Parity and migration certificates

A migration's credibility is decided by one question: how do you know the converted object is safe for its intended release? Airlift answers with two deliberately distinct artifacts. Keeping them separate prevents “the rows matched” from becoming “the object is ready to cut over.”

Parity facet

airlift.parity_certify records what a particular comparison actually proved. Required reproducibility fields include the validator generation, validation run, and source and target snapshots:

interface ParityCertificate {
  evidenceDepth: 'row_count' | 'aggregates' | 'sampled_rows' | 'full_checksum';
  rowCountSource: number;
  rowCountTarget: number;
  aggregateChecksums?: Record<string, string>;
  sampledRowCount?: number;
  checksumMatch?: boolean;
  toolVersion: string;
  validationRunRef: string;
  sourceSnapshotAt: string;
  targetSnapshotAt: string;
}

airlift.parity_evidence.v1 enforces:

1. Minimum depth. An organization can require evidence stronger than row counts.
2. No overclaiming. sampled_rows requires a sample count; full_checksum requires its verdict; aggregate depths require their checksums.
3. Freshness. Source and target snapshots must remain inside policy's evidence window.

This facet is inspectable evidence. It does not by itself advance the object to the migration-certified state.

Readiness profiles

Every object receives a versioned profile over nine tracks:

• inventory;
• target design;
• code;
• data movement;
• deployment;
• functional parity;
• non-functional behavior;
• business acceptance;
• cutover readiness.

Each requirement is explicitly required or not_applicable. Evidence can be pending, passed, failed, stale, or governed by a time-bounded waiver when policy permits it. Identity, tenant isolation, separation of duties, functional parity, and uncertain non-idempotent cutover outcomes are not waivable.

Validation runs enter readiness only when:

• the producer principal is admitted for the organization/provider;
• the provider run completed successfully;
• its immutable evidence reference and SHA-256 digest match the admitted registry;
• the artifact digest, source watermark, target snapshot, tool version, and completion timestamp are present;
• the functional-parity observation resolves to the active parity run.

System-minted signed envelope

airlift.migration_certificate_mint accepts no caller-authored certificate payload. A system principal supplies only the object ID and the expected profile/readiness digests; the handler derives the envelope from current governed projections and fails closed on drift.

The envelope binds:

• organization, estate, object, and optional wave;
• profile ID/version/digest and readiness digest;
• artifact digest, source watermark, and target snapshot;
• parity certificate ID and evidence-manifest digest;
• policy revision and tool generations;
• issuer, issue time, signer key ID, signed digest, and Ed25519 signature.

Private keys come from secret-backed deployment configuration. Offline verification uses the corresponding key-ID/public-key directory. A hash without a valid signature is never described as signed evidence.

Stale and revoked state

Artifact, watermark, target snapshot, profile, readiness, dependency, policy, or release drift invalidates the certificate's claim. Airlift preserves the old envelope and marks it stale or revoked; it never deletes history. Sending an object to rework also removes its active certification from the wave gate.

Why this is the moat

Lakebridge and other engines will keep improving conversion. Airlift's independent value is the versioned answer to what was validated, by whom, against which identities, under which profile and policy, and with which signature. Conversion produces a candidate; independent evidence and governed acceptance produce certification.