Regulated migration must end with proof: show internal risk, the auditors, and the regulator that nothing regressed. Today that proof is assembled by hand, at high cost, and no third party can re-verify it.
CAM produces the proof as a by-product of the migration itself. Agents do the labor. Deterministic machinery does the checking: validators compiled from a human-signed contract, cryptographic commitments over every delivery, an append-only evidence log. Every claim in the certificate resolves to an artifact your auditor can re-verify without us.
Agents propose. Deterministic machinery decides. Humans sign.
The model is never the prover. One gate is irreversible: human signature of the Migration Contract. After signature, the frozen contract is the oracle every step is verified against.
When data moves between systems, or between owners, thousands of relationships must be rebuilt correctly on a platform the source was never designed for. Standard practice answers with row counts, checksums, and spreadsheet reconciliations. These are necessary and semantically blind: they cannot catch a transformation that is plausible byte-by-byte and wrong in meaning.
A mapping error that surfaces after cutover does harm before anyone can see it. And evidence assembled by hand at the end of a programme cannot be independently re-checked, so every audience re-derives its own comfort at full cost.
Agents build a semantic model of the source from schemas, profiles, and deal documents. Bounded metadata only: personal-data columns are redacted before any model sees them, and no model reads bulk production data.
An author agent drafts the Migration Contract, a critic agent attacks it, and a mutation gate checks that seeded corruptions are caught. A human expert signs. The contract is hashed and frozen for the deal.
Agents write the transformation code; compiled validators check every row against the frozen contract. One rule is absolute: the code never adjusts data to make a check pass.
We attack our own pipeline with labelled corruptions and measure what the contract catches. The strength of the verification is itself certified.
Every event appends to a hash-chained log as it happens. The certificate is compiled from the log afterwards, not written beside it. A trail built this way cannot be retrofitted.
The output is a certificate in which every sentence carries a resolvable reference to a hash-anchored artifact, plus the exception schedule and the means to re-verify all of it without Kolega.
Both schemas are yours and you choose the cutover date. The new system goes live, the old one retires, and CAM certifies the move. This is how we finish our own builds.
The spec is contractual, the cutover is a legal event, and the source system goes dark exactly when questions start. CAM replaces trust with signed commitments and the parallel run with tape rehearsal.
Evaluated on a synthetic portfolio with twelve labelled defects injected across the failure classes seen in real transfers. The results are reproducible from the run's own evidence log. The full evaluation, including its open limitations, is in the paper.
CAM runs inside your environment. One machine is enough.
Bulk data never crosses your perimeter. Models see bounded, redacted metadata only.
Both parties record cryptographic commitments at every delivery. A later dispute reduces to a hash comparison.
The engagement ends with the contract, the evidence log, the certificate, and the means to re-verify all of it without Kolega.
Discovery, contract synthesis, and the verifier run against a recent or pending data tape. Fixed fee, two weeks. You receive a gap report, an exception schedule, and a demonstration certificate.
On a live programme, CAM runs beside your existing process and certifies it, displacing nothing. Your plan stays. You gain the evidence layer.
CAM is the delivery mechanism: all five loops, from source to destination, ending in a certificate over a fully triaged exception schedule.
Prototype. Build. Secure. Move, and prove it.
That's the rest of the toolchain. The move is the fourth verb.
How the toolchain fits →