Skip to content
Baldur

pip install baldur-framework

Your service failed at 03:12.
It was fine by 03:13.

Baldur wraps your critical paths in retries, circuit breakers, and a dead-letter queue that replays itself. Self-healing reliability for Python — no sidecar, no mesh.

Apache-2.0 core · adapters for Django, FastAPI, Flask, and Celery

payments/service.py4 lines added
from baldur import protected

@protected(name="payments.charge", retry=True,
           circuit_breaker=True, dlq=True)
def charge(order_id: int) -> Receipt:
    return gateway.charge(order_id)
incident — payments2026-08-02
  1. payment.charge TimeoutError — retry 1/3
  2. payment.charge TimeoutError — retry 2/3
  3. circuit payments OPEN — failing calls parked to DLQ
  4. gateway probe healthy
  5. circuit payments CLOSED
  6. dlq.replay — 31 parked calls replayed, 31 ok
  7. incident resolved — no one was paged

You were asleep for all of this.

The same 58 seconds, as your console saw them.

Every failure, heal, and replay lands in the healing ledger — the first thing you see on Baldur's built-in console. No extra infrastructure to stand up.

healing ledger — payments · tonight 03:10–03:16
31150 03:12:05 circuit opens — 31 calls parked 03:13:02 replay drains to zero 03:1003:1103:12 03:1303:1403:15 03:16
failures 34 healed 34 replayed from DLQ 31 left for you 0 humans paged 0

Reliability as a decorator, not a platform migration.

  1. 01 — decorate

    Mark what must not fail

    Wrap the calls that page you — payments, webhooks, third-party APIs. One decorator composes circuit breaker, retry, fallback, and DLQ; sane defaults, no config server.

  2. 02 — contain

    Failures stop spreading

    Retries with backoff absorb blips. When a dependency truly goes down, the circuit opens and failing calls park in the dead-letter queue instead of piling up.

  3. 03 — heal

    Recovery runs itself

    Baldur probes for recovery, closes the circuit, and replays every parked call in order. The incident closes before the postmortem doc opens.