Fortified Enterprise Fleet
A legacy estate, before and after it can be seen
A governed fleet of specialized agents that discovers legacy data estates, reconstructs lineage, plans migration, validates outcomes, recovers from failure, and keeps production cutover under human authority.
Fortified Enterprise FleetUnmapped
You cannot migrate what nobody can see.
Schemas, procedures, transformations, schedules, ownership and policy live in different systems. The estate is real, and no single account of it is trustworthy.
A governed fleet of specialized agents that discovers legacy data estates, reconstructs lineage, plans migration, validates outcomes, recovers from failure, and keeps production cutover under human authority.
S.01The problem
Legacy estates are rarely described in one reliable place. Catalogs show schemas, but SQL and stored procedures hide transformations. Schedulers encode timing and dependencies. Comments may be stale or adversarial. Sensitive data carries access and residency constraints. Validation logic differs by team, while cutover often depends on manual evidence assembled too late.
Hidden dependencies make local changes break downstream reports and services.
Dialect and type incompatibilities surface late, often during execution.
Model reasoning is unsafe when it is allowed to directly authorize sensitive actions.
Validation frequently stops at row counts instead of checking schemas, hashes, aggregates and null profiles.
Repeated failures are rediscovered because remediation knowledge is not durable.
Cutover authority is fragile when the approval is not bound to the exact migration plan.
S.02The sequence
Migration Control Tower turns the migration lifecycle into a durable, governed state machine. Specialized agents interpret legacy evidence and propose actions. Deterministic services enforce authorization, idempotency, budgets, validation results, approval integrity and legal state transitions. Cloud Run Jobs move rows independently of the reasoning layer. A human operator retains authority over production cutover.
01REQUESTED
Legacy estates are rarely described in one reliable place. Catalogs show schemas, but SQL and stored procedures hide transformations. Schedulers encode timing and dependencies. Comments may be stale or adversarial. Nothing here can yet be trusted as a single account of what exists.
02DISCOVERED
The Discovery agent catalogs schemas, SQL, DAGs, connection posture and ownership evidence. The adapter — not the model — owns connection validation and the extraction of database facts. A model cannot invent a table name or a measured row count.
03ANALYZED · RISK_ASSESSED · PLANNED
Lineage reconstructs dependencies across databases, transformations and schedules. Risk classifies PII, dialect risk and policy exposure. Planner builds ordered targets, mappings, validation checks and remediation notes. Agents are resolved by capability through approved, versioned AgentCards — never hard-coded into the workflow.
04MIGRATING · VALIDATING · FAILED
Cloud Run Jobs move rows independently of the reasoning layer. When validation fails, the break is loud. Failure is a designed path, not an exception: the recovery loop builds an incident from deterministic evidence and uses lineage to locate the responsible pipeline.
05PASSED · READY_FOR_APPROVAL
Schema, count, hash, aggregate, duplicate and null-profile checks run deterministically. A run cannot reach approval until every required check passes. The approval service verifies the human identity, enforces separation of duties, and binds the token to the migration plan hash.
06APPROVED · CUTOVER · COMPLETE
The Cutover agent can consume a valid approval token but cannot issue one. Completion is derived from recorded state transitions rather than from the interface. Every action is scoped, every transition is durable, every validation result is reproducible.
REQUESTED
Legacy estates are rarely described in one reliable place. Catalogs show schemas, but SQL and stored procedures hide transformations. Schedulers encode timing and dependencies. Comments may be stale or adversarial. Nothing here can yet be trusted as a single account of what exists.
The sequence
01 / 06
S.03Three planes
LEGACY ESTATE → GOVERNED AGENT FLEET → CLOUD DATA PLANE → BIGQUERY
Agents reason about metadata, risk, plans and evidence.
The orchestrator advances a run through legal states and resolves approved providers by capability. AgentCards are versioned, signed and pinned to each run. Firestore stores durable run state and idempotency claims. Pub/Sub delivers stage events with dead-letter handling.
Managed jobs move rows; deterministic validators compare source and target.
Cloud Run Jobs execute bounded table movement. In the measured path, three jobs loaded customers, orders and tags from Cloud SQL for PostgreSQL into BigQuery. The executor reports row counts, byte counts, duration and completion evidence independently of the agent control plane.
An authorized operator approves a token cryptographically bound to the plan.
A run cannot reach approval until every required deterministic validation passes. The approval service checks the human identity, verifies separation of duties, and binds the token to the migration plan hash. The Cutover agent can consume a valid token but cannot issue one.
S.04The fleet
Sees the estate
Catalogs schemas, SQL, DAGs, connection posture and ownership evidence.
Finds what depends on what
Reconstructs dependencies across databases, transformations and schedules.
Classifies exposure
Classifies PII, dialect risk, criticality and policy exposure.
Orders the work
Builds ordered targets, mappings, validation checks and remediation notes.
Decides what passed
Runs schema, count, hash, aggregate, duplicate and null-profile checks.
Executes under authority
Consumes human approval, performs the governed cutover, and monitors health.
Follows the cost
Finds affected reports and downstream consumers through wildcard capability discovery.
S.05Architecture
Hover a node to trace its path
Open the full architectureS.06Proof
0
Rows moved
Live / measured
Measured source-to-target transfer by the Cloud Run Job executor.
0 / 9
Services observed
Live / captured
The planned Cloud Run service topology exists in the live inventory.
0
Pre-cutover checks
Live / measured
Deterministic validation passed before the run could reach approval.
0
Migration definitions
Measured control plane
Planning and wave-scheduling benchmark. Zero rows moved in this measurement.
The 20,000-definition result is a planning and wave-scheduling benchmark. It must not be described as 20,000 completed bulk migrations.
S.07Governance
The policy engine receives structured identity, action, resource class and run context. It never receives free-text legacy content. A hostile table comment therefore has no channel into an authorization decision. Unsafe raw-PII access is denied deterministically, secrets remain references until runtime, handlers are idempotent, and approval cannot be reused after the plan changes.
When validation fails, the recovery path builds an incident from deterministic evidence and uses lineage to locate the responsible pipeline. Gemini can explain a bounded root-cause hypothesis; ordinary code selects and applies only an approved remediation. Confirmed fixes are written to cross-run memory, but every future reuse still requires fresh validation.
Next
The fleet
Platform
