Milestones
List view
Analyze many DOOM ports from many different languages for system validation.
No due date•33/45 issues closedFrontier: gaps found while working the burned estates that no burned-estate program needs yet (eras 0-1, spec commands no estate uses, regions beyond Open World's epics, non-burned repos). Recorded so the next estate starts mapped; built only when promoted to a milestone. Growth here is learning, not debt.
No due date•0/48 issues closedAfter Training Montage: the estate types our starter estates (CICS/Db2/VSAM online COBOL) never exercised. Regions: batch utilities (#4890), JCL execution (#4891), IBM MQ (#4892), IMS (#4893), VSAM beyond KSDS (#4894). Each region gets a level estate-crucible built before support lands, so its first run is an honest first-time number. Research basis: 2026-10-11 gap research.
No due date•0/8 issues closedGitgalaxy strives to successfully translate CICS estates to Java—byte for byte, in one shot, on repositories it has never seen before. Successes and deviations from that goal are recorded publicly. Because high-quality CICS targets on public GitHub are incredibly rare, we can't afford to overfit; we have to strictly reserve the remaining repositories as blind validation data. I’ve burned through 3 of them already (GenApp, CBSA, and CardDemo) to build our baseline, which means we must plan, train, and put ourselves through nightmare crucibles before we touch the 4th. Because we can't afford to waste our remaining validation targets on avoidable failures, this milestone is our training montage: a rigorous sweep to eliminate every known blind spot before we open the next repo. Every issue here is one concrete, reproducible engine defect found while preparing for a fresh estate. Sources: the crucible count audit, the engine-vs-translator cross-check, the answer keys (now scoring paragraph extents and edges, #4318), and the estate-crucible's planted horrors (#4317). Each fix is recorded with evidence: a reproducer, before/after on the corpus, the estate-crucible horror flipping from FAIL to PASS, golden-master and ground-truth ledger diffs, and translator byte-agreement for layouts. That is the running record of first-try readiness: when this milestone is clear and the estate-crucible scorecard has no failing horrors, a new estate should scan correctly on the first try, and whatever the result will be etched into our git history.
No due date•254/265 issues closedCan you trust the scanner's output? Path-independent results, golden-master coverage of every output, signals that actually fire on the crucible, archetype drift.
No due date•18/22 issues closedThe engine's architecture roadmap: every system relation as a named fact channel (#3249), a channel registry so new channels don't edit shared seams (#3383), and what the facts unlock -- true dead-code detection (#3266) and nativeness scoring of generated code (#3123). The COBOL-to-Java generator is built on this tree.
No due date•20/22 issues closedDo GitGalaxy's signals predict real defects and incidents, or are they just numbers? Validation against independently identified events over Git history (epic #2982), outcome-label pilots, calibration contracts that admit a signal only on demonstrated defect-lift beyond size, and cleaning out dead or pinned metrics.
No due date•62/67 issues closedBroadening the GlassWorm-style supply-chain worm detector (epic #1171): what a worm is after (credential files), how it spreads and survives (self-propagation, persistence), how it exfiltrates (secret dumps), across more languages and harder to dodge.
No due date•3/8 issues closedCan the porting loop prove code it has never seen, on the first try? Fresh public estates through the trial protocol (first-try numbers frozen before any porting), test inputs generated from record layouts, and the attempts-to-proof histogram. Epics #3755 and #3803.
No due date•16/19 issues closedOther tools let a model rewrite COBOL and claim it works. Here every port comes with its evidence: a byte-for-byte replay against the original, coverage, a mutation score that measures how much the proof really checks, and a person's sign-off. The Java is only half the product; the proof is the other half. Epic #4055.
No due date•45/47 issues closedTraditional AST parsers require mathematically perfect grammar and syntax. We don't even require source code. We extract structure and language keywords from strings of text, doesn't matter if the pattern is in English or binary. It remains to be assessed how much extraction we can get though, we envision some information loss.
No due date•0/3 issues closedGitGalaxy reads IBM z/OS COBOL, JCL and CICS. Real estates are older and wider than that. This milestone teaches the engine the rest of the back catalogue: - **Other vendors' COBOL:** Fujitsu NetCOBOL, Unisys (OS 2200 / MCP, DMSII), HPE NonStop (Tandem SCOBOL, Enscribe) - **Other ecosystems:** IBM i (RPG, CL, DDS), Software AG (Natural, Adabas) - **Pre-relational databases:** CA IDMS, Datacom - **Report writers and 4GLs:** Easytrieve, FOCUS, Mark IV / Vision:Builder - **Fixed-format and utilities:** Fortran 77, DFSORT / SyncSort control-card lineage Column positions still matter here, and that's where a positional reader beats a grammar. **Belongs here if:** the engine doesn't read a legacy language, dialect or data store, or reads it wrong. If the code *is* read and the Java port breaks, that's **Nightmare Mode**. If the proof is weak, that's **Run Verified**. If there's no source at all, that's **Achievement Unlocked: Source Code Optional**.
