Modernize the Map, Not the Myth

I will not promise to “convert 80 million lines.” The product is a continuously verified map from business capabilities and production behavior to applications, data, interfaces, owners, controls, and migration state. First I need business deadlines, risk appetite, system-of-record boundaries, languages/runtime access, production telemetry, change rate, compliance evidence, and which outcomes mean success: cost retired, risk reduced, cycle time, or new capability.

My invariant is that every extracted rule or dependency has evidence, confidence, and freshness. Automated analysis proposes; accountable owners approve. Cutover is behavior- and data-contract driven, not lines-of-code driven.

Actors are portfolio executives, domain owners, application owners, architects, security/compliance, modernization teams, agent operators, release managers, and auditors. Version one inventories code/repos, runtime/jobs, databases, interfaces, incidents, cost, usage, controls, and ownership; builds a versioned dependency/capability graph; extracts candidate business rules and characterization tests; scores migration candidates; creates governed waves/work orders; tracks parity and cutovers; and reconciles actual retirement benefits.

Mock goals: initial 600-app inventory in 60 days; 95% evidence coverage of critical runtime flows as a portfolio discovery SLO; graph updates within four hours of source change; portfolio UI p95 under two seconds; no high-criticality cutover without dual-run and rollback; seven-year decision/audit history. The 95% aggregate is not a cutover waiver: every named critical contract in a wave needs an accountable owner, executable characterization, and rollback decision. Out of scope: automatic deletion, big-bang rewrite, translating every dead line, and letting an agent deploy without approval.

Raw scan work is 320M line-passes. At 2.4M LOC/minute aggregate, the ideal wall time is 133 minutes, about 2.2 hours. That proves scanning is not the 60-day bottleneck. Building, resolving, and validating cross-system behavior, opaque binaries, data semantics, owners, and controls dominate. We need hundreds of partitions for language isolation and skew, but more workers do not create knowledge.

Thirty teams at four apps/year retire 120 apps/year, so a naive portfolio takes five years. Critical shared dependencies and change traffic reduce that throughput; reuse of extracted capabilities/contracts may improve it. The portfolio system must expose WIP, blocked dependencies, and actual retirement—not reward teams for declaring a rewrite “done” while the mainframe remains.

An Application has stable enterprise identity separate from repository names. Every source artifact is content-addressed. A DependencyAssertion is versioned and stores source/target typed IDs, edge kind, direction, environment, evidence pointer, extractor version, confidence, observed time, and approval state. Conflicting assertions coexist; a materialized accepted edge is a view. Every primary key, graph partition, cache key, index document, and object path is prefixed by enterprise_id; content hashes support integrity and deduplication only inside that isolation boundary.

Business capabilities, owners, controls, costs, incidents, interfaces, data sets, rules, tests, and waves are first-class IDs. A graph version pins the evidence set used for a portfolio decision. APIs ingest discovery observations, query impact as-of a version, propose/approve assertions, create wave candidates, manage work orders, record parity results, and execute controlled traffic shifts. The wiki text is commentary; evidence-backed records drive governance.

Read-only connectors snapshot repositories, build manifests, CMDB, schedulers, schema catalogs, API gateways, network flows, observability, tickets, and cost. An ingestion plane normalizes identifiers and stores immutable evidence. Sandboxed analyzers perform language-specific parsing, symbol/call/data-flow analysis, config/secrets redaction, SQL/job extraction, and runtime correlation. Results enter an assertion store plus graph projections and search.

A portfolio service combines criticality, change demand, cost, risk, testability, dependency centrality, owner readiness, and expected value—with inputs visible, not a magic score. Approved waves instantiate blueprint, work-order, test, and decision artifacts. Agents run in least-privilege sandboxes against frozen context; humans approve architecture and side effects. A cutover plane executes shadow reads, dual writes where safe, reconciliation, traffic slices, rollback, and eventually evidence-backed decommission.

I model provenance and observation conditions rather than force consensus. Static analysis may show a possible call; runtime trace shows an observed call for a time/environment; a contract or owner approval adds authority. Edges carry confidence and last-seen time. We preserve negative evidence carefully—absence in sampled telemetry is not proof of no dependency.

