google.gerrit.server.flow.FlowAction;
+import com.google.gerrit.server.flow.FlowCreation;
+import com.google.gerrit.server.flow.FlowExpression;
+
+/**
+ * Methods to create and assert flow entities that are shared between the different flow integration
+ * tests.
+ */
+public class FlowTestUtil {
+  /** Creates a {@link FlowInput} with arbitrary test data that contains one stage. */
+  public static FlowInput createTestFlowInputWithOneStage(
+      AccountCreator accountCreator, Change.Id changeId) throws Exception {
+    return createTestFlowInput(accountCreator, changeId, 1);
+  }
+
+  /** Creates a {@link FlowInput} with arbitrary test data that contains multiple stages. */
+  public static FlowInput createTestFlowInputWithMultipleStages(
+      AccountCreator accountCreator, Change.Id changeId) throws Exception {
+    return createTestFlowInput(accountCreator, changeId, 3);
+  }
+
+  /** Creates a {@link FlowInput} with arbitrary test data that contains an invalid condition. */
+  public static FlowInput createTestFlowInputWithInvalidCondition(
+      AccountCreator accountCreator, Change.Id changeId) throws Exception {
+    FlowInput flowInput = createTestFlowInput(accountCreator, changeId, 1);
+    flowInput.stageExpressions.get(0).condition = TestFlowService.INVALID_CONDITION;
+    return flowInput;
+  }
+
+  /** Creates a {@link FlowInput} with arbitrary test data and as many stages as specified. */
+  private static FlowInput createTestFlowInput(
+      AccountCreator accountCreator, Change.Id changeId, int numberOfStages) throws Exception {
+    FlowInput flowInput = new FlowInput();
+
+    ImmutableList.Builder<FlowExpressionInfo> stageExpressionsBuilder = ImmutableList.builder();
+    for (int i = 0; i < numberOfStages; i++) {
+      FlowExpressionInfo flowExpressionInfo = new FlowExpressionInfo();
+      flowExpressionInfo.condition =
+          String.format("com.google.gerrit[change:%s label:Verified+%s]", changeId, i);
+
+      FlowActionInfo flowActionInfo = new FlowActionInfo();
+      flowActionInfo.name = "AddReviewer";
+      flowActionInfo.parameters =
+          ImmutableMap.of("user", accountCreator.createValid("reviewer" + i).email());
+      flowExpressionInfo.action = flowActionInfo;
+
+      stageExpressionsBuilder.add(flowExpressionInfo);
+    }
+
+    flowInput.stageExpressions = stageExpressionsBuilder.build();
+
+    return flowInput;
+  }
+
+  /** Creates a {@link FlowCreation} with arbitrary test data that contains one stage. */
+  public static FlowCreation createTestFlowCreationWithOneStage(
+      AccountCreator accountCreator, Project.NameKey projectName, Change.Id changeId)
+      throws Exception {
+    return createTestFlowCreation(accountCreator, projectName, changeId, 1);
+  }
+
+  /** Creates a {@link FlowCreation} with arbitrary test data that contains multiple stages. */
+  public static FlowCreation createTestFlowCreationWithMultipleStages(
+      AccountCreator accountCreator, Project.NameKey projectName, Change.Id changeId)
+      throws Exception {
+    return createTestFlowCreation(accountCreator, projectName, changeId, 3);
+  }
+
+  /** Creates a {@link FlowCreation} with arbitrary test data and as many stages as specified. */
+  public static FlowCreation createTestFlowCreation(
+      AccountCreator accountCreator,
+      Project.NameKey projectName,
+      Change.Id changeId,
+      int numberOfStages)
+      throws Exception {
+    FlowCreation.Builder flowCreationBuilder =
+        FlowCreation.builder()
+            .projectName(projectName)
+            .changeId(changeId)
+            .ownerId(accountCreator.createValid("owner").id());
+
+    for (int i = 0; i < numberOfStages; i++) {
+      flowCreationBuilder.addStageExpression(
+          FlowExpression.builder()
+              .condition(
+                  String.format("com.google.gerrit[change:%s label:Verified+%s]", changeId, i))
+              .action(
+                  FlowAction.builder()
+                      .name("AddReviewer")
+                      .addParameter("user", accountCreator.createValid("reviewer" + i).email())
+                      .build())
+              .build());
+    }
+
+    return flowCreationBuilder.build();
+  }
+
+  /**
+   * Private constructor to prevent instantiation of this class.
+   *
+   * <p>This class contains only static methods and hence never needs to be instantiated.
+   */
+  private FlowTestUtil() {}
+}
diff --git a/javatests/com/google/gerrit/acceptance/api/flow/GetFlowIT.java b/javatests/com/google/gerrit/acceptance/api/flow/GetFlowIT.java
new file mode 100644
index 0000000..2565fea
--- /dev/null
+++ b/javatests/com/google/gerrit/acceptance/api/flow/GetFlowIT.java
@@ -0,0 +1,142 @@
+// Copyright (C) 2025 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.google.gerrit.acceptance.api.flow;
+
+import static com.google.common.truth.Truth.assertThat;
+import static com.google.gerrit.acceptance.api.flow.FlowTestUtil.createTestFlowCreation;
+import static com.google.gerrit.acceptance.api.flow.FlowTestUtil.createTestFlowCreationWithMultipleStages;
+import static com.google.gerrit.acceptance.api.flow.FlowTestUtil.createTestFlowCreationWithOneStage;
+import static com.google.gerrit.extensions.common.testing.FlowInfoSubject.assertThat;
+import static com.google.gerrit.testing.GerritJUnit.assertThrows;
+
+import com.google.common.collect.ImmutableList;
+import com.google.gerrit.acceptance.AbstractDaemonTest;
+import com.google.gerrit.acceptance.ExtensionRegistry;
+import com.google.gerrit.acceptance.ExtensionRegistry.Registration;
+import com.google.gerrit.acceptance.TestExtensions;
+import com.google.gerrit.acceptance.TestExtensions.TestFlowService;
+import com.google.gerrit.acceptance.testsuite.change.ChangeOperations;
+import com.google.gerrit.entities.Change;
+import com.google.gerrit.extensions.common.FlowInfo;
+import com.google.gerrit.extensions.restapi.MethodNotAllowedException;
+import com.google.gerrit.extensions.restapi.ResourceNotFoundException;
+import com.google.gerrit.server.flow.Flow;
+import com.google.gerrit.server.flow.FlowCreation;
+import com.google.gerrit.server.flow.FlowService;
+import com.google.gerrit.server.flow.FlowStage;
+import com.google.inject.Inject;
+import java.util.Optional;
+import org.junit.Test;
+
+/**
+ * Integration tests for the {@link com.google.gerrit.server.restapi.flow.GetFlow} REST endpoint.
+ */
+public class GetFlowIT extends AbstractDaemonTest {
+  @Inject private ChangeOperations changeOperations;
+  @Inject private ExtensionRegistry extensionRegistry;
+
+  @Test
+  public void getFlowIfNoFlowServiceIsBound_methodNotAllowed() throws Exception {
+    Change.Id changeId = changeOperations.newChange().project(project).create();
+    MethodNotAllowedException exception =
+        assertThrows(
+            MethodNotAllowedException.class,
+            () -> gApi.changes().id(project.get(), changeId.get()).flow("flow-uuid"));
+    assertThat(exception).hasMessageThat().isEqualTo("No FlowService bound.");
+  }
+
+  @Test
+  public void getNonExistingFlow_notFound() throws Exception {
+    Change.Id changeId = changeOperations.newChange().project(project).create();
+    FlowService flowService = new TestExtensions.TestFlowService();
+    try (Registration registration = extensionRegistry.newRegistration().set(flowService)) {
+      ResourceNotFoundException exception =
+          assertThrows(
+              ResourceNotFoundException.class,
+              () ->
+                  gApi.changes().id(project.get(), changeId.get()).flow("non-existing-flow-uuid"));
+      assertThat(exception).hasMessageThat().isEqualTo("Flow non-existing-flow-uuid not found.");
+    }
+  }
+
+  @Test
+  public void getFlowWithSingleStage_notYetEvaluated() throws Exception {
+    Change.Id changeId = changeOperations.newChange().project(project).create();
+    FlowService flowService = new TestExtensions.TestFlowService();
+    FlowCreation flowCreation =
+        createTestFlowCreationWithOneStage(accountCreator, project, changeId);
+    Flow flow = flowService.createFlow(flowCreation);
+    try (Registration registration = extensionRegistry.newRegistration().set(flowService)) {
+      FlowInfo flowInfo =
+          gApi.changes().id(project.get(), changeId.get()).flow(flow.key().uuid()).get();
