/sap-cc-cloud-readiness

name: sap-cc-cloud-readiness
description: |
  Measures each custom (Z/Y) object's DISTANCE FROM ABAP CLOUD — the question
  S4HANA_READINESS (/sap-cc-analyze) does not answer. `scan` downloads source over
  RFC for a campaign's REMEDIATE scope (or an explicit --objects/--packages set),
  matches a versioned forbidden-statement ruleset + a cloudification-repository
  snapshot offline, and classifies every object TIER_1_READY / TIER_2_WRAPPABLE
  (only blockers are unreleased APIs with a successor) / TIER_3_CLASSIC (a
  forbidden statement or an unreleased API with no successor), with a per-blocker
  blockers.tsv and an AI summary of the cheapest wins. Honest by construction: an
  API absent from the pack is 'unknown' (counted, never a blocker), a source that
  can't be read is COULD_NOT_CHECK (never TIER_1), and any dynamic call sets
  dynamic_blindspot=YES. S/4-ONLY (hard-refuses a non-S/4 pinned profile —
  CC_NOT_S4 — pointing to /sap-cc-analyze). Read-only RFC; no writes, no TR, no
  deploy. Prerequisites: /sap-login pinned to the S/4 system; SAP NCo 3.1 (32-bit).
argument-hint: "scan [--campaign <id>] [--objects <TYPE:NAME,...|file>] [--packages <pat,...>] [--limit <n>] [--refresh-source] [--knowledge <dir>]   |   keyuser (v2)"

SAP Custom-Code Cloud-Readiness — ABAP Cloud Distance Scanner

`/sap-cc-analyze` answers "does this code survive the S/4 conversion". This skill answers a different question: **how far is each object from ABAP Cloud (clean core)** — which extensibility tier it lands in, and what concretely blocks tier 1. It downloads source once over RFC and matches a bundled, versioned knowledge pack offline, so a whole REMEDIATE scope is classified in minutes with per-blocker evidence.

Task: $ARGUMENTS

**S/4-only.** Cloud distance is meaningful only on the S/4 system where clean core applies. Step 1.5 hard-refuses a non-S/4 pinned profile (`CC_NOT_S4`) and points to `/sap-cc-analyze`. **Read-only** — RFC source reads only; no SQL writes, no TR, no deployment.

---

Shared Resources

| File | Token / call | Purpose | |---|---|---| | `<SAP_DEV_CORE_SHARED_DIR>/rules/skill_operating_rules.md` | *(rule)* | Mandatory operating rules | | `<SAP_DEV_CORE_SHARED_DIR>/rules/settings_lookup.md` | *(rule)* | Settings / `work_dir` resolution | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_settings_lib.ps1` + `sap_connection_lib.ps1` | *(dot-source)* | `Get-SapWorkDir`, `Get-SapCurrentConnectionProfile` (S/4 guard) | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_log_helper.ps1` | *(invoke)* | Start/step/end JSONL logging | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_object_resolver.ps1` | `%%OBJECT_RESOLVER_PS1%%` | Standalone scope: expand `--objects`/`--packages` (`-Expand`) | | `<SKILL_DIR>/references/sap_cc_cloud_download.ps1` | `-ScopeFile -CacheDir -SharedDir` | RFC source download (read-only) → `<TYPE>__<NAME>.abap` + `coverage.tsv` | | `<SKILL_DIR>/references/sap_cc_cloud_scan.ps1` | `-SourceDir -OutDir` | Offline scanner → `cloud_tier.tsv` + `blockers.tsv` (pure-local, no SAP) | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_artifact_lib.ps1` | `%%ARTIFACT_LIB_PS1%%` | Register every TSV/MD written | | `plugins/sap-migrate/shared/knowledge/cloud/` | *(pack)* | `forbidden_statements.tsv` + `cloudification_repository.json` + `kp_meta.json` (+ `{custom_url}\knowledge\cloud\` override, file-by-file) | | `/sap-cc-campaign` | *(workspace owner)* | Defines `{CAMPAIGN_DIR}\state.tsv`; this skill reads `decision=REMEDIATE` and NEVER advances state (cloud tier is orthogonal to the R1–R4 tiers) |

> Ships **no GUI VBS** — pure RFC + offline. No session broker / attach lib / golden > screens. The RFC leg connects to the **pinned** S/4 profile.

Step 0 — Resolve Work Dir + Custom URL

powershell -NoProfile -ExecutionPolicy Bypass -Command ". '<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_settings_lib.ps1'; . '<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_connection_lib.ps1'; Write-Output ('WORK_DIR=' + (Get-SapWorkDir)); Write-Output ('CUSTOM_URL=' + (Get-SapSettingValue 'custom_url' ((Get-SapWorkDir) + '\custom'))); Write-Output ('RUN_TEMP=' + (Get-SapRunTemp))"

`{CAMPAIGN_DIR}` = `{work_dir}\migrations\{campaign-id}` when `--campaign` is given; outputs land in `{CAMPAIGN_DIR}\cloud\`. Standalone (no `--campaign`): use `Get-SapArtifactDir` for the scope key. Set `{RUN_TEMP}` = the `RUN_TEMP=` value printed above (`Get-SapRunTemp` mints + creates the per-run scratch dir holding the log state file) — for logging + the download cache; mint it once here and reuse (re-minting breaks the `-Action end` state-file lookup).

Step 0.5 — Start Logging

powershell -ExecutionPolicy Bypass -File "<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_log_helper.ps1" -Action start -StateFile "{RUN_TEMP}\sap_cc_cloudread_run.json" -Skill sap-cc-cloud-readiness -ParamsJson "{}"

Step 1 — Mode Dispatch

`scan` (default) | `keyuser` (**v2, not yet implemented** — see Scope). Parse `--campaign`, `--objects`, `--packages`, `--limit`, `--refresh-source`, `--knowledge`. Log the resolved mode/flags.

Step 1.5 — S/4 Release Guard (fail loud on non-S/4)

powershell -NoProfile -ExecutionPolicy Bypass -Command ". '<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_connection_lib.ps1'; $p = Get-SapCurrentConnectionProfile -PreferGuiActive; Write-Output ('RELEASE_MARKER=' + $p.server_release_marker + ' SID=' + $p.system_name)"

If `server_release_marker` does **not** start with `S4` (e.g. an ECC `ECC_*` marker, or blank) → **STOP** with `CC_NOT_S4`: cloud distance does not apply to a non-S/4 system; point the user to `/sap-cc-analyze` (conversion readiness). Never probe or scan. (An ECC/EC2 profile is correctly refused here — no EC2 variant exists.)

Step 2 — Resolve Scope (scan)

• **Campaign** (`--campaign`): read `{CAMPAIGN_DIR}\state.tsv`, take rows with

`decision=REMEDIATE`. Write a scope TSV (`object_type<TAB>object_name<TAB>package`) to `{RUN_TEMP}\cc_scope.tsv`. Apply `--limit` (a first controlled run). -