Capability commands
Query and govern the evidence-backed source capability matrix with fa.
Capability commands
fa capability operates the tenant-scoped capability registry. It does not install a
converter, deploy an application, or certify client objects.
Query
fa capability list
fa capability list --source snowflake --variant snowflake_enterprise
fa capability list --source redshift --capability incremental_cdc --json
fa capability list --source synapse --construct merge_statement --artifact-kind source
fa capability show cap_<id> --json
fa capability matrix --source synapse --variant synapse_dedicated_sqlmatrix overlays active evidence on the installed source profile and prints each
capability's delivery mode, proof level, provider, and provider version. Missing cells are
reported as unproved.
Construct filters select registry-v2 cells. Text matrix output lists these cells separately and states that they do not aggregate into variant proof.
Mutate through governed actions
All lifecycle mutations use a JSON parameter file and a stable idempotency-key prefix:
fa capability propose --file proposal.json --idempotency-key proposal-v1
fa capability evidence --file evidence.json --idempotency-key evidence-v1
fa capability promote --file promotion.json --idempotency-key promotion-v1
fa capability expire --file expiry.json --idempotency-key expiry-v1
fa capability revoke --file revocation.json --idempotency-key revocation-v1
fa capability reconcile --file reconciliation.json --idempotency-key reconcile-v1The API derives organization and identity from the authenticated principal. Parameter files cannot select another organization or supply an approving actor.
| Command | Required authority | Result |
|---|---|---|
propose | human operator | proposed source/capability/provider generation |
evidence | admitted system | immutable proof reference and digest |
promote | different human reviewer | active claim at or below proven strength |
expire | admitted system or human operator | inactive time-bounded claim |
revoke | human reviewer | explicitly withdrawn claim |
reconcile | admitted system | matched observation or fail-closed expiry on drift |
See Capability registry for schemas and the proof ladder.
Diagnose a source or engagement
fa source doctor snowflake --variant snowflake --level executable
fa source limitations redshift --variant redshift_serverless
fa source certify synapse --variant synapse_dedicated_sql --level certifiable
fa engagement preflight eng_<id>doctor and certify query active, unexpired tenant evidence and exit with status 1
when blocked. Their text output includes a reason and next action for each blocker; --json
returns the stable diagnosis contract for CI. source certify checks whether provider
capabilities are strong enough for the requested outcome; it does not mint a migration certificate. Migration certificates are still
minted only from object-specific admitted validation evidence through fa certificate mint.
An engagement preflight derives its required level from the selected services:
| Engagement service | Capability target |
|---|---|
discovery | assessable |
factory_pilot | executable |
migration_factory | certifiable |
managed_migration_office | certifiable |
cutover_assurance | cutover_certified |
modernization | adds an evidenced modernization requirement |