Antifailure
GitHubDocs
Sign inStart free
Twin Orchestrator

A disposable production twin for every risky change.

Build the change, branch a sanitized database, isolate the network, replace production credentials, journal every resource as it comes up, and tear all of it down when the report is done.

Start the quickstartRequest hosted access
one disposable twin
TOPOLOGY
input
PR image

Built candidate code.

input
Sanitized state

Production-shaped, not production.

disposable twinsealed
runtime
Candidate app

Runs inside the twin.

database
Safe Postgres

Restored for this run only.

identity
Scoped secrets

Live credentials are replaced.

egress
Simulator route

External effects are local or simulated.

Resource journalappend on create
Production databaseNO ROUTE
Production credentialsREPLACED
Default public egressDENY
only durable output
Pull-request evidence
report

Rows, traces, invariant results, and cleanup proof leave the boundary. The twin does not.

  1. 01Build
  2. 02Restore
  3. 03Validate
  4. 04Destroy
Topology of one disposable twin: candidate code and sanitized state enter an isolated run boundary, live production routes are blocked, evidence leaves, and the environment is destroyed.
Lifecycle

Every transition is idempotent and recoverable. A resource is journaled the moment it exists, not after the run succeeds.

environment event log
STATE
observable success path

Four normal events; failure can terminate the same journaled run.

NDJSON
  1. 01
    env.creating
    Plan + provision

    Lock held; resources journaled.

  2. 02
    env.ready
    Containment verified

    Candidate can accept workload.

  3. 03
    env.destroying
    Reverse replay

    Journal drives teardown.

  4. 04
    env.destroyed
    Terminal success

    Cleanup count is complete.

terminal from any prior state
env.failed
stop

Failure is emitted where the run stops. The existing journal remains the recovery source for teardown.

transition
event emitted
resource
journal append
retry
same run lock
Environment state machine showing the successful lifecycle from creating to destroyed, plus env.failed as a terminal event reachable from any earlier state.
  • Plan

    Read the manifest, take the environment lock, write the plan.

  • Provision

    Build candidate, restore safe state, replace credentials, verify containment.

  • Run

    Agents drive the declared workflows. Invariants are asked of the data.

  • Close

    Evidence attaches to the pull request. The journal is replayed in reverse.

IllustrativeThese are the lifecycle events one run emits, so a reader can run af up and af down and watch each of them arrive in the log. The last two are where a run stops: it was torn down, or it failed, which is emitted from any point before it. The run identifier is invented.

Isolation is a spec, not a hope. An unresolved secret fails closed and stops the run.

These seven are in force today on the Docker runtime, which passes all thirty-two runtime conformance behaviours against a real daemon. The Kubernetes runtime is written and not yet proven to the same standard, and no cloud runtime exists. Convenience must not silently override containment.

containment specification
BOUNDARY
twin boundaryfail closed
workload
Declared journeys

Synthetic but production-shaped.

runtime
Candidate app

Can only see twin-scoped dependencies.

resolve
Clone-local DNS
outbound
Simulator gateway
state
Safe Postgres
identity
Twin secrets
Every resourceenvironment label required
Production databaseROUTE CUT
Live credentialsREPLACED
Unlisted destinationDEFAULT DENY
control register7 enforced
  1. 01
    credentialscreds replaced

    No production write credentials

  2. 02
    databaseprod-db cut

    No production database route

  3. 03
    networkegress deny-by-default

    No default internet route

  4. 04
    dnsdns clone-local

    Separate DNS policy

  5. 05
    secretsnamespace twin-scoped

    Separate secrets namespace

  6. 06
    ownershiprun_08f2

    One label scheme, on everything

  7. 07
    teardownDown_TouchesOnlyItsOwnEnvironment

    Touches only what it made

Containment boundary showing clone-local DNS, twin-scoped secrets, safe Postgres and a simulator gateway, with production database, live credentials and default internet routes explicitly blocked.

A preview URL is not the product. The twin exists to answer whether the deployment is safe, then it is destroyed.

The output is a pass or a fail on the pull request, with the rows and the trace behind it. Not a dataset, and not an address somebody has to remember to shut down.

af upaf ciaf down
one CI run
DECIDE
orchestrationlocal
  1. $
    af upcreate

    Build, restore, isolate, verify.

  2. $
    af cijudge

    Run workloads and invariants.

  3. $
    af downdestroy

    Replay the resource journal.

127.0.0.1 · loopback-only previewTEMPORARY
evidence bundle
rows
traces
invariants
pull request
Safety gate
passfail
After the reportenvironment destroyed
The local route disappears.The gate remains.
CI decision flow in which af up creates the twin, af ci collects rows and traces into a pull-request gate, and af down destroys the environment; the preview URL is explicitly temporary.

Cleanup is a first-class safety property. Resource deletion is not a background convenience.

Every resource is written to the journal as it is created, so a run that dies halfway still has a list of what it made. Teardown replays that journal in reverse and counts what it removed. A continuous integration step counts the managed containers and networks afterwards and fails the build if any are left.

IllustrativeA teardown of one run. The journal, the reverse replay and the count of what was removed are real; the resource names and the timestamps are written.

sweep

af env prune removes environments older than a cutoff you pass.

limit

There is no automatic time-to-live and no independent reaper yet. The sweep is a command a person or a schedule runs.

resource journal
CLEANUP
append immediatelycreate ↓
  1. 01isolated networknetwork
  2. 02database statevolume
  3. 03candidate appcontainer
  4. 04side-effect simulatorcontainer
reverse replaydestroy ↑
  1. 04side-effect simulatordelete
  2. 03candidate appdelete
  3. 02database statedelete
  4. 01isolated networkdelete
ownership guard
Filter by this environment label
match

Teardown can enumerate only the containers, network, and volume created for this run.

post-teardown assertions
managed containersCOUNT == 0
managed networksCOUNT == 0
journal entriesALL REPLAYED
af env prune --before <cutoff>manual sweep · no automatic TTL
Cleanup proof showing resources appended to a journal in creation order, filtered by the environment label, deleted in reverse order, and verified by zero-resource assertions.
Keep reading
Next

Know what happens before you deploy.

Create a disposable production twin for every risky change. Catch migration failures before they reach customers.

Start the quickstartRequest hosted access