Modernisation proposal for review; durations are indicative.

execution-contract.md

Status and authority boundary

This execution contract is an unapproved planning proposal. It does not commit funding, staffing, schedule, architecture, outage, production access, deployment, migration, cutover or retirement. It grants no authority to provision services, change authoritative data, merge changes, activate releases or operate production systems.

Work may begin only from a human-accepted task packet for a named delivery slice. Each packet must identify the accessible non-production environment, allowlisted scope, compatibility constraints, expected artifacts, required reviewers, stop conditions and dependencies. Supplied material, compilation, test success, configuration presence and processing coverage are evidence inputs, not proof of production behaviour or semantic completeness.

Agents are task personas rather than accountable owners. They may inspect explicitly accessible material, prepare comparisons, generate test candidates and report discrepancies. Accountable people retain responsibility for interpretation, business and policy decisions, security-risk acceptance, architecture selection, operational actions and release decisions.

Common execution rules

Evidence classification and preservation

Every finding must remain classified as observed implementation or runtime behaviour, confirmed requirement, accepted compatibility constraint, test expectation, qualified finding, contradiction, unsupported claim, investigation item or unapproved implementation candidate.

The compatibility custodian must maintain human-readable decisions to preserve, change, resolve or defer observed interfaces, request and response shapes, status meanings, validation and resource text, nullability, ordering, persistence timing, audit effects, event timing, document and report presentation, and failure behaviour. An accountable application or product reviewer must accept interpretations.

Missing, inaccessible, malformed or contradictory evidence must remain unresolved. Agents must not infer rules for lifecycle transitions, authorization, dates, calendars, quantities, finance, guarantees, identifiers, reference data, migration or recovery.

Review model

Each task requires a delivery participant and an independent reviewer who is not the sole author of the evidence or implementation. Routine agent evidence should receive peer review where practical and then accountable human interpretation. The independent assurance reviewer must sample underlying observations, exclusions and failed cases rather than relying only on summaries.

Security-sensitive work requires independent security review. Finance, guarantee, calculation and reference-data work requires accountable business or data review. Migration, restoration, cutover and recovery evidence requires independent operational and data assurance.

The human delivery coordinator maintains dependencies, blockers and review arrangements. The agent work coordinator divides accepted packets into bounded assignments and assembles their outputs without resolving contradictions. Neither role gains decision authority through coordination.

Progress and evidence states

Progress must be reported as not started, evidence collection in progress, blocked, awaiting human decision, candidate ready for review, accepted for the slice, or rejected for rework. “Accepted for the slice” means only that the named slice’s evidence gate has been met; it does not establish production readiness.

Progress reports must separately record agent runtime, human effort, waiting time and elapsed working time. They must identify inaccessible evidence, failed observations, unresolved contradictions, compatibility effects and blocked downstream slices. Percentage-complete claims are unsuitable where the inventory or semantic boundary is unknown.

Checkpoints, retries and stop conditions

A checkpoint is valid only when its inputs, environment, configuration and observed outcomes are reproducible and reviewed. Checkpoints must occur before any proposed mutation, after characterization, after each independently comparable implementation increment, and before release-gate review.

Retries are permitted only for repeatable evidence collection or tests with unchanged approved inputs. Each retry must retain the prior result, reason, attempt count and outcome. A retry must not conceal nondeterminism, alter data to force success or reinterpret a failed dependency as success. Mutation, event, message, file and migration retries require an approved idempotency, replay and reconciliation contract before implementation.

Agents must stop and escalate on possible production access, credentials outside the approved mechanism, out-of-bound sensitive data, destructive operations, unapproved schema or interface changes, uncontrolled external effects, unexplained reconciliation differences, contradictory acceptance rules, or a non-viable recovery path.

Release gates

No slice may pass its release gate solely because code compiles, automated tests pass or artifacts were processed. Release review requires accepted characterization, traceable compatibility decisions, successful and failed-path evidence, independent review, documented unresolved exclusions and a viable rollback or forward-recovery proposal.

