Configuration map

Understand local, durable, Databricks, Lakebridge, evidence, signing, and Temporal configuration boundaries.

Airlift defaults are safe for tests and demonstrations, not production. Use fa doctor --profile production to inspect configuration shape without printing secret values.

Concern	Selection	Production expectation
State store	`AIRLIFT_STORE`	`postgres` with a Lakebase App binding or explicit Postgres binding
Authorization directory	`AIRLIFT_AUTHORIZATION_JSON`	Tenant, principal type, role, trusted worker/agent/installer, and validation-principal entries
App identity	`AIRLIFT_TRUST_DATABRICKS_APP_HEADERS`, `DATABRICKS_APP_NAME`	Both gates present; OBO remains the authenticated workspace boundary
Development self-review	`AIRLIFT_DEPLOYMENT_ENV`, `AIRLIFT_ALLOW_DEVELOPMENT_SELF_REVIEW`	Optional only for a `dev` deployment whose App name ends in `-dev`; recorded as a non-certifying override
Evidence admission	`AIRLIFT_EVIDENCE_REGISTRY_JSON`	Immutable provider/run/reference/digest entries from admitted principals; entries bind the run's `artifactDigest`, `verdict`, and `completedAt` but establish no provider provenance, so a governed hazard profile needs a provider-backed `airliftEvidenceVerifier`
Certificate signing	`AIRLIFT_EVIDENCE_SIGNING_KEY_ID`, `AIRLIFT_EVIDENCE_SIGNING_PRIVATE_KEY_PEM`	Secret-backed Ed25519 private key and stable key ID
Offline verification	`AIRLIFT_EVIDENCE_VERIFY_KEYS_JSON`	Public-key map; private key is never required for verification
Converter	`AIRLIFT_CONVERTER`	`lakebridge` plus job IDs, volume root, Databricks App service principal, and a certified version pin
Domain workflow	`AIRLIFT_TEMPORAL_MODE`, Temporal connection variables	Temporal for durable cutover; signals wake and never approve
Cutover effect	composition-injected effector	Client-certified checkpoint, apply-once, verify, and compensation contract

Do not place credentials in action parameters, workflow inputs, event payloads, evidence exports, or CLI flags. See the complete configuration reference.