Antifailure
GitHubDocs
Sign inStart free
Solutions · Fintech

Billing, ledgers, and side effects that must never hit live processors.

The firewall simulates Stripe. Safe State masks account identifiers.

The oracle compares ledger writes.

Duplicate events are incidents. They belong in a report, not in production.

Start the quickstartRequest hosted access
  1. 01
    twin.app.internal
    POST /checkout
    origin
    0.4ms
  2. 02
    af-proxy:8443
    egress rule
    inspect
    1.1ms
  3. 03
    stripe.pack.local412b
    POST /v1/charges
    mock
    ledger
  4. 04
    api.stripe.com
    live processor
    deny
    refused
fail closed
Live hop refused

The charge is written to a clone-local ledger. api.stripe.com never resolves.

deny · 0 charged
Simulators, not live processors

Charging a card from a twin is an existential failure.

  • The mode is set per host. block, allow, capture, mock, sandbox or synth, written against the host in antifailure.yaml.

  • Nothing leaves without a rule. Egress defaults to block, so a processor nobody configured is refused on its first run rather than passed through.

  • The ledger records the decision. Each attempt is stored with the mode that decided it, so the reason a request never left is readable afterwards.

antifailure.yaml
egress
1egress:
2default: block
3hosts:
HostHostmode
4
api.stripe.commock
5
api.sendgrid.comcapture
6
hooks.slack.comcapture
7
unknown TCPblock, default
8
api.prod.internalblock, default
Default refuses

A host with no rule is blocked on first contact.

default: block
Containment

Containment is the product surface.

  • Ledger comparison. The oracle compares writes, events, and third-party effects against baseline.

  • Irreversible writes. Candidate billing events that old code cannot reconcile show up before ship.

  • Mid-market first. Technically sophisticated billing teams. Not a regulated-enterprise procurement motion.

twin ledger
0 packets

Twin ledger

in-boundary
id · effectamt
  • chg_184$49.00POST /v1/charges
  • chg_185$49.00retry checkout
  • inv_044$0.00refund path

Live processors

dest · refused
  • api.stripe.com
  • api.sendgrid.com
  • hooks.slack.com
  • api.prod.internal
0 packets out

TTL contained. Processors never resolved.

Existential failure

Not a warning. A failed containment model.

  • There is no warning level for this. A twin that reaches a live processor has not failed a check. Its containment did not hold.

  • The customer finds out. A real card, a real inbox and a real partner endpoint are the three places a contained run becomes somebody else's incident.

  • So the default refuses. A host with no rule against it is blocked, which is the only default that stays safe as the integration list grows.

Attempted-effect ledger

LNS 04

Twin run 08f2

must never · fail closed

LnEffectMode
  1. 01
    STRIPE
    POST /v1/charges $49.00
    MOCK
  2. 02
    SENDGRID
    render invoice.paid.html
    CAPTURE
  3. 03
    SLACK
    webhook preview stored
    CAPTURE
  4. 04
    HOSTNAME
    api.prod.internal
    DENY

3 contained · 1 denied · 0 charged

Total live$0.00
Keep reading
Next

Know what happens before you deploy.

Create a disposable production twin for every risky change. Catch migration failures before they reach customers.

Start the quickstartRequest hosted access