+      assertThat(flowInfo).matches(flow);
+    }
+  }
+
+  @Test
+  public void getFlowWithSingleStage_evaluated() throws Exception {
+    Change.Id changeId = changeOperations.newChange().project(project).create();
+    TestFlowService testFlowService = new TestExtensions.TestFlowService();
+    FlowCreation flowCreation =
+        createTestFlowCreationWithOneStage(accountCreator, project, changeId);
+    Flow flow = testFlowService.createFlow(flowCreation);
+    flow =
+        testFlowService.evaluate(
+            flow.key(),
+            ImmutableList.of(FlowStage.Status.DONE),
+            ImmutableList.of(Optional.of("done")));
+    try (Registration registration = extensionRegistry.newRegistration().set(testFlowService)) {
+      FlowInfo flowInfo =
+          gApi.changes().id(project.get(), changeId.get()).flow(flow.key().uuid()).get();
+      assertThat(flowInfo).matches(flow);
+    }
+  }
+
+  @Test
+  public void getFlowWithMultipleStages_notYetEvaluated() throws Exception {
+    Change.Id changeId = changeOperations.newChange().project(project).create();
+    FlowService flowService = new TestExtensions.TestFlowService();
+    FlowCreation flowCreation =
+        createTestFlowCreationWithMultipleStages(accountCreator, project, changeId);
+    Flow flow = flowService.createFlow(flowCreation);
+    try (Registration registration = extensionRegistry.newRegistration().set(flowService)) {
+      FlowInfo flowInfo =
+          gApi.changes().id(project.get(), changeId.get()).flow(flow.key().uuid()).get();
+      assertThat(flowInfo).matches(flow);
+    }
+  }
+
+  @Test
+  public void getFlowWithMultipleStages_evaluated() throws Exception {
+    Change.Id changeId = changeOperations.newChange().project(project).create();
+    TestFlowService testFlowService = new TestExtensions.TestFlowService();
+    FlowCreation flowCreation = createTestFlowCreation(accountCreator, project, changeId, 3);
+    Flow flow = testFlowService.createFlow(flowCreation);
+    flow =
+        testFlowService.evaluate(
+            flow.key(),
+            ImmutableList.of(
+                FlowStage.Status.DONE, FlowStage.Status.FAILED, FlowStage.Status.TERMINATED),
+            ImmutableList.of(
+                Optional.empty(),
+                Optional.of("error"),
+                Optional.of("terminated because previous stage failed")));
+    try (Registration registration = extensionRegistry.newRegistration().set(testFlowService)) {
+      FlowInfo flowInfo =
+          gApi.changes().id(project.get(), changeId.get()).flow(flow.key().uuid()).get();
+      assertThat(flowInfo).matches(flow);
+    }
+  }
+}
diff --git a/javatests/com/google/gerrit/acceptance/api/flow/ListFlowsIT.java b/javatests/com/google/gerrit/acceptance/api/flow/ListFlowsIT.java
new file mode 100644
index 0000000..8b14c8d
--- /dev/null
+++ b/javatests/com/google/gerrit/acceptance/api/flow/ListFlowsIT.java
@@ -0,0 +1,114 @@
+// Copyright (C) 2025 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.google.gerrit.acceptance.api.flow;
+
+import static com.google.common.collect.ImmutableMap.toImmutableMap;
+import static com.google.common.truth.Truth.assertThat;
+import static com.google.gerrit.acceptance.api.flow.FlowTestUtil.createTestFlowCreation;
+import static com.google.gerrit.acceptance.api.flow.FlowTestUtil.createTestFlowCreationWithMultipleStages;
+import static com.google.gerrit.acceptance.api.flow.FlowTestUtil.createTestFlowCreationWithOneStage;
+import static com.google.gerrit.extensions.common.testing.FlowInfoSubject.assertThat;
+import static com.google.gerrit.testing.GerritJUnit.assertThrows;
+
+import com.google.common.collect.ImmutableList;
+import com.google.common.collect.ImmutableMap;
+import com.google.gerrit.acceptance.AbstractDaemonTest;
+import com.google.gerrit.acceptance.ExtensionRegistry;
+import com.google.gerrit.acceptance.ExtensionRegistry.Registration;
+import com.google.gerrit.acceptance.TestExtensions;
+import com.google.gerrit.acceptance.TestExtensions.TestFlowService;
+import com.google.gerrit.acceptance.testsuite.change.ChangeOperations;
+import com.google.gerrit.entities.Change;
+import com.google.gerrit.extensions.common.FlowInfo;
+import com.google.gerrit.extensions.restapi.MethodNotAllowedException;
+import com.google.gerrit.server.flow.Flow;
+import com.google.gerrit.server.flow.FlowService;
+import com.google.gerrit.server.flow.FlowStage;
+import com.google.inject.Inject;
+import java.util.List;
+import java.util.Optional;
+import java.util.function.Function;
+import org.junit.Test;
+
+/**
+ * Integration tests for the {@link com.google.gerrit.server.restapi.flow.ListFlows} REST endpoint.
+ */
+public class ListFlowsIT extends AbstractDaemonTest {
+  @Inject private ChangeOperations changeOperations;
+  @Inject private ExtensionRegistry extensionRegistry;
+
+  @Test
+  public void listFlowsIfNoFlowServiceIsBound_methodNotAllowed() throws Exception {
+    Change.Id changeId = changeOperations.newChange().project(project).create();
+    MethodNotAllowedException exception =
+        assertThrows(
+            MethodNotAllowedException.class,
+            () -> gApi.changes().id(project.get(), changeId.get()).flows());
+    assertThat(exception).hasMessageThat().isEqualTo("No FlowService bound.");
+  }
+
+  @Test
+  public void listFlow_noFlowsExist() throws Exception {
+    Change.Id changeId = changeOperations.newChange().project(project).create();
+    FlowService flowService = new TestExtensions.TestFlowService();
+    try (Registration registration = extensionRegistry.newRegistration().set(flowService)) {
+      List<FlowInfo> flows = gApi.changes().id(project.get(), changeId.get()).flows();
+      assertThat(flows).isEmpty();
+    }
+  }
+
+  @Test
+  public void listFlows() throws Exception {
+    Change.Id changeId = changeOperations.newChange().project(project).create();
+    TestFlowService testFlowService = new TestExtensions.TestFlowService();
+    Flow flow1 =
+        testFlowService.createFlow(
+            createTestFlowCreationWithOneStage(accountCreator, project, changeId));
+    Flow flow2 =
+        testFlowService.createFlow(
+            createTestFlowCreationWithOneStage(accountCreator, project, changeId));
+    flow2 =
+        testFlowService.evaluate(
+            flow2.key(),
+            ImmutableList.of(FlowStage.Status.DONE),
+            ImmutableList.of(Optional.of("done")));
+    Flow flow3 =
+        testFlowService.createFlow(
+            createTestFlowCreationWithMultipleStages(accountCreator, project, changeId));
+    Flow flow4 =
+        testFlowService.createFlow(createTestFlowCreation(accountCreator, project, changeId, 3));
+    flow4 =
+        testFlowService.evaluate(
+            flow4.key(),
+            ImmutableList.of(
+                FlowStage.Status.DONE, FlowStage.Status.FAILED, FlowStage.Status.TERMINATED),
+            ImmutableList.of(
+                Optional.empty(),
+                Optional.of("error"),
+                Optional.of("terminated because previous stage failed")));
+    try (Registration registration = extensionRegistry.newRegistration().set(testFlowService)) {
+      List<FlowInfo> flows = gApi.changes().id(project.get(), changeId.get()).flows();
+      ImmutableMap<String, FlowInfo> flowInfosByUuid =
+          flows.stream().collect(toImmutableMap(flowInfo -> flowInfo.uuid, Function.identity()));
+      assertThat(flowInfosByUuid.keySet())
+          .containsExactly(
+              flow1.key().uuid(), flow2.key().uuid(), flow3.key().uuid(), flow4.key().uuid());
+      assertThat(flowInfosByUuid.get(flow1.key().uuid())).matches(flow1);
+      assertThat(flowInfosByUuid.get(flow2.key().uuid())).matches(flow2);
+      assertThat(flowInfosByUuid.get(flow3.key().uuid())).matches(flow3);
+      assertThat(flowInfosByUuid.get(flow4.key().uuid())).matches(flow4);
+    }
+  }
+}
diff --git a/javatests/com/google/gerrit/acceptance/api/revision/PortedCommentsIT.java b/javatests/com/google/gerrit/acceptance/api/revision/PortedCommentsIT.java
index d61c2d6..53d9bda 100644
--- a/javatests/com/google/gerrit/acceptance/api/revision/PortedCommentsIT.java
+++ b/javatests/com/google/gerrit/acceptance/api/revision/PortedCommentsIT.java
@@ -537,7 +537,7 @@
 
