Export & Publish, In Depth
Export is where governance turns into something a service can actually run with. Pick a format — shell, dotenv, or HOCON, defaulted sensibly per language (Scala gets HOCON, React/Angular get dotenv, everything else gets shell) — and get back a resolved config file, live, for that one service.
Placeholders that resolve themselves
A custom export template can reference ${config.KEY}, service name, or workspace name, and even disambiguate two inherited template instances that happen to share a key. There's a live "Resolved" preview that re-implements the same interpolation logic client-side purely so it updates as you type.
Approve is the live gate. Publish is something else entirely.
This trips people up coming from the old model, so it's worth being explicit: export never reads the shared master value directly. It reads each service's own synced copy — and that copy only moves the moment that service's impact is approved. A branch merging doesn't change anyone's export output by itself; it's the approval afterward that does.
| Approve | Publish |
|---|---|
| Pulls a merged, notified change into that service's own copy | Promotes that service's own pending local override into effect |
| What actually moves the needle on export output | A service opting itself out of the shared value — unrelated to governance |
| Per impact, per service, the moment a notification arrives | A deliberate, separate action — timed on your terms |
| Reversible via revert-to-pending | Reversible by clearing the override |
The audit trail lives one level up from all of this now: every merged Branch, together with the individual changes it carried, is a permanent record you can browse from the workspace's branch history — and the searchable History page records everything around it, down to each approval, rejection, and override publish, with who and when. Exports themselves are cached for five minutes and invalidated automatically the instant anything that service depends on changes, so you're never looking at stale output without knowing it.
One more export exists at the workspace level: takeout — a single bundle of every active service's resolved config, in each service's own format. It's the pre-archival backup for the one thing that's genuinely irreplaceable if a workspace ever goes away: the resolved secrets and config values no other system holds.