@oriro/orirocli 0.1.0

package/skills/craft/master-architect/references/legacy.md

@@ -0,0 +1,240 @@
+# Legacy System Analysis & Modernization Reference
+
+## LEGACY RISK SCORING FRAMEWORK
+
+Score each dimension 1–5. Total determines strategy.
+
+| Dimension              | 1 (Low Risk)    | 3 (Medium)       | 5 (Critical)           |
+| ---------------------- | --------------- | ---------------- | ---------------------- |
+| Codebase Age           | <2 years        | 5-10 years       | >15 years              |
+| Test Coverage          | >80%            | 20-50%           | 0%                     |
+| Dependency Health      | All current     | Some outdated    | EOL/abandoned          |
+| Documentation          | Excellent       | Partial/stale    | None                   |
+| Bus Factor             | Full team knows | 2-3 people       | 1 person (or gone)     |
+| Runtime Risk           | Containerized   | VM, maintained   | Bare metal, no backups |
+| Language Support       | Active LTS      | Maintenance mode | EOL                    |
+| Business Logic Clarity | Well documented | Partially known  | Black box              |
+
+**Score 8-14:** Targeted refactor (clean up, update deps, add tests)
+**Score 15-22:** Phased modernization (strangler fig, module by module)
+**Score 23-30:** Recommend full rewrite (with risk assessment and stakeholder buy-in)
+**Score >30:** Emergency — assess business continuity risk immediately
+
+---
+
+## MODERNIZATION PATTERNS
+
+### 1. Strangler Fig (Most Recommended)
+
+Best for: Large, complex legacy systems still in active use.
+
+```
+[Legacy System]
+      ↑
+[Facade / API Gateway]  ← New traffic routed here
+      ↓
+[New Service]  ← New features built here
+
+Steps:
+1. Put proxy/facade in front of legacy system
+2. Build new module in modern stack
+3. Route ONE feature's traffic to new module
+4. Test, validate, monitor
+5. Repeat for next feature
+6. When all traffic migrated → decommission legacy
+```
+
+### 2. Branch by Abstraction
+
+Best for: Internal refactoring without external API changes.
+
+```
+1. Create abstraction layer (interface/protocol) over legacy component
+2. Create new implementation behind abstraction
+3. Add feature flag to switch between old/new
+4. Test new implementation under flag
+5. Flip flag for 100% → remove old implementation
+```
+
+### 3. Database-First Migration
+
+Best for: Data model is the real asset, application is thin.
+
+```
+1. Map legacy data model completely (even undocumented fields)
+2. Design new data model
+3. Build ETL pipeline: legacy DB → new DB (with validation)
+4. Run in parallel (dual-write) for 30 days
+5. Validate parity
+6. Cut over application to new DB
+7. Keep ETL running for 30-day rollback window
+```
+
+### 4. Big Bang Rewrite
+
+Best for: Risk score ≥ 23 AND team can absorb downtime AND business agrees.
+
+**WARNING:** Big bang rewrites fail 60-70% of the time. Use ONLY when:
+
+- System is truly unmaintainable
+- Business can fund 6-18 months of parallel development
+- All stakeholders understand the risk
+
+```
+Mitigation:
+1. Comprehensive test suite on legacy BEFORE rewriting (golden master tests)
+2. Feature parity list signed off by business stakeholders
+3. Staged rollout with rollback plan at each stage
+4. Never discard legacy until new system has 30+ days of production load
+```
+
+---
+
+## LANGUAGE-SPECIFIC LEGACY PATTERNS
+
+### COBOL Modernization
+
+```
+Approach: Never fully rewrite first pass.
