/sap-cc-remediate

name: sap-cc-remediate
description: |
  Remediates a migration campaign's TRIAGED R1 (mechanical) objects on the
  SANDBOX — the only sap-migrate skill that changes SAP, and only after a
  mandatory dry-run review. Four actions:
    apply  — dry-run the deterministic R1 rule pack over each object's source →
             <obj>.after.abap + diff for the operator to review (this is the gate).
    assist — R2/R3: assemble a per-object AI context bundle for a recipe-faithful
             rewrite (never auto-applied; DRAFT patterns advisory-only).
    revert — roll a deployed fix back to its retained before-image (confirmed).
    record — after the operator deploys the approved fix + ATC re-check, advance
             campaign state (TRIAGED → REMEDIATED → VERIFIED).
  R1 is deterministic; R2/R3 and unclassified '?' objects are AI-assisted / human
  work, never auto-applied. Run after /sap-cc-triage.
  Prerequisites: downloaded source per R1 object; deploy via the workbench skills
  on the sandbox.
argument-hint: "<apply|assist|revert|record> --campaign <id> [--rules <path>] [--knowledge <dir>] [--source-dir <dir>] [--limit <n>] [--results <path>] [--objects <a,b>] [--brief <path>]"

SAP Custom-Code Migration — Remediate (R1)

You apply the mechanical S/4 fixes to the triaged R1 objects, show the operator exactly what would change (dry-run), and — only after approval and a real sandbox deploy + ATC re-check — record the result. Safety first: never deploy without the dry-run gate; never auto-touch anything above R1.

Task: $ARGUMENTS

---

Shared Resources

| File | Token | Purpose | |---|---|---| | `<SAP_DEV_CORE_SHARED_DIR>/rules/safety_policy.md` | *(rule)* | **Rule 0 (highest priority)** — environment guard; enforced by Step 0.6 via `sap_safety_gate.ps1` | | `<SAP_DEV_CORE_SHARED_DIR>/rules/skill_operating_rules.md` | *(rule)* | Mandatory operating rules. This is an explicit remediation skill; it deploys (to the sandbox) only after operator approval at the dry-run gate. | | `<SAP_DEV_CORE_SHARED_DIR>/rules/settings_lookup.md` | *(rule)* | Settings / `work_dir` resolution. | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_settings_lib.ps1` + `sap_connection_lib.ps1` | *(dot-source)* | `Get-SapWorkDir`; `Resolve-SapProfileHint` + `Get-SapCurrentConnectionProfile` for the Step 3.0 sandbox assertion. | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_log_helper.ps1` | *(invoke)* | Start/step/end JSONL logging. | | `<SKILL_DIR>/references/sap_cc_remediate.ps1` | *(invoke)* | Offline engine: `apply` (rule-pack dry-run) + `assist` (R2/R3 context bundles) + `revert` (rollback staging) + `record` (state/fixlog advance). | | `<SKILL_DIR>/references/migration_rules_r1.tsv` | *(read)* | Deterministic R1 transforms. `mode` AUTO (rewrite) / FLAG (report only). Customer override via `--rules {custom_url}\knowledge\migration_rules_r1.tsv`. | | `<SKILL_DIR>/../../shared/knowledge/recipes/<pattern>.md` | *(read)* | Recipe guidance for R2/R3 (AI-assisted) remediation. | | `/sap-se38` `/sap-se37` `/sap-se24` | *(skills)* | Download source + deploy the approved `<obj>.after.abap`. | | `/sap-activate-object`, `/sap-atc`, `/sap-fix-abap` | *(skills)* | Activate, ATC re-check (variant `S4HANA_READINESS`), and assist on syntax. | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_gate_policy.ps1` | *(record: `-GatePolicyLib`)* | `Get-SapGatePolicy` reads the migration brief's ABAP-Unit bar → `unit_gate` / `unit_gate_when_no_tests` for the record-action unit-test gate (C9). | | `/sap-run-abap-unit`, `/sap-gen-abap-unit` | *(skills)* | Run — and, when a test class is absent under a mandatory unit gate, generate — ABAP Unit tests on the sandbox to back a `VERIFIED` outcome. |

Workspace contract (`remediation\*`, `fixlog.tsv`, REMEDIATED/VERIFIED states) is defined by `/sap-cc-campaign`. This skill **owns** `remediation\`.

> The helper itself is offline (files only). All SAP writes happen through the > delegated workbench skills, on the **sandbox** profile, gated by the dry-run > review.

---

Step 0 — Resolve Work Directory

powershell -NoProfile -ExecutionPolicy Bypass -Command ". '<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_settings_lib.ps1'; . '<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_connection_lib.ps1'; Write-Output ('WORK_DIR=' + (Get-SapWorkDir))"

Set `{WORK_TEMP}` and `{CAMPAIGN_DIR}` = `{work_dir}\migrations\{campaign-id}`.

Set `{RUN_TEMP}` = the per-run scratch dir (`Get-SapRunTemp` mints + creates `{work_dir}\temp\run_<id>`):

powershell -NoProfile -ExecutionPolicy Bypass -Command ". '<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_connection_lib.ps1'; Write-Output ('RUN_TEMP=' + (Get-SapRunTemp))"

Per the CLAUDE.md "Two-bucket temp model" write this skill's per-run scratch (the log state file below, any outcomes TSV you generate) under `{RUN_TEMP}`, never at a fixed name under the `{WORK_TEMP}` root.

---

Step 0.5 — Start Logging

State file: `{RUN_TEMP}\sap_cc_remediate_run.json`. Best-effort.

powershell -ExecutionPolicy Bypass -File "<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_log_helper.ps1" -Action start -StateFile "{RUN_TEMP}\sap_cc_remediate_run.json" -Skill sap-cc-remediate -ParamsJson "{}"

---

Step 0.6 — Safety Gate (Rule 0 — `safety_policy.md`)

This skill deploys fixes to the sandbox (via delegated deploy skills, which run their own Step 0.6 gates too). Run the gate up front for an early verdict; the dry-run review gate and the Step 3.0 SANDBOX_GUARD still apply after ALLOW:

powershell -NoProfile -ExecutionPolicy Bypass -File "<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_safety_gate.ps1" -Action assert -Skill sap-cc-remediate

| Verdict (last line) | Exit | Action | |---|---|---| | `SAFETY: ALLOW ...` | 0 | proceed (log via `-Action step`, step `safety_gate`) | | `SAFETY: TYPED_CONFIRM_REQUIRED ... expect="PROD <SID>/<CLIENT>"` | 3 | the operator must **type** the shown token; re-run assert with `-ConfirmationText '<their verbatim answer>'`; proceed only on `ALLOW_CONFIRMED