Everything that usually needs a second platform runs inside the movement path, with zero per-connector code — and a masked field never reaches the sink in the clear. Each guardrail is a config block; the engine applies them in order, per page, before every write.
Assert invariants on every page — per-record or per-batch. Failures abort the run or quarantine to a dead-letter queue.
Docs →quality:
checks:
- field: email
rule: not_null
on_failure: abort
- field: amount
rule: { gte: 0 }
on_failure: quarantineA versioned promise about the output shape — required fields, types, nullability, enums, patterns, bounds — enforced before the sink. Export to JSON Schema or OpenLineage.
Docs →contract:
version: 1
fields:
- { name: id, type: integer, required: true }
- { name: status, type: string,
enum: [active, churned] }
on_breach: quarantineClassify sensitive fields and redact or hash them. Runs FIRST — before quality, contract, drift, the sink, the DLQ, and lineage — so PII never leaves unmasked. Hashing is deterministic (stays joinable).
Docs →masking:
rules:
- field: email
action: hash # HMAC-SHA256, joinable
- field: ssn
action: redact # → "***"Detect when the source shape changes and decide what happens — warn, evolve, ignore, quarantine, or fail — instead of silently corrupting downstream.
Docs →drift:
on_drift: quarantine
# warn | evolve | ignore
# | quarantine | failEmit OpenLineage events with dataset schemas and column-level lineage derived from the transform chain — to Marquez or any OpenLineage endpoint — plus a movement catalog.
Docs →lineage:
namespace: prod.warehouse
include_schema_facet: true
include_column_lineage: true
transport:
type: http
url: ${env:MARQUEZ_URL}Declare what "healthy" looks like — max staleness, minimum rows, or a learned volume baseline (±3σ). Violations emit a Prometheus counter you can alert on.
Docs →sla:
max_staleness_secs: 86400
min_rows_per_run: 1
volume_anomaly:
sigma: 3All of it is opt-in config on the same pipeline — no extra services, no downstream bolt-ons. See the full guide for every field and policy.
Install the CLI, scaffold a config, and move real data — nothing external to stand up.
curl -LsSf https://github.com/faucet-hq/faucet-stream/releases/latest/download/faucet-cli-installer.sh | sh brew install faucet-hq/faucet-stream/faucet-cli