     CommentInfo portedComment = getPortedComment(patchset2Id, commentUuid);
 
-    assertThat(portedComment).author().id().isEqualTo(authorId.get());
+    assertThat(portedComment).author().hasIdThat().isEqualTo(authorId.get());
   }
 
   @Test
diff --git a/javatests/com/google/gerrit/acceptance/rest/binding/FlowRestApiBindingsIT.java b/javatests/com/google/gerrit/acceptance/rest/binding/FlowRestApiBindingsIT.java
new file mode 100644
index 0000000..0fc2758
--- /dev/null
+++ b/javatests/com/google/gerrit/acceptance/rest/binding/FlowRestApiBindingsIT.java
@@ -0,0 +1,90 @@
+// Copyright (C) 2025 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package com.google.gerrit.acceptance.rest.binding;
+
+import com.google.common.collect.ImmutableList;
+import com.google.gerrit.acceptance.AbstractDaemonTest;
+import com.google.gerrit.acceptance.ExtensionRegistry;
+import com.google.gerrit.acceptance.ExtensionRegistry.Registration;
+import com.google.gerrit.acceptance.PushOneCommit;
+import com.google.gerrit.acceptance.TestExtensions;
+import com.google.gerrit.acceptance.rest.util.RestApiCallHelper;
+import com.google.gerrit.acceptance.rest.util.RestCall;
+import com.google.gerrit.server.flow.Flow;
+import com.google.gerrit.server.flow.FlowAction;
+import com.google.gerrit.server.flow.FlowCreation;
+import com.google.gerrit.server.flow.FlowExpression;
+import com.google.gerrit.server.flow.FlowService;
+import com.google.inject.Inject;
+import org.junit.Test;
+
+/**
+ * Tests for checking the bindings of the flow REST API.
+ *
+ * <p>These tests only verify that the flow REST endpoints are correctly bound, they do no test the
+ * functionality of the flow REST endpoints.
+ */
+public class FlowRestApiBindingsIT extends AbstractDaemonTest {
+  @Inject private ExtensionRegistry extensionRegistry;
+
+  private static final ImmutableList<RestCall> CHANGE_ENDPOINTS =
+      ImmutableList.of(RestCall.get("/changes/%s/flows"), RestCall.post("/changes/%s/flows"));
+
+  private static final ImmutableList<RestCall> FLOW_ENDPOINTS =
+      ImmutableList.of(
+          RestCall.get("/changes/%s/flows/%s"),
+          // Deletion of flow must be tested last
+          RestCall.delete("/changes/%s/flows/%s"));
+
+  @Test
+  public void changeEndpoints() throws Exception {
+    try (Registration registration =
+        extensionRegistry.newRegistration().set(new TestExtensions.TestFlowService())) {
+      String changeId = createChange().getChangeId();
+      gApi.changes().id(changeId).edit().create();
+      RestApiCallHelper.execute(adminRestSession, CHANGE_ENDPOINTS, changeId);
+    }
+  }
+
+  @Test
+  public void flowEndpoints() throws Exception {
+    FlowService flowService = new TestExtensions.TestFlowService();
+    try (Registration registration = extensionRegistry.newRegistration().set(flowService)) {
+      PushOneCommit.Result r = createChange();
+      gApi.changes().id(r.getChangeId()).edit().create();
+      Flow flow =
+          flowService.createFlow(
+              FlowCreation.builder()
+                  .projectName(project)
+                  .changeId(r.getChange().getId())
+                  .ownerId(r.getChange().change().getOwner())
+                  .addStageExpression(
+                      FlowExpression.builder()
+                          .condition(
+                              String.format(
+                                  "com.google.gerrit[change:%s label:Verified+1]",
+                                  r.getChange().getId()))
+                          .action(
+                              FlowAction.builder()
+                                  .name("AddReviewer")
+                                  .addParameter("user", user.email())
+                                  .build())
+                          .build())
+                  .build());
+      RestApiCallHelper.execute(
+          adminRestSession, FLOW_ENDPOINTS, r.getChangeId(), flow.key().uuid());
+    }
+  }
+}
diff --git a/javatests/com/google/gerrit/acceptance/testsuite/change/PatchsetOperationsImplTest.java b/javatests/com/google/gerrit/acceptance/testsuite/change/PatchsetOperationsImplTest.java
index 9391776..be71e6e 100644
--- a/javatests/com/google/gerrit/acceptance/testsuite/change/PatchsetOperationsImplTest.java
+++ b/javatests/com/google/gerrit/acceptance/testsuite/change/PatchsetOperationsImplTest.java
@@ -346,7 +346,7 @@
         changeOperations.change(changeId).currentPatchset().newComment().author(accountId).create();
 
