https://www.appaloft.com/blog Engineering articles about agent application delivery, deployment evidence, Blueprints, control-plane design, and TypeScript DDD. en-US Sat, 29 Aug 2026 07:44:55 GMT https://www.appaloft.com/blog/appaloft-plugin-for-grok-bot https://www.appaloft.com/blog/appaloft-plugin-for-grok-bot Sat, 29 Aug 2026 00:00:00 GMT Add Appaloft from Grok Bot's plugin directory, Authenticate with OAuth, and get the existing skill plus hosted MCP in one plugin. AI Agents MCP Grok https://www.appaloft.com/blog/teach-cursor-opencode-appaloft-setup-agent https://www.appaloft.com/blog/teach-cursor-opencode-appaloft-setup-agent Wed, 26 Aug 2026 00:00:00 GMT How appaloft setup agent installs a skill and MCP locally while keeping login, approval, deployment, and readback as explicit boundaries. AI Agents MCP CLI https://www.appaloft.com/blog/agent-workspace-architecture https://www.appaloft.com/blog/agent-workspace-architecture Mon, 27 Jul 2026 00:00:00 GMT Appaloft 1.4 turns Agent Workspace into a public Sandbox entry workflow: remote harnesses, collaboration leases, hibernation, and an evidence-gated path to ship. Here is the architecture, how it compares to OpenSandbox and peers, and what we are still finishing. AI Agents Sandbox Architecture Agent Workspace https://www.appaloft.com/blog/agents-should-not-publish-their-own-work https://www.appaloft.com/blog/agents-should-not-publish-their-own-work Tue, 21 Jul 2026 00:00:00 GMT Appaloft's new sandbox agent runtime lets coding agents build inside isolated, expiring sandboxes, then freezes their work into immutable artifacts that only an external actor can promote. Here is where we drew the boundary. AI Agents Sandbox Deployment https://www.appaloft.com/blog/delivery-evidence-chain https://www.appaloft.com/blog/delivery-evidence-chain Tue, 21 Jul 2026 00:00:00 GMT AI agents can write an app in ten minutes. Proving what actually shipped is a harder, older problem. This is how we built Appaloft's evidence chain — and where we deliberately stopped. Deployment control Runtime verification AI Agents https://www.appaloft.com/blog/control-plane-key-rotation https://www.appaloft.com/blog/control-plane-key-rotation Sat, 18 Jul 2026 00:00:00 GMT How Appaloft combines a versioned keyring, short-lived OIDC credentials, plan digests, atomic migration, and an independent restore rehearsal. Security Key rotation Postgres GitHub Actions https://www.appaloft.com/blog/deployment-proof-running-workload-changed https://www.appaloft.com/blog/deployment-proof-running-workload-changed Thu, 16 Jul 2026 00:00:00 GMT A deployment needs evidence that its artifact, process, service, and public route all belong to the intended release. Deployment control Runtime verification Docker AI https://www.appaloft.com/blog/compose-rollback-contract https://www.appaloft.com/blog/compose-rollback-contract Wed, 15 Jul 2026 00:00:00 GMT Five invariants for safer single-host Docker Compose updates: image preflight, candidate verification, scoped cleanup, and explicit data boundaries. Docker Compose Deployment Rollback Self-hosting https://www.appaloft.com/blog/who-owns-the-deploy https://www.appaloft.com/blog/who-owns-the-deploy Tue, 14 Jul 2026 00:00:00 GMT Separate repository, CI runner, server, and deployment-state ownership—and see where Appaloft fits without pretending to manage every layer. Deployment control Docker Compose Self-hosting CI/CD https://www.appaloft.com/blog/one-repo-many-runtime-shapes https://www.appaloft.com/blog/one-repo-many-runtime-shapes Mon, 13 Jul 2026 00:00:00 GMT How Appaloft examples use explicit deployment contracts for Vite, Python, Go, and Docker Compose instead of making the platform guess. Deployment control Runtime Docker Examples https://www.appaloft.com/blog/copy-the-environment-shape-not-the-secrets https://www.appaloft.com/blog/copy-the-environment-shape-not-the-secrets Sun, 12 Jul 2026 00:00:00 GMT How Appaloft turns environment copy into a plan-first workflow: topology and intent travel; databases, domains, volume data, and secret values stay behind decisions. Environments Deployment control CLI Safety https://www.appaloft.com/blog/deployment-failure-should-leave-a-recovery-path https://www.appaloft.com/blog/deployment-failure-should-leave-a-recovery-path Fri, 10 Jul 2026 00:00:00 GMT A failed deployment should explain where it stopped, what already happened, which actions are safe, and what verified target can be restored. Deployment control Recovery Rollback AI https://www.appaloft.com/blog/custom-domain-onboarding-flow https://www.appaloft.com/blog/custom-domain-onboarding-flow Thu, 09 Jul 2026 00:00:00 GMT From hostname input to DNS authorization, readback, TLS, routing, and failure handling, this is how Appaloft treats custom domains as a checkable deployment workflow. Custom Domains DNS Routing