skills: decompose-app, rehost-app + mendix-service-seam (split from #293, 4/6)

CHANGELOG.md

@@ -19,6 +19,8 @@ Sections dated before 2026-09-19 predate the cycle and stay as they are. Named m
 
 ## Unreleased
 
+- learn(decompose): **three on-demand skills for working from an existing Mendix app (split from #293, 4/6).** `decompose-app.md` covers splitting a monolith into several apps: choosing the cut on business fit and coupling, a gated target architecture, cut order by dependency direction, moving each slice by MPK, ledgering every crossing edge, and reporting the level the slice reached (build-green, seam-live or strangled). `rehost-app.md` covers regenerating a whole `.mpr` into a fresh app with `pipelines/mendix-mpr/` and reading the fidelity ledger; done means build-green with named hand-offs plus journey parity. `mendix-service-seam.md` collects OData/REST patterns between two Mendix apps: keys, machine-role auth measured 200/401/404, error handlers, external-entity limits, stub replacement and cross-app joins. Each pattern is paired with the verbatim failure it prevents. Routing rows are written as trigger conditions; all three are `ondemand`, so the baseline stays at 75,038 words. Citations of unreviewed inbox notes and uncommitted run captures are replaced by the fact and its field run. `architecture-blueprint.md` and `learned-constants-and-secrets.md` gain one pointer each. `decompose-app.md` names `bin/cut-score.sh` and `bin/cut-ledger.sh`, which arrive in their own split PRs. Field runs on public apps: a field-service template (Mendix 9.24) in eight increments up to a strangled slice; a GenAI showcase app and a banking sample for rehost. — MendixMau
+- new(pipelines): **`pipelines/mendix-mpr/` — the Rehost extractor for an existing Mendix app (split from #293, 3/6).** `rehost-extract.sh` describes each own module with mxcli, reorders the statements so callees come first, replays them into a fresh target `.mpr` of the same Mendix version (deferring and retrying what `check`/`exec` refuse, never dropping a module), and writes a fidelity ledger with one row per source document and the denominator in its header; `export-module-mpk.py` writes a module package from an MPR v1 app with secrets scrubbed, for Mendix 9 sources whose `mx` cannot export. Code only, no samples; the script now runs without bash-4 features. Added to CLAUDE.md's Pipelines table. Field runs on public apps: a banking sample (Mendix 11.13, 155 documents) rehosted build-green, 154/155 identical; a GenAI showcase app (Mendix 11.12, 2776 documents) landed 36/36 modules but is not build-green (42 × CE1613); module packages from a field-service template (Mendix 9.24) installed into 10.24 and 11.13. macOS and the two-tree layout not verified. — MendixMau
 - new(pipelines): **`pipelines/mendix-mpr/` — the Rehost extractor for an existing Mendix app (split from #293, 3/6).** `rehost-extract.sh` describes each own module with mxcli, reorders the statements so callees come first, replays them into a fresh target `.mpr` of the same Mendix version (deferring and retrying what `check`/`exec` refuse, never dropping a module), and writes a fidelity ledger with one row per source document and the denominator in its header; `export-module-mpk.py` writes a module package from an MPR v1 app for Mendix 9 sources whose `mx` cannot export; by default it empties demo users, user roles, admin password, per-configuration constant values, database credentials, certificates and navigation profiles in the project documents, while the module's own units (constant default values included) are copied byte for byte; any unknown `--` option is refused (exit 2). Code only, no samples; the script now runs without bash-4 features. After review: module constants' default values still travel in the package by default — the path the field runs installed — and a new `--scrub-constant-defaults` empties