Configuration reference

Store and identity

• AIRLIFT_STORE=postgres
• Lakebase App binding: DATABRICKS_LAKEBASE_ENDPOINT or ENDPOINT_NAME, with injected PGHOST, PGDATABASE, and PGUSER
• Direct Postgres: AIRLIFT_DATABASE_URL or the AIRLIFT_PG* variables
• AIRLIFT_AUTHORIZATION_JSON — bootstrap membership snapshot only; after first governed adoption the organization membership registry replaces env rows, tenant admins manage members in the Team access App page, and env changes do not grant access
• AIRLIFT_TRUST_DATABRICKS_APP_HEADERS=1 and DATABRICKS_APP_NAME
• AIRLIFT_PSEUDONYM_KEY — dedicated App secret used to derive stable participant, deployment-principal, and workspace refs without storing raw identities in assurance evidence
• AIRLIFT_PROJECTION_REFRESH_MS

Airlift Migration Assistant

• AIRLIFT_GENIE_PROVIDER — auto, deterministic, unity-ai-gateway, model-serving, openai-compatible, anthropic, or azure-openai
• AIRLIFT_GENIE_MODEL — approved Unity Catalog model service, Model Serving endpoint, or external model name
• DATABRICKS_INFERENCE_MODE — auto, ai-gateway, or serving-endpoints
• AIRLIFT_GENIE_BASE_URL — external-provider or Azure OpenAI URL
• AIRLIFT_GENIE_DEPLOYMENT and optional AIRLIFT_GENIE_API_VERSION — Azure OpenAI
• AIRLIFT_GENIE_API_KEY — external-provider key from a Databricks App secret resource; never a literal configuration value
• AIRLIFT_GENIE_AGENT_ID — optional curated Genie Agent for migration analytics

The preferred production path is Unity AI Gateway or Model Serving through the Databricks App service principal. A missing model, permission, secret, timeout, invalid response, or budget failure falls back to deterministic Airlift guidance and cannot weaken a gate. See Airlift Migration Assistant and Engineering remediation.

Development-only workflow exercise

• AIRLIFT_DEPLOYMENT_ENV=dev
• AIRLIFT_ALLOW_DEVELOPMENT_SELF_REVIEW=1
• DATABRICKS_APP_NAME ending in -dev
• AIRLIFT_DEVELOPMENT_OPERATOR_PRINCIPAL
• AIRLIFT_DEVELOPMENT_WORKER_PRINCIPAL

Together these allow one authenticated developer to resolve and review the same residue while exercising a dev App. The event is marked development_self_review. An admitted system principal may then mint an explicitly development certificate, which the production cutover policy always rejects. The flag fails startup outside the complete dev boundary and must not be configured in staging or production. The Synapse certification command uses the schema installed by deployment and never requests schema DDL under a developer identity.

See Development assurance for the complete boundary and inspection commands.

Evidence and certificates

• AIRLIFT_EVIDENCE_REGISTRY_JSON
• AIRLIFT_EVIDENCE_SIGNING_KEY_ID
• AIRLIFT_EVIDENCE_SIGNING_PRIVATE_KEY_PEM
• AIRLIFT_EVIDENCE_VERIFY_KEYS_JSON

Each AIRLIFT_EVIDENCE_REGISTRY_JSON entry requires organizationId, producerPrincipal, provider, providerRunRef, evidenceRef, and evidenceDigest. It may also carry artifactDigest, verdict, and completedAt.

Any declared field is bound: it must match the submitted run exactly, so a manifest naming one artifact and verdict cannot verify a different result smuggled in under the same evidence identity.

Two of those fields can additionally be attested — reported as established by the provider rather than merely recorded next to it. Only verdict and completedAt qualify, because a provider's run document reports them. artifactDigest never does: provider run documents generally do not name the artifact a run exercised, so Airlift binds that field without presenting it as provider proof and lets the conversion-hazard gate corroborate it at certification against the artifact the certificate is effective for.

How attestation is established depends on the verifier. A provider-backed verifier — such as the worker's Volume-backed evidence store — re-reads the provider's evidence body, checks its digest, and re-derives the verdict and completion time from it, reporting a field as attested only when its derived value equals what was submitted. The two fields are judged independently: evidence whose recorded outcome contradicts the submitted verdict, but whose completion time matches, attests completedAt and not verdict — which still fails a governed conversion, because that requires both. A body that is not a provider document at all derives nothing and so attests neither.

This static manifest cannot do that: it never sees an evidence body, so it establishes nothing and reports no attested fields at all. That is deliberate. It is also the verifier Airlift falls back to whenever no provider-backed one is injected, and an operator writing outcome fields into configuration is not provider proof — treating it as such would defeat the gate. (Manifests that once set providerAttested are rejected outright rather than silently downgraded, so the change is visible.)

The practical consequence: a governed Teradata/Lakebridge conversion fails closed under the manifest fallback. Its validation runs are refused with a denial naming this variable and the service to supply, until a provider-backed verifier is injected as the airliftEvidenceVerifier runtime service — for Experiments, the worker's Volume-backed evidence store, which reads the published evidence document and derives the outcome from it. Manifest entries remain fully usable for conversions outside a governed hazard profile.

Lakebridge

• AIRLIFT_CONVERTER=lakebridge
• DATABRICKS_HOST, DATABRICKS_CLIENT_ID, DATABRICKS_CLIENT_SECRET
• AIRLIFT_LAKEBRIDGE_ANALYZER_JOB_ID
• AIRLIFT_LAKEBRIDGE_CONVERTER_JOB_ID
• AIRLIFT_LAKEBRIDGE_VOLUME_ROOT
• optional certified AIRLIFT_LAKEBRIDGE_VERSION

Temporal worker

• AIRLIFT_TEMPORAL_MODE=temporal
• TEMPORAL_ADDRESS, TEMPORAL_NAMESPACE, TLS/API-key variables or their supported Harness FABRIC_TEMPORAL_* equivalents
• AIRLIFT_TASK_QUEUE
• AIRLIFT_APPROVAL_TIMEOUT_MINUTES
• AIRLIFT_SWEEP_CRON, AIRLIFT_SWEEP_MAX_ATTEMPTS

Runway deployment observation

• AIRLIFT_DEPLOYMENT_ADAPTER=runway
• AIRLIFT_RUNWAY_API_URL
• AIRLIFT_RUNWAY_APP_URL (optional console deep link)
• AIRLIFT_RUNWAY_API_TOKEN from a deployment secret

This adapter observes a deployment created by fr; it does not deploy, promote, reconcile, or roll back a release. Before observation, connect the Airlift requirement to a runway/deployment reference containing the Runway deployment ID and staged artifact digest.

There is no environment-only switch that certifies a cutover effector. It is explicitly injected after client certification. Never store secret values in source, docs, action payloads, workflow inputs, or evidence.