Antifailure

Antifailure builds a disposable copy of production for every pull request, so risky changes get tested against something that behaves like the real thing before customers see them. Each run stands up an isolated twin of the application with sanitised, referentially consistent Postgres data, replaced secrets and credentials, clone-local DNS with no public egress and captured side effects, then tears the whole thing down. The failures it's designed to catch are the ones staging rarely does, including database migrations that take exclusive locks, query plan regressions, table rewrites, and side effects such as a payment call or an email firing in the middle of a test.

The process has four steps. Build the candidate application, restore a sanitised production-shaped dataset the product calls Safe State, contain side effects and egress, and destroy everything afterwards. On the command line that's three commands. af init reads the repository and generates configuration, af up builds the database branch, the services and the network isolation, and af test runs agent-driven workflows against the environment and returns a verdict with evidence, meaning rows read, traces, recordings and reproduction steps rather than a bare pass or fail. Load tests use traffic shaped from real production access logs, so the environment is exercised the way users actually hit it.

Containment is where it's most opinionated. The side-effect firewall fails closed on any destination it doesn't recognise, Stripe is simulated, email is captured and webhooks are blocked, so a test can walk through a billing flow without charging anyone or sending a message. Migration safety measures exclusive locks, hold times, table rewrites and query plans and reports them, which turns the question of whether a migration is safe into numbers. Cleanup is journaled as it happens rather than reconstructed later, and every resource is tracked and verified at teardown, which is what makes running a disposable environment on every pull request tolerable rather than a source of orphaned infrastructure.

It's aimed at B2B SaaS teams that deploy daily, fintech companies where billing and ledger changes need proof, marketplaces with queues, workers and dual writes, and developer tool teams. The trust model is customer-hosted and fail closed, so production data never leaves your boundary, and the hosted control plane is optional. Requirements are modest, Docker for local use, a Node runtime for the agent runner, and optionally a production Postgres connection string for masked copies and a GitHub repository for pull-request checks.

The difference from ephemeral preview environments is the data and the verdict. A preview environment typically boots the app on seed data and tells you it came up. Antifailure runs it on masked production data and tells you what the migration would do to a real table, with evidence attached. The engine is MIT licensed and runs locally with no external communication, with the enterprise code confined to a separate directory under its own licence and absent from downloaded releases. The GitHub repository at antifailure/antifailure shows reproducible builds, signed releases with checksums and an SBOM, close to two thousand commits, and a commitment to API stability from version 1.0, alongside a modest star count that reflects how new it is.

The limits are those of a young, Postgres-centred project. Postgres is the only database the site names, so teams on other engines should check before investing. The workflow assumes Docker and a CI pipeline, and the value depends on feeding it a realistic production shape, since the migration and load results are only as telling as the data behind them. And while the engine is free, the moment you want an organisation-wide view, release policies and retained evidence, the Team tier is the entry point, which is priced for companies rather than side projects.

Access is open source first. The Community plan is $0 and includes the local engine, Docker Compose support, basic Postgres, an MCP server and bring-your-own infrastructure, with no account required and limits of 3 live environments, 24 environment-hours per run and 72 environment-hours per rolling day. Team is a flat $500 a month per organisation rather than per person, and brings the hosted control plane, up to 50 members, included run credits, pull-request checks and execution in your own cloud, with metered environment minutes, data volume and workload execution beyond the included amount. Enterprise runs from $2,000 to $8,000 a month on an annual contract and adds up to 1,000 members, multiple repositories, organisation-wide release policy, evidence retention, fleet management, premium connectors and SLA support. There's no published email, so contact is through the site's form and the GitHub repository.