them and prints how many (unverified in Studio Pro: no package built with it has been installed and checked yet); the README states exactly what is and is not scrubbed; both scripts refuse source == output/target (exit 2) before writing; the own-module parse moved to `lib/own-modules.awk` and no longer assumes a fixed number of lead lines, with a fixture over verbatim `list modules` captures (`test-rehost-list-modules.sh`, 5 checks; the old script fails 2). Added to CLAUDE.md's Pipelines table. Field runs on public apps: a banking sample (Mendix 11.13, 155 documents) rehosted build-green, 154/155 identical; a GenAI showcase app (Mendix 11.12, 2776 documents) landed 36/36 modules but is not build-green (42 × CE1613); module packages from a field-service template (Mendix 9.24), exported on the default path (constant defaults copied), installed into 10.24 and 11.13. macOS and the two-tree layout not verified. — MendixMau
 - new(cut-ledger): **`bin/cut-ledger.sh` writes the cut ledger of one decompose slice — one row per crossing edge with its resolution (resolved / stub / handoff / retire / platform) and evidence — and exits 1 while any edge has none** (split from [#293](https://github.com/MendixMau/mxcli-project-toolkit/pull/293), 2/6). Reads the source app's catalog `refs` table (or a `--refs` TSV), a slice file (modules and single documents), first-match rules with mandatory evidence, `mx check` CE1613 names the catalog never recorded (check-only rows), the module exporter's JSON (modules it counts with no ledger row are printed), and verbatim `--extra` rows. #293 shipped it with no fixture; new `tests/wave2/test-cut-ledger.sh` (44 checks) runs on a captured line subset of #293's field run (43 of 346 crossing refs, one key per rule) and reproduces that run's own 57 ledger rows column for column, the pre-fix exporter note, UNRESOLVED → exit 1, refusals → exit 2 (now also an unreadable `--rules`/`--catalog`/`--exporter-json`, which escaped as exceptions with the UNRESOLVED code 1, and a `--refs` line with the wrong field count, which was silently dropped), and `--catalog` at single-tree and `app/` paths. Header corrected to the run's real counts (346 refs → 308 rows; it said 199). — MendixMau (#293 field run on a public template app)
 - new(cut-score), fix(app-facts): **`bin/cut-score.sh` scores a proposed split of an existing app into several apps; `app-facts.sh` no longer needs the sqlite3 CLI** (split from [#293](https://github.com/MendixMau/mxcli-project-toolkit/pull/293), 1/6). Given `--cut "A,B|C|D"` (or one app per level of `app-layer-map.json`) it lists every module edge that crosses an app boundary from `analysis/app-facts/dependencies.json`, names the lane each ref kind would need (OData external entity, published action or REST, or none), and sums a clean / costly / blocked verdict per partition with the denominator printed ("7 of 7 own edges"); an aggregate over a foreign entity is read from `.mxcli/catalog.db` (single-tree or `app/`), and reads NOT DETECTED with a reason when it cannot be. Adapted to master: the catalog's `build_mode` label is recorded, not tested (#259 — v0.24+ labels a full catalog `source`), and an empty `activities_data` reads NOT DETECTED instead of "no aggregates". `app-facts.sh` runs its guard queries through Python's sqlite3 when the CLI is missing (absent on some cloud containers and always on Git Bash), stripping the `\r` native Windows Python prints. Rows whose aggregate cannot be detected name the actual reason (no catalog / empty table / unreadable). `tests/wave2/test-cut-score.sh` 70/70 on a captured four-module fixture (14 new: label, empty table, row reasons, own modules derived from edges, both layouts); `test-app-report.sh` 109/109; `test-catalog-edge-guard.sh` 22/22, new case forcing the Python path with CRLF output (fails without the `tr`). — MendixMau (#293 field runs on public template apps)

