How it works
A deploy is an act, never a side effect. A tool reaches Substrait only because someone ran the deploy command. Source arrives either from the builder’s own GitHub repository or as a stored snapshot, with no git host at all.
Dev first. Every new tool starts in dev, behind sign-in for your organisation. The builder cannot switch that sign-in off; turning it off in dev needs a written reason and an operator’s approval.
Production comes last. Production does not exist until the builder goes live. Going live is one click, and it promotes the build already tested in dev, with no rebuild. Later deploys keep landing in dev until the next promotion.
Promotion is the only way into production. Every promotion runs the security check on that exact build. A build within your policy is promoted automatically. A build with too many issues stops for a human approver.
Versions and rollback. Every release is versioned. A bad release rolls back to the last good version in one click.
Each environment is separate. Dev and production each have their own database, file storage, settings and address.