Production
Not in path- ingress
- app
- prod-db
- workers
Pre-production deployment safety
Know what happens before you deploy,
on a disposable production twin.
The engine is open source and runs in your own continuous integration today, with no account.
The hosted control plane is open: sign in with GitHub and connect a repository.
A risky pull request, stopped before it merges. Eighty five seconds.
Antifailure makes a copy of production, the same size and the same shape and the same load, with every real name replaced. Your change runs there first, on every pull request, before it merges, whether a person wrote it or an agent did. Then the copy deletes itself.
- A copy of production, same size and shape
- Your change runs there first
- Then the copy deletes itself
Migration Safety
Migration Safety. Catch exclusive locks before they take checkout down. The strongest lock held per table, whether another session was left waiting on it, and how the plans moved.
MIG-1204widen_plan_id1 / 12
widen_plan_id
Widen plan_id on subscriptions and measure the exclusive lock, whether another session is left waiting on it, and whether the table is rewritten before the change ships.
Activity
Antifailure opened the run from checkout traffic · 2min ago
The run added the labels FINDING and Locks · 2min ago
maya · 4min ago
ACCESS EXCLUSIVE held 27.4s, and another session was seen waiting on it even on the branch.
jordan · just now
@antifailure can you take a stab at this?
Antifailure connected · just now
Changed 2 files · nullable add, backfill later · just now
Antifailure moved from Todo to Block · just now
Example findingOne migration rehearsed, with the numbers chosen. What is measured is the strongest lock mode and its hold time, whether another session was left waiting on it, whether the table was rewritten, and the query plans before and after.
Isolated Twin
A disposable production twin. Build the candidate, restore safe state, contain side effects, and destroy everything when the report is done.
IllustrativeThe order is real, and so are the containment seals: build, restore safe state, contain, destroy. The percentages are a shaped run.
Isolated networking
Clone-local DNS, no default public egress, no route out of the network.
Safe credentials
Production secrets are replaced. The twin cannot reach live keys.
Cleanup proof
Every resource is journaled, destroyed, and counted at teardown. Nothing outlives the run.
Safety properties
Safety properties, not slogans. Whether this deployment is safe to ship against real data, real concurrency, real workers, and the deploy itself.
Fail closed.
Unknown destinations are denied inside the twin, and an unverified golden cannot be branched.
Traffic shaped like production's.
The route mix out of your own access log, with the worst regression first.
Pass or fail, with evidence.
A gate on the pull request carrying the rows, the trace, and the video behind it.
Load
Traffic shaped like production's. The route mix out of your own access log, sent at the twin. Not production traffic diverted.
Your Code Editor
1
2
3
4
5
6
7
8
9
// The application. Antifailure needs no import in it. export default async function handler(req, res) { const subs = await db.query( "select * from subscriptions where account_id = $1", [req.accountId], ); res.status(200).json(subs); }
Getting started with Antifailure···
Three commands. af init reads the repository and writes the manifest, af up builds the twin around a branch of the golden, af test runs the workflows and returns verdicts with evidence. With a production database, af golden refresh once before af up.
terminal$ af init $ af up $ af test # verdicts, with evidence
Try for yourself, start proving a change before it ships.
IllustrativeAn editor with the real files in it. af init, af up and af ci exist and do what the terminal shows; the repository and its contents are made up.
Side-Effect Firewall
Fail closed on side effects. The twin cannot charge cards, email users, or invoke production webhooks. Unknown destinations are blocked.
Trust model
Fail closed. Customer-hosted. Production data stays in your boundary. Cleanup is journaled as it happens, not reconstructed afterwards.
Fail closed
An unverified golden cannot be branched, and inside the twin there is no route out.
Customer-hosted
Production data stays inside the customer boundary. The control plane never needs a copy.
What counts as proof
A verdict is only worth what it carries. Every result on a pull request arrives with the rows it read, the trace it took and the recording of the attempt, so a reviewer can check the finding instead of trusting it. Measurable evidence, or no claim.
Know what happens
before you deploy.
Create a disposable production twin for every risky change. Catch migration failures before they reach customers.