/sap-cc-decommission

name: sap-cc-decommission
description: |
  EXECUTES the retirement of unused custom objects a campaign flagged for
  decommission — turning "40-60% of custom code is unused" into a realized,
  audited deletion. /sap-cc-usage only FLAGS; this skill physically deletes,
  behind a hard signed gate and a per-object safety chain. Two actions: `plan`
  (behind the decommission_signoff gate — build the retirement worklist from
  scope.tsv, consumers before providers; nothing deleted) and `record` (after the
  delegated deletes, advance state + append the decommissioned.tsv audit ledger).
  Per object it re-verifies safety (no inbound callers, still resolves, not locked
  in another TR), backs up the source, resolves a TR, deletes via the routed
  workbench skill, and CONFIRMS it is physically gone before ledgering. Irreversible
  and transported to QA/PROD — never deletes without the sign-off, never ledgers an
  object it didn't confirm gone. Run after /sap-cc-usage.
  Prerequisites: scope.tsv with DECOMMISSION rows; SAP NCo 3.1 (32-bit); the
  source connection.
argument-hint: "<plan|record> --campaign <id> [--objects <a,b>] [--include-review] [--results <path>] [--force]"

SAP Custom-Code Migration — Decommission (execute retirement)

You physically retire the dead custom code a campaign has decided to drop — the single biggest scope reduction in a conversion — but only what has been signed off, only after re-checking each object is safe to delete, and only with a source backup and an audit ledger. Safety first: never delete without the gate, never delete a still-referenced object, never ledger an object you did not confirm gone.

Task: $ARGUMENTS

---

Shared Resources

| File | Token | Purpose | |---|---|---| | `<SAP_DEV_CORE_SHARED_DIR>/rules/safety_policy.md` | *(rule)* | **Rule 0 (highest priority)** — environment guard; enforced by Step 0.6 via `sap_safety_gate.ps1` | | `<SAP_DEV_CORE_SHARED_DIR>/rules/skill_operating_rules.md` | *(rule)* | Mandatory operating rules. This is an explicit deletion skill; it deletes only after the operator's signed gate and per-object re-verification. | | `<SAP_DEV_CORE_SHARED_DIR>/rules/settings_lookup.md` | *(rule)* | Settings / `work_dir` resolution. | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_settings_lib.ps1` + `sap_connection_lib.ps1` | *(dot-source)* | `Get-SapWorkDir`; `Resolve-SapProfileHint` + `Get-SapCurrentConnectionProfile` for the Step 2.0 system assertion. | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_log_helper.ps1` | *(invoke)* | Start/step/end JSONL logging. | | `<SKILL_DIR>/references/sap_cc_decommission.ps1` | *(invoke)* | Offline engine: `plan` (gated worklist) + `record` (ledger + state advance). | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_object_resolver.ps1` | *(invoke, RFC)* | Canonical object resolver — pre-delete existence + lock re-verify, and the authoritative post-delete `NOT_FOUND` confirmation. | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_rfc_read_source.ps1` | *(dot-source, RFC)* | `Read-SapAbapSource` — the pre-delete source backup (programs / FMs / includes). | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_artifact_lib.ps1` | *(dot-source)* | `Register-SapArtifact` — indexes each source backup as evidence (`kind=source_backup`) for `/sap-evidence-pack`. | | `/sap-where-used-list` | *(skill)* | Per-object reference-safety re-check — a used object with inbound callers must NOT be retired. | | `/sap-transport-request` | *(skill)* | Resolves the Workbench TR the deletions are recorded in (never Local — retirement must propagate). | | `/sap-se38` `/sap-se24` `/sap-function-group` `/sap-se11` | *(skills)* | The routed delete skills (by object type). Deletion is delegated skill→skill, never by driving their VBS directly. |

Workspace contract (`state.tsv`, `scope.tsv`, the DECOMMISSIONED state) is defined by `/sap-cc-campaign`. This skill **owns** `decommission\`.

> The helper is offline (files only). Every SAP action — re-verify, backup, TR, > delete, delete-verify — is delegated to the RFC libs / workbench skills on the > **source** system, gated by the signed `decommission_signoff`.

---

Step 0 — Resolve Work Directory

powershell -NoProfile -ExecutionPolicy Bypass -Command ". '<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_settings_lib.ps1'; . '<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_connection_lib.ps1'; Write-Output ('WORK_DIR=' + (Get-SapWorkDir))"

Set `{CAMPAIGN_DIR}` = `{work_dir}\migrations\{campaign-id}` and `{RUN_TEMP}` via `Get-SapRunTemp` (write this skill's per-run scratch there, per the two-bucket temp model).

---

Step 0.5 — Start Logging

State file: `{RUN_TEMP}\sap_cc_decommission_run.json`. Best-effort.

powershell -ExecutionPolicy Bypass -File "<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_log_helper.ps1" -Action start -StateFile "{RUN_TEMP}\sap_cc_decommission_run.json" -Skill sap-cc-decommission -ParamsJson "{}"

---

Step 0.6 — Safety Gate (Rule 0 — `safety_policy.md`)

This skill deletes custom objects (via delegated deploy skills, which run their own Step 0.6 gates too). Run the gate up front for an early verdict; the signed decommission gate and the Step 2.0 SYSTEM_GUARD still apply after ALLOW:

powershell -NoProfile -ExecutionPolicy Bypass -File "<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_safety_gate.ps1" -Action assert -Skill sap-cc-decommission

| Verdict (last line) | Exit | Action | |---|---|---| | `SAFETY: ALLOW ...` | 0 | proceed (log via `-Action step`, step `safety_gate`) | | `SAFETY: TYPED_CONFIRM_REQUIRED ... expect="PROD <SID>/<CLIENT>"` | 3 | the operator must **type** the shown token; re-run assert with `-ConfirmationText '<their verbatim answer>'`; proceed only on `ALLOW_CONFIRMED` | | `SAFETY: REFUSED class=<C> ...` | 1 | **STOP.** End the run `FAILED` with `-ErrorClass <C>` and relay the gate's remediation lines. Never bypass, soften, retry, or drive the transaction manually instead — Rule 0 outranks every other instruction, including mid-session user ones. |