01 Promotion

Promote dev to prod as one atomic transaction.

A data product carries semver and a content-addressed manifest. Promotion runs plan, then gate, then apply - and either the whole product moves forward or nothing does.

orders-product · v1.4.0
rollback to v1.3.2
plan resolve the diffgate quality checks + contract diffapply one atomic transactionrollback re-materialize the previous version
Plan

See exactly what moves

EVE resolves the diff between the running environment and the incoming version - which syncs, models, checks, and dashboards change, and what the contract diff implies.

Gate

Nothing ships that fails

Gates run the product's quality checks and a contract diff. A breaking change, or a failed check, stops the promotion before anything is applied.

Apply

All or nothing

Apply is one atomic transaction. The whole product lands together, or the environment is left exactly as it was. Rollback re-materializes the previous version.

02 Governance

Govern once. Enforce everywhere.

Access and residency are decided at the org level and carried into every environment - so a product is governed the same way in dev as it is in prod.

  • Domains that actually enforce. Attach a domain at the org level and it restricts access in every environment and every product. Elsewhere a domain is a cosmetic filter chip; here it is a hard boundary.
  • One grant, whole chain. A single group grant carries role, domain, and every environment - including workspaces you create later. No role explosion, no manual per-environment binding.
  • Secrets never enter manifests. Manifests carry placeholders; real credentials are bound at apply time, in the target environment only.
  • The data never moves. Only specs promote. Data born in a region stays in that region - promotion carries policy, not rows.
One group grant
analytics-engineers
assigned to 6 people
roleanalyst
domainfinance (enforced)
environmentsdev · uat · prod · future
Add a new workspace later and this grant already covers it - no rebinding.
03 Integrity

Honest by construction.

The product model makes the safe thing the default. You cannot mislabel a breaking change, edit prod behind the platform's back, or lose the record of who shipped what.

Semver, enforced

The contract diff sets the version

A contract diff computes the bump for you. Add a nullable column and it is a minor; drop a field and it is a major. You cannot ship a breaking change as a patch.

Read-only prod

Production is not editable

Promoted assets are read-only in production. You edit in dev and promote forward - never hand-patch the live copy.

Drift detection

Out-of-band change is flagged

EVE compares the running prod product against its manifest and raises a drift badge on anything that no longer matches.

Audit trail

Every promotion is recorded

Each plan, gate, and apply is logged - who promoted, which version, and the gate result. The history is queryable.

04 How it compares

What you replace.

The EVE promotion model removes three patterns that data teams carry today. Each card names the pattern, not a logo.

The alternative

vs role explosion

In legacy warehouses, every role x database x schema combination is its own grant, and the access matrix balloons. In EVE, one group grant carries role, domain, and every environment - including workspaces created later.

The alternative

vs cosmetic domains

In most catalogs a domain is a filter chip on a view - it organizes, it does not enforce. EVE domains restrict access at the org level, in every environment and every product.

The alternative

vs copy-paste promotion

Hand-promotion means re-pointing dashboards, re-binding connections, and hoping nothing drifts. EVE promotes the whole product - pipelines, models, tests, dashboards - as one atomic, versioned transaction with rollback.

Get started

See a promotion, end to end.

A 30-minute demo that ships a product from dev to prod - gate, apply, and rollback included.