How assurance works

A check that has never failed proves nothing.

Anyone can ship a comparator that always says “looks fine.” So we seeded a rounding difference into our own reference migration and made ours fail. Below is the mechanism and every number behind both answers: an EMR Serverless 6.15.0 → 7.5.0 runtime upgrade, executed on real AWS in account 400920695203, us-east-1, in both directions of the verdict.

Two runs, two verdicts

Same workload, same comparator. The only difference is that a rounding difference was deliberately introduced into the second one.

INSUFFICIENT_EVIDENCE
EQUIVALENT

One workload — tpch-q1-reference-v1 — executed on both platforms. 10 equality assertions ran and no differences were found. The recommendation still stops short of PROCEED: no estate inventory or static scan was attached, and equivalence on one pair is not a cut-over verdict.

Measureemr-6.15.0emr-7.5.0
Spark3.4.1-amzn-23.5.2-amzn-1
Wall clock48.5s19.6s
Cost$0.0157$0.0202

The verdict is scoped to the workloads that were assessed. It says nothing about workloads that were not run.

DO_NOT_CUT_OVER
DIFFERENCE FOUND

A rounding difference was seeded into the workload on purpose, so that a passing verdict could be distinguished from a comparator that cannot fail. It was caught three independent ways: the output schema drifted, the row content hash changed, and three aggregates moved.

  • Tolerance for this comparison was rel=0.0, abs=0.0 — exact equality, so a rounding change is a difference, not a rounding error.
  • The seeded run is 00g7nppt0p4fu80b, a real job run in the same account and region.

This is the most important run on the page. Without it, the equivalent verdict is an unfalsifiable claim.

How a verdict is produced

Five steps. Nothing in the chain is a questionnaire, a checklist, or a heuristic read of your code — every step below is an execution or a comparison of what execution returned.

Step 1
Pin the workload

One versioned workload is the unit under test. The reference migration used tpch-q1-reference-v1. The version is what a verdict attaches to, so a later change to the workload invalidates the verdict instead of silently inheriting it.

Step 2
Execute on both platforms

The same workload is submitted to the source platform and the target platform. In the reference migration that meant emr-6.15.0 (Spark 3.4.1-amzn-2) and emr-7.5.0 (Spark 3.5.2-amzn-1), as real EMR Serverless job runs in AWS account 400920695203, us-east-1 — not a dry run and not a simulation. Naming the engine matters: these runs were submitted by the assurance harness, not dispatched through SparkPilot's governed control plane. The assurance run and the dispatch path are separate things.

Step 3
Capture what each platform reports

Output schema, a row content hash, aggregate values, wall clock, and the platform's own reported resource consumption. Evidence is taken from the platform, so the comparison does not depend on trusting either vendor's summary of itself.

Step 4
Assert equality at a declared tolerance

The tolerance is stated up front rather than discovered afterwards. The reference comparison ran 10 equality assertions at rel=0.0, abs=0.0 — exact — and found no differences. Verdict: EQUIVALENT.

Step 5
Emit a scoped verdict

PROCEED_FOR_ASSESSED_SCOPE on the equivalent pair; DO_NOT_CUT_OVER when a difference is found. The scoping is deliberate and it is load-bearing: the verdict covers the workloads that were actually executed and compared, and says nothing about workloads that were not run.

What gets compared

Three axes were exercised by the reference migration, each with the figure it produced.

Outputs

Column types, a row content hash over the result set, and aggregate values, each asserted at the declared tolerance. This is the assertion that caught the seeded difference three separate ways.

10 assertions · 0 differences
Runtime

Wall clock for the run on each platform, measured on the runs themselves rather than inferred from a benchmark. Faster is not automatically better — it is evidence a reviewer weighs alongside the equality result.

48.5s on emr-6.15.0 · 19.6s on emr-7.5.0
Cost

Cost is the platform's own reported resource consumption for the run priced at that platform's published public rates. It is not a bill, and it is not a modelled forecast. Where a platform exposes no consumption feed the value reads not measured — never zero.

$0.0157 on emr-6.15.0 · $0.0202 on emr-7.5.0

The negative control, in full

Everything the comparator reported on the seeded run, at tolerance rel=0.0, abs=0.0. These five findings are why the equivalent verdict on the other run is worth reading.

AssertionReference runSeeded runResult
Schema — sum_chargedecimal(38,6)decimal(38,1)type drift
Row content hash984eb4735fc1b990…5e7671c91ac6d5cc…differs
Aggregate — max1418207490.4101811418207475.3differs
Aggregate — min1391007086.0812121391007105.8differs
Aggregate — sum8427644657.0161888427644818.5differs

On a narrow screen, swipe horizontally to read the full table.

Run identifiers

The EMR application and job-run identifiers behind the figures on this page, in AWS account 400920695203, us-east-1.

  • Reference migrationapplication 00g7nppcfcrf8i09 · job run 00g7nppqou31tg0b
  • Reference migrationapplication 00g7nppdqs2mr409 · job run 00g7npps1fnug00b
  • Seeded negative controljob run 00g7nppt0p4fu80b

Read the report itself

Everything on this page summarises generated artifacts. The artifacts themselves are published here, unedited — including the report that answers its own headline with INSUFFICIENT_EVIDENCE because no estate was inventoried.

What this does not prove

The scoping is the product. A verdict that quietly covered work nobody executed would be worth less than no verdict at all, so here is exactly where the evidence stops.

The estate inventory has not been run against a real estate

The reference migration report records it plainly: jobs inventoried 0, source files scanned 0, inventory complete no. Nothing on this page should be read as evidence that discovery or static scanning works at estate scale, because that has not been demonstrated.

One workload, one migration path, one runtime-upgrade pair

tpch-q1-reference-v1 across EMR Serverless 6.15.0 → 7.5.0. No second workload, no second platform pair, and no second migration path has been taken end to end.

The verdict is scoped on purpose

PROCEED_FOR_ASSESSED_SCOPE is not a hedge bolted on afterwards — it is what the verdict means. It covers the workloads that were executed and compared. It says nothing about the ones that were not.

Failure-mode divergence was not exercised

Both platforms completed the reference workload successfully, so this comparison never had to reconcile two different failures. Comparing how a workload fails across runtimes is part of the intent; it is not part of what has been proven.

Where this sits

Datafold diffs tables across databases. SparkPilot diffs job behavior across runtimes — outputs, runtime, cost, and failure modes.

Today that comparison is proven on outputs, wall clock, and platform-reported cost, for one workload across one runtime-upgrade pair. The reference workload succeeded on both platforms, so failure-mode divergence was not exercised — see the section above.

This is not a checklist and it is not a conversion consultancy. The differentiation is neutral execution evidence and result equivalence: the workload is run on both platforms, the outputs are compared, and the verdict states its own scope. The owned object is the versioned workload and the release attestation attached to it.

Bring us a workload and a destination

The migration above is a runtime upgrade we ran on ourselves — one workload, one pair. The useful next one is yours. Bring a workload and a target, and we will tell you before we start whether we can execute it on both sides. If we can, you get this same report — including the answer you did not want. If we cannot, you get that answer for free.