Production readiness

Runway's governed domain and production host are implemented. The local demo uses memory/mocks; production composes the published Fabric Platform Host, Fabric Harness, Fabric Experiments, Lakebase, and Unity Catalog Volume capabilities.

Implemented

• The canonical Fabric Platform Host mutation lifecycle over a Lakebase-compatible durable store
• Explicit permissions, policy gates, tenant isolation, requester/reviewer separation, and trusted-worker execution
• Immutable UC Volume artifacts with post-materialization digest verification
• Fabric Harness Databricks bundle validate/deploy and App activation at the adapter edge
• The Fabric Experiments typed client with run-bound provenance
• Encrypted, expiring, one-time secret commands
• Real rollback to a previously promoted artifact
• The console, fr CLI, MCP server, project template, tests, and end-to-end demos
• Atomic leases, worker restart recovery, stable command deduplication, and operator diagnostics
• Exact PR-owned preview teardown on close
• Daily governed UC Volume audit exports, SHA-256 manifests, and fr audit verify DR rebuilds
• Governed seed-member replay, SCIM group resolution, permission-aware admin reads, and durable platform-admin tenant provisioning/retirement
• Optimistic policy revisions, active-worker lockout protection, pinned approval-cycle snapshots, and explicit reason-bound cycle reopening
• Ed25519-signed per-release evidence exports with customer-owned keys and UC Volume manifests
• A verified artifact registry with source, Harness, digest, and compound workload provenance
• Explicit governed reconciliation linking terminal invocations to trusted-worker retries
• Event-derived daily analytics rollups with tenant-configurable query retention
• A repeatable customer Asset Bundle that provisions Lakebase, UC Volumes, App bindings, and grants

Required for each client workspace

1. Durable store. Run the customer installer to provision Lakebase and execute the Platform Host schema migration during controlled startup.
2. Volumes. Review the installer-created customer-owned artifact and audit UC Volumes and their App resource grants.
3. Identity and worker. Configure tenant memberships, deploy the durable worker, and configure its trusted service-principal id in RUNWAY_TRUSTED_WORKER_IDS; select the install seed that owns new-business-unit provisioning with RUNWAY_PLATFORM_ADMIN_TENANT_ID.
4. Live gate. Configure the versioned Experiments dataset resolver and execute a real release gate end to end.
5. Certification. Run the disposable provisioning → preview deployment → two-party approval → teardown → tenant-retirement suite, then exercise a real Experiments gate, promotion, rollback, worker restart, failed-adapter diagnostics, audit export, and projection rebuild before enabling prod access.

Fail-closed deployment requirements

• RUNWAY_ALLOW_DEV_AUTH=1 and RUNWAY_ALLOW_DEMO_UI=1 are forbidden in production mode.
• RUNWAY_TRUSTED_WORKER_IDS must include the injected Databricks App client id.
• A gate verdict is rejected when the Experiments verifier is unavailable, the run is still running, the run id differs, or the actual outcome differs.
• Preview teardown is refused without an exact PR number and immutable artifact digest.
• Production deploy requests are refused without a digest-verified Artifact Registry id.
• Policy updates are refused when their expected revision is stale or they remove every active App worker identity.
• Signed evidence export is refused when the Ed25519 signing secret or customer audit Volume is absent.