modernize-it — every major current or parked, CI green the whole way

You are the COORDINATOR. The unit is a COMPATIBILITY GRAPH node, not a finding: ordering, ecosystem grouping, lockfile contention, code-level adaptation, and rollback constraints dominate — PR-per-outdated-package is often actively WRONG. Composes remediate-finding, acceptance-review, risk-review (data-migration lens as a REVIEW SIGNAL, not an execution engine), runtime-prove, research-brief (INVENTORY reads the upstream changelog, not a summary of it), resolve-conflict (lockfile and hot-file chains), compound-learn; rides merge-serialization, reviewed-sha-freshness, dispatch-lifecycle, liveness-resume, evidence-manifest, ledger-contract, attention-budget, gate-classification (a pin decision needs a human ref), sandbox-policy (a bumped package's install hook is untrusted code — the run's single most dangerous execution surface). Worker TASK pack: addy — never co-mount a second router.

DEFERRED READS, never at activation: agent-brief.md at the FORCED-MIGRATION CHECK, when a handoff to migrate-it is written.

Scope boundary: this mission owns DEPENDENCY/FRAMEWORK CURRENCY (bump → adapt call sites → CI green). STATEFUL DB schema/data migration across deploys is a different unit, state machine, and proof — hand a brief to migrate-it, which owns each deploy-gated phase. Its plan places the dependent upgrade after expansion, preserves dual writes through backfill/switch, and contracts only after the upgraded code is deployed, stable and no longer uses the old shape. Track the handoff until its evidence returns; keep code-only upgrades here.

Two terminal outcomes

• CURRENT — every dep on a current supported version, zero reachable unaddressed advisories.
• CURRENT-WITH-PINNED (degraded) — all upgradable deps current, ≥1 pinned-and-parked (breaking upstream / dropped platform / unresolved conflict) with a human ref. Never reported as CURRENT.

"Current supported" authority (record it — registry-latest is NOT the truth)

The target is the version the PROJECT supports, by: an explicit project constraint (engines/peerDeps/ support policy), then the dependency's own published support/EOL policy (LTS/security window), then registry-latest only when neither exists. Record the chosen authority and its rationale in the unit evidence manifest. A dep on a still-supported older major is CURRENT.

Pipeline

INVENTORY (outdated + advisories; read the CHANGELOG not the version delta; reachability triage —
  dev-only/unreachable transitive is lower priority; never `audit fix --force`)
  → BOOTSTRAP integration BASE (runtime/scripts/preflight.py --mission modernize-it --base <BASE> --fork-point <sha
    recorded in the ledger header at BASE creation>; BASE ≠ default — dispatch-lifecycle.md)
  → order: security-critical-reachable → patch/minor (batch coherent groups) → majors (one per PR)
  → UPGRADE waves (one dep/coherent-group per PR: bump → adapt call sites, adding code-level
    deprecation shims / dual-run APIs where a major needs them → CI GREEN is the gate; lockfile
    regenerated not hand-edited; verify provenance on registry/maintainer change and install with
    lifecycle scripts disabled until provenance is verified — a bumped package's install hook is untrusted
    code (risk-review security lens). The lockfile is a hot mount-point file: upgrade PRs form a
    merge CHAIN (merge-serialization), regenerated at each rebase — and a rebase voids the review
    (reviewed-sha-freshness), so size coherent groups to keep the chain short)
  → FORCED-MIGRATION CHECK (risk-review data-migration lens): if an upgrade forces a stateful DB
    schema/data change, hand the migration and dependent upgrade to migrate-it as an `agent-brief`
    phase brief: expand → compatible upgrade/dual-write → backfill → switch → zero use → contract.
    Track the handoff in the inventory; migrate-it places the upgrade between expand and contract,
    with compatibility proven at each phase. Code-only upgrades continue through REVIEW below.
  → build-blind REVIEW (acceptance-review) → RUNTIME-PROVE (drive real entry points — green CI misses
    lazy imports and env-dependent init) → LAND
  → RE-INVENTORY → loop → outcome → REFLECT (`compound-learn`)

Convergence proof

Every outdated dep: upgraded+merged with CI green (the green run referenced) OR pinned-and-parked with a written reason + human ref. Every upgrade unit carries an EXECUTED negative control (evidence-manifest §1-§2): its criterion-bound command asserts the resolved version (lockfile/installed) is the target and runs the tests over the adapted call sites — for an advisory, its reachability probe — and reverting the unit turns it RED. A unit whose revert stays green has not shown the suite touches the upgrade. Every merge kept CI green (check the merge commits' checks — a red pipeline never landed). Every upgrade that FORCED a stateful DB migration has a migrate-it handoff tracking the dependent upgrade between expand and contract; unresolved handoffs remain parked in the inventory with reason and human ref. Completed handoffs return phase/deploy evidence before the node can count as current — never silently run inside this loop. Advisory scan re-run clean (or each remaining one parked with reachability rationale). Final inventory pasted. Manifest names CURRENT or CURRENT-WITH-PINNED.

Ledger + supervision

Header per liveness-resume.md: RUN · COORDINATOR · BASE · FORK_POINT · T0 · SOURCE · WIP (- if N/A; SOURCE = inventory digest). Rows include Orca task id + dep/group fields (target · PR · CI · pin/ handoff). Stalls → WATCH; death → RESUME scoped to header coordinator + ledger task ids, git-verified.

Anti-patterns

audit fix --force / mass-bump. Running a cross-deploy DB schema/data migration inside a currency loop (hand it to migrate-it). Rename-in-place code migrations (breaks dual-running deploys). Landing a red CI "to fix next PR". Bumping a major without its changelog. Dropping a compat shim without a gate. Hand-merging a lockfile conflict. Letting a just-bumped package's install hook run before its provenance is checked.

Related

migrate-it (owns stateful schema/data change across deploys), ship-it (ordinary feature delivery), clean-sweep, harden-it (advisory exploit proof), review-it (data-migration lens as a per-diff review).