     CommentInfo comment = getCommentFromServer(changeId, commentUuid);
-    assertThat(comment).author().id().isEqualTo(accountId.get());
+    assertThat(comment).author().hasIdThat().isEqualTo(accountId.get());
   }
 
   @Test
diff --git a/package.json b/package.json
index 95dde02..91a3585 100644
--- a/package.json
+++ b/package.json
@@ -56,6 +56,7 @@
     "safe_bazelisk": "if which bazelisk >/dev/null; then bazel_bin=bazelisk; else bazel_bin=bazel; fi && $bazel_bin",
     "eslint": "npm run safe_bazelisk test polygerrit-ui/app:lint_test",
     "eslintfix": "npm run safe_bazelisk run polygerrit-ui/app:lint_bin -- -- --fix $(pwd)/polygerrit-ui/app",
+    "eslintfix:modified": "git diff --name-only --diff-filter=d | grep -E 'polygerrit-ui/app/.*\\.(js|ts)$' | sed 's|^polygerrit-ui/app/||' | xargs -r npm run safe_bazelisk run polygerrit-ui/app:lint_bin -- -- --fix",
     "litlint": "npm run safe_bazelisk run polygerrit-ui/app:lit_analysis",
     "lint": "eslint -c polygerrit-ui/app/eslint-bazel.config.js polygerrit-ui/app",
     "gjf": "./tools/gjf.sh run"
diff --git a/polygerrit-ui/app/api/styles.ts b/polygerrit-ui/app/api/styles.ts
index 6ca8496..5adc98f 100644
--- a/polygerrit-ui/app/api/styles.ts
+++ b/polygerrit-ui/app/api/styles.ts
@@ -26,7 +26,6 @@
 export declare interface Styles {
   font: Style;
   form: Style;
-  icon: Style;
   menuPage: Style;
   spinner: Style;
   subPage: Style;
diff --git a/polygerrit-ui/app/elements/change-list/gr-change-list-hashtag-flow/gr-change-list-hashtag-flow.ts b/polygerrit-ui/app/elements/change-list/gr-change-list-hashtag-flow/gr-change-list-hashtag-flow.ts
index ea61bfc..cd8c08a 100644
--- a/polygerrit-ui/app/elements/change-list/gr-change-list-hashtag-flow/gr-change-list-hashtag-flow.ts
+++ b/polygerrit-ui/app/elements/change-list/gr-change-list-hashtag-flow/gr-change-list-hashtag-flow.ts
@@ -152,7 +152,7 @@
         flatten
         down-arrow
         @click=${this.toggleDropdown}
-        .disabled=${isFlowDisabled}
+        ?disabled=${isFlowDisabled}
         >Hashtag</gr-button
       >
       <iron-dropdown
diff --git a/polygerrit-ui/app/elements/change-list/gr-change-list-hashtag-flow/gr-change-list-hashtag-flow_test.ts b/polygerrit-ui/app/elements/change-list/gr-change-list-hashtag-flow/gr-change-list-hashtag-flow_test.ts
index 98bd1ad..09d7995 100644
--- a/polygerrit-ui/app/elements/change-list/gr-change-list-hashtag-flow/gr-change-list-hashtag-flow_test.ts
+++ b/polygerrit-ui/app/elements/change-list/gr-change-list-hashtag-flow/gr-change-list-hashtag-flow_test.ts
@@ -298,7 +298,9 @@
         `,
         {
           // iron-dropdown sizing seems to vary between local & CI
-          ignoreAttributes: [{tags: ['iron-dropdown'], attributes: ['style']}],
+          ignoreAttributes: [
+            {tags: ['iron-dropdown'], attributes: ['style', 'focused']},
+          ],
         }
       );
     });
diff --git a/polygerrit-ui/app/elements/change-list/gr-change-list-topic-flow/gr-change-list-topic-flow.ts b/polygerrit-ui/app/elements/change-list/gr-change-list-topic-flow/gr-change-list-topic-flow.ts
index 08d3218..d4a02b5 100644
--- a/polygerrit-ui/app/elements/change-list/gr-change-list-topic-flow/gr-change-list-topic-flow.ts
+++ b/polygerrit-ui/app/elements/change-list/gr-change-list-topic-flow/gr-change-list-topic-flow.ts
@@ -152,7 +152,7 @@
         flatten
         down-arrow
         @click=${this.toggleDropdown}
-        .disabled=${isFlowDisabled}
+        ?disabled=${isFlowDisabled}
         >Topic</gr-button
       >
       <iron-dropdown
diff --git a/polygerrit-ui/app/elements/change-list/gr-change-list-topic-flow/gr-change-list-topic-flow_test.ts b/polygerrit-ui/app/elements/change-list/gr-change-list-topic-flow/gr-change-list-topic-flow_test.ts
index 407b84e..e3ebb4c3 100644
--- a/polygerrit-ui/app/elements/change-list/gr-change-list-topic-flow/gr-change-list-topic-flow_test.ts
+++ b/polygerrit-ui/app/elements/change-list/gr-change-list-topic-flow/gr-change-list-topic-flow_test.ts
@@ -291,7 +291,9 @@
         `,
         {
           // iron-dropdown sizing seems to vary between local & CI
-          ignoreAttributes: [{tags: ['iron-dropdown'], attributes: ['style']}],
+          ignoreAttributes: [
+            {tags: ['iron-dropdown'], attributes: ['style', 'focused']},
+          ],
         }
       );
     });
@@ -600,7 +602,9 @@
         `,
         {
           // iron-dropdown sizing seems to vary between local & CI
-          ignoreAttributes: [{tags: ['iron-dropdown'], attributes: ['style']}],
+          ignoreAttributes: [
+            {tags: ['iron-dropdown'], attributes: ['style', 'focused']},
+          ],
         }
       );
     });
diff --git a/polygerrit-ui/app/elements/change/gr-ai-prompt-dialog/gr-ai-prompt-dialog.ts b/polygerrit-ui/app/elements/change/gr-ai-prompt-dialog/gr-ai-prompt-dialog.ts
new file mode 100644
index 0000000..7fd3468
--- /dev/null
+++ b/polygerrit-ui/app/elements/change/gr-ai-prompt-dialog/gr-ai-prompt-dialog.ts
@@ -0,0 +1,258 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import {fire} from '../../../utils/event-util';
+import {fontStyles} from '../../../styles/gr-font-styles';
+import {sharedStyles} from '../../../styles/shared-styles';
+import {modalStyles} from '../../../styles/gr-modal-styles';
+import {css, html, LitElement, PropertyValues} from 'lit';
+import {customElement, query, state} from 'lit/decorators.js';
+import {GrButton} from '../../shared/gr-button/gr-button';
+import {getAppContext} from '../../../services/app-context';
+import {fireError} from '../../../utils/event-util';
+import {subscribe} from '../../lit/subscription-controller';
+import {resolve} from '../../../models/dependency';
+import {changeModelToken} from '../../../models/change/change-model';
+import {ParsedChangeInfo} from '../../../types/types';
+import {PatchSetNum} from '../../../types/common';
+import {HELP_ME_REVIEW_PROMPT, IMPROVE_COMMIT_MESSAGE} from './prompts';
+import {when} from 'lit/directives/when.js';
+import {copyToClipboard} from '../../../utils/common-util';
+
+const PROMPT_TEMPLATES = {
+  HELP_REVIEW: {
+    id: 'help_review',
+    label: 'Help me with review',
+    prompt: HELP_ME_REVIEW_PROMPT,
+  },
+  IMPROVE_COMMIT_MESSAGE: {
+    id: 'improve_commit_message',
+    label: 'Improve commit message',
+    prompt: IMPROVE_COMMIT_MESSAGE,
+  },
+  PATCH_ONLY: {
+    id: 'patch_only',
+    label: 'Just patch content',
+    prompt: '{{patch}}',
+  },
+};
+
+type PromptTemplateId = keyof typeof PROMPT_TEMPLATES;
+
+@customElement('gr-ai-prompt-dialog')
+export class GrAiPromptDialog extends LitElement {
+  /**
+   * Fired when the user presses the close button.
+   *
+   * @event close
+   */
+
+  @query('#closeButton') protected closeButton?: GrButton;
+
+  @state() change?: ParsedChangeInfo;
+
+  @state() patchNum?: PatchSetNum;
+
+  @state() patchContent?: string;
+
+  @state() loading = false;
+
+  @state() selectedTemplate: PromptTemplateId = 'HELP_REVIEW';
+
+  private readonly getChangeModel = resolve(this, changeModelToken);
+
+  private readonly restApiService = getAppContext().restApiService;
+
+  constructor() {
+    super();
+    subscribe(
+      this,
+      () => this.getChangeModel().change$,
+      x => (this.change = x)
+    );
+    subscribe(
+      this,
+      () => this.getChangeModel().patchNum$,
+      x => (this.patchNum = x)
+    );
+  }
+
+  static override get styles() {
+    return [
+      fontStyles,
+      sharedStyles,
+      modalStyles,
+      css`
+        :host {
+          display: block;
+          padding: var(--spacing-m) 0;
+        }
