The ledger comes first
Pressing Publish in the workspace opens the publish dialog, and the first thing in it is the verification ledger — one sentence stating the verdict (“All 7 promises were checked, and they held.” / “1 promise did not hold, and 2 were never checked.”), a proportion bar, and the counts:- proved by tests — machine-verified promises
- confirmed by you — promises you judged yourself
- did not work — checks that ran and failed, each listed by name under “Ran and did not pass”, with a link to review them in the Proof tab
- not checked — promises nobody checked, each listed under “Going live without”
The one exception: broken security promises
If a security-relevant promise — one about who can reach data, or whether signing in works — is known broken, pressing Publish diverts once to a second look. It names the failure, states plainly that publishing puts it in front of real people, and offers two buttons: Back (go fix it — the primary choice) and Publish anyway (available, deliberately styled as the secondary one). This happens exactly once per publish, only for security failures, and it is informed consent — not a veto. You can always publish; you just can’t do it by muscle memory past a known security hole.What publishing actually does
Publishing runs in the background after you confirm:- Your app’s backend capabilities are hardened for production — promoted from their sandboxed state to production configuration. The dialog shows which ones, as context.
- The app itself is deployed and wired to its public production URL.
- The dialog reports “Publishing started — your app is going live”; you can close it, and the workspace shows progress and the live URL when it’s ready.