Banks call it maker-checker; everyone else calls it review. The person or agent who prepares a change to production is not the one who puts it there, and both steps leave a record. FoxByte’s change requests are that control for schema changes.
Make the change on a branch
A branch is a full copy of main, made in seconds, so a migration is tried against real data at full size rather than a sample. Everything it runs is recorded in the branch’s Blackbox, attributed to the login that ran it.
$ fox branch create add-invoices-index $ psql "postgresql://dbadmin:<API_KEY>@localhost:6432/add-invoices-index?sslmode=require"
Ask, then check
fox branch request lists the statements the branch has that main does not, in the order they ran, and opens a request. Nothing is applied. A reviewer reads exactly what would run.
$ fox branch request add-invoices-index --to main $ fox request list --open $ fox request show 3
Apply, all or nothing
Approving applies the statements to main in one transaction: all of them, or none. Rejecting leaves main untouched. Either can carry a note saying why.
A request is refused rather than half-applied when main has changed the same object since the branch was made, when main’s guardrails would block one of its statements, or when there is nothing to apply.
$ fox request approve 3 --note "Reviewed with the payments team" $ fox request reject 4 --note "Drops a column the reports still read"
Who may approve
Approving needs the right to manage the target: an admin for main, the owner for any other branch. An agent’s key can manage nothing, so an agent can prepare and ask, and never approve its own change.
The limit to know today: FoxByte does not stop a person approving their own request. Someone who can manage main can ask and approve the same change, and the record shows that they did both. Until the product enforces two people, make it a rule in your process, and check the requests list in your reviews.
What is kept
- The request: who asked, who approved or rejected, the note, and the statements, in order.
- On main, the Blackbox records each applied statement, still attributed to whoever wrote it on the branch.
- Those Blackbox entries are hash-chained like every other, and anchored in Enterprise.
- Change requests carry schema only. No data moves between branches.