Evaluator readiness
Inspect the derived evaluation-ready label for a frozen evaluation candidate — when it is true, when it fails closed, and how candidate freezes and rehearsals are recorded.
Evaluator readiness
evaluation_ready is a derived label, never a stored one. It is true exactly when a
fresh rehearsal against the newest frozen evaluation candidate passed every required
route inside an unexpired window. No event, handler, or caller can write it, and it
promotes nothing — not an integration, a capability cell, a certificate, a gate, or a
cutover decision.
Two governed actions build the evidence:
airlift.evaluator_candidate_freeze— freezes one evaluation candidate: its content digest, release reference, proof snapshot, change-log reference, known limitations, and window expiry. The frozen candidate is governed state; readiness compares rehearsals against it, never against anything a caller or configuration supplies.airlift.evaluator_rehearsal_record— records one rehearsal of the evaluation journey against the newest admitted freeze.
Readiness law
| Condition | Result |
|---|---|
| No candidate frozen | Fails closed — no_freeze |
| Freeze window expired | Fails closed — freeze_expired |
| No rehearsal against the freeze | Fails closed — no_rehearsal |
| Rehearsal against a superseded candidate | Fails closed — candidate_mismatch |
| Rehearsal older than the freshness window | Fails closed — stale_rehearsal |
| A required route missing, failed, or not applicable | Fails closed — route_coverage_incomplete or route_failed |
| Fresh, candidate-matched, fully-passing rehearsal, unexpired window | evaluation_ready: true |
The rehearsal freshness window is a module constant, never organization-configurable — configuration may never buy readiness. The evaluation window's recorded expiry is separately bounded by a module-constant maximum, and it never extends rehearsal freshness.
Required coverage
Every rehearsal must cover the two core routes (app, sql_warehouse) plus every
route for a configured surface (unity_catalog, jobs, lineage, dashboard,
ai_gateway, genie). Coverage is conjunctive: a missing, undeclared, duplicate, or
not_applicable required route is rejected. The digest binds the derived outcome, so a
flipped replay cannot pass the recompute.
Recording contract
Freezing and rehearsing are admitted system actions. Recording requires an in-process admitted system principal; the remote transport carries no system actor, so these are the admitted probe's path, never a human's. The App section is read-only.
fa evaluator freeze \
--file .airlift/evaluation-freeze.json \
--idempotency-key evaluator-freeze-<run-id>
fa evaluator rehearsal \
--file .airlift/evaluator-rehearsal.json \
--idempotency-key evaluator-rehearsal-<run-id>
fa evaluator window # exit 0 only when evaluation_ready is true
fa evaluator window --jsonRehearsal participants are opaque principal references, never emails, UPNs,
DOMAIN\user forms, or credential-shaped strings; identifier-shaped input is rejected
at both the action params schema and the recorded-event schema.
Honest support boundary
Governed deployments currently fail closed: no production runtime wires an admitted evaluator verifier yet, so no governed deployment can record a freeze or rehearsal until one is admitted. That is the deliberate, honest default.
A green label does not imply per-participant access was verified: the access preflight is deployment-scoped and is not yet bound to rehearsal participants. That binding is named in the DBX1 remaining exit. A readiness label is never business proof and promotes nothing.
Databricks access & integrations
Inspect the observed access state of an Airlift App deployment and the fail-closed state of its Databricks target integrations.
Unity Catalog evidence spine
Inspect the derived Databricks-native evidence state — the governed analytics projection into Unity Catalog, artifact-to-target reconciliation, and fail-closed coverage.