+
+Phase 1 (Month 1-3):
+  - Map all COPYBOOKS (shared data structures)
+  - Document all CALL trees (entry points and dependencies)
+  - Identify all batch jobs, JCL scripts, VSAM files
+  - Wrap critical programs in REST API facade (use IBM CICS/MF REST bridge)
+
+Phase 2 (Month 3-9):
+  - Extract business rules to documented specs
+  - Rebuild rules in modern language (Java/Python)
+  - Run COBOL and new system in parallel, compare outputs
+
+Phase 3 (Month 9+):
+  - Cut over transaction by transaction
+  - VSAM → PostgreSQL data migration
+  - Decommission COBOL programs as new code validated
+
+Tools: Micro Focus Enterprise Developer, IBM Rational Developer, OpenCOBOL
+```
+
+### PHP Legacy (PHP 5.x / WordPress / Custom CMS)
+
+```
+Most common issues:
+  - mysql_* functions (deprecated, removed PHP 7) → PDO
+  - No namespaces → add PSR-4 autoloading
+  - Global state everywhere → dependency injection
+  - SQL injection via string concatenation → parameterized queries
+  - md5/sha1 passwords → bcrypt/argon2
+
+Modernization path:
+  PHP 5 → PHP 7.4 → PHP 8.2 (step by step, run PHPStan at each step)
+  Add Composer if missing
+  Add PHPUnit tests for each module before refactoring
+```
+
+### jQuery / Vanilla JS Legacy (Pre-framework)
+
+```
+Issues:
+  - Global namespace pollution
+  - DOM manipulation spaghetti
+  - No module system
+  - $.ajax everywhere
+
+Migration path:
+  1. Add Vite build tool (zero config bundler)
+  2. Convert to ES modules (import/export)
+  3. Replace jQuery AJAX with fetch() or axios
+  4. Componentize DOM sections into React/Vue (island architecture)
+  5. Full framework migration last (not first)
+```
+
+### Java EE / Spring Legacy (Pre-Spring Boot)
+
+```
+Issues:
+  - XML configuration (applicationContext.xml, web.xml)
+  - EJBs / JEE container dependencies
+  - Java 6/7 idioms (no lambdas, no streams)
+  - WAR deployment to Tomcat/JBoss
+
+Migration path:
+  1. Upgrade Java version (6→8→11→17→21, each increment)
+  2. Convert XML config to @Configuration classes
+  3. Replace EJBs with Spring @Service beans
+  4. Migrate from Spring MVC → Spring Boot (embedded Tomcat)
+  5. Containerize (Dockerfile → Cloud Run / EKS)
+```
+
+### Oracle / PL/SQL Legacy → PostgreSQL
+
+```
+Key differences to handle:
+  - ROWNUM → LIMIT/OFFSET
+  - NVL() → COALESCE()
+  - DECODE() → CASE WHEN
+  - SYSDATE → NOW()
+  - Sequences (Oracle) → SERIAL or GENERATED ALWAYS AS IDENTITY (PG)
+  - PL/SQL stored procedures → PL/pgSQL or move logic to app layer
+  - VARCHAR2 → VARCHAR
+  - NUMBER → NUMERIC or INTEGER
+
+Tools: ora2pg (automated conversion, handles most cases)
+Always review: triggers, stored procedures, packages (manual conversion required)
+```
+
+---
+
+## AUDIT FRAMEWORK FOR INHERITED CODEBASES
+
+When handed an unfamiliar codebase, run this audit in order:
+
+### Hour 1: Orient
+
+```
+1. README → understand what it does (if no README, that's a finding)
+2. Directory structure → identify architectural pattern
+3. package.json / pom.xml / requirements.txt → tech stack + dependency ages
+4. Git log → "git log --oneline -50" → last 50 commits, understand activity level
+5. "git shortlog -sn" → who wrote this code
+```
+
+### Hour 2: Find the Danger Zones
+
+```
+Search for:
+  - Hardcoded credentials (grep -r "password\|secret\|api_key" --include="*.{js,py,java}")
+  - TODO/FIXME comments (often mark known broken areas)
+  - Commented-out code blocks (usually hiding complexity)
+  - Files last modified >2 years ago that are still in hot path
+  - Any file >1000 lines (god classes/functions)
+```
+
+### Hour 3: Run It
+
+```
+1. Get it running locally
+2. Run existing tests (measure coverage)
+3. Look for: build warnings, deprecation notices, failing tests ignored with skip
