Parity certificates

A migration's credibility is decided by one question: how do you know the converted object is right? Airlift's answer is the parity certificate — and its honesty model (ADR-003): a certificate must state what it actually proves.

The schema

Every airlift.parity_certify call carries a certificate with required, reproducibility fields:

interface ParityCertificate {
  /** Weakest → strongest: what this certificate actually proves. */
  evidenceDepth: 'row_count' | 'aggregates' | 'sampled_rows' | 'full_checksum';
  rowCountSource: number;
  rowCountTarget: number;
  /** Required at `aggregates` depth and deeper. */
  aggregateChecksums?: Record<string, string>;
  /** Required at `sampled_rows` depth. */
  sampledRowCount?: number;
  /** Required at `full_checksum` depth. */
  checksumMatch?: boolean;
  /** The converter/validator generation, e.g. `lakebridge@0.14.2`. Required. */
  toolVersion: string;
  /** The parity-suite execution (workspace job run / testkit report). Required. */
  validationRunRef: string;
  sourceSnapshotAt: string;
  targetSnapshotAt: string;
}

The policy

airlift.parity_evidence.v1 enforces three things before the state machine ever sees the certification:

1. Minimum depth. Each organization configures minimumEvidenceDepth via airlift.policy_configure (default: aggregates). A row_count-only certificate in an aggregates org is blocked with the reason in the audit stream.
2. No overclaiming. A certificate that declares sampled_rows without a sampledRowCount, or full_checksum without a checksumMatch verdict, is blocked. The depth you claim is the evidence you carry.
3. Freshness. Source and target snapshots must be inside the configured window (default 72 hours). Certifying against last month's snapshot is structurally rejected.

Revocation

Certificates are living state. When a certified object is sent to rework (airlift.object_rework — timezone drift found downstream, a semantic bug, a changed source), the active certificate is revoked in the projection, the object drops out of the wave gate's certified count, and the wave cannot cut over until a fresh certificate lands. Nothing is deleted: the revoked certificate stays in the ledger with its reason.

Why this is the moat

Databricks' own tooling converts code, and it keeps getting better — which makes Airlift more valuable, not less: whatever produces the conversion, the certificate is the independent, vendor-neutral record of what was verified, at what depth, against which snapshots, with which tool. Regulated-industry sign-off trusts it precisely because it is not the vendor grading its own homework.