JarvisX Connected-Evidence Agent

Reconcile your migration on your OWN engines, at scale, without your data or credentials ever leaving your network — then get a signed certificate.

Run this inside your perimeter. It connects to your source + target warehouses with your own read-only credentials, checks that each converted query returns the same rows as the source, and emits only counts + hashes + a verdict. Optionally it sends that verdict (never your rows) to JarvisX for an Ed25519-signed, ledgered Connected-Evidence certificate.

Why it scales to 1 TB

It does not pull your data. In --mode pushdown (default) it computes a fingerprint inside the warehouse — COUNT(*) + an order-independent sum of per-row hashes — and compares two one-row fingerprints. A 1 TB result reconciles by moving a few bytes. A mismatch is definitive; a match is high-probability equal. --mode full pulls rows for a row-level diff (small data only).

Install

pip install jarvisx-evidence-agent            # core (stdlib only)
pip install "jarvisx-evidence-agent[bigquery]"   # + BigQuery client
pip install "jarvisx-evidence-agent[snowflake,duckdb,postgres]"

Configure (recon.json)

{
  "source": {"engine": "bigquery", "project": "my-legacy-proj"},
  "target": {"engine": "snowflake", "account": "...", "user": "...", "warehouse": "...", "database": "...", "schema": "..."},
  "pairs": [
    {"name": "daily_sales", "source_sql": "SELECT id, SUM(amt) t FROM sales GROUP BY id",
                            "target_sql": "SELECT id, SUM(amt) t FROM SALES GROUP BY id"}
  ]
}

Engines: duckdb (local file / parquet / csv via setup_sql), bigquery (ADC), snowflake (env/config), postgres (dsn), or callable (point at your own module.connect(cfg) -> fn(sql)->(cols, rows) adapter for anything else). Credentials come from your environment (ADC / env / DSN) — this tool never stores them.

Run

# reconcile → JSON report (counts + hashes only)
jarvisx-evidence-agent --config recon.json --out report.json

# reconcile AND get a signed certificate (Enterprise plan; only the fingerprint is sent)
jarvisx-evidence-agent --config recon.json --submit https://gojarvisx.ai --token jvx_xxx \
    --source-type bigquery --target-type snowflake

Exit code is non-zero if any pair is a definite mismatch — drop it straight into your migration CI. The signed certificate can be independently verified at https://gojarvisx.ai/api/proof/verify against the public key at /api/proof/pubkey.

What leaves your network

Only: query name, engines, row counts, hashes, and the verdict. Never raw rows, never SQL text (in the signed cert), never credentials.

Also: jarvisx verify — a CI/dev correctness gate for SQL changes

Same package ships a second command that verifies an AI-made (or any) SQL change is behavior-preserving — credential-free, no warehouse needed. Give the original + changed SQL; JarvisX runs both on a synthetic fixture and row-diffs them, returning a gate with a CI-friendly exit code.

# exit 0 = pass (preserved) · 1 = block (changed) · 2 = review (unproven) · 3 = error
jarvisx verify -o before.sql -c after.sql -d bigquery
jarvisx verify --original-sql "SELECT id,SUM(amt) t FROM s GROUP BY id" \
               --changed-sql  "SELECT id,SUM(amt) AS t FROM s GROUP BY 1" -d bigquery
# add a signed certificate (metered; needs a jvx_ token):
jarvisx verify -o before.sql -c after.sql -d bigquery --sign --token jvx_xxx

Drop it in a pre-commit hook or CI step to block a merge when gate != pass. It calls the hosted verify_change tool over HTTPS (set --url/JARVISX_URL to override); only the SQL text leaves your machine. A review result means JarvisX could not prove equivalence — escalate to a human, never treat it as a pass.

As a PR gate (CI)

jarvisx ci verifies every changed *.sql file between the PR base and HEAD and fails the check on a behavior change:

jarvisx ci -d bigquery               # exit 1 if any change blocks; add --fail-on-review to also fail on unproven

Ready-made GitHub Action: jarvislistens/jarvisx/.github/actions/jarvisx-verify@main (check out with fetch-depth: 0). Copy-paste workflow: docs/examples/jarvisx-verify-pr.yml. Per-file results show up as PR annotations + a job summary.

License

Proprietary — © JarvisX.