THEMIS / RUNTIME-VERIFIED RELEASE CONTROL

Themis documentation

Themis checks whether a change to AI context still produces safe and expected analytics behavior.

Themis does not trust a model answer on its own. It checks the answer with read-only replay, an independent oracle, DataHub metadata, policy rules, and OpenTelemetry evidence. It writes a redacted receipt that a person can inspect.

One important boundary

PROMOTE means that the release passed the configured Themis checks. It does not deploy a service. It does not approve a business decision. A person still owns the release action.

Choose a path

You want to...	Start here
Understand the idea in five minutes	What is Themis?
Run the checked-in examples	Quick start
Use the hosted workspace	Run a scenario
Understand DataHub and OpenTelemetry	Evidence lifecycle
Operate the VPS deployment	VPS deployment
Fix a problem	Troubleshooting
Integrate an analytics agent	Analytics Agent

The shortest useful explanation

Themis follows this loop:

1. A release manifest describes the baseline, candidate, dataset, context, and replay cases.
2. Themis freezes and identifies the dataset.
3. An analytics agent may propose read-only SQL.
4. Themis runs that SQL and an independent oracle.
5. Themis checks live DataHub evidence.
6. Themis records OpenTelemetry IDs for the run.
7. A deterministic policy returns PROMOTE, REVIEW, or QUARANTINE.
8. Themis stores a redacted receipt.

The order matters. A good-looking SQL answer cannot replace an independent check.

Public project links

• Open the Themis workspace
• Open the Themis Analytics Agent
• Return to the project list

Documentation rules

This guide uses short sentences and common words. Each page answers one main question. Commands use placeholders for private values. Never copy a password, token, or provider key into a command in a public issue or document.