Ascender is CIQ's commercially supported continuation of AWX, and it solves the one thing AWX broke: it ships releases and you can buy a support contract. But it keeps AWX's footprint. A Kubernetes-based install, Postgres, and a Receptor mesh stand up before the first playbook runs, and Ansible is still the only tool. SwitchTender is one Go binary. Download it, run it, and you have job templates, schedules, RBAC, surveys, workflows, and approvals, with directory sign-in on Pro, plus a live host-by-task matrix and seven tools instead of one. Ascender's export, made with its own ascender-kit client on the AWX data model, imports in one command.
Ascender's approval node is AWX's. The approver is any user who can launch the template, an org admin, or anyone granted Approve on that template, and a request that is not approved in time is marked timed out and takes the failure path. SwitchTender's approval commits a digest of the inventory snapshot, the resolved container image, the pinned commit, and the saved plan, and the executor refuses a run whose content moved after sign-off. An AI agent gets one credential and a ceiling below admin, so it proposes and never approves. The audit trail is a signed hash chain that an Apache-2.0 verifier checks offline, with no login to any server.
What Ascender runs, SwitchTender runs free in one binary with no Kubernetes, Postgres, or Receptor mesh under it. Directory sign-in is Pro at $500 a year; Ascender ships it free, so that row is theirs. Ascender's job templates run Ansible playbooks; any other tool runs as a task inside one, which the controller cannot see or approve on its own terms. SwitchTender runs seven tools through one gate.
Three gaps, in CIQ's own words. On approval, the vendor documents who may click and when the request times out, not what content the click covers. Ascender records the revision a job used; no page says it refuses a run whose content changed after approval. On evidence, Ledger "logs what the platform itself does," the auditor's answer is "a query against the trail the platform already built," the activity stream forwards to Logstash, Splunk, Loggly, Sumologic, and Elastic Stack, and no hashing or signing is documented. On agents, no AI, LLM, or agent feature appears on the product page, the compare page, the July 2026 press release, or the current release notes.
AWX froze in July 2024 and has shipped nothing since. Ascender is the answer to exactly that. CIQ, the team behind Rocky Linux, maintains it, ships releases, and sells the support contract and SLA that a regulated shop often needs before it will run anything in production. If what you're buying is AWX itself, kept alive and supported, Ascender delivers it. This page is about the other axis: whether you want AWX's capabilities without inheriting AWX's architecture.
The enterprise checklist, side by side. The full three-way table including AWX and Semaphore is on the comparison page.
| Capability | SwitchTender | Ascender |
|---|---|---|
| Approval bound to the content that runs: inventory, image, commit, plan | a digest recomputed before execution | Workflow node records a decision, not a digest; jobs record the revision used after the fact |
| Hard ceiling on AI agents: cannot approve its own run or touch identity or secrets | agents are principals capped below admin | No AI feature documented |
| Evidence a third party verifies offline, without trusting the server | signed hash chain, Apache-2.0 verifier | |
| Deploy | One binary, SQLite or Postgres creating a new Postgres schema is Team, opening an existing one is never gated | Kubernetes or k3s + Postgres + Receptor |
| Model | Source-available, self-host free | Core, Ledger, and Galaxy Proxy are Apache 2.0; Reaqt and Registry ship only as subscription images; Ascender Pro lists at $100 or $150 per node per year |
| Commercial support and SLA | Email support from Pro, SLA at Enterprise | Standard is business hours, Premium is 24/7 with a 30-minute Severity 1 response; no self-support tier |
| Tools | Ansible, Terraform, OpenTofu, Bash, PowerShell, Python, Go | Ansible only |
| Live host-by-task matrix | ||
| Job templates, surveys, schedules | ||
| Drag-and-drop workflow editor | ||
| RBAC, teams, per-object grants | ||
| LDAP, SAML, OIDC sign-in | Pro, $500/yr | |
| Execution environments | All seven tools, Docker or Podman | Ansible only, run as pods on Kubernetes |
| Instance groups | worker queues, Team | |
| High availability | Active-active on Postgres creating the schema is Team, opening an existing one is never gated | Via Kubernetes |
| Duration-balanced job splitting | Job slicing, each slice runs a portion of the inventory | |
| Flaky-host detection and duration trends | Per-host job summaries, neither of these | |