Any activation remains controlled and inactive until separately authorized by accountable people. Unknown callers, scheduled work, production-only behaviour or unresolved authorization and data meanings block affected activation.

Slice contract: Recover and Characterize the Executable Baseline

The allowlist covers inventory of accessible artifacts; repeatable non-production build and deployment preparation; runtime, configuration, schema and dependency observations; one human-selected representative journey; successful, denied, malformed and dependency-failure characterization; and observation of a human-authorized non-production restore demonstration. Production changes and generalization from the representative journey are excluded.

Required artifacts are the authoritative discovered-component and consumer inventory, reproducible baseline description, environment and dependency gap register, compatibility catalogue, representative journey trace, failure-observation record, schema and migration-state account, and restore evidence report.

Bind the artefact inventory agent, baseline reproduction agent, journey trace agent, compatibility characterization agent and restore evidence agent. Required human review comes from application, platform, database, security and operations representatives, with independent assurance sampling repeated deployment, denied paths, dependency failures and restore evidence.

Checkpoints occur after inventory reconciliation, first reproducible deployment, repeated deployment, journey trace and restore observation. Environmental failures may be retried only after the changed prerequisite is recorded. The gate requires repeated non-production deployment, controlled configuration and schema state, reviewed runtime dependencies, deployment recovery and restore evidence. Unknown callers and inaccessible dependencies remain blockers for affected later slices.

The planning range remains 15, 30 or 60 elapsed working days. These are scenarios, not commitments.

Slice contract: Establish Measures and Approval Evidence

The allowlist covers drafting candidate measures, identifying sources and exclusions, preparing approved evidence collection, separating effort and waiting categories, and applying accepted definitions to low, central and high scenarios. It excludes invented baselines, targets, owners and production telemetry changes without authorization.

Required artifacts are the measurement catalogue, repeatable calculation definitions, source and sampling register, scenario assumptions, missing-evidence register and revised planning ranges based on the first accepted slice.

Bind the measurement definition agent, evidence collection agent and scenario analyst agent. Product, security, data, architecture, platform, operations and incident representatives must approve adopted definitions and ownership. Independent review must verify repeatability and inclusion of adverse and missing observations.

Each adopted indicator requires an approved owner, source, baseline, target, sampling period and calculation method. Unknown values remain unestablished. Checkpoints occur at definition review, source validation, first measured sample and re-estimation. Collection retries must preserve missing or failed samples. The release gate requires measured rather than inferred evidence and explicit separation of agent runtime, human effort, waiting time and elapsed time.

The planning range remains 8, 18 or 35 elapsed working days after baseline acceptance.

Slice contract: Resolve Identity, Relationships and Authorization

The allowlist covers tracing authentication and authorization, drafting the action-resource-identity-relationship-state matrix, bounded non-production tampering and denial tests, and narrowly approved policy candidates behind inactive controlled activation. Provider selection, exceptional access, relationship cardinality and risk acceptance are excluded until decided.

Required artifacts are the identity-flow map, authorization matrix, authoritative relationship-source map, tampering and denial suite, outage and credential-expiry observations, secret-handling assessment and compatibility-impact record.

Bind the identity flow tracer, authorization matrix agent, tampering test agent and, only after contract approval, policy implementation agent. Security, product, application and identity-administration representatives must review, with independent security assurance.

Checkpoints occur after flow tracing, matrix review, current deny-path characterization and candidate-policy comparison. Failed identity-provider calls may be retried only under an approved outage policy. The gate requires tested deny paths, server-side relationship reloads, malformed-claim and inactive-user handling, and reviewed outage and key-rotation behaviour. Microsoft Entra ID, managed identities and Key Vault remain conditional candidates.

The planning range remains 20, 40 or 80 elapsed working days.

