When the Agent Builds the App, Who Deploys It?

The “Now What” Moment

AI coding agents can scaffold a full-stack application in minutes. The hard part has never been writing the code—it is the tedious, error-prone work that comes after: creating a hosting project, wiring a database, configuring payment webhooks, verifying DNS records, and remembering to tear down the test resources before they start billing. This is the gap between a prototype and a product, and it is where most agent-built projects stall. GoLive, an open-source Agent Skill published by Mike Hasa, attempts to automate exactly that last mile. It does not replace your agent; it rides shotgun, translating high-level intent—take this app live—into provider-specific provisioning, verification, and cleanup, all through the user’s own accounts and with no central backend or telemetry.

The problem is well recognized. Independent developers are already building agentic applications that rival corporate teams, using autonomous systems that plan, call tools, and adjust strategies across multiple steps. But getting those applications onto real infrastructure still requires a human to navigate dashboards, copy API keys, and cross-reference checklists. GoLive frames itself as the answer to that specific “now what” moment that arrives right after the AI finishes coding.

An Agent Skill, Not a CLI

The first thing to understand is the packaging. GoLive is not a traditional DevOps utility you run from a terminal in isolation. It is an Agent Skill, designed to be consumed by conversational coding agents such as OpenAI Codex or Claude Code. You invoke it inside a chat session with a natural-language request, and the skill inspects the repository, detects what infrastructure the application needs, and plans the exact changes before asking for your approval. This distinction matters because it places GoLive inside an emerging ecosystem of agent-native tooling. The recent Agent Plugins 1.0.0 specification, backed by Google, Amazon, Cursor, Microsoft, OpenAI, and Vercel, is attempting to standardize how skills and model-context servers are packaged so they can travel between clients. GoLive is a practical, early demonstration of what that portability might look like in practice: infrastructure automation delivered as a conversational primitive rather than a standalone SaaS platform.

The workflow follows a rigid detect-plan-approve-apply-verify loop. The skill inspects the codebase, asks about missing providers, presents a plan naming the specific destination accounts and resource settings, and waits for explicit human approval before touching anything. Writes are gated not just by a single confirmation, but by extra flags for destructive or sensitive operations: additional gates for DNS record changes, live-mode production steps, and teardown. This is not accidental caution; it is the core architecture. The tool is explicitly designed to stop at the first failed check rather than barrel onward, and it keeps secrets out of the chat log, storing API keys in a local credentials file with restricted permissions. The execution code keeps values out of plans, state, and command output. On macOS, a native hidden-input dialog can save a needed API key; other platforms fall back to your own editor. The design assumes the chat log is untrusted and the human is the final authority.

Verified, Not Just Scripted

Where GoLive diverges from simpler deployment scripts is its obsession with evidence. Every run produces an ownership document, a state file, and a verification report that records pass, fail, warning, and skipped results. After deployment, the drift-check workflow can re-read the live infrastructure and compare it against the recorded baseline, flagging changes without ever re-baselining automatically. When a project is done, the teardown path plans the removal of only the resources it provably created, then re-reads the DNS zone to confirm the records are actually gone.

This audit trail is deliberate. The project maintains a public validation record documenting exactly which journeys have been live-tested—hosting via Vercel and Netlify, databases via Supabase and Neon, custom domains via Porkbun and GoDaddy, transactional email through Resend, Stripe test-mode payments, and Supabase Auth configuration—and which remain mock-covered or unvalidated. The alpha release even includes a handoff document generator that writes a markdown file tagging every resource as verified, recorded, not verifiable, or unknown, effectively treating infrastructure as a codebase artifact with provenance. In a landscape where agents often hallucinate or silently skip steps, this emphasis on observable state is arguably more valuable than the automation itself.

The verification report is granular. It distinguishes between a check that passed, one that was skipped because a human needs to act, one that warned because a fresh subdomain landed in spam, and one that failed because a webhook signature did not verify. When the skill provisions a Stripe test-mode integration, it does not merely register the webhook endpoint; it attempts a real test-card payment and verifies that the resulting event carries a valid signature. When it configures Resend for transactional email, it attempts a real send and notes whether the message was delivered. This is not synthetic monitoring; it is disposable, approved live testing that is subsequently torn down, and the results are written into the project’s permanent record.

