Evaluator readiness

evaluation_ready is a derived label, never a stored one. It is true exactly when a fresh rehearsal against the newest frozen evaluation candidate passed every required route inside an unexpired window. No event, handler, or caller can write it, and it promotes nothing, not an integration, a capability cell, a certificate, a gate, or a cutover decision.

Two governed actions build the evidence:

• airlift.evaluator_candidate_freeze: freezes one evaluation candidate: its content digest, release reference, proof snapshot, change-log reference, known limitations, and window expiry. The frozen candidate is governed state; readiness compares rehearsals against it, never against anything a caller or configuration supplies.
• airlift.evaluator_rehearsal_record: records one rehearsal of the evaluation journey against the newest admitted freeze.

Readiness law

The rehearsal freshness window is a module constant, never organization-configurable, configuration may never buy readiness. The evaluation window's recorded expiry is separately bounded by a module-constant maximum, and it never extends rehearsal freshness.

Required coverage

Every rehearsal must cover the two core routes (app, sql_warehouse) plus every route for a configured surface (unity_catalog, jobs, lineage, dashboard, ai_gateway, genie). Coverage is conjunctive: a missing, undeclared, duplicate, or not_applicable required route is rejected. The digest binds the derived outcome, so a flipped replay cannot pass the recompute.

Recording contract

Freezing and rehearsing are admitted system actions. Recording requires an in-process admitted system principal; the remote transport carries no system actor, so these are the admitted probe's path, never a human's. The App section is read-only.

fa evaluator freeze \
  --file .airlift/evaluation-freeze.json \
  --idempotency-key evaluator-freeze-<run-id>

fa evaluator rehearsal \
  --file .airlift/evaluator-rehearsal.json \
  --idempotency-key evaluator-rehearsal-<run-id>

fa evaluator window          # exit 0 only when evaluation_ready is true
fa evaluator window --json

Rehearsal participants are opaque principal references, never emails, UPNs, DOMAIN\user forms, or credential-shaped strings; identifier-shaped input is rejected at both the action params schema and the recorded-event schema.

Honest support boundary

Governed deployments currently fail closed. No production runtime wires an admitted evaluator verifier yet, so no governed deployment can record a freeze or rehearsal until one is admitted. That is the deliberate, honest default.

A green label does not imply per-participant access was verified. The access preflight is deployment-scoped and is not yet bound to rehearsal participants. That binding is named in the DBX1 remaining exit. A readiness label is never business proof and promotes nothing.