THEMIS / RUNTIME-VERIFIED RELEASE CONTROL

THEMIS

Ship new context only when AI behavior still holds. DataHub supplies the meaning. OpenTelemetry supplies the proof.

RUN LIVE WORKSPACE +

01 / DATAHUB CONTEXT

Context is the gate.

Before replay, Themis resolves the changed asset into the signals that govern the run: lineage, meaning, quality, and ownership.

change signal / 01fixture-attested story

01

nyc-taxi-context-v2

One semantic definition changed. Themis follows the authoritative NYC Taxi field before a release can move. ReplayPlan keeps critical cases first; the live workspace records the returned plan.

baselineSUM(total_amount)

candidate riskcongestion_surcharge

quality contractPASS

affected surfaces04

owneranalytics-platform@example.org

THEMIS CONTEXT
GATE resolve

01

lineage / sourcenyc_taxi.yellow_trips

workspace

02

semantic / documentNYC Taxi context v2

workspace

03

quality / fieldtotal_amount

candidate risk

04

consumer / agentanalytics-agent

affected

LINEAGE SEMANTIC QUALITY IMPACT

02 / OPENTELEMETRY EVIDENCE

Replay the trace.

Themis sends the same question through the candidate and watches every retrieval, tool call, and source check for drift.

ReplayPlan / CASE 02 OF 8 TRACE / STORY REFERENCE STORY ONLY

DATAHUB / EXPECTED CONTEXT

OTEL / STORY TRACE

03 / DETERMINISTIC POLICY

QUARAN- TINE

A critical source regression is not a soft warning. Themis holds the candidate, names the failing evidence, and offers a human-gated repair proposal. Approval can lead to replay; Themis never deploys.

critical regression deprecated source field human approval required

01detect

02quarantine

03repair → replay

release decision / STATIC DEMO STORY

nyc-taxi-context-v2

1 / 8 failed

replay thresholdBLOCKED

critical failure

deprecated source field

Candidate SQL reached congestion_surcharge while the DataHub field is marked deprecated. The trace and semantic diff point to a repair proposal for the authoritative total_amount field.

datahub.field urn:li:datasetField:(…nyc_taxi,total_amount)

otel.trace workspace evidence

required approve repair proposal, then replay

04 / DURABLE RELEASE EVIDENCE

Make the decision replayable.

Story path: repair proposal, human approval, same-case replay. A PROMOTE decision means eligible for promotion; it never means deployed.

PROMOTE
AFTER
REPAIR + REPLAY

The candidate
is eligible.

DataHub context selected the cases. OpenTelemetry is the workspace proof. Policy can mark the candidate eligible; Themis does not deploy.

ABLATION / DATAHUB DISABLED
NO WRITE-BACK review

LIVE DATAHUB + FIXTURE-ATTESTED
POLICY SIGNALS / STORY PATH promote
eligible

release evidence receipt

THEMIS-POLICY-V1
STATIC DEMO STORY / NOT LIVE

release_idnyc-taxi-context-v2

decisionPROMOTE

baseline / candidateanalytics-agent-v1 → analytics-agent-v2

datahub_entities

urn:li:dataset:(urn:li:dataPlatform:duckdb,nyc_taxi.yellow_trips,PROD)
urn:li:document:themis-nyc-taxi-context-v2

evidenceReplayPlan / deterministic / 8 cases / story reference

write_backlive workspace only / no landing write

quarantine→human approval→repair→replay

THEMIS THEMIS

THEMIS