+4. Check all environment variables needed — missing .env.example is a finding
+```
+
+### Deliverable: Technical Debt Register
+
+```
+| Item | Severity | Effort | Risk if Ignored | Owner | Sprint |
+|------|----------|--------|-----------------|-------|--------|
+| ...  | P0-P3    | S/M/L  | Low/Med/High    | ...   | ...    |
+```
+
+---
+
+## DOCUMENTATION RECOVERY
+
+When there's no documentation, create it in this order:
+
+1. **Architecture Decision Records (ADRs):** Document WHY, not just what
+2. **Data Dictionary:** Every table, every non-obvious column, what it means in business terms
+3. **Runbook:** How to deploy, roll back, restart, debug the top 5 failure modes
+4. **API Reference:** OpenAPI spec auto-generated from code (Swagger, FastAPI auto-docs)
+5. **Onboarding Guide:** How to get a new developer productive in <1 day

package/skills/craft/master-architect/references/mobile.md

@@ -0,0 +1,447 @@
+# Mobile Development Reference
+
+## FRAMEWORK SELECTION
+
+```
+React Native + Expo:  ✓ JS/TS team, fast iteration, large ecosystem, good for B2B/SaaS
+                      ✓ <user>'s current choice (<project> Shield)
+                      ✗ Performance-intensive apps, deep native APIs
+
+Flutter:              ✓ Best cross-platform UI fidelity, fast rendering (Skia/Impeller)
+                      ✓ Single codebase for iOS/Android/Web/Desktop
+                      ✗ Dart learning curve, smaller ecosystem than RN
+
+Swift (iOS native):   ✓ Best iOS performance, all native APIs, latest Apple features
+                      ✗ iOS-only, no code sharing with Android
+
+Kotlin (Android):     ✓ Best Android performance, all native APIs, Jetpack Compose
+                      ✗ Android-only
+
+Decision rule:        Solo founder + existing JS/TS codebase → React Native + Expo
+                      UI-intensive product (games, complex animations) → Flutter
+                      Enterprise iOS-first → SwiftUI
+```
+
+---
+
+## REACT NATIVE + EXPO (Primary Stack)
+
+### Project Setup (Production Grade)
+
+```bash
+# New project with Expo SDK 51+
+npx create-expo-app@latest MyApp --template
+cd MyApp
+
+# Essential packages
+npx expo install expo-router          # File-based routing (like Next.js)
+npx expo install expo-secure-store    # Secure token storage (not AsyncStorage)
+npx expo install expo-notifications   # Push notifications
+npx expo install expo-updates         # OTA updates
+
+# EAS Setup
+npm install -g eas-cli
+eas build:configure                   # Creates eas.json
+eas credentials                       # Sets up signing certs
+```
+
+### eas.json (Production Config)
+
+```json
+{
+  "cli": { "version": ">= 9.0.0" },
+  "build": {
+    "development": {
+      "developmentClient": true,
+      "distribution": "internal"
+    },
+    "preview": {
+      "distribution": "internal",
+      "android": { "buildType": "apk" }
+    },
+    "production": {
+      "autoIncrement": true,
+      "android": { "buildType": "app-bundle" },
+      "ios": { "simulator": false }
+    }
+  },
+  "submit": {
+    "production": {
+      "android": { "serviceAccountKeyPath": "./service-account.json", "track": "production" },
+      "ios": { "appleId": "...", "ascAppId": "..." }
+    }
+  }
+}
+```
+
+### Navigation (Expo Router — App Directory Pattern)
+
+```
+app/
+  _layout.tsx          ← Root layout (providers, global styles)
+  (auth)/
+    _layout.tsx         ← Auth stack
+    login.tsx
+    signup.tsx
+  (tabs)/
+    _layout.tsx         ← Tab navigator
+    index.tsx           ← Home tab
+    dashboard.tsx
+    settings.tsx
+  modal.tsx             ← Modal screen
+```
+
+### Secure Storage (Never Use AsyncStorage for Sensitive Data)
+
+```typescript
+import * as SecureStore from "expo-secure-store";
+
+// Store token — encrypted at rest using device keychain/keystore
