anti-legacy

Validates the requirements graph against the wicked-estate code graph before the blueprint phase. Checks every requirement's legacy field resolves to a real program node in the graph (not a JCL step), finds uncaptured behavior-bearing nodes with business logic that need requirements, and flags duplicate program references. Blocks if errors are found; warns and requires human review if only gaps remain. Run after extraction/graph-translator, before blueprint. Use when: "validate requirements graph", "audit the graph", "check graph accuracy", "are we missing any programs", "graph audit before dev", "validate before blueprint".

Apply structural lenses to the legacy code graph to identify entry points, domain boundaries, shared data coupling, operational modes (batch vs online), and risk hotspots. Queries the wicked-estate code graph via the helper (never raw SQLite, never legacy_graph.json). Produces an analysis report. Use when: "analyze the legacy code", "identify entry points", "find domain boundaries", "what are the hotspots", "classify the programs".

Pre-build threat modeler — the adversarial half of the Phase Execution Protocol (PEP, AGENTS.md §10). Given a phase plan and its threat surface, generates a structured threat list BEFORE the producer runs so the producer can address each threat in its output rather than discovering the gap post-build. CRITICAL threats block the phase from advancing until the producer acknowledges them (fix or documented waiver). MEDIUM/MINOR are advisory. Distinct from anti-legacy:adversarial-review (which reviews rendered output AFTER production) — the antagonist attacks the plan BEFORE production, while it is still cheap to change. Use when: any phase producer is about to run; "antagonist check"; "threat model this phase"; "what could go wrong"; PEP step 3 in orchestrate.

The anti-legacy pipeline internals SME, and the home of the shared antilegacy_core Python library. Use when: understanding or operating the pipeline core, diagnosing a core module (estate seam, requirements-graph builder, coverage, manifest state machine, validator), checking pipeline readiness, or extending antilegacy_core.

Map the Requirements Graph to a target state architecture blueprint. Defines the modern package structure, API surface (REST/gRPC), database schemas, class boundaries, and repository patterns for the target stack. Produces blueprint.json + blueprint.md. Use when: "design the target architecture", "create the blueprint", "map requirements to target stack", "design the Spring Boot structure", "what does the modern version look like".

Render the full stakeholder DELIVERABLES package once the requirements graph is ready — product requirements (PRD), architecture diagrams, detailed test strategy, functional test scripts, end-to-end migration plan, and the living risk / decisions / evidence logs — into .anti-legacy/deliverables/, then compile an index. Register-only; does not advance the pipeline. Use when: "produce the deliverables", "generate all the deliverables", "the deliverables package", "PRD + diagrams + plan + risk/decision logs".

Package and deploy the modernized application to the configured deployment target. Supports GCP Cloud Run, AWS ECS/Fargate, Azure AKS, and generic Kubernetes. Generates Dockerfile, CI/CD pipeline config, and deployment manifests. Requires GATE_4_UAT to be cleared. Use when: "deploy the app", "generate the Dockerfile", "create CI/CD config", "package for Cloud Run", "generate Kubernetes manifests", "deployment".

Guide the agent in modifying the plugin's code, templates, or skills to address learnings and gaps found in UAT/semantic validation. Use when: "update the plugin", "fix parsing bug", "modify translation rule", "develop the plugin", "self-correct code translator based on learning".

Modernization developer. Translates ONE legacy requirement into idiomatic target-stack code + unit tests from a micro-context (business rules, entity schemas, translation patterns, test contracts) — never the full legacy source or requirements graph. Annotates each rule with @ImplementsRule. Use when: dispatched by anti-legacy:swarm to implement a requirement / translate a task.

Crawl the wicked-estate code graph with adaptive ring expansion and annotate each behavior-bearing node with its business rule. Per node, gather context one ring at a time (node + 1 dependency down / 1 dependent up via blast-radius) until the rule can be stated with confidence, then RESOLVE it (rule + confidence + provenance) or RISK-flag it for human research. Annotations are written into wicked-estate's native `requirement` fields and mirrored to the anti-legacy `.anti-legacy/annotations.jsonl` IP overlay. Emits a resolved-or-flagged coverage report. Replaces the old graph-translator enrich flow. Use when: "extract the business rules", "annotate the graph", "crawl and resolve", "run the extraction loop", "build the coverage report", "resolve or risk-flag the nodes".

Final completeness-review swarm (B1b). Scans the BUILT target app for mocked / half-done / incomplete work across four dimensions — CODE, DOCS, CONFIG, BUILD — with one parallel reviewer subagent per dimension. Runs the deterministic completeness_scanner, reasons over its findings, and emits evidence/completeness-report.json (status PASS|FAIL; FAIL on any HIGH finding). Runs LAST, after docs + functional tests exist, so it reviews those too. On FAIL it kicks back to the phase that owns the gap. Clears GATE_5_COMPLETENESS only on PASS. Use when: "final review", "completeness review", "is the build actually done", "scan for stubs / mocks / TODOs in the target", "did we ship any half-done work".

