Topic · Unknown system

What's the safest way to modernize legacy software that nobody fully understands?

Gist

Do not invent the spec from the unread tree. Proof fails the merge with proof audit --check mirror_complete when a ledger cell on the slice you still run has no counterpart on the slice you keep. A consulting programme is not that cell.

proof audit --check mirror_complete

Keep the strangler. Keep the workshop. They peel routes. They do not ask whether reject_unknown:negative still exists after the peel.

Request demo Guess vs ledger

01 · The circular spec

Reading the code to write the shall is grading your own exam.

Nobody left. The comments lie. An agent will happily emit a spec that agrees with the function.

The empty start lives on replace a component with no specs. The rewrite that already has a ledger lives on characterization testing and mirrors. Two live services and a traffic split live on migrating a critical service. This page is the programme where the system is still running and no one can sign what it was supposed to do.

“Nobody understands it” is not a reason to skip the shall. It is the reason a spec-from-code pass is circular. The model writes a requirement that matches the function, then a test that matches both. The old negative path never becomes a cell, because nobody named it.

// unread tree, still serving
// SYS-REQ-204:reject_unknown:nominal   // guessed from the happy path
// reject_unknown:negative             // never named; still in production
// agent: "spec recovered from source"

// slice you intend to keep
// SYS-REQ-204:reject_unknown:nominal
// dashboards: green

Pick a slice you will keep. Have an owner sign the shalls for that slice, including the negatives they can still demonstrate from production. Declare the old files and the new files as a Mirror at proof/mirrors/MIR-*.yaml. Cells are keyed by (requirement, dimension, discriminant), never by test name. proof audit --check mirror_complete fails when that cell exists on the source and not on the target, once the mirror status is complete.

02 · The exhibit

Same unread tree. A recovered spec, or a missing cell.

The workshop says the behaviour was extracted. The catalog still owes a negative. Click the tabs.

Spec from the code

Looked at the function, then the test it wrote
reject_unknown:negative not in the recovered shall

Workshop is green

The shall

When the payload is unknown, the service shall reject it and leave the store unchanged.

No owner signed this

The guess

Still a story about the unread tree. Still not a cell key.

Consulting kept

Proof

Ask does reject_unknown still have negative
Job audit --check mirror_complete

Merge blocked if the cell vanished

A recovered spec, or the missing cell. Click the tabs.

Move	What it buys	What it loses
Legacy-modernization consulting	A programme, a workshop, a slide that says the system is understood.	Ads demand is real. It is not a cell. Keep the workshop. It is not the bar.
Strangler facade	A front door that peels routes off the unread tree over time.	The facade can stay green while the negative never ports. Not a Proof surface.
Spec recovered from source	A document that agrees with the function you already have.	Circular. The model and the code share a context window. Keep the notes. Do not sign them as shalls.
Empty-start replace	Throw the component away and write shalls from the owner.	That H1 lives on replace with no specs. This page is the tree you cannot throw away yet.
Proof	Each source cell on the signed slice has a target counterpart, or a complete mirror stays red.	Presence, not I/O. Owners still sign. Jama still authors. Two shims are a different check.

The check reads the Mirror object, then the cells on each side. A recovered markdown spec is not an input.

proof mirror list
proof audit --check mirror_complete --verbose

// SYS-REQ-204:reject_unknown:nominal
// SYS-REQ-204:reject_unknown:negative

proof audit --check differential_conformance

mirror_complete proves the evidence cell exists on the target. It does not re-run the test. A mirrored test that fails is tests_pass, not a parity gap. in_progress gaps stay warnings. A complete mirror that later grows a source-only cell re-opens at error.

differential_conformance is the I/O check: one language-neutral input, two shims, compare envelopes. A transform with fewer than two complete shims is skipped as information. The differential dimension on the Mirror object itself is deferred. Never describe a completed mirror as “we now understand the legacy system.” We have not run this gate against a frozen corpus of unread trees next to a consulting programme. The loss is named, not scored.

03 · The honest loss

Proof does not recover intent from unread code.

If nobody declared a Mirror, mirror_complete is a no-op. An owner still has to sign the slice.

Proof does not interview the last person who touched the module. Proof does not peel routes off a facade. A strangler is not this product. Proof does not sell a fleet rewrite. mirror_complete does not prove the two binaries agree on an input. That is differential_conformance on a declared transform, with two complete shims. A Python-only or Rust-only shim is skipped as information.

Proof does not invent the shall. Jama still wins at programme authoring. 100% MC/DC on the written decision still misses a partition that was never a condition. A completed mirror is not a modernized estate.

The empty-start H1 lives on replace a component with no specs. The rewrite H1 lives on characterization testing and mirrors. The cutover H1 lives on migrating a critical service. Do not mint a twin of any of those.

Request demo How the install is bought

04 · Nearby questions

What people type next.

How do I safely replace a legacy component that has no specs and no tests? Throw it away and start from signed shalls. Replace with no specs.

How do I rewrite a legacy system without introducing regressions? The campaign on a tree that already has a ledger. Characterization.

We're migrating a critical service. How do I prove the new one matches the old one? Two live services, a traffic split. Service cutover.

How do I prove a database or API migration didn't change behavior? Flyway and Pact still version files. Database or API.

Is there a way to check behavioral equivalence between old and new implementations? Presence is mirror_complete. Agreement on an input is differential_conformance. FAQ on the cutover page.