The migration method

Airlift's method is a factory, not a script. Six stages, each a set of governed actions with policies and structural state machines; the funnel is the state machine.

1. Assess

The Lakebridge Analyzer runs as a Databricks workspace job (ADR-002) — never a local Python process. Execution lives in the customer workspace; the report lands in a UC volume; airlift.assessment_record records the job run, the report reference, the object counts, and the pinned analyzer version. A result without a tool version is not reproducible evidence, so the schema refuses it.

The assessment alone is a sellable deliverable: the estate inventory with complexity scoring and wave candidates, signed by the audit trail that produced it.

2. Plan

airlift.wave_plan and airlift.wave_assign group discovered objects into cutover waves. Waves are governed state from the moment they exist: the planner is recorded, and separation of duties (airlift.cutover_separation.v1) guarantees the planner can never approve their own wave. Objects can only be assigned while the wave is still planned — an approved wave's scope is frozen.

3. Convert

Two lanes, one funnel:

• Deterministic first. The Lakebridge Converter (BladeBridge / next-gen transpiler) runs as a workspace job over each object. Most estates see the majority of their SQL surface convert here.
• Agent repair loop for the residue. A Fabric Harness agent proposes translations for what the deterministic pass could not handle, executes them in a sandboxed Databricks SQL context, compares against sampled source data, and iterates — or parks the object in rework for a human.

Both lanes use the same governed actions (conversion_start, conversion_record), so the attempt ledger, tool versions, and funnel counts are always consistent. Agent actors are policy-bounded (airlift.agent_conversion_bounds.v1): they convert, they never decide.

4. Certify

Parity suites (via @fabricorg/databricks-testkit) compare source and target, and airlift.parity_certify records a parity certificate that states its own evidence depth. The airlift.parity_evidence.v1 policy enforces the organization's configured minimum depth and snapshot freshness, and rejects certificates that claim a depth without carrying its evidence.

The advertised factory metric is deliberately strict: % of in-scope objects auto-converted with a parity certificate — not raw conversion accuracy.

5. Cut over

airlift.cutover_execute is gated by airlift.cutover_gate.v1:

• every wave object certified (or explicitly excluded);
• for high-blast-radius estates (configured environments, or priority-classified), the configured number of distinct approvals collected via airlift.wave_approve;
• the planned → executing approval-skip edge reserved for low-blast-radius (dev) rehearsals.

The worker executes the cutover as a durable workflow: a condition()-style approval gate that fails closed on expiry or denial, an effector step that never auto-retries (non-idempotent), and completion reported back through airlift.cutover_record — which also moves every certified object to cutover in the event log. airlift.cutover_rollback is a first-class governed action.

6. Attest

airlift.evidence_export assembles the replayable evidence pack for a wave or an object: assessments, conversion attempts with tool versions, certificates with evidence depth, approvals (who, when), execution, completion, rollback if any — plus the governance revision in force. The pack is content-digested (sha256), and the export itself is an audit event, so the stream proves what was attested without storing the pack.

The residue tripwire (ADR-004)

Written down in week 1 so it cannot be quietly renegotiated later: if the Phase-1 residue spike — 20–30 real source objects through Lakebridge — shows more than 60% of estate objects need human-only conversion, the agentic conversion story is weak, and Phase 2 pivots to a productized governance+evidence play with conversion fully delegated. The funnel, certificates, gates, and evidence stand either way; that is the point of building the factory around the tool instead of the tool into the factory.

Result (2026-08-01): tripwire NOT tripped. The spike ran live on serverless workspace jobs against the public Northwind estate — 36 real T-SQL objects (13 tables, 16 views, 7 procedures). The deterministic pass auto-converted 35 of 36 (residue 2.8%); the single failure was a genuine PARSING error in a stored procedure — exactly the class the Phase-2 repair agent exists for. Caveats are recorded in the ADR (Northwind is a simple estate; the protocol is re-run per design-partner estate before committing scope), and every outcome was loaded through governed actions into the durable funnel.