Publish, review, approve, promote

The registry separates three operations so no single command can put code in front of users. Each is a dry run until you say otherwise.

Publish a candidate

yarn fruitful registry publish-first-party --package <name>            # dry run
yarn fruitful registry publish-first-party --package <name> --apply    # publish

Publishing creates an exact candidate evaluation for the release: the resolution digest of the whole package graph, the runtime digest, and the review digest. --tag defaults to candidate. Nothing resolves to a candidate.

Today this publishes from the maintained first-party inventory in the repository. Publishing from outside the repository is being built on the same commands and the same auth login credential.

Read the state

yarn fruitful registry status --package <name>

Status is read-only: releases, their evaluations, and which tag each currently resolves to. Use it before and after every write.

Approve

yarn fruitful registry approve --package <name> --evaluation <id> \
  --resolution <digest> --runtime <digest> --review <digest> \
  --apply --confirm-stage <stage> --reviewer-user <id> --reviewer-organisation <id>

Approval records that a named reviewer reviewed exactly these digests. Passing every digest is deliberate: an approval cannot drift onto a different build. Without --apply and --confirm-stage the command only shows what it would do.

Promote

yarn fruitful registry promote --package <name> --evaluation <id> \
  --resolution <digest> --runtime <digest> --review <digest> \
  --apply --confirm-stage <stage> --reviewer-user <id> --reviewer-organisation <id>

Promotion moves the stable tag to an approved evaluation. From then on Explore offers the feed and new installs resolve to that release. Installed devices keep the resolution they have until they update; a resolution is never rewritten underneath them.

What reviewers look at

The review plane sees what users never do: the sanitized fixtures, the expectations, the presentation examples, and the evidence sidecars whose digests must match the committed bytes. A reviewer checks the fixture is clean, the expectation is semantically right, and the preview reads well. See The registry trust model.

Reference: CLI.