Controlled Releases

A tested rule may still need review before it is used for real decisions. Devlish’s release registry records which compiled version was proposed, who approved it, and which version was published. Native execution can consult that registry to reject an artifact that has not been published.

An artifact is the compiled package for a specific source version. The registry tracks its content hash, a fingerprint that distinguishes it from changed code. Read Governed Rules and Evidence Bundles first; this page assumes a rule with identity metadata and passing test cases.

registry.json stores release events in order, with each event linked to the previous event’s hash. A proposal creates a draft, approval makes it eligible for publication, and publication makes it eligible for registry-checked execution. Retirement removes that eligibility. The registry check applies only to execution paths that use it; publication does not automatically deploy a program or restrict every host.

Propose a tested version

A proposal compiles the rule and runs its named cases, then records the artifact and evidence hashes. A failing version cannot be proposed. With pricing_tier.dvl and its cases prepared, record a proposal:

devlish release propose pricing_tier.dvl --author andrew

Approve and publish

Approval records a reviewer distinct from the recorded author. Publication then makes the approved version eligible to run through the registry check. Only approved versions can be published, and published effective windows for one rule cannot overlap. For the proposed pricing.tier version:

devlish release approve pricing.tier@1.0.0 --approver dana
devlish release publish pricing.tier@1.0.0

Check publication during execution

Passing --governed makes native execution compare the compiled artifact hash with the registry. An unpublished or changed artifact is rejected. The following command assumes the rule accepts amount and the registry contains its published artifact:

devlish run pricing_tier.dvl \
  --governed registry.json \
  --input '{"amount": 150}'

Inspect, retire, and roll back

Listing shows recorded releases, and verification checks registry integrity. Retirement records that a version is no longer published. To return to a previously approved version, publish it again after retiring any conflicting version. The following example assumes version 2.0.0 is published and version 1.0.0 remains approved:

devlish release list
devlish release verify
devlish release retire pricing.tier@2.0.0
devlish release publish pricing.tier@1.0.0

Rollback publishes a previously approved artifact as a new event. Registry history is not deleted.

--governed currently applies to native run execution. MCP and REPL execution do not consult the release registry yet.