Lab 04 · Migration Assessment Sprint

Sameer's GCC runs a migration factory for the parent org, and the parent just bought agentic assessment tooling that promises "a business case in hours, not months". The tooling is real; so is its failure mode. An assessment engine sees the CMDB. It does not sit in the interviews where someone says "oh — and don't touch that IP." This sprint trains the override discipline that keeps AI-drafted dispositions from becoming AI-shipped outages.

Time & tier

~120 minutes hands-on · Core tier (maps to module M4). Cost: ₹0 — design-artifact lab; a chat assistant (free tier or local Ollama) and a spreadsheet or markdown tables.

Setup

Create assessment-sprint/ with the two source files below, plus three empty deliverables: disposition-sheet.md, wave-plan.md, override-log.md.

File 1 — cmdb-export.md (all data synthetic):

ID   App          Stack                      OS             Crit  Users  LastChange  CMDB notes
A01  StoreFront   Java 11 / Tomcat           RHEL 7         High  9,000  2026-05     Customer web store; stateless app tier
A02  PayBridge    .NET Fx 4.7                Win Srv 2016   High    120  2024-11     Settlement gateway; "small, quiet box"
A03  ArchiveHub   PHP 7 / MySQL              CentOS 6       Low       0  2021-03     No interactive logins in 12 months
A04  HRPortal     Vendor pkg (on-prem)       Win Srv 2019   Med   4,500  2025-09     Vendor offers SaaS edition
A05  CrewRoster   VB6 client + SQL Server    Win Srv 2012   Med     300  2023-02     Desktop app, installer on file share
A06  QuoteEngine  Java 17 / Spring Boot      Ubuntu 22      High  1,100  2026-06     12-factor-ish; CI/CD exists
A07  DataMart     Oracle 12c                 Solaris 11     High     40  2025-12     Analyst reporting DB, 6 TB
A08  MailRelay    Postfix                    Debian 10      Low     n/a  2022-08     Internal SMTP relay
A09  DevWiki      Confluence Server          Ubuntu 20      Low     800  2024-04     License renewal due Q4
A10  FieldTrack   Node.js 20                 Amazon Linux   Med    650  2026-04     Stateless REST API + Mongo
A11  LedgerCore   RPG / IBM i (AS/400)       IBM i 7.4      High     60  2026-01     Core ledger; separate platform team
A12  ReportGen    SSRS                       Win Srv 2016   Med     200  2025-07     Nightly PDF reports off DataMart

File 2 — interview-notes.md (fragments from discovery calls — the CMDB never saw these):

Ops engineer (infra walkthrough):
"PayBridge is the easiest box in the estate, honestly. Oh — one thing.
Every night at 01:30 it exchanges settlement files with LedgerCore over
Connect:Direct. The AS/400 team whitelists PayBridge's IP address on
their side, and the batch window closes at 03:00 sharp. Last time
networking changed that IP, settlements failed for two days. Don't
touch the IP."

Finance controller:
"ArchiveHub? Dead app, nobody logs in. Although — internal audit pulled
seven years of invoices out of it in March. Statutory retention means we
keep those records queryable until 2031. Legal was very clear about that."

HR ops lead: "The vendor's SaaS edition covers everything we use. We'd
pay to never patch that server again."
Store ops: "StoreFront and QuoteEngine release together every two weeks;
QuoteEngine calls StoreFront's session service on every quote."
DBA: "DataMart on Solaris is my retirement risk. Nobody else can run it.
ReportGen breaks whenever DataMart sneezes — they move together or not
at all."
Crew supervisor: "CrewRoster's vendor is gone. The VB6 source is in a
zip on the file share. We only use the roster grid and the export."
Platform team: "LedgerCore is not in scope for this program. It stays on
IBM i. Anything that talks to it keeps talking to it."

Guided steps

Step 1 — Let the AI draft the 6R sheet (25 min)

Paste only cmdb-export.md (not the interview notes) to your assistant: "You are assisting a migration assessment. For each application assign a 6R disposition (rehost, replatform, refactor, repurchase, retire, retain) with a one-line rationale and a confidence (H/M/L). Output a table." This mirrors how assessment tooling actually works — structured data in, dispositions out. Copy the result into disposition-sheet.md as the AI draft columns, untouched.

✅ Checkpoint: disposition sheet holds 12 AI-drafted rows with rationale and confidence, produced from the CMDB alone.

Step 2 — Validate against the interviews, app by app (30 min)

Now read interview-notes.md and walk all 12 rows. For each, add your disposition and rationale in adjacent columns. Most AI drafts will be reasonable — that is what makes the wrong ones dangerous. Ask of every row: does any interview fragment change the risk, the dependency picture, or the business context? Update dispositions where it does.

✅ Checkpoint: all 12 rows carry a human disposition; at least the dependency-affected rows cite an interview fragment.