+await SecureStore.setItemAsync("auth_token", token, {
+  keychainAccessible: SecureStore.WHEN_UNLOCKED_THIS_DEVICE_ONLY,
+});
+
+// Retrieve
+const token = await SecureStore.getItemAsync("auth_token");
+
+// NEVER: AsyncStorage for tokens — it's plaintext on disk
+```
+
+### State Management (2024 Best Practice)
+
+```typescript
+// Server state: TanStack Query (React Query)
+import { useQuery, useMutation } from "@tanstack/react-query";
+
+function TransactionList() {
+  const { data, isLoading, error } = useQuery({
+    queryKey: ["transactions", userId],
+    queryFn: () => api.getTransactions(userId),
+    staleTime: 30_000, // 30s before refetch
+    retry: 3,
+  });
+}
+
+// Global client state: Zustand (not Redux)
+const useStore = create<AppState>()(
+  persist(
+    (set) => ({
+      user: null,
+      setUser: (user) => set({ user }),
+    }),
+    { storage: createJSONStorage(() => AsyncStorage) },
+  ),
+);
+```
+
+### Performance — Critical Rules
+
+```typescript
+// 1. Memoize everything that crosses a component boundary
+const Component = React.memo(({ data }) => ...)
+const handlePress = useCallback(() => ..., [deps])
+const computed = useMemo(() => expensiveCompute(data), [data])
+
+// 2. FlashList over FlatList for lists >100 items
+import { FlashList } from '@shopify/flash-list'
+<FlashList data={items} renderItem={renderItem} estimatedItemSize={70} />
+
+// 3. Lazy load heavy screens
+const HeavyScreen = React.lazy(() => import('./HeavyScreen'))
+
+// 4. Image optimization — always
+import { Image } from 'expo-image'  // Not React Native's Image
+<Image source={{ uri }} contentFit="cover" transition={200} />
+
+// 5. Hermes engine — always enabled (default in Expo SDK 48+)
+// 6. New Architecture (Fabric + JSI) — enable in app.json for new projects
+```
+
+### Push Notifications (Expo + FCM/APNs)
+
+```typescript
+// Register device token
+const token = await Notifications.getExpoPushTokenAsync({
+  projectId: Constants.expoConfig.extra.eas.projectId,
+});
+await api.saveDeviceToken(userId, token.data);
+
+// Handle notifications while app is open
+Notifications.addNotificationReceivedListener((notification) => {
+  // Update UI, show badge, etc.
+});
+
+// Handle notification tap (background/killed state)
+Notifications.addNotificationResponseReceivedListener((response) => {
+  const screen = response.notification.request.content.data.screen;
+  router.push(screen); // Deep link to relevant screen
+});
+```
+
+### OTA Updates (Critical for SaaS)
+
+```typescript
+// expo-updates — push JS bundle updates without App Store review
+// Fixes bugs, updates content, tweaks UI — instantly
+
+import * as Updates from "expo-updates";
+
+async function checkForUpdate() {
+  const update = await Updates.checkForUpdateAsync();
+  if (update.isAvailable) {
+    await Updates.fetchUpdateAsync();
+    await Updates.reloadAsync(); // Restart app with new bundle
+  }
+}
+
+// EAS Update channels: development → staging → production
+// eas update --branch production --message "Fix crash on login"
+```
+
+### App Store Submission Checklist
+
+```
+Android (Play Store):
+  □ AAB built with eas build --platform android --profile production
+  □ Version code incremented (autoIncrement: true in eas.json)
+  □ All permissions declared in AndroidManifest.xml with justification
+  □ Target SDK = current year's API level (required)
+  □ Privacy policy URL in store listing
+  □ Content rating questionnaire complete
+  □ Screenshots: phone + 7-inch tablet
+  □ eas submit --platform android
+
+iOS (App Store):
+  □ IPA built with eas build --platform ios --profile production
+  □ Bundle version / build number incremented
+  □ All NSUsageDescription strings in Info.plist (camera, location, etc.)