The Limits of Agentic Ops

For all its architectural discipline, GoLive is unambiguously early alpha. Version 0.1.0-alpha.3 carries roughly 949 GitHub stars and a warning that much of the roadmap is direction, not finished code. The live-tested matrix is narrow: six specific provider pairings have been exercised end-to-end, while cross-pairings and broader framework support remain mocked or untested. Cloudflare DNS has an adapter but no live validation. Account isolation for Supabase Auth is implemented and mock-covered, but its first real run is still pending. The tool explicitly refuses to guess when a provider lacks an API surface it needs. Vercel, for instance, exposes no per-deployment read that the skill can use for promotion or rollback, so it simply warns and skips rather than improvising.

There are also inherent boundaries that no amount of code can remove. The skill does not create billing accounts or accept terms of service on your behalf. Identity verification, browser-based OAuth logins, inbox clicks for email confirmation, and credit-card entry remain human tasks. The tool guides you to the right dashboard page, then waits. This human-in-the-loop design is framed as a feature—your accounts remain yours, and no GoLive backend ever sees your credentials—but it also means the fully automated dream stops at the provider’s front door. The documentation itself notes that an agent already authenticated with a provider could bypass the skill’s controls entirely.

The alpha’s narrow provider matrix also reveals a maintenance reality. Each live-tested path represents not just code but a sequence of supervised, disposable runs on real accounts, complete with cleanup. The project explicitly warns that cross-pairings have only mocked coverage and should not be assumed to work. This honesty about verification gaps is rare in open-source infrastructure tooling, where READMEs often imply broader support than exists. GoLive’s validation document, by contrast, reads like an engineering logbook, complete with dates, known defects, and issue references.

The Bigger Picture

GoLive arrives at a moment when the AI developer tooling stack is stratifying. On one layer, you have the coding agents themselves—Cursor, Windsurf, Zed, Replit—generating application logic. On another, you have infrastructure platforms handling durable execution for long-running agent workflows. GoLive occupies a narrow but critical seam between them: the moment a codebase needs to become a live product. It is part of a broader category of tools attempting to make agents act across real-world APIs, but it is unusual in its refusal to centralize control. There is no GoLive account to create, no hosted backend, no product telemetry. The skill runs on your machine, talks to providers through your credentials, and stores state in your repository. This zero-backend approach mirrors the self-sovereign ethos of the Agent Plugins specification, where components are meant to fail independently and client-specific extensions live in isolated directories.

Whether this model scales is an open question. Traditional infrastructure-as-code tools manage complexity through centralized state backends and mature provider ecosystems. GoLive, by contrast, is essentially a curated collection of provider-specific adapters wrapped in an approval workflow. Its long-term viability depends on whether the agent-skill ecosystem standardizes fast enough to attract contributions for the long tail of providers, or whether every new adapter remains a bespoke maintenance burden for a single maintainer.

What Comes Next

The roadmap reads like a production engineer’s checklist: backend containers, schema migrations, file storage, OAuth, SMS, background workers, monitoring, CI/CD previews, promotion and rollback, backups, cost alerts, and accessibility checks. Many of these are marked as planned or in-progress, with only teardown and basic drift detection currently implemented and tested. The next milestones on the critical path are live-validation of account isolation, live-mode payment flows, and the Cloudflare DNS adapter.

What GoLive is betting on is that the bottleneck in software delivery has shifted. Writing code is now cheap; wiring it to the internet safely is not. If the project can expand its verified provider matrix while keeping its strict approval and evidence model, it could become a standard component of the agentic development stack. If it cannot, it will remain a promising but narrow utility for a handful of hosting-and-database pairings. Either way, it has framed the problem correctly. The agent built your app. Somebody still has to read the DNS manual, verify the webhook signatures, and remember to cancel the test project. For now, at least, that somebody is you—with GoLive holding the checklist.