Author executable functional / scenario acceptance tests from the per-requirement test contracts BEFORE the build exists (shift-left), and validate those contracts are runnable and unambiguous (hard gate). Emits JUnit 5 for a Java target stack, pytest for Python; any other stack returns an explicit "stack not yet supported" error — never a silent pass. The companion POST-BUILD execution cycle runs in anti-legacy:target-review via the functional test runner. Use when: "author the acceptance tests", "generate the functional tests", "write executable scenario tests", "validate the test contracts", "are the contracts runnable", "shift-left acceptance tests".

Enforce transition gates. Verify that required sign-offs and evidence exist before the pipeline can advance. Nine gates: GATE_0_DISCOVERY (automated survey integrity), GATE_1_DESIGN (design review), GATE_1B_SEMANTIC_JOIN (semantic-join review), GATE_2_PLAN (plan review), GATE_3_BUILD (automated build integrity + round-trip rule-coverage), GATE_3B_SEMANTIC (semantic validation review), GATE_3C_DIFFERENTIAL (automated executed output-parity vs a golden legacy corpus), GATE_4_UAT (UAT acceptance, reviewer-independence enforced), GATE_5_COMPLETENESS (automated final completeness gate). A `failed` opinion on any gate triggers a generalized, guided kick-back that rewinds the pipeline to the gate's producing phase. Blocks pipeline execution if any required gate is not cleared. Use when: "check gate status", "verify gate 1", "can we proceed to build", "has the design been signed off", "record a sign-off", "gate check".

The §I5 domain-graph re-think. Takes the ANNOTATED wicked-estate code graph (the resolved-or-flagged evidence spine produced by anti-legacy:extraction) plus the cluster(weight="calls") capability communities and re-thinks them into the TARGET-state DOMAIN graph — a capability-oriented requirements_graph.json, not a 1:1 code skeleton. Merges one-or-more source apps into ONE target system, honoring disposition (keep | modify | drop | new) so a reimagined-away rule is an EXPLICIT drop with a reason, never a silent omission. Emits the gate-validated requirements graph + a drop manifest + disposition-aware round-trip coverage. Use when: you reached here to "translate the call graph" / "build the requirements graph" / "re-think the annotated graph into capability domains" / orchestrate Phase 4 "Graph Translate" (after extraction, before blueprint).

Decompose the blueprint into a concrete, ordered task list for the build swarm. One task per requirement node, scoped to ≤150 lines of target code. Tasks are topologically sorted by dependency order (data layer before service layer before API layer). Produces task.md for the swarm. Requires GATE_2_PLAN sign-off. Use when: "create the task list", "plan the build", "decompose the blueprint", "what order do we build things", "generate task.md".

Analyze and map inter-repository dependencies when multiple codebases are modernization sources. Scans routes and client requests, identifies dangling external links, and validates contract matches. Use when: "joining repositories", "mapping multi-repo interfaces", "verifying inter-app dependencies".

Deploy validator subagents to review the new and old code in context of dependency chains, determine if there are semantic/functional gaps, and record them back to the requirements graph. Produces semantic-validation-report. Requires GATE_3_BUILD to be cleared. Use when: "run semantic validation", "validate code semantics", "find gaps between old and new code", "review code by dependency chains", "update graph with gaps".

Initialize the .anti-legacy/ workspace and manifest for a new modernization project. Run once per project before any other anti-legacy skill. Creates directory structure, config.json template, audit trail, and seeds the patterns directories. Use when: "start a modernization", "init anti-legacy", "set up a new migration project".

A meta-skill — a skill that WRITES skills. Once the blueprint exists, it generates one target-tailored `build-<domain>` SKILL.md per domain into .anti-legacy/generated-skills/, baking the blueprint component specs + each requirement's business rules / validations / error paths + entity parity into reusable build instructions a CLI/IDE agent FOLLOWS to build the target natively and consistently. Inverse of anti-legacy:develop-plugin (which evolves the plugin): this generates the TARGET system's build skills. Use when: "generate the build skills", "create skills to build the target", "scaffold the target build", "forge build skills", "make it natural to build the target state".

Indexes one or more legacy source apps with wicked-estate (the code-graph engine) into per-app SQLite graphs under .anti-legacy/graphs/, then registers a deterministic wicked-estate stats digest as the checksummed `legacy-graph` evidence. wicked-estate natively captures the mainframe estate (COBOL/JCL/CICS/IMS/DB2 — module/function/field, JCL step/dataset, cics_program/cics_map, ims_database/segment, db2_table) AND modern languages (Java, C#, Python, TypeScript, Go, Kotlin, Rust, and others) in one pass, with {confidence, provenance} on every edge. Multiple repos stay as separate per-app DBs and federate via cross-graph (the merge case). No language routing, no batch extractor, no hand-rolled JSON graph. Use when: "scan the codebase", "discover the legacy code", "build the call graph", "index the source apps", "survey the source apps".