+  □ Privacy manifest (PrivacyInfo.xcprivacy) — required since 2024
+  □ App Tracking Transparency (ATT) prompt if using IDFA
+  □ Screenshots: 6.7" + 6.5" + iPad (if iPad supported)
+  □ TestFlight tested by 5+ internal testers
+  □ eas submit --platform ios
+```
+
+---
+
+## SWIFT / SWIFTUI (iOS Native)
+
+### Modern SwiftUI Patterns
+
+```swift
+// MVVM with @Observable (iOS 17+ — modern approach)
+@Observable class TransactionViewModel {
+    var transactions: [Transaction] = []
+    var isLoading = false
+    var error: Error?
+
+    func fetchTransactions(userId: String) async {
+        isLoading = true
+        defer { isLoading = false }
+        do {
+            transactions = try await api.getTransactions(userId: userId)
+        } catch {
+            self.error = error
+        }
+    }
+}
+
+struct TransactionListView: View {
+    @State private var viewModel = TransactionViewModel()
+
+    var body: some View {
+        List(viewModel.transactions) { tx in
+            TransactionRow(transaction: tx)
+        }
+        .task { await viewModel.fetchTransactions(userId: currentUserId) }
+        .overlay { if viewModel.isLoading { ProgressView() } }
+    }
+}
+```
+
+### Networking (Modern Swift Concurrency)
+
+```swift
+struct APIClient {
+    private let session = URLSession.shared
+
+    func get<T: Decodable>(_ path: String, as type: T.Type) async throws -> T {
+        guard let url = URL(string: baseURL + path) else { throw APIError.invalidURL }
+        var request = URLRequest(url: url)
+        request.setValue("Bearer \(AuthManager.shared.token)", forHTTPHeaderField: "Authorization")
+
+        let (data, response) = try await session.data(for: request)
+        guard let http = response as? HTTPURLResponse, 200..<300 ~= http.statusCode else {
+            throw APIError.httpError((response as? HTTPURLResponse)?.statusCode ?? 0)
+        }
+        return try JSONDecoder.iso8601Full.decode(T.self, from: data)
+    }
+}
+```
+
+### Security (iOS)
+
+```swift
+// Keychain for sensitive data (NOT UserDefaults)
+import Security
+
+func saveToKeychain(key: String, value: String) throws {
+    let data = Data(value.utf8)
+    let query: [String: Any] = [
+        kSecClass as String: kSecClassGenericPassword,
+        kSecAttrAccount as String: key,
+        kSecValueData as String: data,
+        kSecAttrAccessible as String: kSecAttrAccessibleWhenUnlockedThisDeviceOnly
+    ]
+    SecItemDelete(query as CFDictionary)
+    let status = SecItemAdd(query as CFDictionary, nil)
+    guard status == errSecSuccess else { throw KeychainError.saveFailed(status) }
+}
+
+// Biometric auth
+let context = LAContext()
+context.evaluatePolicy(.deviceOwnerAuthenticationWithBiometrics,
+    localizedReason: "Authenticate to view transactions") { success, error in ... }
+```
+
+---
+
+## KOTLIN / JETPACK COMPOSE (Android Native)
+
+### Modern Architecture (MVVM + StateFlow)
+
+```kotlin
+// ViewModel with Kotlin Coroutines
+@HiltViewModel
+class TransactionViewModel @Inject constructor(
+    private val repository: TransactionRepository
+) : ViewModel() {
+
+    private val _uiState = MutableStateFlow<TransactionUiState>(TransactionUiState.Loading)
+    val uiState: StateFlow<TransactionUiState> = _uiState.asStateFlow()
+
+    init { loadTransactions() }
+
+    private fun loadTransactions() {
+        viewModelScope.launch {
+            repository.getTransactions()
+                .catch { e -> _uiState.value = TransactionUiState.Error(e.message ?: "Error") }
+                .collect { transactions -> _uiState.value = TransactionUiState.Success(transactions) }
+        }
+    }
+}
+