+        section {
+          display: flex;
+          padding: var(--spacing-m) var(--spacing-xl);
+        }
+        .flexContainer {
+          display: flex;
+          justify-content: space-between;
+          padding-top: var(--spacing-m);
+        }
+        .footer {
+          justify-content: flex-end;
+        }
+        .closeButtonContainer {
+          align-items: flex-end;
+          display: flex;
+          flex: 0;
+          justify-content: flex-end;
+        }
+        .content {
+          width: 100%;
+        }
+        .template-selector {
+          margin-bottom: var(--spacing-m);
+        }
+        .template-options {
+          display: flex;
+          flex-direction: column;
+          gap: var(--spacing-s);
+        }
+        .template-option {
+          display: flex;
+          align-items: center;
+          gap: var(--spacing-s);
+        }
+        textarea {
+          width: 500px;
+          height: 300px;
+          font-family: var(--monospace-font-family);
+          font-size: var(--font-size-mono);
+          line-height: var(--line-height-mono);
+          padding: var(--spacing-s);
+          border: 1px solid var(--border-color);
+          border-radius: var(--border-radius);
+          resize: vertical;
+        }
+        .toolbar {
+          display: flex;
+          gap: var(--spacing-s);
+          margin-top: var(--spacing-s);
+        }
+      `,
+    ];
+  }
+
+  override render() {
+    return html`
+      <section>
+        <h3 class="heading-3">Create AI Prompt (experimental)</h3>
+      </section>
+      ${when(
+        this.loading,
+        () => html` <div class="loading">Loading patch ...</div>`,
+        () => html` <section class="flexContainer">
+          <div class="content">
+            <div class="template-selector">
+              <div class="template-options">
+                ${Object.entries(PROMPT_TEMPLATES).map(
+                  ([key, template]) => html`
+                    <label class="template-option">
+                      <input
+                        type="radio"
+                        name="template"
+                        .value=${key}
+                        ?checked=${this.selectedTemplate === key}
+                        @change=${(e: Event) => {
+                          const input = e.target as HTMLInputElement;
+                          this.selectedTemplate =
+                            input.value as PromptTemplateId;
+                        }}
+                      />
+                      ${template.label}
+                    </label>
+                  `
+                )}
+              </div>
+            </div>
+            <textarea
+              .value=${this.getPromptContent()}
+              readonly
+              placeholder="Patch content will appear here..."
+            ></textarea>
+            <div class="toolbar">
+              <gr-button @click=${this.handleCopyPatch}>
+                <gr-icon icon="content_copy" small></gr-icon>
+                Copy Prompt
+              </gr-button>
+            </div>
+          </div>
+        </section>`
+      )}
+      <section class="footer">
+        <span class="closeButtonContainer">
+          <gr-button
+            id="closeButton"
+            link
+            @click=${(e: Event) => {
+              this.handleCloseTap(e);
+            }}
+            >Close</gr-button
+          >
+        </span>
+      </section>
+    `;
+  }
+
+  override firstUpdated(changedProperties: PropertyValues) {
+    super.firstUpdated(changedProperties);
+    if (!this.getAttribute('role')) this.setAttribute('role', 'dialog');
+  }
+
+  override willUpdate(changedProperties: PropertyValues) {
+    if (changedProperties.has('change') || changedProperties.has('patchNum')) {
+      this.loadPatchContent();
+    }
+  }
+
+  private async loadPatchContent() {
+    if (!this.change || !this.patchNum) return;
+    this.loading = true;
+    const content = await this.restApiService.getPatchContent(
+      this.change._number,
+      this.patchNum
+    );
+    this.loading = false;
+    if (!content) {
+      fireError(this, 'Failed to get patch content');
+      return;
+    }
+    this.patchContent = content;
+  }
+
+  private getPromptContent(): string {
+    if (!this.patchContent) return '';
+    const template = PROMPT_TEMPLATES[this.selectedTemplate];
+    return template.prompt.replace('{{patch}}', this.patchContent);
+  }
+
+  private async handleCopyPatch(e: Event) {
+    e.preventDefault();
+    e.stopPropagation();
+    if (!this.patchContent) return;
+    await copyToClipboard(this.getPromptContent(), 'AI Prompt');
+  }
+
+  private handleCloseTap(e: Event) {
+    e.preventDefault();
+    e.stopPropagation();
+    fire(this, 'close', {});
+  }
+}
+
+declare global {
+  interface HTMLElementTagNameMap {
+    'gr-ai-prompt-dialog': GrAiPromptDialog;
+  }
+}
diff --git a/polygerrit-ui/app/elements/change/gr-ai-prompt-dialog/gr-ai-prompt-dialog_test.ts b/polygerrit-ui/app/elements/change/gr-ai-prompt-dialog/gr-ai-prompt-dialog_test.ts
new file mode 100644
index 0000000..a25dcae
--- /dev/null
+++ b/polygerrit-ui/app/elements/change/gr-ai-prompt-dialog/gr-ai-prompt-dialog_test.ts
@@ -0,0 +1,77 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import '../../../test/common-test-setup';
+import './gr-ai-prompt-dialog';
+import {assert, fixture, html} from '@open-wc/testing';
+import {GrAiPromptDialog} from './gr-ai-prompt-dialog';
+import {createParsedChange} from '../../../test/test-data-generators';
+import {PatchSetNum} from '../../../api/rest-api';
+import {stubRestApi} from '../../../test/test-utils';
+
+suite('gr-ai-prompt-dialog test', () => {
+  let element: GrAiPromptDialog;
+  setup(async () => {
+    stubRestApi('getPatchContent').returns(Promise.resolve('<patch>'));
+    element = await fixture(html`<gr-ai-prompt-dialog></gr-ai-prompt-dialog>`);
+    element.change = createParsedChange();
+    element.patchNum = 1 as PatchSetNum;
+    await element.updateComplete;
+  });
+
+  test('renders', async () => {
+    assert.shadowDom.equal(
+      element,
+      /* HTML */ ` <section>
+          <h3 class="heading-3">Create AI Prompt (experimental)</h3>
+        </section>
+        <section class="flexContainer">
+          <div class="content">
+            <div class="template-selector">
+              <div class="template-options">
+                <label class="template-option">
+                  <input
+                    checked=""
+                    name="template"
+                    type="radio"
+                    value="HELP_REVIEW"
+                  />
+                  Help me with review
+                </label>
+                <label class="template-option">
+                  <input
+                    name="template"
+                    type="radio"
+                    value="IMPROVE_COMMIT_MESSAGE"
+                  />
+                  Improve commit message
+                </label>
+                <label class="template-option">
+                  <input name="template" type="radio" value="PATCH_ONLY" />
+                  Just patch content
+                </label>
+              </div>
+            </div>
+            <textarea
+              placeholder="Patch content will appear here..."
+              readonly=""
+            >
+            </textarea>
+            <div class="toolbar">
+              <gr-button>
+                <gr-icon icon="content_copy" small=""> </gr-icon>
+                Copy Prompt
+              </gr-button>
+            </div>
+          </div>