README.md

@@ -536,6 +536,7 @@ Every mxcli project has a `.ai-context/skills/` directory (bundled by `mxcli ini
 | Generating a new project's CLAUDE.md — baseline routing plus project-specific facts | `skills/bootstrap-project.md` |
 | Setting up or resuming an mxcli project in a cloud/ephemeral container — the one-time setup order (mxcli download → mxcli init → init-project.sh → sources decision → push) and the commit-and-push loop that survives container reclaim | `skills/cloud-dev-environment.md` |
 | Changing an EXISTING Mendix app — adding a feature, altering a flow, restructuring a module — when it has no BRDs, no architecture doc and no wireframes: the knowledge base comes from the live model (Path D), stages 2–4 run over what changes plus what it touches, nothing more, and the Track B regression baseline is the precondition; audit-only stays in existing-app-assurance | `skills/existing-app-change.md` |
+| Splitting an existing Mendix monolith into several apps — strangler, "move module X into its own app", carving out a slice, microservices from one .mpr; choosing the cut, moving a slice by MPK, accounting for every crossing edge, or reporting the level a slice reached | `skills/decompose-app.md` |
 | Setting up or wiring a COMPANY BRAIN — the private tier between the toolkit and a project for own skills, conventions, lint rules, MDL snippets and approved MPKs; and deciding whether something goes to the toolkit, the company brain or docs/brain/ | `skills/company-brain.md` |
 | Cutover and retrospective — promoting proven patterns back into the toolkit | `skills/close-the-loop.md` |
 | Before citing ANY behavioural claim about the harness, the Mendix runtime or a test tool as evidence, or counting tokens from transcripts — a claim not in the register may not be cited | `skills/measured-claims.md` |
@@ -550,6 +551,7 @@ Every mxcli project has a `.ai-context/skills/` directory (bundled by `mxcli ini
 | Reviewing what the extraction actually produced — the Stage 1 surface, and the file the Stage 1 gate looks for. Renders a code-extracted and a document knowledge base alike, so a requirements-driven project gets the surface too; prints no zero that a second record does not agree with | `bin/extraction-report.sh` |
 | Assessing or planning a migration up front, before any pipeline is chosen | `skills/assess-migration.md` |
 | Running the extraction pipeline | `skills/migration-pipeline.md` |
+| Rehosting an existing Mendix .mpr into a fresh app — "port this app to a clean Mendix 11 project", re-platforming or rebuilding a whole app from its own model, running pipelines/mendix-mpr/rehost-extract.sh or reading its fidelity ledger | `skills/rehost-app.md` |
 | Migrating from a stack that has no dedicated pipeline | `skills/migrate-general.md` |
 | Migrating an OutSystems app | `skills/migrate-outsystems.md` |
 | Understanding OutSystems 11 source | `skills/source-os11.md` |
@@ -649,6 +651,7 @@ Every mxcli project has a `.ai-context/skills/` directory (bundled by `mxcli ini
 
 | Task | Skill to load |
 |---|---|
+| Wiring a service seam between two Mendix apps — one app's OData or REST consumed by another, replacing a stub by an external entity, joining data that lives in the other app, or choosing keys and auth for an app-to-app service | `skills/mendix-service-seam.md` |
 | Building a REST integration (consumed or published) for the first time on a project — the checks that avoid a rebuild after the first live call | `skills/rest-integration-first-time-right.md` |
 | Adding a constant, installing a marketplace module, deploying to a new environment, or needing a Mendix PAT — where an encryption key, API credential, endpoint or access token gets its value, why a free node has only one channel, and why a token missing from the files you grepped is not missing | `skills/learned-constants-and-secrets.md` |
 