+// Compose UI
+@Composable
+fun TransactionScreen(viewModel: TransactionViewModel = hiltViewModel()) {
+    val uiState by viewModel.uiState.collectAsStateWithLifecycle()
+
+    when (val state = uiState) {
+        is Loading -> CircularProgressIndicator()
+        is Success -> LazyColumn {
+            items(state.transactions, key = { it.id }) { TransactionItem(it) }
+        }
+        is Error -> ErrorView(state.message, onRetry = viewModel::loadTransactions)
+    }
+}
+```
+
+### Secure Storage (Android Keystore)
+
+```kotlin
+// EncryptedSharedPreferences — backed by Android Keystore
+val masterKey = MasterKey.Builder(context)
+    .setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
+    .build()
+
+val prefs = EncryptedSharedPreferences.create(
+    context,
+    "secure_prefs",
+    masterKey,
+    AES256_SIV,   // key encryption
+    AES256_GCM    // value encryption
+)
+prefs.edit().putString("auth_token", token).apply()
+```
+
+---
+
+## FLUTTER (Cross-Platform)
+
+### Architecture (BLoC Pattern — Production Standard)
+
+```dart
+// BLoC: Business Logic Component separates UI from state
+class TransactionBloc extends Bloc<TransactionEvent, TransactionState> {
+  final TransactionRepository _repo;
+
+  TransactionBloc(this._repo) : super(TransactionInitial()) {
+    on<LoadTransactions>(_onLoad);
+  }
+
+  Future<void> _onLoad(LoadTransactions event, Emitter<TransactionState> emit) async {
+    emit(TransactionLoading());
+    try {
+      final transactions = await _repo.getAll(userId: event.userId);
+      emit(TransactionLoaded(transactions));
+    } catch (e) {
+      emit(TransactionError(e.toString()));
+    }
+  }
+}
+
+// UI
+BlocBuilder<TransactionBloc, TransactionState>(
+  builder: (context, state) => switch(state) {
+    TransactionLoading() => const CircularProgressIndicator(),
+    TransactionLoaded(transactions: var txs) => TransactionList(txs),
+    TransactionError(message: var msg) => ErrorView(msg),
+    _ => const SizedBox.shrink(),
+  },
+)
+```
+
+### Flutter Performance
+
+```dart
+// const constructors wherever possible — prevents rebuilds
+const Padding(padding: EdgeInsets.all(16), child: MyWidget())
+
+// ListView.builder for any list — never ListView with children: [...]
+ListView.builder(
+  itemCount: items.length,
+  itemBuilder: (context, index) => ItemTile(items[index]),
+)
+
+// RepaintBoundary for complex widgets that shouldn't repaint with parent
+RepaintBoundary(child: ComplexChart())
+
+// Isolates for CPU-intensive work (parsing, crypto, image processing)
+final result = await compute(parseJsonInBackground, rawJson)
+```
+
+---
+
+## MOBILE SECURITY BASELINE
+
+```
+Storage:          Keychain (iOS) / Keystore (Android) / SecureStore (Expo)
+                  NEVER: UserDefaults, SharedPreferences, AsyncStorage for tokens
+
+Transport:        TLS 1.3. Certificate pinning for high-security apps.
+                  iOS: ATS enforced. Android: network_security_config.xml
+
+Auth tokens:      Short-lived JWT (1h) + refresh in secure storage
+                  Biometric unlock for refresh token access
+
+Root/Jailbreak:   Detect with SafetyNet/Play Integrity (Android) + jailbreak checks (iOS)
+                  Warn user. Block for financial apps.
+
+Code obfuscation: R8/ProGuard (Android) — always in production
+                  iOS: binary is compiled, harder to reverse, but still obfuscate strings
+
+Screenshot:       FLAG_SECURE (Android) / preventScreenCapture (iOS) for sensitive screens
+
+API keys:         Never in mobile app bundle — even "private" ones get extracted
+                  All secrets → your backend → mobile calls your backend
+```