Slice contract: Formalize Lifecycles and Identifiers

The allowlist covers extraction of observed transitions and effects, contradiction analysis, identifier characterization, and concurrency and interruption tests. No state machine, uniqueness control or replacement mutation may be activated before the relevant decisions are accepted.

Required artifacts are separate lifecycle contracts for notifications, assessments, movements, shipments, receipts and outcomes; transition and editability matrices; contradiction decisions or deferrals; identifier format, normalization, lookup, scope and allocation contracts; and record-level persistence, audit, event and response comparisons.

Bind the lifecycle evidence agent, contradiction analyst, identifier behaviour agent and concurrency test agent. Product, policy, movement, finance, reporting and data representatives decide meanings. Independent review must reconcile downstream effects.

Checkpoints occur at observed-state capture, contradiction review, approved contract, concurrency characterization and implementation comparison. Duplicate or stale commands must not be retried as fresh commands without an approved idempotency rule. The gate requires accepted contracts and evidence for simultaneous allocation, failed saves, bulk interruption and event failure.

The planning range remains 20, 45 or 90 elapsed working days.

Slice contract: Resolve Calculations and Reference Meanings

The allowlist covers approved non-production profiling, boundary tests, record-level comparisons and preservation checks for dates, units, quantities, finance, guarantees, routes, facilities and classifications. Silent normalization, conversion, deduplication, reclassification and new guarantee uniqueness constraints are excluded.

Required artifacts are profiling results, approved workflow-specific contracts, boundary suites, record-level discrepancy classifications, historical-reference preservation rules and decisions distinguishing warnings from blocking validation.

Bind the data profiling agent, boundary test agent, record comparison agent and reference-meaning preservation agent. Policy, business, finance, data, guarantee and security representatives must review; legal or policy conflicts remain with accountable human owners.

Checkpoints occur after profiling, contradiction review, contract approval and record comparison. Calculation retries must use unchanged source records and retain every discrepancy. The gate requires explicit decisions on precision, precedence, cardinality and separation of duty, plus concurrent financial and guarantee evidence.

The planning range remains 30, 65 or 130 elapsed working days.

Slice contract: Introduce Modular and Durable Mutation Boundaries

The allowlist covers coupling discovery, one approved bounded compatibility interface, transaction and concurrency seams, durability prototypes and reversible-release preparation. It excludes service-per-domain assumptions and unapproved changes from synchronous to asynchronous completion.

Required artifacts are the boundary and authoritative-writer definition, coupling map, compatibility comparison, transaction and audit contract, replay and dead-letter model, reconciliation procedure, controlled-activation design and rollback or forward-recovery evidence.

Bind the coupling discovery agent, compatibility seam agent, transaction and concurrency agent, delivery durability agent and reversible release agent. Architecture, application, security, operations and affected business owners must review.

Checkpoints occur after coupling characterization, boundary approval, inactive implementation, failure testing and recovery rehearsal. Message retries require approved idempotency, ordering, poison-message and replay authority. The gate requires evidence for failed saves, termination after commit, duplicates, out-of-order delivery, timeouts and audit distinctions. Azure App Service is preferred only if baseline evidence supports it; Container Apps, bounded Functions, Service Bus and an outbox remain conditional.

The planning range remains 25, 55 or 110 elapsed working days.

Slice contract: Secure Files and Preserve Generated Documents

The allowlist covers file-flow characterization, bounded security testing, document comparison, orphan detection and approved inactive storage or quarantine candidates. Retention, legal hold, scanner policy and visible document changes require human decisions.

Required artifacts are the file-flow and ownership map, scanner-outcome contract, authorization and file-security suite, document fixtures and comparisons, orphan reconciliation report, cleanup and restoration evidence, and retention decision register.

Bind the file-flow characterization agent, file security test agent, document comparison agent and orphan reconciliation agent. Security, data, records, operations and document consumers must review.

