Concept

Safe software evolution

The dangerous moment in software isn't the build - it's the Tuesday afternoon, eight months later, when someone changes a field three workflows depend on. Safe software evolution is the discipline that makes that moment boring. Here's what it consists of, and why almost no tool has it.

The definition

Safe software evolution means changing running software with the impact of every change computed and reviewed before it applies. Five properties, together:

Blast radius: the load-bearing idea

The blast radius of a change is everything it would affect: screens showing the field, workflows reading it, automations triggered by it, integrations sending it. In most stacks this knowledge lives in someone's head - which is why "quick changes" produce silent failures, and why scary changes get postponed until the tool is rewritten instead of evolved.

In Chromoly, the blast radius is computed - derived automatically from the AppSpec, because a system defined as structured data has a dependency graph a machine can walk. "What breaks if I rename this field?" stops being a guess and becomes an answer with a list.

AI change management

AI makes changes cheap to request - which makes the discipline more necessary, not less. A change described in one sentence can still touch half the system. AI change management means the acceleration never bypasses the review:

  1. Your request becomes an explicit diff against the system definition - never a direct mutation.
  2. The blast radius is computed and shown, breaking changes flagged.
  3. The changed system builds into preview; you test it.
  4. Production updates only on your approval, as a new version, audit-logged.
  5. If it's wrong anyway: rollback, one action, records untouched.

The same rule binds AI clients operating a system over MCP: writes route through the same approval gates as everyone else, and there are no delete tools at all. Speed from AI, control from the pipeline.

Why almost no tool has this

Safe evolution requires the system's structure to exist as data. Hand-written code buries dependencies in logic; no-code builders keep them in the builder's head; automation stacks scatter them across disconnected scenarios. None of these can compute impact - so they can't preview it, so change stays risky, so tools decay. Chromoly could build it because the architecture starts from a structured definition. The safety isn't a feature bolted on; it falls out of the design.

Questions

What is safe software evolution?

The practice of changing running software with the impact of every change computed and reviewed before it applies: dependencies mapped automatically, blast radius shown up front, changes staged in preview, applied as versioned deploys, and reversible by rollback. It's how software tracks a changing business without breaking.

What is a blast radius in software?

Everything a proposed change would touch: the screens, workflows, automations, and integrations that depend on the thing being changed. In Chromoly it's computed automatically from the dependency manifest and shown before the change applies - so 'what breaks if I rename this field?' is an answer, not a discovery.

What is AI change management?

Applying change-management discipline to AI-driven modifications: every AI-proposed change becomes an explicit, reviewable diff; impact is computed before application; a human approves anything consequential; everything is audit-logged and reversible. The AI accelerates change without being allowed to surprise you.

How does rollback work in Chromoly?

Every deploy is a version of the system definition (the AppSpec). Restoring a previous version restores the previous system - screens, workflows, rules - while your records stay untouched. Rollback is one action, not a recovery project.

Why do most tools not have this?

Because it requires the system's structure to exist as data. Hand-written code, no-code assemblies, and automation stacks keep dependency knowledge in people's heads, so impact can't be computed - only guessed. That's why changes get postponed, drift accumulates, and tools get rewritten instead of evolved.