Offline-first
Software you deploy with Alien no longer depends on Alien being up.
Every machine in a deployment now keeps the last accepted deployment plan and supervises it locally. If the control plane becomes unreachable — our outage, their network partition, an air-gap window — nothing changes for the workloads. They keep serving. They keep restarting on failure. A machine can reboot during the outage and come back with its workloads running, restored entirely from the local plan.
Stateful workloads are handled with more care: rather than guessing during a partition, they hold further changes until the control plane is back and fresh authority is confirmed — no split-brain, no double-writes.
Operators aren't blind in the meantime. A local status command inspects what's actually running on a machine, read-only and offline. And the dashboard now separates "we can't reach this machine" from "this workload is down", so a management-plane gap doesn't page anyone about healthy software.
When connectivity returns, machines report what happened and reconcile back to the desired state.
- Workloads survive outages — serving, restarts, and recovery continue with no control plane
- Reboot-safe — machines restore their full workload set from the locally cached plan
- No split-brain — stateful workloads wait for fresh authority instead of guessing
- Honest status — management reachability and workload health are reported separately
If you sell software that runs in your customer's environment, this is the guarantee they ask about: your vendor's control plane is not in their critical path.
