{
  "id": "page:library-composition-legacy-modernization",
  "_kind": "Page",
  "_file": "wiki/library/composition-legacy-modernization.md",
  "_cluster": "wiki",
  "attributes": {
    "nodeKind": "Page",
    "title": "Composition: Legacy Modernization (Event Storming + DDD + FDD + Strangler Fig + RUP) (Library)",
    "displayName": "Composition: Legacy Modernization (Event Storming + DDD + FDD + Strangler Fig + RUP) (Library)",
    "slug": "library/composition-legacy-modernization",
    "articlePath": "wiki/library/composition-legacy-modernization.md",
    "article": "\n# Composition: Legacy Modernization (Event Storming + DDD + FDD + Strangler Fig + RUP)\n\n**Provenance**: implements methodology backlog Example 4 \"Legacy Banking System Modernization\"\n(`library/methodologies/backlog.md`, ~line 1954, previously marked \"Not Implemented\").\nScenario: refactor a monolithic banking system to microservices (brownfield), with a\nzero-downtime requirement and irreversible legacy retirement steps that demand recorded approvals.\n\n## Why this composition\n\nNo single ingredient methodology suffices for a brownfield banking migration:\n\n| Ingredient | Unique contribution | Why it is not enough alone |\n| --- | --- | --- |\n| **Event Storming** | Discovery breadth — maps ALL domain events, hotspots, and pivotal events across the whole monolith fast | Produces a timeline, not boundaries, delivery plans, or governance |\n| **DDD strategic design** | Boundary rigor — bounded contexts, context map, ubiquitous language, anti-corruption layers against the legacy model | Assumes discovery already happened; says nothing about delivery cadence or cutover risk |\n| **FDD** | Delivery cadence — per-context feature lists and design/build-by-feature loops that parallelize cleanly | Feature factories do not decide when it is safe to route production traffic |\n| **Strangler Fig (inline)** | Incremental risk containment — facade routing, executed old-vs-new parity, slice-at-a-time cutover, verified retirement | A cutover pattern, not a discovery or modeling method |\n| **RUP** | Governance — phase-boundary go/no-go sign-offs (Inception/Elaboration/Construction/Transition) with accountable experts | Governance without domain discovery or parity evidence is rubber-stamping |\n\n## Ingredient handoff map\n\nIngredient tasks are imported and invoked **by name**; the `clm.*` tasks are this module's own glue and cutover machinery.\n\n| Producer stage | Artifact | Consumer stage |\n| --- | --- | --- |\n| Event Storming (`bigPictureStormingTask`, `processModelingTask`) | events timeline, hotspots, pivotal events | `clm.handoff.storm-to-contexts` distills DDD-ready candidate subdomains |\n| Storm handoff | candidate subdomains + hotspots | DDD (`identifySubdomainsTask`, `defineBoundedContextsTask`) |\n| DDD (`createContextMapTask`, `contextMappingTask`, `buildUbiquitousLanguageTask`, `identifyDomainEventsTask`) | bounded contexts + context map | `clm.design.legacy-acl-plan` (ACL per legacy touchpoint), FDD model scope, RUP `defineArchitectureTask` |\n| FDD (`developOverallModelTask`, `buildFeaturesListTask`, `planByFeatureTask`) | per-context feature plans | `clm.handoff.features-to-slices` derives ordered cutover `sliceSpecs[]` |\n| FDD (`designByFeatureTask`, `buildByFeatureTask`) + `clm.build.context-verification` | verified context builds (executed evidence) | Construction sign-off, then the P5 slice loop |\n| `clm.parity.execute-comparison` + adversarial parity gate | executed old-vs-new parity report | `cutover-slice-approval.<sliceId>` and `legacy-decommission.<sliceId>` approvals |\n| All phase boundaries | phase payloads (vision, gates, evidence) | RUP sign-offs (`createVisionDocumentTask`, `createBusinessCaseTask`, `assessRisksTask`, `defineArchitectureTask`, `refineProjectPlanTask` feed the payloads) |\n\n## Strangler Fig is modeled inline\n\nThere is **no** `strangler-fig` ingredient directory in this library, and this module never\nreferences one. The Strangler Fig pattern lives entirely in this module's own tasks:\n\n- `clm.cutover.prepare-routing` — facade routing seam, shadow-capable, legacy path untouched\n- `clm.parity.execute-comparison` — EXECUTED old-vs-new comparison checks (parity report artifact)\n- `clm.cutover.execute` — guarded routing flip (approval provenance recorded)\n- `clm.cutover.post-verification` — executed smoke/invariant re-checks against live routing\n- `clm.decommission.execute` — guarded legacy retirement with post-removal regression run\n\n## Phase walkthrough (P0–P6)\n\n- **P0 — kip recall**: composition-pattern facts, ingredient interface shapes, prior handoff\n  successes/failures, strangler cutover lessons (kind `methodology-composition`). Threaded into every later task.\n- **P1 — RUP Inception + big-picture discovery**: vision, business case, risk assessment;\n  big-picture storming and process modeling over the legacy system; storm-to-contexts handoff.\n  Gate: `phase-gate-signoff.inception`.\n- **P2 — DDD strategic design (Elaboration)**: subdomains → bounded contexts → context map →\n  ubiquitous language + domain events; ACL plan per context; architecture + plan baseline.\n  Adversarial gate `clm.context-map-review`, then `phase-gate-signoff.elaboration`.\n- **P3 — FDD feature decomposition**: sequential per-context model/feature-list/plan; the\n  features-to-slices handoff derives risk-ascending `sliceSpecs[]` (each with EXECUTABLE\n  comparison checks — a slice without them is invalid and the process throws).