Composition: Legacy Modernization (Event Storming + DDD + FDD + Strangler Fig + RUP)

**Provenance**: implements methodology backlog Example 4 "Legacy Banking System Modernization" (library/methodologies/backlog.md, ~line 1954, previously marked "Not Implemented"). Scenario: refactor a monolithic banking system to microservices (brownfield), with a zero-downtime requirement and irreversible legacy retirement steps that demand recorded approvals.

Why this composition

No single ingredient methodology suffices for a brownfield banking migration:

Ingredient handoff map

Ingredient tasks are imported and invoked **by name**; the clm.* tasks are this module's own glue and cutover machinery.

Strangler Fig is modeled inline

There is **no** strangler-fig ingredient directory in this library, and this module never references one. The Strangler Fig pattern lives entirely in this module's own tasks:

• clm.cutover.prepare-routing — facade routing seam, shadow-capable, legacy path untouched
• clm.parity.execute-comparison — EXECUTED old-vs-new comparison checks (parity report artifact)
• clm.cutover.execute — guarded routing flip (approval provenance recorded)
• clm.cutover.post-verification — executed smoke/invariant re-checks against live routing
• clm.decommission.execute — guarded legacy retirement with post-removal regression run

Phase walkthrough (P0–P6)

successes/failures, strangler cutover lessons (kind methodology-composition). Threaded into every later task.

big-picture storming and process modeling over the legacy system; storm-to-contexts handoff. Gate: phase-gate-signoff.inception.

ubiquitous language + domain events; ACL plan per context; architecture + plan baseline. Adversarial gate clm.context-map-review, then phase-gate-signoff.elaboration.

features-to-slices handoff derives risk-ascending sliceSpecs[] (each with EXECUTABLE comparison checks — a slice without them is invalid and the process throws).

maxParallelContexts. Contexts are independent by construction (P2 gate enforced single ownership), so branches share no state. **Orchestrator note**: do not co-schedule P5 slices against unresolved P4 branches — compose slice inputs only from settled build results. Gate: phase-gate-signoff.construction with per-context executed verification evidence.

routing seam → executed parity comparison → adversarial parity gate → cutover approval → guarded cutover → post-verification → decommission approval → guarded decommission. Any rejection or failed verification halts the loop with an explicit halt record.

phase-gate-signoff.transition, then kip assert of handoff/parity/ordering lessons.

• **P0 — kip recall**: composition-pattern facts, ingredient interface shapes, prior handoff
• **P1 — RUP Inception + big-picture discovery**: vision, business case, risk assessment;
• **P2 — DDD strategic design (Elaboration)**: subdomains → bounded contexts → context map →
• **P3 — FDD feature decomposition**: sequential per-context model/feature-list/plan; the
• **P4 — parallel context builds (Construction)**: ctx.parallel.all over contexts, chunked by
• **P5 — strictly sequential cutover slices**: a plain for...of — never parallel. Per slice:
• **P6 — Transition close-out**: modernization report (completed AND halted slices, first-class),

**Parallel/sequential contract**: context builds run in parallel (bounded), cutover slices run strictly sequentially with executed verification between each slice.

Policy-gated actions

Enumerated in the module JSDoc @policyGatedActions block so adapters/policy YAML gating can be generated from it.

None of these carry autoApproveAfterN — production-traffic, irreversible-retirement, and go/no-go decisions stay accountable.

Adversarial parity gate

Per slice, clm.parity.<sliceId> (via the shared adversarialGate combinator) reviews the executed parity report with two independent critics:

diffs are real, complete, and reproducible; executed old-vs-new evidence is mandatory.

idempotency, audit trail) covered by executed checks.

• **parity-critic** — re-executes a sample of comparison checks itself and verifies the report's
• **risk-critic** — divergence severity, rollback readiness, banking invariants (balances,

Iron law: every claim needs an EXECUTED check output (file:line citations plus re-run outputs); a parity report whose checks were not actually executed is an automatic FAIL. A passed: true verdict with empty evidence is coerced to a protocol failure by the combinator. Fix loop: maxFixAttempts (default 2) with the built-in gate fixer, then escalation to a routed owner breakpoint; on escalation-reject the slice **halts** — no cutover approval is ever raised. Ordering guarantee: the parity gate must pass (or be owner-approved) **before** cutover-slice-approval.<sliceId> is raised.

Inputs and usage

babysitter run:create \
  --process methodologies/composition-legacy-modernization/composition-legacy-modernization.js#process \
  --inputs '{
    "systemName": "core-banking",
    "legacyDescription": "COBOL+Java monolith: accounts, payments, loans, fraud; Oracle DB; zero-downtime SLA",
    "domainExperts": ["ops-lead", "payments-sme", "loans-sme"],
    "zeroDowntimeRequired": true
  }'

Design rules

parity checks are hard halts/failures — never defaulted, skipped, or silently continued. Guarded executors additionally refuse to build without approved === true provenance.

../../specializations/common-utilities/routed-gate-combinators.js (routedBreakpoint, adversarialGate, kipRecall, kipAssert) — kip calls override the combinators' default kind with methodology-composition and take kipModel from inputs (default sonnet).

kind: 'agent' and a mandatory evidence array (minItems: 1) in its output schema.

• **No fallbacks.** Missing slice comparisonChecks, unapproved breakpoints, and unexecuted
• **Combinator reuse.** Routing metadata, adversarial gates, and kip checkpoints come from
• **Agent-only tasks.** Every clm.* task is a Style-A defineTask factory with