Featured
How a directory becomes a public URL
Appaloft's Deploy door takes the current folder, not a required git remote. The command a new user pastes is appaloft up. Success is a live URL on a server you control.
CLIDeployRailway alternative
Engineering notes
Appaloft engineering blog
Concrete choices behind reliable delivery: where boundaries sit, how failures recover, and what the system can actually prove.
AIAgents
Appaloft plugin for Grok Bot
Add Appaloft from Grok Bot's plugin directory, Authenticate with OAuth, and get the existing skill plus hosted MCP in one plugin.
AIAgents
Teach Cursor and OpenCode how to deploy
How appaloft setup agent installs a skill and MCP locally while keeping login, approval, deployment, and readback as explicit boundaries.
AIAgents
Remote agent workspaces that outlive your laptop
Appaloft 1.4 turns Agent Workspace into a public Sandbox entry workflow: remote harnesses, collaboration leases, hibernation, and an evidence-gated path to ship. Here is the architecture, how it compares to OpenSandbox and peers, and what we are still finishing.
AIAgents
The agent that builds your app should not publish it
Appaloft's new sandbox agent runtime lets coding agents build inside isolated, expiring sandboxes, then freezes their work into immutable artifacts that only an external actor can promote. Here is where we drew the boundary.
Deployment controlRuntime verification
How we built the delivery evidence chain
AI agents can write an app in ten minutes. Proving what actually shipped is a harder, older problem. This is how we built Appaloft's evidence chain — and where we deliberately stopped.
SecurityKey rotation
Control-Plane Key Rotation: From Key Custody to Recovery
How Appaloft combines a versioned keyring, short-lived OIDC credentials, plan digests, atomic migration, and an independent restore rehearsal.
Deployment controlRuntime verification
"Deployed" is not a health check
A deployment needs evidence that its artifact, process, service, and public route all belong to the intended release.
Docker ComposeDeployment
A rollback button is not a recovery plan
Five invariants for safer single-host Docker Compose updates: image preflight, candidate verification, scoped cleanup, and explicit data boundaries.
Deployment controlDocker Compose
Who owns the deploy? Dividing Git, CI, servers, and release state
Separate repository, CI runner, server, and deployment-state ownership—and see where Appaloft fits without pretending to manage every layer.
Deployment controlRuntime
A deployment platform should not assume every app runs on port 3000
How Appaloft examples use explicit deployment contracts for Vite, Python, Go, and Docker Compose instead of making the platform guess.
EnvironmentsDeployment control
Copy the environment shape, not the production secrets
How Appaloft turns environment copy into a plan-first workflow: topology and intent travel; databases, domains, volume data, and secret values stay behind decisions.
Deployment controlRecovery
Deployment failures should leave a recovery path
A failed deployment should explain where it stopped, what already happened, which actions are safe, and what verified target can be restored.
Custom DomainsDNS
How a custom domain gets connected to Appaloft
From hostname input to DNS authorization, readback, TLS, routing, and failure handling, this is how Appaloft treats custom domains as a checkable deployment workflow.
AIMCP
MCP tools are product APIs, not demo endpoints
Why Appaloft generates MCP tools from the operation catalog and routes them back through the same CommandBus, QueryBus, authz, audit, and readback boundaries.
Deployment controlRouting
What a deploy URL should promise
A deploy URL is part of the deployment contract: some links should never move, some aliases can move with audit, and custom domains need ownership proof.
BlueprintMarketplace
Install progress should not be a pile of disconnected logs
Why Appaloft shows Blueprint installs as one readable application progress experience instead of asking users to stitch together component logs and support details.
GitHub ActionsDeployment control
From GitHub Actions to Appaloft: what evidence a deployment should leave behind
How Appaloft thinks about GitHub Actions deployments as auditable evidence: commit SHA, image digest, config snapshot, provenance, readback, and rollback.
AIStatic Artifacts
When an AI agent builds a static site, deployment should still be a workflow
How Appaloft turns an agent-produced dist directory into an auditable static artifact publication instead of handing an AI broad cloud credentials.
DDDSpecification
DDD in Appaloft TypeScript, Part 4: specifications
Appaloft's lightweight Specification style in TypeScript, from selection specs to readiness gates and drift reports.
AICLI
AI agents should not log in by copying cookies
Why Appaloft separates human browser login, CI tokens, and AI agent token handoff instead of letting agents impersonate users.
AIMCP
Skills are not MCP: how AI agents should call a deployment control plane
Why Appaloft keeps AI skills, MCP tools, CLI commands, and the operation catalog in separate roles instead of creating an agent-only deployment path.
BlueprintDeployment control
Blueprints are not marketplace cards
How Appaloft models Blueprints as versioned application topology definitions, then turns one-click deploys into reviewable dry-run install plans.
DDDValue Object
DDD in Appaloft TypeScript, Part 3: value objects
How Appaloft uses practical TypeScript value objects: schema versions, literal unions, ids, secret references, masked connections, and provider boundary aliases.
DDDAggregate Root
DDD in Appaloft TypeScript, Part 2: aggregate roots
How Appaloft models InstalledApplication as an aggregate root in TypeScript, with plan acceptance, readback, failure, and rollback transitions.
DDDTypeScript
DDD in Appaloft TypeScript, Part 1: start with boundaries, not folders
How Appaloft applies domain-driven design in TypeScript through Blueprint planning, installed applications, dependency resources, and runtime composition.
AIDeployment control
A deployment control plane for the AI era
How Appaloft models deployment as an auditable operating path shared by CLI, GitHub, AI tools, Blueprints, and Cloud.
BunSelf-hosting
We built Appaloft with Bun: what worked, what surprised us, and where it still hurts
A practical look at how Appaloft uses Bun for TypeScript scripts, compiled binaries, embedded Web/docs assets, PGlite, and multi-target release packaging.