\n- **P4 — parallel context builds (Construction)**: `ctx.parallel.all` over contexts, chunked by\n  `maxParallelContexts`. Contexts are independent by construction (P2 gate enforced single\n  ownership), so branches share no state. **Orchestrator note**: do not co-schedule P5 slices\n  against unresolved P4 branches — compose slice inputs only from settled build results.\n  Gate: `phase-gate-signoff.construction` with per-context executed verification evidence.\n- **P5 — strictly sequential cutover slices**: a plain `for...of` — never parallel. Per slice:\n  routing seam → executed parity comparison → adversarial parity gate → cutover approval →\n  guarded cutover → post-verification → decommission approval → guarded decommission.\n  Any rejection or failed verification halts the loop with an explicit halt record.\n- **P6 — Transition close-out**: modernization report (completed AND halted slices, first-class),\n  `phase-gate-signoff.transition`, then kip assert of handoff/parity/ordering lessons.\n\n**Parallel/sequential contract**: context builds run in parallel (bounded), cutover slices run\nstrictly sequentially with executed verification between each slice.\n\n## Policy-gated actions\n\nEnumerated in the module JSDoc `@policyGatedActions` block so `adapters/policy` YAML gating can be generated from it.\n\n| actionId | Expert | breakpointId pattern | Guarded executor |\n| --- | --- | --- | --- |\n| `cutover-slice-approval` | `modernization-lead` | `cutover-slice-approval.<sliceId>` (per-slice-unique) | `clm.cutover.execute` runs only when `result.approved === true`; approval provenance (`breakpointId`, `approved`, `autoApproved`) recorded in its output |\n| `legacy-decommission` | `modernization-lead` | `legacy-decommission.<sliceId>` (per-slice-unique) | `clm.decommission.execute` — **decommission never auto-executes**; an unapproved decommission is a halt, not a skip |\n| `phase-gate-signoff` | `program-sponsor` | `phase-gate-signoff.<inception\\|elaboration\\|construction\\|transition>` | Rejection returns an explicit halted result — later phases never run |\n\nNone of these carry `autoApproveAfterN` — production-traffic, irreversible-retirement, and\ngo/no-go decisions stay accountable.\n\n## Adversarial parity gate\n\nPer slice, `clm.parity.<sliceId>` (via the shared `adversarialGate` combinator) reviews the\nexecuted parity report with two independent critics:\n\n- **parity-critic** — re-executes a sample of comparison checks itself and verifies the report's\n  diffs are real, complete, and reproducible; executed old-vs-new evidence is mandatory.\n- **risk-critic** — divergence severity, rollback readiness, banking invariants (balances,\n  idempotency, audit trail) covered by executed checks.\n\nIron law: every claim needs an EXECUTED check output (file:line citations plus re-run outputs);\na parity report whose checks were not actually executed is an automatic FAIL. A `passed: true`\nverdict with empty evidence is coerced to a protocol failure by the combinator. Fix loop:\n`maxFixAttempts` (default 2) with the built-in gate fixer, then escalation to a routed owner\nbreakpoint; on escalation-reject the slice **halts** — no cutover approval is ever raised.\nOrdering guarantee: the parity gate must pass (or be owner-approved) **before**\n`cutover-slice-approval.<sliceId>` is raised.\n\n## Inputs and usage\n\n| Input | Type | Default | Meaning |\n| --- | --- | --- | --- |\n| `systemName` | string | — (required) | Legacy system name, e.g. `core-banking` |\n| `legacyDescription` | string | — (required) | Monolith overview, tech stack, constraints |\n| `domainExperts` | string[] | `[]` | Storming participants |\n| `zeroDowntimeRequired` | boolean | `true` | Cutover downtime constraint |\n| `maxParallelContexts` | number | `3` | Context-build chunk size |\n| `maxFixAttempts` | number | `2` | Adversarial-gate fix budget |\n| `kipDir` | string | `.a5c/kip` | kip store directory |\n| `kipModel` | string | `sonnet` | Model for structured kip paths |\n\n```bash\nbabysitter run:create \\\n  --process methodologies/composition-legacy-modernization/composition-legacy-modernization.js#process \\\n  --inputs '{\n    \"systemName\": \"core-banking\",\n    \"legacyDescription\": \"COBOL+Java monolith: accounts, payments, loans, fraud; Oracle DB; zero-downtime SLA\",\n    \"domainExperts\": [\"ops-lead\", \"payments-sme\", \"loans-sme\"],\n    \"zeroDowntimeRequired\": true\n  }'\n```\n\n## Design rules\n\n- **No fallbacks.** Missing slice `comparisonChecks`, unapproved breakpoints, and unexecuted\n  parity checks are hard halts/failures — never defaulted, skipped, or silently continued.\n  Guarded executors additionally refuse to build without `approved === true` provenance.\n- **Combinator reuse.** Routing metadata, adversarial gates, and kip checkpoints come from\n  `../../specializations/common-utilities/routed-gate-combinators.js` (`routedBreakpoint`,\n  `adversarialGate`, `kipRecall`, `kipAssert`) — kip calls override the combinators' default\n  kind with `methodology-composition` and take `kipModel` from inputs (default `sonnet`).\n- **Agent-only tasks.** Every `clm.*` task is a Style-A `defineTask` factory with\n  `kind: 'agent'` and a mandatory `evidence` array (`minItems: 1`) in its output schema.\n",
    "documents": [
      "specialization:composition-legacy-modernization"
    ]
  },
  "outgoingEdges": [
    {
      "from": "page:library-composition-legacy-modernization",
      "to": "specialization:composition-legacy-modernization",
      "kind": "documents"
    }
  ],
  "incomingEdges": [
    {
      "from": "page:index",
      "to": "page:library-composition-legacy-modernization",
      "kind": "contains_page"
    }
  ]
}