Rolling a detector out to a fleet without watching it first is how false alarms are born — and how operators learn to ignore a system. The platform's deployment lifecycle is designed so that nothing a model says is visible to production until it has been observed.
The lifecycle
draft ──publish + bind──► shadow ──observation elapsed──► active ──► retired
│ computes silently under │
│ an internal output signal │
└──────────◄ rollback, always permitted ─┘- Publishing validates the graph against the type system and mints an immutable version.
- Binding applies a version to a machine; inputs resolve by semantic role.
- Shadow computes under an internal output so the score can be charted against reality before anyone acts on it.
- Promotion is refused by the server if the observation period has not elapsed — and the server says why.
- Rollback is always permitted. A superseded binding hands its signal over rather than orphaning it.
Preview before shadow
Before a binding even exists, the graph can be previewed over real history: chart in, chart out. Warm-up periods are marked rather than silently included; live-only operators refuse to fabricate history; retention boundaries are drawn so a gap looks like a gap. Backfill runs as a resumable job with a bounded budget.
What we say to customers
The pipeline — upload, validate, wire, bind, place, shadow — is proven by tests and by live placement runs on the AI box. Your first model is the acceptance run. We say so before the project starts, and we design the shadow stage so that run is a safe one.