| Tamper-evident, signed audit | Activity stream forwarded to Logstash, Splunk, Loggly, Sumologic, or Elastic Stack; Ledger change diffs exported as CSV or PDF; no hashing or signing documented in either | |
| Drift detection and reconcile, Ansible and Terraform | detection free, one-click reconcile Team | Drift detection in Ascender Pro through Ledger, described as watching baselines between runs; no reconcile documented |
| Notification channels | Eleven, each with per-template targets | Ten: AWS SNS, Email, Grafana, IRC, Mattermost, PagerDuty, Rocket.Chat, Slack, Twilio, Webhook, attached to organizations, projects, templates, workflows, inventory sources, and system jobs |
| Advisory AI triage and fleet answers | No AI, LLM, or agent feature documented | |
| Drop-in Go plugins: tools, secrets, AI, notifiers | ||
| Import from other tools | One command | Its own export through ascender-kit; in-place migration from AWX through the installer |
Checked against Ascender's own documentation on 2026-10-08, for Ascender 25.6.2, published 2026-09-09. A comparison decays the day it is written, so check a row against the current release before you rely on it. Full table and sources.
Ascender is AWX's core with years of production use, a deep Ansible ecosystem of credential types, inventory plugins, and execution environments, and a Receptor mesh built for running across network boundaries at scale. Since July 2026 Ascender Pro also ships Reaqt, which listens for fleet events, matches rules, and launches job templates; Registry, a local hub for collections and execution environments; Federated Inventory, which fans one launch across regional inventories as child jobs; errata and CVE status by host; and an open source Galaxy Proxy. SwitchTender has none of those five. Behind it is a company you can pay to answer the phone. SwitchTender closes the ecosystem gap differently. Any team can add a tool, a secret engine, an AI provider, or a notification channel as a drop-in Go plugin binary, no fork and no rebuild of the server. Pick Ascender when the deciding factor is staying on AWX. Pick SwitchTender when it is the product and the footprint.
Ascender uses AWX's data model, so its export imports into SwitchTender the same way AWX's does. Projects, inventories, templates, surveys, and schedules come across, with a dry run first so you see the plan before anything is written.
switchtender import awx awx-export.json --db switchtender.db# Keep both values: the server must start with this same pair.
export SWITCHTENDER_ENCRYPTION_KEY=$(openssl rand -hex 32)
export SWITCHTENDER_ENCRYPTION_SALT=$(openssl rand -hex 16)
switchtender import awx awx-export.json --db switchtender.db --applyThe switching guide maps every AWX concept to its SwitchTender equivalent, and the migration reference covers the details. Coming from stock AWX instead? The AWX alternative page makes that case.
The four asked most often when somebody is comparing this against what they already run.
No. It reaches the machines it manages over SSH, the same way Ansible does, and installs no agent on them. There is no per-host daemon to deploy, patch, or account for. You run the one server binary. Worker processes for extra throughput are a Team feature, and they are pool members rather than agents belonging to a host.
All three, resolved at launch rather than copied into this database. Vault dynamic secrets go further: a short-lived credential is minted for each run and revoked when the run ends. Azure authenticates from the attached managed identity with no stored key, AWS takes an access key from the credential or the standard AWS environment variables, and anything else resolves through a command whose output is the secret.
Yes, and it is what pipelines are for here. Steps mix tools freely on a dependency graph with parallel branches, built on a drag-and-drop canvas, and an approval step holds the pipeline for a person before the steps after it run. A policy decides which runs are held, and an agent's run is held unless a written policy exempts it. When the approval has to bind an exact Terraform plan, run the apply on its own: it plans first, and the approval binds the saved plan, so it cannot be approved as one thing and executed as another. By default an admin may approve a run they launched. Requiring a different person is a Team rule.
An install keeps running as it is. There is no license server and no phone-home, a paid license keeps verifying offline through its term, and your data and receipts stay yours, checked by an open verifier that does not depend on us. Every release converts to Apache 2.0 two years after it ships, and at once if KordLoom ceases business.