Skip to main content

Environments and promotion

Getting a table, a model, an ontology or a pipeline from development into production is where most governed platforms quietly stop being governed. Somebody runs a script, and the thing that arrives in production is related to what was reviewed by convention rather than by construction.

Here promotion is a first-class catalog operation with a ledger behind it.

Environments​

An environment is a declared object, not a naming convention on a schema. Each carries its own per-environment overrides, so the same catalog object can resolve to different connections, locations or parameters in development, staging and production without being a different object.

That is what makes a promotion meaningful: the thing promoted is the same object, moving, rather than a copy that happens to look similar.

The promotion path​

Figure: promotion as a reviewed operation. A set of catalog objects is planned into a bundle, versioned, signed and sealed, then requested into a target environment. Approval is explicit and contracts are validated on promote, so a change that would violate an active data contract does not reach production. Every outcome lands in the promotion ledger.

Table equivalent

StageWhat happens
PlanThe set of catalog objects to move is resolved, with its components
VersionThe bundle is versioned
Sign and sealThe bundle is signed, so what arrives is verifiably what was approved
RequestPromotion into a target environment is requested
ValidateData contracts are validated on promote, not after
Approve or rejectAn explicit decision, recorded
LedgerThe promotion ledger records what moved, when, and under whose approval

Solution bundles​

The unit of promotion is a solution bundle: a set of catalog objects planned, versioned, signed and sealed, and exported as one artifact rather than a list of things to apply in the right order and hope.

Two consequences worth naming.

A bundle can cross an air gap. Because it is signed and sealed, it can be carried on removable media into a disconnected estate and verified on import rather than trusted because it arrived. That is the same posture the platform takes with policy, model and catalog bundles everywhere else.

A bundle is a reviewable unit. A reviewer approves a coherent change to a vertical, not fourteen unrelated object edits that happen to have been made the same afternoon.

Workspace promotion edges​

Promotion is not only vertical through environments. Promotion edges between workspaces declare which workspace may promote into which, so the path a change can take through an organization is a declared graph rather than whatever permissions happen to allow.

Model promotion​

Models carry their own approval path on top of this, with promotion approvals, a lease, artifact trust and reachability checks, and guards that prevent a model from quietly reaching data or relocating to a cell that policy forbids. See model operations.

Why this shape​

The argument for a data platform is usually "we know what you have." The argument that survives an audit is "we know how it got there, and who said yes."

A promotion ledger with contract validation and a signed bundle turns "how did this reach production" from an archaeology exercise into a query, which is the same move the platform makes everywhere else: make the record a property of the operation rather than something reconstructed from logs afterward.