Afe watches every way a deployment can happen in your delivery tools, and who caused it. It shows what is live in every environment, says how certain each answer is, and tells you when it could not see a source instead of going quiet.
What is live where, since when, how it got there, and how sure Afe is.
6 live placements 2 weak, ambiguous or unknown 1 flagged by an observation gap 1 drift finding
| Service | Production | Staging | Preview |
|---|---|---|---|
Webweb |
8289f2acommit
certain
deploy
|
c41d09ecommit
certain
deploy
|
b527614commit
strong
deploy
|
Shop APIshop-api |
shop-api:hotfix-1022image
unknown
manual
drift
Not produced by any observed build
|
97532e9commit
probable
deploy
|
– |
Workerworker |
a047a20commit
ambiguous
deploy
evidence in a gap
|
e13b163commit
strong
deploy
|
– |
The problem
A change can reach production through a workflow, a GitOps sync, a manual override, a preview promotion or a Terraform apply. Each tool only knows its own part.
GitHub, ArgoCD, Vercel and Terraform each name environments their own way. Nobody can say what is running in production without opening all of them.
A missed delivery or an expired token leaves a hole in the record. Most dashboards cannot tell a quiet afternoon from a blind spot.
A hand-edited image tag, a deploy from a laptop or an instant rollback puts code live that no commit explains. You find out during the incident.
Product
Afe is read-only by default. It connects to the tools you already use and builds one picture from what they report.
Services by environments. Each cell says what runs (commit, image or deployment), since when, which event put it there, and how sure Afe is.
Every event from every connected tool, newest first. Filter by tool, actor, target, trigger, outcome or how the event was observed.
Follow a commit from change to CI, artifact, config, deploy and runtime, with the evidence for every step. Ask whether it is already live in production.
Flags manual ArgoCD overrides, deploys without Git metadata, images no observed build produced and out-of-band rollbacks, with the evidence.
Webhooks for speed, polling and reconciliation for completeness. When a source is unreachable, Afe records the gap, shows it, and backfills when it recovers.
Opt in to run, re-run and cancel workflows, follow live steps and read logs without leaving Afe. Actions use the permissions of your own linked GitHub account.
Rules turn each tool's names (production, an ArgoCD app, a Vercel target) into one set of
services and environments for your whole organization.
People see what their linked GitHub, ArgoCD and Vercel accounts can see. Administrators manage users and sign-in; there is no second permission model to keep in sync.
One image plus PostgreSQL. Credentials are encrypted with a key you hold, and events are deleted after a retention window you choose.
Timeline
A workflow run, an ArgoCD sync, a Vercel promotion and a Terraform apply land in the same timeline, in the same shape, with the actor and the target.
argocd.sync.succeeded means the same thing everywhere in the app and the API.Honest answers
Linking a deploy back to a commit is sometimes exact and sometimes a judgement. Afe shows which, the same way on every page, and never hides a blind spot behind an empty list.
Data may be missing from 2 connections — Afe cannot observe them right now. Events from those periods will be backfilled when each connection recovers.
Commit journeys
Pick a commit and follow it across tools. Every edge carries its evidence and its confidence: solid when identifiers match, dashed when Afe is inferring.
8289f2a
deploy.yml #918
ghcr.io/acme/web@sha256:4e1c…
web/overlays/prod
web-production
production
3f9a1c2 live in production? Yes: it is an ancestor of
8289f2a, which has been running there since 14:41. Afe checks containment against what is
actually live, not against the branch.
How it works
A read-only GitHub App for your organization, ArgoCD with a token or an in-cluster agent for clusters behind a firewall, Vercel projects and Terraform runs.
Signed webhooks arrive in seconds. Polling and reconciliation catch what webhooks miss, and outages are recorded as gaps, then backfilled.
Commit SHAs, image digests, tags and deployment ids link events into placements and journeys. Your mapping rules name the services and environments.
The matrix, timeline, journeys and drift findings show what is live, how it got there and how sure Afe is, in the UI and through the API.
Self-host
Afe ships as one image plus PostgreSQL. Your events and credentials stay in your infrastructure.
# 1. Get the compose file (pick the latest release)
mkdir afe && cd afe
VERSION=v0.1.0
curl -fsSLO https://raw.githubusercontent.com/theafeai/afe/$VERSION/docker-compose.yml
curl -fsSL https://raw.githubusercontent.com/theafeai/afe/$VERSION/.env.example -o .env.example
# 2. Generate the encryption key and admin token (keep both)
mkdir -p secrets && chmod 700 secrets
openssl rand -base64 32 > secrets/afe_encryption_key
openssl rand -hex 32 > secrets/afe_admin_token
chmod 644 secrets/afe_encryption_key secrets/afe_admin_token
# 3. Configure
cp .env.example .env
sed -i.bak "s/^POSTGRES_PASSWORD=.*/POSTGRES_PASSWORD=$(openssl rand -hex 24)/" .env
sed -i.bak "s/^AFE_VERSION=.*/AFE_VERSION=${VERSION#v}/" .env && rm .env.bak
# 4. Start, then open http://127.0.0.1:8080
docker compose up -d --waitSecurity
Afe needs read access to observe. Anything that changes a tool is opt-in, scoped, and uses your own permissions.
Observation uses read-only scopes. Delivery actions in GitHub are opt-in and can be restricted per repository and action.
Every inbound webhook is signature-checked before it is parsed or stored, and replayed deliveries are rejected.
Tokens, keys and webhook secrets are encrypted with a key you keep outside the database. Secrets and authorization headers are never logged.
Roadmap
From observing every deploy to operating them, and keeping a permanent record of each one.
Plans, not promises: no dates are committed. Follow progress on GitHub, or get in touch if you want Afe Cloud.
FAQ
Not today. The open-source Afe shows what is deploying where, now and recently: events are kept for a retention window (30 days by default, at most 60) and then deleted, so it is not a compliance record.
An immutable audit log of every deployment and its lifecycle is on the roadmap for Afe Cloud.
Not unless you opt in. Observation is read-only. GitHub Actions operations are optional, use the permissions of each person's own linked GitHub account, and administrators can block specific actions per repository.
GitHub (Actions, deployments, packages and attestations), ArgoCD (any instance, including clusters behind a firewall through a read-only in-cluster agent), Vercel and Terraform. Afe also records its own configuration changes.
Reconciliation polling finds missed events and marks them as late. If a source cannot be reached, Afe records an observation gap, shows it on every affected page, and backfills the period when the connection recovers.
In your PostgreSQL database. Credentials are encrypted with a key you hold outside the database. Afe sends nothing to us.
Not yet. Afe Cloud is on the roadmap, with hosting, custom permissions, an alerts and notifications centre, and an immutable audit log of every deployment. Today Afe is self-hosted and open source under Apache-2.0. If you want to hear when it is ready, get in touch.
Self-host Afe in about fifteen minutes, star the repository to follow along, or talk to us about your delivery setup.