Release decisions¶
The decision is the output of deterministic policy.
Decision table¶
| Decision | Meaning | Next action |
|---|---|---|
PROMOTE |
Required replay, oracle, evidence, and policy checks passed. | A human may approve the release process. |
REVIEW |
The run needs human attention or has incomplete required evidence. | Inspect the receipt and fix the evidence gap. |
QUARANTINE |
A critical replay or policy check failed. | Stop release. Fix the candidate or its context. |
Common causes¶
PROMOTE¶
- The candidate uses supported fields.
- Replay cases pass.
- The independent oracle agrees.
- Required DataHub evidence is present.
- The dataset identity is correct.
- The receipt write-back is verified when required.
REVIEW¶
- DataHub was intentionally disabled.
- A required signal is unavailable.
- The run has incomplete evidence.
- An operator must inspect a non-critical mismatch.
QUARANTINE¶
- A deprecated field is used.
- The candidate and oracle disagree.
- A critical replay case fails.
- The SQL artifact is unsafe or malformed.
- The dataset identity does not match the manifest.
Policy is not deployment¶
Themis stops at an evidence-backed release signal. It does not call a
deployment system after PROMOTE. This separation protects the release gate
from becoming an automatic production switch.