Documentation / Advanced
Keep deployment state immutable
Projects, workflow versions, signed releases and active pointers are separate contracts.
Start from a project
rippflow.yaml binds workflows, handlers, artifacts and a catalog. Generate CDK only against the target installation’s approved catalog; generation is not deployment.
rippflow init application --lang python
cd application
rippflow validate rippflow.yamlInspect before activation
Workflow versions are immutable. Publication binds team/project attribution and approved handler grants. Scoped execution-plane deployments (scoped-deployments-v1, >=1.9.0) support AuthorizationMode=Default (explicit GrantPoliciesTableName records) and AuthorizationMode=NativeIAM (native-iam-v1 IAM role paths /tenants/<tenantId>/<role> or /rippflow-admin/<role> with iam:GetRole RoleId verification and dynamic tenant creation). Deployed workflows accept runs via CLI (rippflow deployments run --execution-id or dispatch), SigV4 HTTPS (POST /v1/deployments/{id}/executions or /dispatches), or EventBridge InputTransformer rules targeting the SigV4 API; direct CellStarterFunction Lambda Invoke is a trusted installation-internal boundary and not a per-tenant authenticated API. Activation and rollback change the active pointer without rewriting prior versions.
rippflow workflows list --json
rippflow versions WORKFLOW --limit 20Verify a release before staging
Signed catalogs/manifests, channel/edition checks, revocation/expiry and installation compatibility protect release delivery. Preflight updates and use supported rollback. Website preview downloads do not establish public signed installer availability.
rippflow releases list --json
rippflow installation version --json
rippflow installation updates check --jsonKeep rollout proposals separate
Starter PR 33 proposes ownership migration and a batch guard change. PR 34 carries distribution-closure evidence and source pins. Neither is silently treated as installed behavior.
Verified sources
Checked 2026-11-05.
- registry.rs f6c7970 · main
- project.rs 7f5ea32 · main
- releases.rs f6c7970 · main