Deployment control https://www.appaloft.com/blog/mcp-tools-are-product-apis https://www.appaloft.com/blog/mcp-tools-are-product-apis Wed, 08 Jul 2026 00:00:00 GMT Why Appaloft generates MCP tools from the operation catalog and routes them back through the same CommandBus, QueryBus, authz, audit, and readback boundaries. AI MCP API Deployment control Agents https://www.appaloft.com/blog/what-a-deploy-url-should-promise https://www.appaloft.com/blog/what-a-deploy-url-should-promise Tue, 07 Jul 2026 00:00:00 GMT A deploy URL is part of the deployment contract: some links should never move, some aliases can move with audit, and custom domains need ownership proof. Deployment control Routing Rollback AI https://www.appaloft.com/blog/install-progress-should-not-be-disconnected-logs https://www.appaloft.com/blog/install-progress-should-not-be-disconnected-logs Mon, 06 Jul 2026 00:00:00 GMT Why Appaloft shows Blueprint installs as one readable application progress experience instead of asking users to stitch together component logs and support details. Blueprint Marketplace Product Experience https://www.appaloft.com/blog/github-actions-appaloft-deployment-evidence https://www.appaloft.com/blog/github-actions-appaloft-deployment-evidence Sun, 05 Jul 2026 00:00:00 GMT How Appaloft thinks about GitHub Actions deployments as auditable evidence: commit SHA, image digest, config snapshot, provenance, readback, and rollback. GitHub Actions Deployment control Provenance AI https://www.appaloft.com/blog/ai-agent-static-site-deployment https://www.appaloft.com/blog/ai-agent-static-site-deployment Sat, 04 Jul 2026 00:00:00 GMT How Appaloft turns an agent-produced dist directory into an auditable static artifact publication instead of handing an AI broad cloud credentials. AI Static Artifacts Deployment control Agents https://www.appaloft.com/blog/ddd-specification-appaloft-typescript https://www.appaloft.com/blog/ddd-specification-appaloft-typescript Fri, 03 Jul 2026 00:00:00 GMT Appaloft's lightweight Specification style in TypeScript, from selection specs to readiness gates and drift reports. DDD Specification TypeScript https://www.appaloft.com/blog/ai-agent-cli-auth-token-handoff https://www.appaloft.com/blog/ai-agent-cli-auth-token-handoff Thu, 02 Jul 2026 00:00:00 GMT Why Appaloft separates human browser login, CI tokens, and AI agent token handoff instead of letting agents impersonate users. AI CLI Auth Agents https://www.appaloft.com/blog/skills-are-not-mcp-ai-deployment-control-plane https://www.appaloft.com/blog/skills-are-not-mcp-ai-deployment-control-plane Wed, 01 Jul 2026 00:00:00 GMT Why Appaloft keeps AI skills, MCP tools, CLI commands, and the operation catalog in separate roles instead of creating an agent-only deployment path. AI MCP Deployment control Agents https://www.appaloft.com/blog/blueprints-are-not-marketplace-cards https://www.appaloft.com/blog/blueprints-are-not-marketplace-cards Tue, 30 Jun 2026 00:00:00 GMT How Appaloft models Blueprints as versioned application topology definitions, then turns one-click deploys into reviewable dry-run install plans. Blueprint Deployment control Marketplace AI https://www.appaloft.com/blog/ddd-value-objects-appaloft-typescript https://www.appaloft.com/blog/ddd-value-objects-appaloft-typescript Sun, 28 Jun 2026 00:00:00 GMT How Appaloft uses practical TypeScript value objects: schema versions, literal unions, ids, secret references, masked connections, and provider boundary aliases. DDD Value Object TypeScript https://www.appaloft.com/blog/ddd-aggregate-root-appaloft-typescript https://www.appaloft.com/blog/ddd-aggregate-root-appaloft-typescript Sat, 27 Jun 2026 00:00:00 GMT How Appaloft models InstalledApplication as an aggregate root in TypeScript, with plan acceptance, readback, failure, and rollback transitions. DDD Aggregate Root TypeScript https://www.appaloft.com/blog/ddd-in-appaloft-typescript-architecture https://www.appaloft.com/blog/ddd-in-appaloft-typescript-architecture Fri, 26 Jun 2026 00:00:00 GMT How Appaloft applies domain-driven design in TypeScript through Blueprint planning, installed applications, dependency resources, and runtime composition. DDD TypeScript Architecture https://www.appaloft.com/blog/ai-native-deployment-control-plane https://www.appaloft.com/blog/ai-native-deployment-control-plane Thu, 25 Jun 2026 00:00:00 GMT How Appaloft models deployment as an auditable operating path shared by CLI, GitHub, AI tools, Blueprints, and Cloud. AI Deployment control Cloud https://www.appaloft.com/blog/we-built-appaloft-with-bun https://www.appaloft.com/blog/we-built-appaloft-with-bun Thu, 25 Jun 2026 00:00:00 GMT A practical look at how Appaloft uses Bun for TypeScript scripts, compiled binaries, embedded Web/docs assets, PGlite, and multi-target release packaging. Bun Self-hosting Engineering