Skip to content

Release decisions

The decision is the output of deterministic policy.

Decision table

Decision Meaning Next action
PROMOTE Required replay, oracle, evidence, and policy checks passed. A human may approve the release process.
REVIEW The run needs human attention or has incomplete required evidence. Inspect the receipt and fix the evidence gap.
QUARANTINE A critical replay or policy check failed. Stop release. Fix the candidate or its context.

Common causes

PROMOTE

  • The candidate uses supported fields.
  • Replay cases pass.
  • The independent oracle agrees.
  • Required DataHub evidence is present.
  • The dataset identity is correct.
  • The receipt write-back is verified when required.

REVIEW

  • DataHub was intentionally disabled.
  • A required signal is unavailable.
  • The run has incomplete evidence.
  • An operator must inspect a non-critical mismatch.

QUARANTINE

  • A deprecated field is used.
  • The candidate and oracle disagree.
  • A critical replay case fails.
  • The SQL artifact is unsafe or malformed.
  • The dataset identity does not match the manifest.

Policy is not deployment

Themis stops at an evidence-backed release signal. It does not call a deployment system after PROMOTE. This separation protects the release gate from becoming an automatic production switch.