Reference
Actions
The governed mutation identifiers, who may call them, and the state transition each performs.
Runway's entire write surface reduces to thirty governed actions. Every CLI command, MCP tool, console button, and API call resolves to one of these. Each runs through the full mutation pipeline — schema, policy, state machine, handler, adapter, event.
| Action id | Initiator | Transition | Purpose |
|---|---|---|---|
runway.app_register | human or authorized automation | — | Register a deployable app; mints an app_ id |
runway.artifact_register | operator, CI, or agent | — | Verify and admit a content-addressed Harness build; mints an art_ id |
runway.deploy_request | developer, CI, or agent | none → requested | Request a dev or preview deploy of a verified artifact id |
runway.reconciliation_request | operator or agent | — | Request reason-bound recovery of a failed durable invocation |
runway.reconciliation_dispatch | trusted worker only | — | Link a recovery request to the replacement invocation |
runway.deployment_reconcile | trusted worker only | — | Revalidate and redeploy the exact projected artifact |
runway.analytics_rollup | trusted worker only | — | Derive an immutable completed-day summary from Platform events |
runway.preview_destroy | authorized operator or CI | requested/gate_*/approval_pending/approved → preview_destroyed | Destroy the exact PR-owned preview bundle |
runway.gate_evaluate | authorized caller | — | Request a Fabric Experiments evaluation run (async) |
runway.gate_record | trusted Experiments system actor | requested → gate_passed / gate_failed | Record the exact requested run's verdict |
runway.promotion_approve | permitted human or registered agent (≠ requester) | gate_passed/approval_pending → approval_pending | Record one distinct endorsement |
runway.promotion_reopen | reviewer/admin or authorized agent | approval_pending → gate_passed | Discard endorsements with a reason and adopt current policy on the next cycle |
runway.promotion_finalize | trusted worker only | approval_pending → approved | Enforce the configured total/human threshold |
runway.promotion_execute | trusted worker only | approved → promoted | Deploy the approved release to production |
runway.rollback_request | human operator | promoted → rollback_requested | Select a previously promoted release |
runway.rollback_execute | trusted worker only | rollback_requested → rolled_back | Redeploy the selected artifact |
runway.secrets_sync | authorized operator | — | Consume an opaque one-time secret command at the edge |
runway.secret_delete | authorized operator | — | Delete one key from one environment scope |
runway.secret_rename | authorized operator | — | Write a replacement key, then delete the old key |
runway.audit_export | trusted worker or admin | — | Export the tenant event ledger and recovery manifest |
runway.evidence_export | reviewer or admin | — | Write and Ed25519-sign one release's evidence package |
runway.policy_set | tenant admin | — | Commit effective release policy and trusted-worker configuration |
runway.tenant_upsert | tenant admin | — | Configure the current internal business-unit boundary |
runway.membership_set | tenant admin | — | Grant, change, or revoke a tenant role assignment |
runway.tenant_provision | platform-tenant admin | — | Request a new isolated business unit and first administrator |
runway.tenant_bootstrap | trusted worker only | — | Atomically initialize target tenant, policy, and administrator |
runway.tenant_provision_complete | trusted worker only | — | Attest target-tenant initialization in the platform stream |
runway.tenant_retire | platform-tenant admin or authorized agent | — | Request removal of a business unit from active authorization |
runway.tenant_retire_apply | trusted worker only | — | Record retirement in the target tenant ledger |
runway.tenant_retire_complete | trusted worker only | — | Attest target retirement in the platform stream |
Adapter steps
Some actions drive a Databricks or gate-engine adapter step:
| Action | Adapter step(s) |
|---|---|
runway.artifact_register | artifact.verify (materialize + SHA-256 tree verification) |
runway.deploy_request | bundle.validate → bundle.deploy (dev / preview) |
runway.deployment_reconcile | bundle.validate → bundle.deploy (exact prior intent) |
runway.preview_destroy | bundle.destroy (exact PR target) |
runway.gate_evaluate | evaluations.request |
runway.promotion_execute | bundle.deploy (prod) |
runway.rollback_execute | bundle.deploy (prior artifact) |
runway.secrets_sync | secrets.sync |
runway.secret_delete | secrets.delete |
runway.secret_rename | secrets.sync → secrets.delete |
runway.audit_export | audit.export (customer audit Volume) |
runway.evidence_export | evidence.export (signed report + manifest in customer audit Volume) |
rollback_request records the decision only — it has no adapter step; the redeploy happens
in rollback_execute. bundle.deploy is idempotent, which is what makes production execution
safely retryable.
Notes
- Async gates.
gate_evaluateonly requests a run and transitions nothing; the verdict arrives later throughgate_record. Experiments has no completion webhook, so a poller records the verdict on its behalf. - Server/worker-only actions.
gate_record,promotion_finalize,promotion_execute,rollback_execute,reconciliation_dispatch,deployment_reconcile,analytics_rollup,tenant_bootstrap,tenant_provision_complete,tenant_retire_apply, andtenant_retire_completeare not exposed on the public API allowlist — recording verdicts, initializing isolation boundaries, and executing production are reserved for the system. - Opaque secret values.
secrets_syncandsecret_renamecarry one-time command IDs, never values. Rename writes the replacement before deleting the old key; Platform checkpoints both adapter steps durably. - Idempotent sync.
secrets_syncis idempotent and its sensitive input is redacted before the durable invocation is recorded. See secrets. - Recovery is another mutation. Platform Host recovers expired leases automatically. Terminal
adapter failures require
reconciliation_request; the worker never edits an old invocation. - Approval policy is pinned. The first endorsement freezes approval/evidence semantics for that
cycle. Only
promotion_reopencan discard endorsements, mint a new cycle identity, and adopt the current tenant policy. Approval and finalizer idempotency are cycle-scoped; worker trust always uses current settings.
See governed delivery for the full state machine and gates and evidence for the promotion policies.