Attach provenance where data changes custody or shape.
Makoto does not require one orchestration platform or catalog. An integration has four jobs, and it can attach wherever a system can observe exact inputs and outputs, record a claim, sign it, and carry it to the next participant.
Four responsibilities
- ObserveHash the exact input and output artifacts the platform actually read and wrote.
- AttestCreate an origin or transformation statement with predecessor links and platform metadata.
- CarryKeep signed statements, required profiles, and final artifact references together at the handoff.
- VerifyResolve exact schemas, authorize signers, reconstruct the graph, and hash the received bytes.
Common attachment points
| Pattern | Useful moment | Typical systems |
|---|---|---|
| Lifecycle hook | After a task, flow, or asset materialization succeeds | Airflow, Prefect, Dagster |
| Macro or post-hook | After a model or SQL transformation commits | dbt, Snowflake |
| Listener or event subscriber | When a stage, job, or catalog object materializes | Spark, Databricks, Unity Catalog |
| Producer or consumer interceptor | At a bounded stream window or message batch | Kafka, Kafka Connect |
| Write-path wrapper | Hash on write and verify on read | Object stores, warehouses, IO managers |
| Release workflow | Before publishing a dataset or model artifact | GitHub Actions, registries, research archives |
Platform field notes
Each note starts from a real extension surface in the platform, then maps it to the same protocol responsibilities. The Makoto-specific operator, hook, or processor still needs a maintainer, tests, and public code before it can be called an integration.
- 01
Apache Airflow
Emit transformation evidence from task callbacks or a wrapper operator; bind DAG, run, task, inputs, outputs, and code identity.
Read note → - 02
dbt
Use model post-hooks or run artifacts to attest to compiled SQL, source relations, target relation, invocation, and manifest identity.
Read note → - 03
Apache Spark
Use a listener around jobs or stages, then bind application identity, input paths, output paths, code, and exact artifact digests.
Read note → - 04
Apache Kafka
Attest to bounded topic, partition, offset, or time windows instead of treating an unbounded stream as one static artifact.
Read note → - 05
Snowflake
Attach evidence through tasks, procedures, query history, and stage writes while keeping warehouse claims separate from exact-byte claims.
Read note → - 06
Databricks
Connect job events and catalog lineage to signed statements, exact inputs, notebook or code identity, and recipient-verifiable outputs.
Read note → - 07
Dagster
Extend asset materialization metadata with signed predecessor and artifact digests at the asset boundary.
Read note → - 08
Prefect
Use flow and task state hooks to publish statements after successful materialization and verify evidence before downstream reads.
Read note → - 09
Expanso
Append evidence as data moves through distributed pipelines, including transformations performed close to the source.
Read note →
An integration is code, tests, fixtures, and a verifiable handoff—not a logo.
Choose one attachment point, implement the four responsibilities, and add a positive case plus failures for altered metadata, wrong bytes, missing predecessors, and unauthorized signers.