An assembled app — not a pointer to a backend.

Versioned + immutable deployments

Every build pins manifest SHA, functions, agents, state names, and events. Promote to staging → production with a single tx pointer move. Atomic rollback to the previous deployment in one call.

Environments + preview branches

prod / staging / preview / dev. Each environment owns its state namespace and Vault secret scope. Idempotent deployments via Idempotency-Key — replay returns the same deployment row.

Forkable, with license inheritance

Fork any app with a permissive (MIT/Apache/BSD) license by default. Strong-copyleft requires the caller to own the source. Proprietary licenses require an explicit override. Source attribution badge on every fork.

Autopilot classification

Every app is automatically placed on the right execution tier — static, edge, agent, or full — based on its manifest. Operators can override per build; the inferred class is recorded for audit.

Performance Score

A transparent, weighted score across six axes (latency, errors, cost, asset size, edge p95, requests) with per-plan asset and cost budgets. Frozen formula version, replayable across runs.

App Network grants

Cross-app capability grants: App A can use App B's declared capability. Per-recipient manifest check, idempotent creation, revocation with audit trail, in-memory expiry reclassification.

Declarative contract

A single YAML or JSON manifest describes functions, agents, state names, events, capabilities, UI, frontend build, and the license. Canonical-JSON SHA pins the manifest to the deployment row.

• Functions, agents, state, events, and capabilities in one file
• Execution class auto-classified from the manifest; operators can override
• Hash-named frontend assets get long-cache headers; everything else gets revalidation
• Manifest schema is validated at publish; unknown fields are rejected

Serve from one URL

The App Runtime serves the manifest's frontend assets and dispatches fx://, agt://, and state calls without exposing the orchestrator. Host-aware routing for prod, staging, dev, and preview-{N} branches.

• {slug}.functionfly.app, {slug}-staging.functionfly.app, {slug}-dev.functionfly.app, {slug}--preview-{N}.functionfly.app
• BuildStore with circuit breaker — degrades to 503 with Retry-After on downstream failure
• Live event fan-out over WebSocket: ff.live streams deployments, manifest builds, and capability events
• Per-app tokens authenticate fabric bindings; hash-at-rest, env-scoped, revocable

Discovery + grants + marketplace

Apps can publish capabilities to other apps and install extensions from the template catalog. Discovery surfaces every capability with active installs; grants wire the cross-app authority.

• Templates seeded across 12 categories (saas-starter, ai-agent, marketplace, docs, ecommerce, …); instantiate a template into a new app with one call
• Per-app FCI extensions: install, toggle, uninstall without losing the underlying capability installation
• App Network grants: cross-app capability sharing with manifest-level validation
• Score formula frozen at v1 — any future version is a NEW migration and a NEW formula row, never an in-place edit

Write the manifest

Author YAML or JSON describing functions, agents, state, events, capabilities, UI, and frontend build. The manifest is the source of truth — no separate config files.

Build

POST /v1/app-fabric/apps/{slug}/build. The build pipeline writes the ffpkg archive to the BuildStore and inserts a manifest row keyed on the canonical-JSON SHA. Same body re-builds return the same row id.

Create environments

Create a production env (and staging / preview / dev as needed). Each environment owns its state namespace and Vault secret scope; URLs are derived from {slug}.functionfly.app + env kind.

Deploy

POST /v1/app-fabric/apps/{slug}/deploy with an Idempotency-Key. The deployment validates the manifest belongs to the app, the env belongs to the app, and writes an append-only immutable deployment row. Replays return the same deployment.

Promote

Promote the deployment to current with a single-tx pointer move. The previous current deployment flips to rolled_back automatically. Rollback picks the highest-seq non-current deployment.

Serve

The App Runtime serves the manifest's assets and dispatches fabric calls. Hash-named assets get long-cache headers; non-hashed assets get revalidation. Live events stream over ff.live.

Fork (or install extensions)

Fork any permissive-licensed app with an attribution badge. Or extend an app with a per-app FCI: install, toggle, uninstall — without losing the underlying capability installation.

Score + audit

Every deployment is scored on the six axes against the per-plan asset and cost budgets. Mismatched score formula versions surface as Prometheus alerts; audit rows survive flag flips for forensic replay.

Static

Landing pages, marketing sites, docs portals, handbooks. Frontend-only manifest, hash-named assets, edge cache. The runtime serves from a content-addressed store.

Edge functions

SaaS dashboards, internal tools, admin panels. Functions but no agents — fx:// calls dispatch through the registry runtime and return JSON. The App Runtime serves the UI plus dispatches function calls.

Agent

AI copilots, customer support agents, research assistants. Agents declared in the manifest, fx:// tools installed per agent, wake on HTTP / webhook / schedule / event / agent-call. Memory tiers (conversation, working, long-term) come along for free.

Full

Long-running workloads, scheduled pipelines, background jobs. Full FlyBox / CCP placement with custom containers, GPU access, and per-app resource budgets. The App Runtime fronts the deploy surface and the dispatcher handles the rest.