Account-independent Synapse certification

Use this pack when engineers need confidence in the complete Airlift composition but do not have a live Synapse tenant. It proves deterministic product behavior against a versioned representative corpus and can incorporate live non-production Databricks evidence. It does not simulate away client networking, permissions, source semantics, or production authority.

What the pack executes

Run it from a development checkout:

pnpm certify:synapse

For the focused Temporal provider journey, run:

pnpm test:e2e:synapse:mock

That command executes the parent and child workflows under Temporal's time-skipping test server and verifies success, provider failure, cross-engagement denial, production rejection, and deployment reconciliation.

Publish the isolated browser lane

The browser journey is published separately from production. Its configuration is fixed to sandbox.airlift.fabric.pro, AIRLIFT_RUNTIME_TIER=sandbox, the airlift-sandbox-v1 task queue, shared PostgreSQL, dark worker activation, and AIRLIFT_SYNTHETIC_JOURNEY_MODE=hermetic.

Run the repository's deployment migration before starting the worker. It creates the private fabric_airlift.validation_evidence table used by the hermetic Experiments adapter. Evidence is immutable and content-addressed, and the same PostgreSQL-backed object publishes and verifies it. These rows remain private sandbox evidence and never establish workspace, client, or production proof.

From a reviewed, clean commit already pushed to origin/main:

pnpm cloudflare:sandbox:preflight
pnpm cloudflare:sandbox:deploy

The release preflight rebuilds the console and Temporal worker artifacts, verifies every artifact byte against its manifest, requires both manifests to name the exact pushed commit, binds a SHA-256 release ID, and rejects production routes or changed sandbox variables. Immediately before Wrangler runs, it repeats the clean-tree, pushed-commit, artifact-manifest, template-digest, release-ID, and generated-byte checks. The production command remains pnpm cloudflare:deploy and its template cannot activate a synthetic provider.

The worker remains dark after publication. Activate it only through the existing sandbox worker activation path after confirming the configured PostgreSQL database, Temporal namespace, Cloudflare Access audience, and governed authorization map all belong to the sandbox. Do not infer or copy production resources.

The run-ledger start control remains disabled until one unambiguous governed Synapse candidate exists. Candidate preparation is explicit operator work; the application does not seed an organization, engagement, source binding, transfer, deployment, or object scope on startup. This prevents a publication from fabricating tenancy or migration state.

Start identity is derived on the server from that exact scope plus its durable run generation. Concurrent browser submissions therefore attach to one Temporal execution; a later generation follows the terminal PostgreSQL row for the same binding, transfer, deployment, object, and cutover scope. Unrelated rows over the same objects cannot advance it, and generation is bounded to 32 before operator reconciliation is required. Cancellation records a terminal row inside a non-cancellable Temporal activity; after hard termination, the next deterministic Temporal generation hydrates the authoritative tenant projection and first reconciles its selected stale running predecessor rows. If the prior Temporal execution is no longer retained or the sandbox namespace was replaced, only Temporal's typed workflow-not-found result may advance that durable running row; describe timeouts and other transport failures do not mutate the ledger. No browser nonce can select workflow identity.

The parent workflow deliberately pauses at awaiting_validation_request. On that ledger row, an authorized natural person selects Request validation and continue. The rendered row supplies its workflow ID, and the server revalidates that exact workflow's engagement, running phase, and frozen validation contract from the durable journey row before it submits the exact idempotent airlift.validation_execution_request, and sends only a payload-free Temporal wake. The workflow then discovers the governed request from projections. A signal cannot supply or override validation scope, suite, tracks, identity, or evidence.

Successful execution writes:

• reports/f8c-synapse-evidence.json — input accepted by the public evaluator;
• reports/f8c-synapse-certification.json — evaluation plus command-result digests.

Reports are generated evidence and should be retained in an immutable CI artifact store, not committed as permanent proof.

Proof levels

The request schema rejects the final two levels. This is a structural policy, not a documentation warning.

Evidence integrity

Every stage carries a reference, SHA-256 digest, build reference, dataset reference, tool version, completion time, and asserted behavior. The evaluator rejects:

• a missing required stage;
• workspace stages represented by hermetic evidence;
• a build or dataset mismatch;
• evidence completed after the observation time;
• an attempted client or production request.

The report has separate evidence and report digests. Publishing the report does not promote a source-capability claim; use the governed capability registry and human review for that decision.

Engineering-leadership interpretation

hermetic_proven means the product composition and failure behavior are repeatable without purchasing or borrowing a source account. It is the gate for expanding the same contract to another source pack.

workspace_proven is the stronger pre-client gate. Do not assign it merely because the App is running. Target assets, validation, release promotion, and durable rehearsal must all return immutable live references.

An App deployment alone is insufficient for workspace proof.

Neither result supports a time-savings percentage. Measure manual baseline effort, automation runtime, human remediation, and accepted outcomes during an actual engagement before publishing a value claim.