+        </section>
+        <section class="footer">
+          <span class="closeButtonContainer">
+            <gr-button id="closeButton" link=""> Close </gr-button>
+          </span>
+        </section>`
+    );
+  });
+});
diff --git a/polygerrit-ui/app/elements/change/gr-ai-prompt-dialog/prompts.ts b/polygerrit-ui/app/elements/change/gr-ai-prompt-dialog/prompts.ts
new file mode 100644
index 0000000..e44ab1a
--- /dev/null
+++ b/polygerrit-ui/app/elements/change/gr-ai-prompt-dialog/prompts.ts
@@ -0,0 +1,93 @@
+/**
+ * @license
+ * Copyright 2025 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+export const HELP_ME_REVIEW_PROMPT = `
+You are a highly experienced code reviewer specializing in Git patches. Your
+task is to analyze the provided Git patch (\`patch\`) and provide comprehensive
+feedback.  Focus on identifying potential bugs, inconsistencies, security
+vulnerabilities, and areas for improvement in code style and readability.
+Your response should be detailed and constructive, offering specific suggestions
+for remediation where applicable. Prioritize clarity and conciseness in your
+feedback.
+
+# Step by Step Instructions
+
+1.  Read the provided \`patch\` carefully.  Understand the changes it introduces to the codebase.
+
+2.  Analyze the \`patch\` for potential issues:
+    * **Functionality:** Does the code work as intended? Are there any bugs or unexpected behavior?
+    * **Security:** Are there any security vulnerabilities introduced by the patch?
+    * **Style:** Does the code adhere to the project's coding style guidelines? Is it readable and maintainable?
+    * **Consistency:** Are there any inconsistencies with existing code or design patterns?
+    * **Testing:** Does the patch include sufficient tests to cover the changes?
+
+3.  Formulate concise and constructive feedback for each identified issue.  Provide specific suggestions for remediation where possible.
+
+4.  Summarize your findings in a clear and organized manner.  Prioritize critical issues over minor ones.
+
+5.  Review the feedback written so far. Is the feedback comprehensive and sufficiently detailed?
+If not, go back to step 2, focusing on any areas that require further analysis or clarification.
+ If yes, proceed to step 6.
+
+6.  Output the complete review.
+
+
+Patch: 
+"""
+{{patch}}
+"""
+IMPORTANT NOTE: Start directly with the output, do not output any delimiters.
+Take a Deep Breath, read the instructions again, read the inputs again. Each instruction is crucial and must be executed with utmost care and attention to detail.
+
+Review:
+`;
+
+export const IMPROVE_COMMIT_MESSAGE = `
+You are a Git commit message expert, tasked with improving the quality and clarity of commit messages.
+Your goal is to generate a well-structured and informative commit message based on a provided Git patch. 
+The commit message must adhere to a specific style guide, focusing on conciseness, clarity, and a professional tone.
+You will use the patch's diff to understand the changes, summarizing complex diffs and focusing on the intent and impact of the changes.
+You should paraphrase any provided bug summaries to explain the problem that was fixed.
+Your output must be a single Markdown code block containing only the complete commit message (title and body), 
+formatted according to the provided specifications.
+
+# Step by Step Instructions
+
+1. **Analyze the Patch:** Carefully examine the provided \`patch\` to understand the changes made to the codebase. 
+Identify the key modifications, focusing on their intent and impact. Summarize complex changes concisely.
+
+2. **Review Existing Commit Message:** Read the commit message included in the \`patch\`. Note its strengths and weaknesses.  
+Identify areas for improvement in clarity, conciseness, and adherence to the style guide.
+
+3. **Refine the Title:** Craft a concise and informative commit title (under 60 characters) using sentence case and the imperative mood. 
+The title should accurately reflect the primary change implemented in the patch.
+
+4. **Develop the Body:** Write a detailed body for the commit message, explaining the "what" and "why" of the changes.
+ Use the information gathered in Step 1 to describe the intent and impact of the modifications.  
+ Structure the body using paragraphs, blank lines, and bullet points as needed for clarity. Wrap lines to approximately 72 characters.
+
+5. **Ensure Style Compliance:** Verify that the commit message (title and body) adheres to all requirements outlined in the provided
+"Commit Message Requirements" section.  This includes checking for sentence case, imperative mood, line wrapping, and the exclusion of testing information.
+
+6. **Format the Output:**  Enclose the complete commit message (title and body) within a single Markdown code block.
+ Ensure there is one blank line separating the title and the body.
+
+7. **Review and Iterate (Loop Instruction):** Review the complete commit message. Is it clear, concise, and informative? 
+Does it accurately reflect the changes made in the patch and adhere to the style guide? If not, return to Step 3 or Step 4 to make improvements.\
+  If satisfied, proceed to Step 8.
+
+8. **Output the Commit Message:** Output the final, formatted commit message as a single Markdown code block.
+
+
+Patch: 
+"""
+{{patch}}
+"""
+IMPORTANT NOTE: Start directly with the output, do not output any delimiters.
+Take a Deep Breath, read the instructions again, read the inputs again. Each instruction is crucial and must be executed with utmost care and attention to detail.
+
+Commit Message:
+`;
diff --git a/polygerrit-ui/app/elements/change/gr-change-summary/gr-change-summary.ts b/polygerrit-ui/app/elements/change/gr-change-summary/gr-change-summary.ts
index 276d9e2..58900d7 100644
--- a/polygerrit-ui/app/elements/change/gr-change-summary/gr-change-summary.ts
+++ b/polygerrit-ui/app/elements/change/gr-change-summary/gr-change-summary.ts
@@ -7,10 +7,13 @@
 import '../gr-comments-summary/gr-comments-summary';
 import '../../shared/gr-icon/gr-icon';
 import '../../checks/gr-checks-action';
+import '../gr-ai-prompt-dialog/gr-ai-prompt-dialog';
 import {css, html, LitElement, nothing} from 'lit';
-import {customElement, state} from 'lit/decorators.js';
+import {customElement, query, state} from 'lit/decorators.js';
 import {subscribe} from '../../lit/subscription-controller';
 import {sharedStyles} from '../../../styles/shared-styles';
+import {modalStyles} from '../../../styles/gr-modal-styles';
+import {spinnerStyles} from '../../../styles/gr-spinner-styles';
 import {getAppContext} from '../../../services/app-context';
 import {CheckRun, ErrorMessages} from '../../../models/checks/checks-model';
 import {Action, Category, CheckResult, RunStatus} from '../../../api/checks';
@@ -28,7 +31,6 @@
 import {AccountInfo, CommentThread, DropdownLink} from '../../../types/common';
 import {Tab} from '../../../constants/constants';
 import {ChecksTabState} from '../../../types/events';
-import {spinnerStyles} from '../../../styles/gr-spinner-styles';
 import {modifierPressed} from '../../../utils/dom-util';
 import {commentsModelToken} from '../../../models/comments/comments-model';
 import {resolve} from '../../../models/dependency';
@@ -39,6 +41,9 @@
 import {when} from 'lit/directives/when.js';
 import {combineLatest} from 'rxjs';
 import {userModelToken} from '../../../models/user/user-model';
+import {assertIsDefined} from '../../../utils/common-util';
+import {GrAiPromptDialog} from '../gr-ai-prompt-dialog/gr-ai-prompt-dialog';
+import {KnownExperimentId} from '../../../services/flags/flags';
 
