1
Inspect your data
Choose the customer or robot calibration destination contract, upload a CSV or XLSX file, and inspect the real rows, inferred types, and values that may cause trouble.
5 rows read · 4 hazards flagged
AI assisted data migration
Move data.
Prove what changed.
A successful import is not the same as a correct one. MoveProof verifies approved destination contracts across customer data and per-joint robot calibration migrations, then shows you the evidence either way.
The preview on this page is a synthetic customer migration. The same verification-first workflow also supports the robot calibration destination contract; live migrations use the deployed backend, database, verifier, and configured model routing.
What can silently change
Each of these passes an ordinary import without an error.
Illustrative calibration records. MoveProof verifies data, not hardware.
- Calibration uploaded
- AI proposal
- Human decision
- Deterministic execution
- Independent verification
- Evidence
- Committed
Select a field to see what the migration did to it.
customers_v1 · MOV-2026-0091 · plan v1 · run 1
Synthetic preview
Failed
- Source00127
- Approved transformationCast to INTEGER
- Staged127
- Independent verificationFailedIdentifier matches the source exactly, as a string
The integer cast stripped the leading zero. The row imported without error.
The problem
The import succeeded.
But did the data keep its meaning?
An import can finish without errors even when critical values change. Row counts may match and logs may remain clean while customer identifiers, dates, or robot calibration metadata lose their intended meaning.
Data migrations often involve operations teams and consultants alongside database specialists. A misspelled name may be easy to spot. A data-type conversion applied consistently across thousands of rows is far harder to detect.
In the spreadsheetIn the database
customer_id
00127127
An integer cast removes the leading zeros.
signup_date
03/04/20242024-03-04
A date-format assumption turns April 3 into March 4.
balance
1200.551200.5499
A numeric conversion changes the amount by a fraction of a cent.
firmware_version
3.103.1
Parsing a version as a number drops its trailing zero.
rows
2 rows1 row
A duplicate is removed without an approved policy.
A successful import doesn’t guarantee data integrity.
How it works
Four milestones.
Eight controlled stages.
Customer records and robot calibration data use the same eight-stage path: inspect, plan, review, stage, verify, repair, commit, report. Four stages require an explicit decision from you.
- 2
Approve the plan
NVIDIA Nemotron 3 Super proposes a typed mapping plan. When deterministic validation identifies two or more concerns, MoveProof escalates to Nemotron 3 Ultra for deeper reasoning. Tavily provides advisory context, while human reviewers resolve ambiguities and approve the plan.
Plan v1 · 7 operations · 2 review items
- 3
Verify the staged result
A verifier that shares no code with the planner checks the staged data against the approved contract.
9 checks · 7 passed · 0 failed · 2 not verified
- 4
Commit with evidence
Commit stays blocked until nothing mandatory is outstanding, and the report records what was never checked.
5 rows committed · 2 properties not verified
Illustrative figures from one example run. Every mandatory check passed, so commit was allowed; the two properties not verified are recorded in the evidence report.
The approach
Three rules the code enforces
Each rule is enforced in the domain layer rather than promised by the interface, so a new screen cannot quietly break it.
Operating model
Enforced rules
The checker is not the author
In the model-assisted profile, the model proposes transformations. A separate verifier that shares no code with the planner decides whether they held. A model confirming its own output would not count as verification.
Planner and verifier are separate modules by construction.
Plans are versioned and immutable
An approved plan is never edited. A repair creates a new version with a reviewable diff, and every executed operation names the version it came from.
Plan v1 stays on the record, including the cast that failed.
Not verified never means passed
Results are reported in four separate counts rather than one score, so a property that was never checked cannot be mistaken for one that held.
Passed · Failed · Review required · Not verified.
Verification boundary
What MoveProof proves
A passed verification means the invariants in the approved contract held. For a robot calibration migration, that means the recorded calibration values survived the declared migration contract.
What MoveProof does not claim
- That every possible semantic error has been ruled out. The evidence report states this in its limitations section.
- Calibration correctness.
- Robot behavior or hardware safety.
Technology
AI proposes.
Validated code executes.
MoveProof treats AI-generated mappings as proposals, never as executable instructions. Every proposed plan must pass deterministic validation and receive human approval before execution.
NVIDIA Nemotron 3 Super, served through Nebius Token Factory, drafts a typed mapping plan from a schema summary and up to five sample rows. When deterministic validation identifies two or more concerns, MoveProof escalates to Nemotron 3 Ultra for deeper reasoning. More reasoning. No extra authority.
An independent verifier checks staged data against the approved contract before commit. The same safeguards apply to customer records and robot calibration data. Tavily provides advisory context for human review but cannot change verification results or commit eligibility.
The authority path
auto · hover to exploreTavily, external evidence
Advisory only
Public references that inform the human decision in step 3. Cannot affect verification state or commit eligibility.
Step 1 of 6
Nebius / AI reasoning. Nemotron 3 Super drafts a typed plan from a schema summary and up to five rows. Ultra joins only on escalation. The output is data, never SQL.
Infrastructure
moveproof · next.js / vercel
The workspace. It renders every state the API reports and never decides commit eligibility itself.
›GET /api/migrations/{id}
→ render plan, checks, evidence
commit button = server decides
▍
Auto. Hover to pause. Snippets are illustrative.
What is running in this build
- Plan versioning and operation allowlist
- Destination profiles for customer and robot calibration data
- Independent verification engine with four result categories
- Discrepancy explorer and auditable evidence reports
- Verified CSV export from stored verified data
- JSON, HTML and PDF evidence exports
- Nemotron inference through Nebius Token Factory
- FastAPI backend with PostgreSQL staging and commit gates
- Rust verifier for canonical reconciliation
Nebius and NVIDIA are named to describe technologies used by MoveProof. Neither company endorses this project.
Verification evidence
See what your migration actually changed.
Walk the verification-first workflow with synthetic customer or robotics fixtures, from the proposed plan through human review, verification, commit, and final evidence.
Open the workspace