Spawn developer subagents to translate legacy code into target stack code, one task at a time. Each subagent receives a micro-context (requirement, data schemas, translation patterns) and writes the target file + unit tests. Works task-by-task through task.md in dependency order. Requires GATE_2_PLAN sign-off. Use when: "build the code", "start translating", "run the swarm", "translate task X", "implement the requirements".

Run compiler and build integrity checks on the generated target codebase. Supports Java (Maven/Gradle/javac), Go, C# (.NET), Python, Kotlin, TypeScript. Auto-clears GATE_3_BUILD only if compilation passes AND the round-trip rule-coverage proof passes (rule_coverage >= 1.0, zero FAIL requirements). Use when: "check if it compiles", "run the build", "verify the generated code", "target review", "build integrity check".

Generate a shift-left test strategy from the target blueprint. Produces one test contract per requirement node — inputs, assertions, boundary conditions, data parity verification rules (legacy output vs modern output), and integration test plans. Use when: "create a test strategy", "generate test contracts", "write the test plan", "what do we need to test", "parity testing approach".

Spawn independent UAT reviewer subagents to validate target code behavior against the test contracts. UAT subagents have read-only access only — they cannot modify code. Each subagent reviews one domain's requirements against contracts and outputs PASS/FAIL verdicts. Requires GATE_3_BUILD to be cleared. Use when: "run UAT", "validate the generated code", "check against requirements", "start the UAT crew", "independent review".

Universal adversarial review of ANY generated / AI-derived output — a READ-ONLY critic that challenges a produced artifact against the SOURCE DATA it was derived from, INDIVIDUALLY (one artifact) or in PARALLEL batch (e.g. every rendered deliverable). It hunts unsupported/optimistic claims, dropped §2 traceability (req_id→legacy_components→rule), empty/weak sections, missing parity rules on numeric outputs, "done" that hides gaps, and divergence from the requirements graph. Targets: deliverables (.anti-legacy/deliverables/), skill-forge's generated build skills (.anti-legacy/generated-skills/), and any single produced artifact. Returns a structured verdict (findings[] with severity → PASS / REVISE / BLOCK). Advisory: it never clears a gate. The pre-build analog of anti-legacy:uat-reviewer (which critiques built code). Use when: "adversarial review", "critique this output", "review the deliverables", "review the generated build skills", "challenge the PRD / risk log / plan", "is this output honest".

Second extraction pass that captures the NEGATIVE behavior the first pass (ring[0]) misses: error paths, validations, and negative requirements. For each already-resolved behavior node it crawls one+ ring DEEPER into the node's error-handling source (exception handlers, rollback/ABEND, validation guards, SQL error clauses) and re-annotates the overlay with source-grounded error_paths[] + validations[]; negatives it can only DERIVE (from boundaries/validations) are written flagged (lower confidence). Runs after anti-legacy:extraction, before anti-legacy:graph-translator. Use when: "no error paths", "no negative requirements", "extract error handling", "what should the system reject", "deepen the extraction".

Assemble a GOLDEN CORPUS for the differential-equivalence gate (GATE_3C_DIFFERENTIAL) from whatever is available on the project, and grade how trustworthy it is. Most projects never have pre-captured legacy I/O, so without this the gate is permanently NOT_APPLICABLE. This skill builds the best-available golden — from the test contracts' expected_output (always present after test-strategy), a source-derived reference oracle, or real captured legacy I/O — tags every entry with its provenance + confidence, and emits a provenance report that explains, in plain English, why a verdict built on it should or should not be trusted. The gate then WARNS graded by that confidence ("the data could be incorrect, and here is why") rather than hard-blocking on a golden that may itself be wrong. Only a FAIL against CAPTURED legacy blocks. Use when: "capture corpus", "build a golden corpus", "GATE_3C is NOT_APPLICABLE / vacuous", "I don't have legacy I/O", "differential equivalence has no golden", "assemble parity golden".

The EXECUTED output-parity gate (GATE_3C_DIFFERENTIAL, ISS-7). Runs a golden corpus of legacy inputs+outputs against the BUILT target's actual outputs for the same inputs, and asserts field-by-field parity within each contract's declared parity_rules — precision-aware, so COMP-3 decimal loss (silent and catastrophic) is caught. Unlike GATE_3_BUILD (proves rules are PRESENT in the target graph) and GATE_3B_SEMANTIC (a human READS the rules as equivalent), this RUNS the target and diffs outputs. Automated + vacuous-safe: with no golden corpus it is NOT_APPLICABLE and never blocks; with a corpus, any parity violation FAILs and kicks back to build. Use when: "differential equivalence", "output parity", "does the target produce the same numbers as legacy", "prove COMP-3 parity", "golden file comparison", running GATE_3C.

