Getting started
Configuration map
Understand local, durable, Databricks, Lakebridge, evidence, signing, and Temporal configuration boundaries.
Configuration map
Airlift defaults are safe for tests and demonstrations, not production. Use
fa doctor --profile production to inspect configuration shape without printing
secret values.
| Concern | Selection | Production expectation |
|---|---|---|
| State store | AIRLIFT_STORE | postgres with a Lakebase App binding or explicit Postgres binding |
| Authorization directory | AIRLIFT_AUTHORIZATION_JSON | Tenant, principal type, role, trusted worker/agent/installer, and validation-principal entries |
| App identity | AIRLIFT_TRUST_DATABRICKS_APP_HEADERS, DATABRICKS_APP_NAME | Both gates present; OBO remains the authenticated workspace boundary |
| Development self-review | AIRLIFT_DEPLOYMENT_ENV, AIRLIFT_ALLOW_DEVELOPMENT_SELF_REVIEW | Optional only for a dev deployment whose App name ends in -dev; recorded as a non-certifying override |
| Evidence admission | AIRLIFT_EVIDENCE_REGISTRY_JSON | Immutable provider/run/reference/digest entries from admitted principals; entries bind the run's artifactDigest, verdict, and completedAt but establish no provider provenance, so a governed hazard profile needs a provider-backed airliftEvidenceVerifier |
| Certificate signing | AIRLIFT_EVIDENCE_SIGNING_KEY_ID, AIRLIFT_EVIDENCE_SIGNING_PRIVATE_KEY_PEM | Secret-backed Ed25519 private key and stable key ID |
| Offline verification | AIRLIFT_EVIDENCE_VERIFY_KEYS_JSON | Public-key map; private key is never required for verification |
| Converter | AIRLIFT_CONVERTER | lakebridge plus job IDs, volume root, Databricks App service principal, and a certified version pin |
| Domain workflow | AIRLIFT_TEMPORAL_MODE, Temporal connection variables | Temporal for durable cutover; signals wake and never approve |
| Cutover effect | composition-injected effector | Client-certified checkpoint, apply-once, verify, and compensation contract |
Do not place credentials in action parameters, workflow inputs, event payloads, evidence exports, or CLI flags. See the complete configuration reference.