 function handleSpaceOrEnter(e: KeyboardEvent, handler: () => void) {
   if (modifierPressed(e)) return;
@@ -94,6 +99,12 @@
   @state()
   draftCount = 0;
 
+  @query('#aiPromptModal')
+  aiPromptModal?: HTMLDialogElement;
+
+  @query('#aiPromptDialog')
+  aiPromptDialog?: GrAiPromptDialog;
+
   private readonly showAllChips = new Map<RunStatus | Category, boolean>();
 
   private readonly getCommentsModel = resolve(this, commentsModelToken);
@@ -104,6 +115,8 @@
 
   private readonly getChangeModel = resolve(this, changeModelToken);
 
+  private readonly flagsService = getAppContext().flagsService;
+
   private readonly reporting = getAppContext().reportingService;
 
   constructor() {
@@ -184,6 +197,7 @@
   static override get styles() {
     return [
       sharedStyles,
+      modalStyles,
       spinnerStyles,
       css`
         :host {
@@ -246,16 +260,25 @@
         .login gr-button {
           margin: -4px var(--spacing-s);
         }
+        table.info {
+          width: 100%;
+        }
         td.key {
           padding-right: var(--spacing-l);
           padding-bottom: var(--spacing-s);
           line-height: calc(var(--line-height-normal) + var(--spacing-s));
+          width: 70px;
         }
         td.value {
           padding-right: var(--spacing-l);
           padding-bottom: var(--spacing-s);
           line-height: calc(var(--line-height-normal) + var(--spacing-s));
         }
+        .value-content {
+          display: flex;
+          align-items: center;
+          justify-content: space-between;
+        }
         /* The basics of .loadingSpin are defined in shared styles. */
         .loadingSpin {
           width: calc(var(--line-height-normal) - 2px);
@@ -531,26 +554,54 @@
     });
   }
 
+  private handleOpenAiPromptDialog() {
+    assertIsDefined(this.aiPromptModal, 'aiPromptModal');
+    this.aiPromptModal.showModal();
+  }
+
+  private handleAiPromptDialogClose() {
+    assertIsDefined(this.aiPromptModal, 'aiPromptModal');
+    this.aiPromptModal.close();
+  }
+
   override render() {
     return html`
       <div>
-        <table>
+        <table class="info">
           <tr>
             <td class="key">Comments</td>
             <td class="value">
-              <gr-comments-summary
-                .commentsLoading=${this.commentsLoading}
-                .commentThreads=${this.commentThreads}
-                .draftCount=${this.draftCount}
-                .mentionCount=${this.mentionCount}
-                showCommentCategoryName
-                clickableChips
-              ></gr-comments-summary>
+              <div class="value-content">
+                <gr-comments-summary
+                  .commentsLoading=${this.commentsLoading}
+                  .commentThreads=${this.commentThreads}
+                  .draftCount=${this.draftCount}
+                  .mentionCount=${this.mentionCount}
+                  showCommentCategoryName
+                  clickableChips
+                ></gr-comments-summary>
+                ${when(
+                  this.flagsService.isEnabled(KnownExperimentId.GET_AI_PROMPT),
+                  () =>
+                    html`<gr-button link @click=${this.handleOpenAiPromptDialog}
+                      >Help Me Review</gr-button
+                    >`
+                )}
+              </div>
             </td>
           </tr>
           ${this.renderChecksSummary()}
         </table>
       </div>
+      ${when(
+        this.flagsService.isEnabled(KnownExperimentId.GET_AI_PROMPT),
+        () => html` <dialog id="aiPromptModal" tabindex="-1">
+          <gr-ai-prompt-dialog
+            id="aiPromptDialog"
+            @close=${this.handleAiPromptDialogClose}
+          ></gr-ai-prompt-dialog>
+        </dialog>`
+      )}
     `;
   }
 
diff --git a/polygerrit-ui/app/elements/change/gr-change-summary/gr-change-summary_test.ts b/polygerrit-ui/app/elements/change/gr-change-summary/gr-change-summary_test.ts
index 73e6b37..6b900c0 100644
--- a/polygerrit-ui/app/elements/change/gr-change-summary/gr-change-summary_test.ts
+++ b/polygerrit-ui/app/elements/change/gr-change-summary/gr-change-summary_test.ts
@@ -59,15 +59,17 @@
     assert.shadowDom.equal(
       element,
       /* HTML */ `<div>
-        <table>
+        <table class="info">
           <tbody>
             <tr>
               <td class="key">Comments</td>
               <td class="value">
-                <gr-comments-summary
-                  clickablechips=""
-                  showcommentcategoryname=""
-                ></gr-comments-summary>
+                <div class="value-content">
+                  <gr-comments-summary
+                    clickablechips=""
+                    showcommentcategoryname=""
+                  ></gr-comments-summary>
+                </div>
               </td>
             </tr>
           </tbody>
diff --git a/polygerrit-ui/app/elements/shared/gr-icons/gr-icons.ts b/polygerrit-ui/app/elements/shared/gr-icons/gr-icons.ts
index 89c8770..0cad1ec 100644
--- a/polygerrit-ui/app/elements/shared/gr-icons/gr-icons.ts
+++ b/polygerrit-ui/app/elements/shared/gr-icons/gr-icons.ts
@@ -3,7 +3,6 @@
  * Copyright 2017 Google LLC
  * SPDX-License-Identifier: Apache-2.0
  */
-import '@polymer/iron-icon/iron-icon';
 import '@polymer/iron-iconset-svg/iron-iconset-svg';
 const $_documentContainer = document.createElement('template');
 
