Architecture

Airlift is a vertical on the Fabric framework suite: it owns migration meaning (estates, objects, waves, certificates, gates) and composes everything else from published family contracts.

The module (packages/airlift)

• Objects: Estate (est), MigrationObject (obj), Wave (wav), Organization — id prefixes registered in the module manifest.
• 20 governed actions, every one mutatesDomain: true with explicit emitsEvents and requiredPermissions. Handlers never write state: they return pending domain events, and the host appends them after schema, policy, and state-machine checks pass.
• State machines are the funnel: illegal transitions (certify-before-convert, record-before-execute, double cutover) do not exist as edges, so they are rejected structurally, before the handler runs.
• Policies are code evaluators registered on the module: org scoping, the platform registry boundary, parity evidence, the cutover gate, separation of duties, and agent conversion bounds. Blocks land as ComplianceBlocked events in the caller's own org audit stream.
• Projections fold the org's events into the funnel, the wave board, the estate inventory, the conversion/certificate ledgers, and the audit view. The fold is scoped to a single organization before any row is built — isolation by construction, not by UI filter.

The worker (apps/airlift-worker)

The composition root owns the runtime, the activity bundle, the versioned task queue (airlift; breaking changes ship on airlift-v2), and schedule specs. The cutover workflow (workflows/cutover.workflow.ts) is a direct @temporalio/workflow implementation — condition, signals, queries, proxyActivities — per the family standard ("direct @temporalio/* for application-domain workflows") and the Tower precedent, served through the Harness startTemporalWorker({ workflowsPath, activities }) wrapper over the shared connection config. Workflow code is deterministic (the contract test enforces that workflow bundles runtime-import only @temporalio/workflow); all I/O lives in activities; every governed invoke carries a stable idempotency key; the non-idempotent cutover effect runs on a single-attempt proxy — never auto-retried. The whole surface is certified on the Temporal time-skipping test environment: gated approvals, expiry, denial, anonymous-signal and policy-rejection fail-closed, duplicate-start collapse.

Approval security (ADR-0005 row 7): the authenticated console's governed airlift.wave_approve is the primary approval path — the gate re-checks readiness periodically, so no signal is required. Signal-minted approvals are off by default (AIRLIFT_ALLOW_SIGNAL_APPROVALS=1 opts in, for credential-secured Temporal namespaces only); anonymous signals and denials fail closed.

The seams

What Airlift deliberately does NOT build

ADRs

• ADR-001 — Composition-only. No transpiler, eval, mutation-pipeline, or Databricks transport code in this repo; Temporal follows the family standard (Harness wrappers for plumbing, direct @temporalio/workflow for the domain workflow — see the 2026-08-01 amendment); the repository contract test enforces the rules.
• ADR-002 — Lakebridge as workspace jobs. No local Python runtime; results recorded by reference with pinned tool versions.
• ADR-003 — Certificates state their evidence. Depth-honest schema plus the parity-evidence policy.
• ADR-004 — The residue tripwire. Pre-committed pivot criterion for the agentic conversion bet.
• ADR-005 — Phase-0 exceptions. The dated staged-compliance ledger — most rows now closed with live evidence (durable store, real Temporal workflow, signal-approval security gate); the cutover effector and console OBO validation remain open.