Portfolio ranking is multi-criteria with hard constraints. A hub’s centrality and blast radius may make it a prerequisite, a platform extraction candidate, or something to stabilize rather than migrate first. I build dependency-respecting waves with capacity, blackout windows, shared data ownership, and rollback constraints. Executives can run scenarios with weights, but every recommendation includes sensitivity: if a small weight change flips the rank, it is not a robust decision.

We extract candidate rules from code, docs, tickets, production traces, and subject-matter interviews, each cited to evidence. We separate technical plumbing from policy and create Given/When/Then rules plus characterization fixtures from representative and edge-case production inputs. A golden-master harness compares outputs, side effects, latency, and accounting invariants using masked or synthetic data.

The strangler facade gives one stable contract. We begin shadow reads, then mirror traffic without effects, compare normalized outcomes, and investigate mismatches by value/risk slice. Where dual writes are necessary, one system remains authoritative and an outbox plus reconciliation detects divergence; we avoid uncontrolled bidirectional writes. Canary traffic increases by capability/cohort. Rollback shifts the route pointer and reconciles in-flight state. Retirement requires zero approved consumers, archived evidence, data retention disposition, credentials revoked, jobs stopped, and cost verified.

The wave readiness gate fails because critical-flow coverage is incomplete. I add scheduler and file-catalog evidence, quarantine the cutover, and use the file’s producer job, naming patterns, access audit, and downstream control totals to resolve consumers. The new assertion version triggers reverse-impact notifications and re-plans dependent waves.

Architecturally, discovery becomes continuous: code/CMDB alone was insufficient. I add batch scheduler, managed-file-transfer, filesystem audit, data lineage, and operator interview collectors. Graph completeness is measured per evidence family and critical capability, not one percentage. We may first wrap the file contract or extract a shared service instead of migrating the intended app. The schedule changes; the truth does not.

I block cutover. Count-weighted parity is the wrong objective; value-, regulatory-, and risk-weighted slices are hard gates. The mismatch set becomes a first-class error bucket linked to rules, source lines, and fixtures. We determine whether the legacy behavior is required, a known bug, or undocumented policy; only an authorized decision can intentionally diverge.

The agent’s summary is not evidence. We rerun the canonical built artifact in the golden harness, add the high-value cases to a protected holdout, and require SME/legal approval for changed behavior. If business explicitly chooses a correction, we version the policy, migration rule, communication, and effective date. Otherwise the old route stays authoritative for that cohort while safe cohorts can canary separately.

Graph publication, approvals, wave membership, leases, and route changes use transactional compare-and-set. Analysis delivery is at least once and idempotent on artifact digest plus analyzer version. Work orders have dependency DAGs and exclusive leases for conflicting assets; optimistic merge and code ownership handle parallel changes. Per-language queues, tenant/domain quotas, retry budgets, poison-repo quarantine, and backfill pools prevent one COBOL monolith from starving change-driven analysis.

Connectors are read-only by default; code and secrets stay in tenant/VPC boundaries; extracted data inherits source ACLs; agent tools have task-scoped credentials, egress policy, signed artifacts, and human approval for writes. Observe discovery freshness/completeness, conflicting/stale edges, analysis lag/cost, WIP/block age, parity by value/risk slice, cutover error/latency/reconciliation, rollback time, retired cost, access anomalies, and audit gaps. Immutable evidence and event logs rebuild graph projections; cutover configs are replicated and restore/rollback is rehearsed.

Start with read-only discovery in one domain; validate identity and graph edges with owners; publish portfolio scenarios without committing funds; select a low-coupling pilot and one representative hard system; build characterization harnesses before replacement; shadow, dual-run, canary, and retire with explicit gates; then scale reusable analyzers/contracts across waves. Compare forecast with actual cost, risk, lead time, and decommission completion quarterly.

The trade-off is local migration speed versus portfolio coherence. A team can ship a new app quickly while duplicating a shared capability and leaving dependencies behind. I accept slower wave approval to make interfaces, ownership, evidence, and retirement measurable—then use the factory to accelerate repeated, well-understood patterns.

I’ll summarize continuous discovery, evidence-backed decisions, parallel work controls, and reversible cutover.