diff --git a/polygerrit-ui/app/elements/shared/gr-js-api-interface/gr-plugin-loader.ts b/polygerrit-ui/app/elements/shared/gr-js-api-interface/gr-plugin-loader.ts
index ee8a3db..75ca77b 100644
--- a/polygerrit-ui/app/elements/shared/gr-js-api-interface/gr-plugin-loader.ts
+++ b/polygerrit-ui/app/elements/shared/gr-js-api-interface/gr-plugin-loader.ts
@@ -25,7 +25,6 @@
 import {spinnerStyles} from '../../../styles/gr-spinner-styles';
 import {subpageStyles} from '../../../styles/gr-subpage-styles';
 import {tableStyles} from '../../../styles/gr-table-styles';
-import {iconStyles} from '../../../styles/gr-icon-styles';
 import {GrJsApiInterface} from './gr-js-api-interface-element';
 import {define} from '../../../models/dependency';
 import {modalStyles} from '../../../styles/gr-modal-styles';
@@ -84,7 +83,6 @@
   public readonly styles = {
     font: fontStyles,
     form: grFormStyles,
-    icon: iconStyles,
     menuPage: menuPageStyles,
     spinner: spinnerStyles,
     subPage: subpageStyles,
diff --git a/polygerrit-ui/app/embed/diff/gr-context-controls/gr-context-controls.ts b/polygerrit-ui/app/embed/diff/gr-context-controls/gr-context-controls.ts
index 57fe6dc..cfb850d 100644
--- a/polygerrit-ui/app/embed/diff/gr-context-controls/gr-context-controls.ts
+++ b/polygerrit-ui/app/embed/diff/gr-context-controls/gr-context-controls.ts
@@ -466,7 +466,7 @@
     >
       <span class="showContext">${text}</span>
       ${tooltip}
-    </md-text-buttonn>`;
+    </md-text-button>`;
     return button;
   }
 
diff --git a/polygerrit-ui/app/embed/diff/gr-diff/gr-diff.ts b/polygerrit-ui/app/embed/diff/gr-diff/gr-diff.ts
index 8a9d81c..3bbf5b6 100644
--- a/polygerrit-ui/app/embed/diff/gr-diff/gr-diff.ts
+++ b/polygerrit-ui/app/embed/diff/gr-diff/gr-diff.ts
@@ -59,7 +59,6 @@
 import {html, LitElement, PropertyValues} from 'lit';
 import {grSyntaxTheme} from '../gr-syntax-themes/gr-syntax-theme';
 import {grRangedCommentTheme} from '../gr-ranged-comment-themes/gr-ranged-comment-theme';
-import {iconStyles} from '../../../styles/gr-icon-styles';
 import {DiffModel, diffModelToken} from '../gr-diff-model/gr-diff-model';
 import {provide} from '../../../models/dependency';
 import {
@@ -296,7 +295,6 @@
 
   static override get styles() {
     return [
-      iconStyles,
       sharedStyles,
       grSyntaxTheme,
       grRangedCommentTheme,
diff --git a/polygerrit-ui/app/package.json b/polygerrit-ui/app/package.json
index a5fb256..8c23f07 100644
--- a/polygerrit-ui/app/package.json
+++ b/polygerrit-ui/app/package.json
@@ -10,7 +10,6 @@
     "@polymer/iron-autogrow-textarea": "^3.0.3",
     "@polymer/iron-dropdown": "^3.0.1",
     "@polymer/iron-fit-behavior": "^3.1.0",
-    "@polymer/iron-icon": "^3.0.1",
     "@polymer/iron-iconset-svg": "^3.0.1",
     "@polymer/iron-input": "^3.0.1",
     "@polymer/iron-selector": "^3.0.1",
diff --git a/polygerrit-ui/app/services/flags/flags.ts b/polygerrit-ui/app/services/flags/flags.ts
index b32d396..144b260 100644
--- a/polygerrit-ui/app/services/flags/flags.ts
+++ b/polygerrit-ui/app/services/flags/flags.ts
@@ -23,4 +23,5 @@
   SAVE_PROJECT_CONFIG_FOR_REVIEW = 'UiFeature__save_project_config_for_review',
   PARALLEL_DASHBOARD_REQUESTS = 'UiFeature__parallel_dashboard_requests',
   GET_AI_FIX = 'UiFeature__get_ai_fix',
+  GET_AI_PROMPT = 'UiFeature__get_ai_prompt',
 }
diff --git a/polygerrit-ui/app/styles/gr-icon-styles.ts b/polygerrit-ui/app/styles/gr-icon-styles.ts
deleted file mode 100644
index 9865825..0000000
--- a/polygerrit-ui/app/styles/gr-icon-styles.ts
+++ /dev/null
@@ -1,15 +0,0 @@
-/**
- * @license
- * Copyright 2022 Google LLC
- * SPDX-License-Identifier: Apache-2.0
- */
-import {css} from 'lit';
-
-export const iconStyles = css`
-  iron-icon {
-    display: inline-block;
-    vertical-align: top;
-    width: 20px;
-    height: 20px;
-  }
-`;
diff --git a/polygerrit-ui/app/styles/shared-styles.ts b/polygerrit-ui/app/styles/shared-styles.ts
index 1582f6c..10bfb37 100644
--- a/polygerrit-ui/app/styles/shared-styles.ts
+++ b/polygerrit-ui/app/styles/shared-styles.ts
@@ -131,13 +131,6 @@
     border-spacing: 0;
   }
 
-  iron-icon {
-    color: var(--deemphasized-text-color);
-    vertical-align: top;
-    --iron-icon-height: 20px;
-    --iron-icon-width: 20px;
-  }
-
   /* Stopgap solution until we remove hidden$ attributes. */
 
   :host([hidden]),
diff --git a/polygerrit-ui/app/yarn.lock b/polygerrit-ui/app/yarn.lock
index c78bb5d..5b7d9ca 100644
--- a/polygerrit-ui/app/yarn.lock
+++ b/polygerrit-ui/app/yarn.lock
@@ -126,7 +126,7 @@
   dependencies:
     "@polymer/polymer" "^3.0.0"
 
-"@polymer/iron-icon@^3.0.0-pre.26", "@polymer/iron-icon@^3.0.1":
+"@polymer/iron-icon@^3.0.0-pre.26":
   version "3.0.1"
   resolved "https://registry.yarnpkg.com/@polymer/iron-icon/-/iron-icon-3.0.1.tgz#93211c39d8825fe4965a68419566036c1df291eb"
   integrity sha512-QLPwirk+UPZNaLnMew9VludXA4CWUCenRewgEcGYwdzVgDPCDbXxy6vRJjmweZobMQv/oVLppT2JZtJFnPxX6g==
diff --git a/polygerrit-ui/web-test-runner.config.mjs b/polygerrit-ui/web-test-runner.config.mjs
index 3cbf1d0..3600ce6 100644
--- a/polygerrit-ui/web-test-runner.config.mjs
+++ b/polygerrit-ui/web-test-runner.config.mjs
@@ -55,9 +55,8 @@
 
 /** @type {import('@web/test-runner').TestRunnerConfig} */
 const config = {
-
-  concurrency: 4,
-
+  // Default is CPU cores / 2. Use default
+  // concurrency: 5,
   // WORKAROUND: Prevents tests from failing or timing out when run concurrently.
   // Recent Chrome versions aggressively throttle inactive tabs, which interferes with
   // parallel tests. These flags disable that behavior, ensuring tests that rely on