No due date•0/10 issues closedDefects in GitGalaxy's function call graph found by comparing it against a compiler or type-checker reference: pyan3 for Python, the TypeScript compiler's type checker (tests/tools/ts_callgraph.js) for TypeScript, and future references for other languages. The comparison runs as the Level 2 call-resolution gate (tests/tools/call_graph_resolution.py, graph-accuracy-audit.yml). Every issue it surfaces goes here: a wrong confident link, a link into a bodyless signature, a call the engine never extracts, a reference-tool gap. Also here are the PRs that add a language's reference or fix what it finds. Numbers quoted in these issues are against a reference, not ground truth. Check disagreements against source before claiming them (CLAUDE.md, "Comparative-correctness claims").
No due date•75/88 issues closedImproving speed and efficiency is a constant goal. We've redesigned dependencies to be faster, we've built ReDos detection pipelines, and we've built timing sensors into every sub-phase of the engine to explore any abnormality that might pop up. While this initiative started to ensure that this scan could be in the CI pipeline, we found the aggregate data to be a gold mine. We've documented the phases enough now, that speed helps us find any miswiring early. Our engine's speed follows a linear log-log relationship between repo LOC (of any language) versus scan time. We can scan any repo, sort by scanning time for every metric and systematically address the outliers. This allows us to detect issues on brand new never scanned repos (..these files scanned 10x slower, likely contains redos errors which correlate with extraction errors) so now speed, and the deviation from it, is also a metric to flag new to the system issues. Overall, we've used this system to create hypotheses around speed, test them out at scale and determine how helpful they would be or not, we've deferred some ideas that warranted an assessment and left them up for others to check. Who knows, maybe they will become more of a bottleneck as capabilities grow.
No due date•39/47 issues closedWorthwhile work off the main questlines -- self-contained, most of it a good way into the codebase: - **5-Tier Knowledge Graph Hierarchy (epic #108):** `SignalProcessor` flattens Function -> Class -> File -> Folder -> Repo into a File-level score, skipping the Class level. #109 the risk-aggregation math, #110 class-level risk vectors in the SQLite/output recorders, #111 the docs. - **ML-Ops positive controls (#96):** a defanged malware sample library in CI, so a structural-signature change can never silently drift the threat classifier. - **Scanning / UX:** a full scan mode ignoring the default vendor/generated exclusions (#136), a Sankey diagram of what was scanned (#137), a warning for uncommitted files outside git-based scanning (#138). - **Small fixes and cleanup:** Ruff trailing whitespace (#499), an orphaned README trigger scanner (#513), PowerShell functions missed after the aperture change (#3303), a tiktoken import failure that takes the engine down (#3791), raising the minimum Python to 3.11 (#3322), the README's strategy narrative (#3255).
No due date•48/60 issues closedEvolving GitGalaxy from a structural static analysis tool into a compliance-ready, air-gap-native DevSecOps platform for highly regulated sectors (Aerospace, Defense, FinTech, MedTech) -- tracked under epic #75. Traditional AST-based analysis can't run against decades-old, uncompilable defense/aerospace codebases. This milestone extracts Structural Signatures for legacy and modern safety-critical languages (no working toolchain required) and layers a domain-specific risk ontology on top: - **Phase 1 -- Defense Primitives (language dictionaries):** JOVIAL/CMS-2 (#77), VHDL (#78), Lustre/SCADE (#81), HAL/S (#82), CORAL 66 (#1141), PL/I (#1142), ATLAS (#1143). Ada/SPARK (#76) and AGC Assembly already shipped. - **Phase 2 -- Domain-Specific Ontology Auto-Binning Engine (#84):** classify a file's architectural role (flight software, ground control, avionics bus, ...) instead of treating every repository as generic source code. - **Phase 3 -- MISRA C/C++ Structural Signatures & Liability Floor (#80):** a hard compliance gate for the automotive/aerospace C/C++ safety-critical coding standard. SARIF export, SBOM generation, and CI/CD delta-gating (Phases 4-5) already shipped under v2.4.0 -- see #75's own status note for the current remaining scope. **Note:** #1142's PL/I signatures overlap with #2502 (Legacy Modernization, CICS-driven) -- see #2516 for the open consolidation question before either ships.
No due date•3/12 issues closed