Autonomous data engineering change management

Every data change gets a senior review before it ships.

Diffara investigates the blast radius, simulates the consequences on production-like data, and returns an evidence-backed verdict on the pull request — then watches what actually happened and learns from it.

See a real review Look inside the workspace
What lands on your pull request

Not a score. A case, with the evidence attached.

This is the GitHub check Diffara posts. Every number in it was measured by a bounded query against production-like data — nothing here is a model writing prose about a diff.

diffara / change review BLOCK · risk 96 · policy p_2026_08_30

A LEFT JOIN became an INNER JOIN on the customer path of a financial fact table.

Rows whose customer_id has no match in dim_customer were preserved and now are not. Three critical consumers read this path.

  • 42,817 rows removed — 4.3% of the table, measured baseline against candidate on a bounded sample
  • customer_id matches at 96.1% — the unmatched 3.9% are exactly the rows the new join drops
  • inc_2024_114 — the same edit understated revenue in this estate before
  • rpt_mrr, rpt_revenue_daily, revenue_board reach this asset; the last is executive-critical

Suggested validation: assert referential integrity on customer_id before merge. This estate declares no test for it.

evidence: SIM-4482, PRF-292, INC-284 · simulation coverage: partial · decided by policy, not by a model

GitHub check · the verdict is computed by a versioned rule pack from deterministic features. The agent gathered the evidence; it could not choose the outcome.

The product

One workspace. The graph is the substrate, not a picture.

Changes arrive as a queue you scan and enter. Opening one transitions into a persistent investigation workspace — no tabs, no separate lineage page, no chat window.

app.diffara.com/changes
Diffara Search or jump to… ⌘K Prod
9 changes today 1 blocked 2 awaiting approval 2 warned 1 not reviewed
  • 1a050aafanalytics.fct_invoiceblock 96git diff3m
  • 7bd3e112analytics.dim_customerpass 18git diff11m
  • c40918debilling.fct_subscription_chargeapproval required 71pipeline revision24m
  • 55e1b807telemetry.device_readingnot reviewedconfig change31m
  • 9f2c14abfinance.rpt_revenue_dailywarn 34git diff48m
  • 2e88d031growth.dim_planpass 9schema event1h
  • b1740fc2core.stg_billing_invoicesapproval required 64notebook revision2h
  • 6ad39e50ml.feature_churn_windowwarn 41git diff3h
  • d0c7a219analytics.dim_datepass 4git diff5h

Changes · swipe the frame · a launchpad, not a dashboard. The last row says not reviewed rather than sitting blank — a change nobody investigated is not a change that passed.

app.diffara.com/changes/1a050aaf
Diffara Search or jump to… ⌘K Prod

analytics.fct_invoice

10 assets reachable · 4 demonstrated · 2 criticalblock 96

Which of the paths that matter are we least sure about?

Asking Impact through Confidence
fct_invoice stg_invoice_linedeclared · 1.00 rpt_mrrdeclared · 1.00 rpt_churndeclared · 1.00 exec_kpi_dailydbt_ref · 1.00 finance_closedeclared · 1.00 revenue_boardname_match · 0.70 churn_cohortdeclared · 1.00 arr_forecastcolumn_match · 0.78 board_packname_match · 0.70
demonstrated impact reachable, not demonstrated inferred, lower confidence business-critical
baseline proposed simulated deployed observed deployed and observed are unavailable — this change has not shipped
trace
  1. action resulttrace_downstream
  2. action resultprofile_dataset
  3. action resultsimulate_query partial
  4. claim assertednull rate regression
  5. policy decisionblock

Investigation Workspace · swipe the frame · rpt_churn is reachable and recedes — only demonstrated impact brightens. revenue_board is critical and reached by a name-matched path at 0.70, so it carries an uncertainty halo.

The problem

Teams can see what code changed. They cannot see what it will do.

A LEFT JOIN becomes an INNER JOIN and eleven thousand invoices stop existing. CI is green — it validated the checks somebody thought to write. Observability notices in production, which is after the board deck went out.

Today

Blast radius is reconstructed by hand

A senior engineer opens the lineage tool, traces what they remember, and hopes the graph is current. It takes an hour and it is not repeatable.

Today

Tests check what someone predicted

Existing CI validates predefined assertions. The failures that matter are the ones nobody wrote a test for, because nobody expected them.

Today

Incidents teach nobody

What was learned in the postmortem lives in a doc. The next change of the same shape gets reviewed by someone who never read it.

How it stays honest

The parts most systems get wrong are the parts we made structural.

An autonomous reviewer is only worth installing if you can trust what it says. Four rules are enforced by the architecture rather than promised in a prompt.

Rule 01

A model can never set the verdict

The agent gathers evidence and states findings. A deterministic policy engine computes PASS, WARN or BLOCK from a versioned rule pack. The reasoning layer cannot import the decision function — that is a test, not a convention.

Rule 02

Every claim carries its evidence

A finding reaches “supported” only when a recorded tool result sits underneath it. Anything the model asserts without one stays a hypothesis and moves no decision. Unsupported claims are visibly different from findings.

Rule 03

Missing evidence lowers confidence

Incomplete lineage does not become complete lineage. If the blast radius cannot be established, the review says so and escalates rather than clearing the change — silence about what a change affects is never read as safety.

Rule 04

Synthetic data cannot pose as real

Every observation carries a provenance class and an observation time. Fixture and replay data are rendered differently from customer-derived evidence, everywhere, so a demo can never be mistaken for a measurement.

What it is for

Six jobs, in the words an engineer would use.

  1. 01When I change a model, tell me every high-confidence downstream asset that could be affected.
  2. 02When the semantic meaning changes, explain it in data-engineering terms — not line-level diff terms.
  3. 03Before merge, test the candidate against production-like data without risking production.
  4. 04When output changes unexpectedly, investigate why and show the evidence.
  5. 05When risk is high, block or escalate by policy; when evidence is incomplete, say so rather than guessing.
  6. 06After deployment, compare predicted impact with actual impact so the next review is better.
Status

Pre-pilot. Here is exactly where it stands.

A product that refuses to overstate its evidence should not overstate itself either. Nothing below is a customer result.

Built
The investigation kernel: semantic diff, change graph, evidence ledger, bounded simulation, deterministic risk and policy, replayable traces, and the review that lands on a pull request.
Stack today
GitHub and dbt against a cloud warehouse. Vendor-specific logic lives only in connectors — no warehouse name appears anywhere in the reasoning layer.
Measured on
106 synthetic change scenarios covering joins, grain, incremental loads, schema, dedupe and business metrics. Zero false blocks and zero forbidden actions are enforced gates in CI.
Not yet proven
Real-world efficacy. Those figures are measured on generated fixtures, which validates software behaviour and not customer outcomes. The first design partner is what changes that.
Looking for
Teams of 5–50 data engineers on Git-based SQL or dbt with a cloud warehouse, who have had at least one change-induced incident worth preventing.
First design partner

Bring a change that should have been caught.

Diffara is pre-pilot. The next step is one team running it against real pull requests — you keep every verdict it produces, and the review gets corrected wherever it is wrong.

  • Read-onlyOne repository and one warehouse schema. There is no write path to grant.
  • Non-blockingReviews post as an advisory check until you decide they should gate a merge.
  • Two weeksYou keep the verdicts, the evidence and the traces, whatever you decide after.
Start a conversation A change-induced incident you would rather not repeat is the only prerequisite.