Orchestration

A promotion is not a request. It starts when a gate passes, waits for approvals that arrive minutes or days later from people and agents, and finishes with an adapter call that changes production. The thing that owns that wait has to survive process restarts, redeploys, and scale-to-zero without either forgetting the cycle or promoting something twice.

Runway supports two owners for that wait.

Set the mode explicitly with RUNWAY_ORCHESTRATION_MODE, which accepts exactly poll or temporal. Anything else is rejected at startup rather than silently interpreted. With the variable unset, a production deployment resolves to temporal and everything else resolves to poll.

Production requires Temporal Cloud

A production install refuses to start unless RUNWAY_TEMPORAL_ADDRESS is a *.tmprl.cloud endpoint with TLS credentials. This is a hard startup check, not a warning.

The reason is that a half-wired orchestration mode is worse than either mode on its own. If the product believed it was running on Temporal while no workflow existed, promotion cycles would wait for a signal nobody would ever send, and the poll loop that would otherwise have finalized them has been deliberately switched off. Failing at process start makes that a configuration error you read in a log line, rather than an approval that silently never lands.

The same rule governs client construction: if the Temporal client cannot be built, the process refuses to start rather than degrading to a mode nobody selected.

What the workspace must provide

• A Temporal Cloud namespace reachable from Databricks Apps over TLS. Egress from a Databricks App to Temporal Cloud has been verified on a workspace with default networking, but accounts using Private Link, network connectivity configurations, or restrictive firewall policy should confirm it before rollout — this is the prerequisite most likely to fail in a locked-down account.
• An API key for that namespace, or a client certificate pair.

Configuration

The customer bundle binds these from the secret scope; set them directly only when running outside the bundle.

TLS is enabled automatically when the address looks like Temporal Cloud; RUNWAY_TEMPORAL_TLS overrides that explicitly. For a private deployment terminating TLS with your own certificate authority, RUNWAY_TEMPORAL_CLIENT_CERT_PEM, RUNWAY_TEMPORAL_CLIENT_KEY_PEM, RUNWAY_TEMPORAL_SERVER_ROOT_CA_PEM, and RUNWAY_TEMPORAL_SERVER_NAME_OVERRIDE are available in place of an API key.

Installing without Temporal Cloud

There is exactly one supported way, and it is not the default:

export RUNWAY_ALLOW_LOCAL_TEMPORAL=1

This permits a non-cloud Temporal endpoint for a topology you have certified yourself — a self-hosted Temporal cluster inside the customer's network, for example. It disables the Temporal Cloud address check and nothing else; a Temporal server is still required.

To run without Temporal entirely, set RUNWAY_ORCHESTRATION_MODE=poll. The action worker's poll loop then owns promotion cycles, exactly as it did before. This is supported for development and evaluation installs. It is not recommended for production, because the poll loop's durability guarantees are weaker than a workflow's: it reconstructs intent from projection state on each pass rather than holding it.

What changes between the modes

Only who finalizes and executes a promotion.

• Under temporal, promotion cycles start when a gate passes, approvals arrive as workflow signals, and the poll loop skips promotion_finalize and promotion_execute so the workflow is the single author of both.
• Under poll, the action worker performs them itself.

Everything else is unchanged in both modes. Gate recording, tenant lifecycle, seeding, and rollback execution stay with the action worker, and every mutation remains a governed action with the same policy evaluation and the same audit trail. The orchestrator decides when a governed action runs; it never decides whether policy is satisfied.

A reconciler covers the gap where a workflow should exist and does not — an approval whose signal was lost, or a cycle that began before the workspace was switched to temporal. It starts the missing workflow from Platform's projection state, so a cycle is recovered rather than stranded.