Checkpoints occur after current-flow characterization, scanner-policy decision, protected-path testing and restoration demonstration. Unknown, error, timeout or unavailable scanning must never be retried or reclassified as clean by assumption. The gate requires authorization, quarantine, interrupted-transfer recovery, cleanup and retained-source restoration evidence. Private Azure Blob Storage remains a candidate.

The planning range remains 18, 40 or 85 elapsed working days.

Slice contract: Establish Reporting and Operational Readiness

The allowlist covers representative report fixtures, record-, field- and presentation-level comparison, approved telemetry correlation and runbook exercises. It excludes inferred service levels and output changes accepted only from equal row counts.

Required artifacts are report fixtures, lineage and authorization records, compatibility comparisons, freshness and divergence observations, telemetry design, sensitive-logging review, alert ownership and exercised runbooks.

Bind the report fixture agent, report comparison agent, telemetry correlation agent and runbook exercise agent. Report consumers, product, data, operations and security representatives must review.

Checkpoints occur after fixture approval, comparison, observation period and runbook exercise. Refresh retries must preserve divergence evidence. The gate requires small, empty and large comparisons, sensitive-export checks, alert ownership and backup-restoration evidence. Availability, performance, support hours, retention, freshness, recovery-time and recovery-point objectives remain decisions. Azure Monitor, Application Insights and Log Analytics remain candidates.

The planning range remains 18, 40 or 80 elapsed working days.

Slice contract: Rehearse Deterministic Migration, Cutover and Recovery

The allowlist covers approved profiling, deterministic transformations, rejected-record retention, reconciliation, interruption and recovery tests, and controlled-routing rehearsals. Production activation, downtime, retirement and historical deletion are excluded.

Required artifacts are preflight diagnostics, approved mappings and survivor rules, checkpoint and rerun design, rejected-record register, source-to-target reconciliation, restore and restart evidence, caller and scheduled-work coverage, activation and recovery trigger proposals, and retained-history access evidence.

Bind the migration profiler, deterministic transformation agent, reconciliation agent, interruption and recovery agent and controlled-routing agent. Data, business, security, operations and change authorities must review, with independent migration assurance.

Checkpoints occur before transformation, after each materially different migration pattern, after interruption and restart, after reconciliation and after full cutover rehearsal. Retries must restart only from approved checkpoints and must retain prior outputs and discrepancies. Unclassified differences require a halt.

The gate requires owned discrepancies, record-level and referential reconciliation, lifecycle continuity, financial, quantity, file and report comparisons, restore evidence, dependency-failure handling and measurable activation and recovery triggers. Azure SQL Database remains a leading candidate only after compatibility evidence; Azure SQL Managed Instance remains a conditional coexistence option.

The planning range remains 30, 70 or 150 elapsed working days.

Critical path and re-estimation

The baseline slice is the entry point. Measures and authorization may follow its acceptance. Lifecycle work additionally depends on authorization; calculations depend on lifecycle decisions; modular mutation boundaries depend on baseline, authorization and lifecycle acceptance. File work depends on those mutation boundaries and authorization. Reporting depends on the baseline and mutation boundaries. Migration rehearsal depends on accepted calculation meanings, file preservation and reporting readiness.

Access, reviewer availability, identity-provider evidence, authoritative calendars, finance and policy decisions, supplier participation, production-like data, protected files, shared integration environments, business calendars, change freezes and full-rehearsal scheduling may control elapsed time. No capacity is assumed.

After the first accepted slice, all ranges and persona needs must be recalibrated using observed agent runtime, human effort, waiting time, environment contention and elapsed time. Contingency must remain attached to unresolved evidence and scarce review rather than hidden inside a single commitment.

Final approval boundary

Completion of these slice contracts would provide planning and review evidence only. Production activation, migration, cutover, rollback, forward recovery, legacy retirement and deletion require separate accountable authorization after all affected callers, scheduled work, compatibility constraints, operational ownership, reconciliation results, retention rules and recovery evidence have been accepted.