Single-tenant alpha · public signup closed
Durable hosting for software
an agent wrote and an agent maintains.
The unit of this platform is an app, not a sandbox. It exists next year. It hibernates to zero compute when nothing is calling it, and wakes on its own triggers. No one has to remember it is running, because when it is idle, it isn't.
The layer nobody owns
Agents now write more software than humans do, and almost all of it is small: a scraper someone runs weekly, an internal dashboard for a team of four, a webhook reconciling two SaaS tools, a script that emails a summary every Monday. Existing infrastructure fails these from both directions.
Agent sandboxes are ephemeral by design
Sessions cap out somewhere between 30 minutes and 24 hours. They exist to run code an agent wrote once. There is no concept of an app that is still there in six months, still firing its Monday trigger, still owned by the agent that made it.
App platforms assume a human author
A git repo, a review, a deploy, and someone who notices the bill. That per-app overhead — in dollars, in configuration, in attention — is entirely reasonable for ten apps and absurd for a hundred thousand.
So an app here is a row and a blob
An app at rest is rows in Postgres and byte ranges under a shared bucket. Nothing else. No per-app DNS record, certificate, load-balancer rule, queue, or namespace. Every one of those carries a standing per-object cost, and it is that overhead — not compute — that makes the long tail uneconomic everywhere else.
One call, permanently hosted
const app = await instances.apps.create({
slug: "weekly-invoice-digest",
runtime: "python3.12",
source: { "main.py": ..., "requirements.txt": ... },
triggers: [{ type: "cron", schedule: "0 9 * * 1" }],
capabilities: ["net:api.stripe.com", "email:send", "fs:/data"],
budget: { monthly_usd: 2 },
});That app is live immediately. It fires every Monday at 09:00, sleeps the rest of the week, and every network call it makes is checked against a capability it declared. Reachable from a typed SDK, a CLI, and an MCP server — because the primary consumer is an agent, not a person at a terminal.
Measured 2026-07-28 on a development machine (8-core, Docker Desktop) over 12 genuine cold starts — the app is stopped to zero processes between every sample. A Python app with a real dependency tree measures p50 581 ms / p99 735 ms. These are not production-hardware numbers, and Docker Desktop is known to diverge from Linux in ways that have already produced real bugs for us. Every figure here is reproducible from docs/measurements.md; anything we have not measured is not on this page.
One million apps per control plane at a median under $0.05/month is a design target, not a measurement. It is the number every architectural decision gets tested against. We have measured to 100,000 apps.
Use of a credential, never possession
This is the part we ask you to read carefully, because it is easy to overclaim and we would rather be believed.
An app gets use of a credential. It never gets possession of one.
- Revocable at the broker. Withdraw the grant and the next call fails, without redeploying the app.
- Non-transferable. The app cannot hand the credential to anything else, because it does not hold it.
- Rotatable without touching a revision. Change the secret; the app's source and its running revision are untouched.
- Logged per call. Every brokered call — allowed and denied — is recorded against the app that made it.
An app declares intent in its manifest — net:api.stripe.com, fs:/data,
email:send — and the control plane brokers each one at call time. The app runs on a
network whose only reachable peer is the broker, so an app that ignores the configuration and
opens a raw socket finds nothing there. Enforcement is the network, never an SDK the code could
decline to use.
What we will not tell you is that "the app never touches the credential." An app with a live grant can use it for as long as it runs, and can do anything with the results of an authenticated call. Possession and use are different properties, and only one of them is ours to guarantee. The reasoning, and what we rejected, is in ADR-0008.
Where did this come from
Every app records which agent created it, which model, and a hash of the generating prompt. Every mutation and every lifecycle transition is an append-only audit record. When something misbehaves at app #400,000, that is one query — and it still answers after the app has been deleted, because purging an app leaves a tombstone carrying its provenance behind.
Waitlist
Instances is a single-tenant alpha. Public signup is closed and stays closed until three specific gates close — they are named on the limitations page. Leave an email and we will tell you when that changes.
Email only. No account is created, nothing is charged, and we store the address for one purpose: telling you when access opens.