Step 3 — Hunt the traps (20 min)

Two applications in this portfolio have an obvious disposition that is wrong. The CMDB actively misleads on both; the interview notes contain the tell. If your Step 2 pass already caught them, verify your reasoning; if not, re-read the notes asking "what would break, and what would a regulator or auditor say?" per app. For each trap, write three lines in the sheet: the naive disposition, the correct one, and the single fact that flips it.

✅ Checkpoint: two rows explicitly marked as traps, each with naive vs corrected disposition and the flipping fact.

Step 4 — Build the wave plan (25 min)

Ask the AI to propose migration waves from your corrected sheet, then adjudicate. Constraints that must be visible in wave-plan.md: co-move pairs (the interviews name two), anything coupled to LedgerCore inherits its constraints, retire/repurchase items need their own decommission or cutover track rather than a lift wave, and wave 1 should be low-risk confidence-builders. Three to four waves with entry/exit criteria per wave is the expected shape. Where you rejected the AI's sequencing, note why inline.

✅ Checkpoint: wave-plan.md shows 3–4 waves, both co-move pairs respected, and at least one documented rejection of an AI sequencing suggestion.

Step 5 — Write the override log (20 min)

For every row where your disposition differs from the AI draft, log: app, AI said, you said, evidence source, and what the AI couldn't have known (data it never saw vs reasoning it fumbled). This distinction is the deliverable your delivery leadership actually needs — it tells them what discovery inputs the tooling must be fed next time versus where human review is irreducible.

✅ Checkpoint: override-log.md has one row per divergence, each classifying the cause as missing-data or bad-reasoning.

Verification

• Trap captureboth trap apps identified with corrected dispositions and the flipping facts (compare with the answer key only after).
• Disposition completeness12/12 rows with AI draft, human final, confidence, and rationale.
• Wave integritythe two co-move pairs travel together; nothing coupled to the retained platform migrates ahead of its interface plan.
• Override honestyevery divergence is logged, including ones where the AI was right and you initially weren't.

Completion artifact

The assessment-sprint/ folder. Self-grading rubric (pass = 8/11):

• Trap A caught (0–2)corrected with the dependency fact = 2; caught but wrong reasoning = 1.
• Trap B caught (0–2)corrected with the compliance fact = 2.
• Sheet quality (0–3)dispositions defensible, confidence honest, interview citations present = 3.
• Wave plan (0–2)constraints respected, entry/exit criteria per wave = 2.
• Override log (0–2)complete, with missing-data vs bad-reasoning classification = 2.

Client-safe variant

Real CMDB exports carry hostnames, IPs, and commercial context that rarely may enter public AI tools. Practice on this synthetic estate freely; on engagement, either run the drafting step inside the client-approved tenancy, or pre-process the export — replace app names with codes, strip IPs and hostnames, keep only the decision-relevant columns — before prompting, or use a local model via Ollama. The disposition sheet and override log formats are client deliverables; keep the mapping file (codes → real names) inside the client boundary.

Stuck?

• •
  The AI refuses to commit to dispositions: tell it a draft with stated confidence is wanted, not a final answer, and that every row will be human-reviewed.
• •
  Everything comes back "replatform": ask it to argue the cheapest plausible disposition per app first, then what fact would force a costlier one.
• •
  The traps aren't surfacing: interrogate per app — "who depends on this?", "what happens if it disappears?", "who would object?" — against the interview notes.
• •
  Wave plan ignores the pairs: paste the two co-move fragments back and ask it to re-derive constraints from quotes only.

Answer key (don't read before attempting)

Trap A — A02 PayBridge. The CMDB sells it as the easiest rehost in the estate (small, quiet, Windows 2016). The interviews reveal a nightly Connect:Direct settlement exchange with LedgerCore (retained on IBM i, out of scope), an IP-whitelist dependency on the AS/400 side, and a hard 01:30–03:00 batch window — a prior IP change caused a two-day settlement outage. A naive rehost changes its network identity and breaks settlement. Correct handling: retain or late-wave rehost, gated on re-engineering the interface (or a coordinated whitelist/network-preservation plan with the platform team), with the batch window as an explicit cutover constraint.

Trap B — A03 ArchiveHub. Zero logins in 12 months screams retire. The interviews reveal it holds seven years of statutorily retained invoices, queryable until 2031, which internal audit actively used in March. Retiring it destroys a compliance archive. Correct handling: not retire — retain or (better) replatform the archive to cheap immutable storage with legal hold and a query path, decommissioning only the CentOS 6 host, with sign-off from legal/audit recorded.

Secondary checks: A04 HRPortal → repurchase (SaaS edition); A01+A06 co-move (session-service coupling, shared release train); A07+A12 co-move (DataMart/ReportGen); A11 LedgerCore → retain, out of scope.