Legacy migration

Hyperoru accepts useful historical context through a one-way import boundary. It does not connect to a legacy database or let imported claims silently become current evidence.

What can be imported

The legacy-import-v1 manifest supports workspaces, sources, completed audits, findings, dispositions, comments, tasks, schedules, and context history. Every record includes a stable source ID and revision, while the manifest identifies the source system, source tenant, transformation version, and generation time.

Safety model

Each record is checksummed and placed in workspace-isolated quarantine. Raw email identities are replaced with keyed references and credential-like fields are removed before storage. A legacy identity can be linked only to an active, verified member of the destination workspace, with explicit operator confirmation.

Dry-run batches cannot publish. Canary, cohort, and final-delta batches publish only after validation and identity confirmation. Published records appear as historical context, not live evidence, findings, or architectural truth.

Operator sequence

1. Enable the legacy_import workspace flag.
2. Submit a dry-run manifest in Admin → Migration & release.
3. Resolve collisions, rejected identities, and missing references in the source transformation.
4. Confirm identity links to verified workspace members.
5. Publish one canary batch.
6. Reconcile counts and per-kind checksums, then sign the matched report.
7. Rehearse rollback before freezing legacy mutation.
8. Migrate bounded cohorts, freeze the source, and run a final delta.
9. Keep the legacy service offline while production release gates are observed.

Inspect imported history

Workspace viewers can use GET /v1/workspaces/{workspace_id}/legacy-history. The endpoint returns only active, sanitized published history and requires the legacy_import flag. Rolled-back records remain auditable to operators but are not returned as active customer history.

Production release evidence

Hyperoru records migration, scale, restore, security, and product gate evidence with a status, measurements, immutable evidence references, reason, and operator. A failed gate pauses rollout. Independent penetration testing and restore evidence stay pending until their real artifacts exist.

See the internal legacy migration and production release runbook for the staged procedure and failure triage.