One command to kick off a full modernization conversion. Formulates acceptance criteria, presents for user review, then drives the pipeline to completion via /goal — dispatching subagents for all work while monitoring and reporting. Use when: "convert this codebase", "modernize this app", "run the full conversion", "kick off the migration".

Synthesize the target application's human-facing documentation (README, ARCHITECTURE, DEPENDENCIES, ENVIRONMENTS) from the committed pipeline artifacts — config.json, blueprint.json, requirements_graph.json, target_graph.json — NOT by coining prose with an LLM. Writes the docs INSIDE the target app directory so the delivered repo is self-describing, and registers each as a manifest artifact. Runs in the DOCUMENT phase, after GATE_4_UAT. Use when: "document the target app", "generate the README", "write the architecture doc", "produce app docs", "document the modernized service", "DOCUMENT phase".

Master orchestrator for the anti-legacy pipeline. Sequences all 16 phases (plus an optional semantic-join phase for multi-repo surveys), enforces all eight gates (GATE_0_DISCOVERY, GATE_1_DESIGN, GATE_1B_SEMANTIC_JOIN, GATE_2_PLAN, GATE_3_BUILD, GATE_3B_SEMANTIC, GATE_4_UAT, GATE_5_COMPLETENESS), and resumes from wherever it left off. Start here — this skill dispatches everything else.

Render a detailed, stakeholder-facing Product Requirements Document from the requirements graph (the resolved-or-flagged spine) plus the coverage report — domains, per-requirement business rules / validations / error paths, entity tables, the explicit dropped-scope list, a coverage-&-gaps section, and a req_id → legacy_components → rule-id traceability appendix. Deterministically derived (no LLM prose), registered as a manifest artifact, never advances the phase. Use when: "generate the PRD", "product requirements document", "detailed requirements deliverable".

Compile everything into a single offline Markdown review packet for the team. Includes architecture diagrams, domain breakdowns, entity tables, requirement details, test strategy summary, and the GATE_1_DESIGN sign-off checklist. Designed for teams with only git and fileshares — no external tools required to read it. Use when: "compile the review packet", "create the team review document", "prepare for gate 1", "package the design for review".

Generate stakeholder-facing FUNCTIONAL test scripts across four types — data-parity (legacy vs modern), UAT (Given/When/Then Gherkin), end-to-end business journeys, and API/contract — from the requirements graph + blueprint + test contracts, written under .anti-legacy/deliverables/tests/. Functional, NOT unit. Complements (does not replace) the gated build-binding tests from anti-legacy:functional-tests. Use when: "generate functional test scripts", "write the acceptance tests", "parity/UAT/E2E/API tests", "produce the test scripts deliverable".

Independent UAT reviewer. READ-ONLY validation that generated target code implements the business rules + test-contract scenarios; returns a structured PASS/FAIL verdict in isolation from the developer. Use when: dispatched by anti-legacy:uat-crew to validate a domain's requirements against contracts.

RETIRED. Modern-language indexing is now handled by wicked-estate, which the code-graph engine indexes natively across 91 languages (Java, C#, Go, TypeScript, Kotlin, Scala, Python, PHP, Ruby, C/C++, Rust, and more) — the same `wicked-estate index` pass that captures the mainframe estate (COBOL/JCL/CICS/IMS/DB2). There is no longer a separate modern survey track and no `legacy_graph.json` to merge into. Do NOT invoke this skill: run `anti-legacy:survey` instead — it indexes every `source_apps` entry (mainframe or modern) into a wicked-estate DB and registers the deterministic `legacy-graph` digest as evidence. This stub exists only so stale references resolve to a clear redirect during the WF1 migration; it performs no work.

Own the project's domain VOCABULARY — the shared, evidence-grounded glossary of entity nouns, action verbs, and abbreviations that rule statements are written in. A config-driven bootstrap MINES the live vocabulary from the wicked-estate code graph (db2_table/cics_program/step entities, paragraph/program verbs, field-token abbreviations); the extraction agent then PROPOSES new terms and PROMOTES meanings against code-logic ground truth. Two orthogonal axes per term: `status` (proposed -> confirmed = is the TERM real) and `verification` (unverified -> untrusted_verified -> trusted_verified = is the MEANING proven). Writes .anti-legacy/vocabulary.json, validated by schemas/vocabulary.schema.json. Use when: "bootstrap the vocabulary", "mine the glossary", "what does this abbreviation mean", "propose a term", "promote this term", "confirm a definition", "add an alias", "is this term trusted", "verify the vocabulary".