decommission-gatelisted

The governed turn-off primitive — no legacy component is severed until its replacement has PROVEN independence and the old side is provably safe, recorded in an append-only operator-bound validation ledger the gate RE-DERIVES from live re-checks at turn-off time (fail-closed, waiver-blind). Drives scripts/foundry-decommission.py: validate-register (class-aware register, GENERATED gate_status), record (append-only ledger; refuses incomplete VALIDATED rows incl. the custody real-operation proof), gate-check (GO only on latest-VALIDATED + live reverify/old-safe re-checks under a forced waiver-blind phase; else NO-GO exit 1). Turn-off is structurally the LAST wave. Trigger: "decommission", "turn off the legacy", "is it safe to delete", "sever the old side", "/foundry:decommission-gate".
lukasrepublic/agentic-foundry · ★ 1 · AI & Automation · score 67

Install: claude install-skill lukasrepublic/agentic-foundry

# decommission-gate — build-and-validate first, turn-off last, GO re-derived live Turn-off is the one irreversible, highest-blast-radius action of a migration. This skill governs it with three machine-checkable stages driven through `scripts/foundry-decommission.py`. **The gate consumes a recorded design principle: a persisted "validated" flag alone NEVER authorizes a sever — GO is re-derived from live re-checks at the moment of turn-off.** ## The register (one YAML, class-aware, generated status) - **Enumerate every in-scope component** in `decommission-register.yaml`: stable `id`, the `legacy_identity` being turned off, the `replacement` and how it is reached, a `class`, a `parallel_name`, a `custody` flag, a `soak_window`, per-component `checks.reverify` / `checks.old_safe` slot commands (read-only by contract), and a **generated `gate_status`** — derived from the ledger by `validate-register --regen`, NEVER hand-edited (a hand edit that disagrees with the ledger fails validation closed). - **Class semantics decide the old-side safety question** (they are OPPOSITES, not variants): - **endpoint-bearing (inbound)** — safe when ZERO consumers remain over the soak window (flow logs to the old interface / load-balancer request+connection counts == 0). - **headless (outbound worker: signer, poller, listener)** — the hazard is DUAL-OPERATION (double-spend, conflicting signatures, duplicated side effects), so safe means the old instance is QUIESCED: st