ROUTING.md

@@ -56,6 +56,7 @@ picks the row up. That is the whole procedure — there is no second list to rem
 | Generating a new project's CLAUDE.md — baseline routing plus project-specific facts | `skills/bootstrap-project.md` | ba | P | ondemand |
 | Setting up or resuming an mxcli project in a cloud/ephemeral container — the one-time setup order (mxcli download → mxcli init → init-project.sh → sources decision → push) and the commit-and-push loop that survives container reclaim | `skills/cloud-dev-environment.md` | all | P | ondemand |
 | Changing an EXISTING Mendix app — adding a feature, altering a flow, restructuring a module — when it has no BRDs, no architecture doc and no wireframes: the knowledge base comes from the live model (Path D), stages 2–4 run over what changes plus what it touches, nothing more, and the Track B regression baseline is the precondition; audit-only stays in existing-app-assurance | `skills/existing-app-change.md` | ba,architect | P,0 | ondemand |
+| Splitting an existing Mendix monolith into several apps — strangler, "move module X into its own app", carving out a slice, microservices from one .mpr; choosing the cut, moving a slice by MPK, accounting for every crossing edge, or reporting the level a slice reached | `skills/decompose-app.md` | lead,architect,mdl | 0,3,5,6 | ondemand |
 | Setting up or wiring a COMPANY BRAIN — the private tier between the toolkit and a project for own skills, conventions, lint rules, MDL snippets and approved MPKs; and deciding whether something goes to the toolkit, the company brain or docs/brain/ | `skills/company-brain.md` | all | - | ondemand |
 | Cutover and retrospective — promoting proven patterns back into the toolkit | `skills/close-the-loop.md` | all | 7 | ondemand |
 | Before citing ANY behavioural claim about the harness, the Mendix runtime or a test tool as evidence, or counting tokens from transcripts — a claim not in the register may not be cited | `skills/measured-claims.md` | all | - | ondemand |
@@ -77,6 +78,7 @@ picks the row up. That is the whole procedure — there is no second list to rem
 | Reviewing what the extraction actually produced — the Stage 1 surface, and the file the Stage 1 gate looks for. Renders a code-extracted and a document knowledge base alike, so a requirements-driven project gets the surface too; prints no zero that a second record does not agree with | `bin/extraction-report.sh` | ba | 1 | ondemand |
 | Assessing or planning a migration up front, before any pipeline is chosen | `skills/assess-migration.md` | ba | 0 | ondemand |
 | Running the extraction pipeline | `skills/migration-pipeline.md` | ba | 0,1 | ondemand |
+| Rehosting an existing Mendix .mpr into a fresh app — "port this app to a clean Mendix 11 project", re-platforming or rebuilding a whole app from its own model, running pipelines/mendix-mpr/rehost-extract.sh or reading its fidelity ledger | `skills/rehost-app.md` | lead,ba,mdl | 0,1,5,6 | ondemand |
 | Migrating from a stack that has no dedicated pipeline | `skills/migrate-general.md` | ba | 0 | ondemand |
 | Migrating an OutSystems app | `skills/migrate-outsystems.md` | ba | 0 | ondemand |
 | Understanding OutSystems 11 source | `skills/source-os11.md` | ba | 0,1 | ondemand |
@@ -193,6 +195,7 @@ picks the row up. That is the whole procedure — there is no second list to rem
 
 | Always relevant for | Load this | Agent(s) | Stage(s) | Tier |
 |---|---|---|---|---|
+| Wiring a service seam between two Mendix apps — one app's OData or REST consumed by another, replacing a stub by an external entity, joining data that lives in the other app, or choosing keys and auth for an app-to-app service | `skills/mendix-service-seam.md` | lead,architect,mdl | 3,5 | ondemand |
 | Building a REST integration (consumed or published) for the first time on a project — the checks that avoid a rebuild after the first live call | `skills/rest-integration-first-time-right.md` | mdl | 4,5 | ondemand |
 | Adding a constant, installing a marketplace module, deploying to a new environment, or needing a Mendix PAT — where an encryption key, API credential, endpoint or access token gets its value, why a free node has only one channel, and why a token missing from the files you grepped is not missing | `skills/learned-constants-and-secrets.md` | mdl,architect,gate | 4,5,6 | ondemand |
 

agents/architect-agent.md

@@ -58,6 +58,8 @@ This table is your whole list. The baseline table in the project's CLAUDE.local.
 | `project-bin/check-prototype-links.js` | Before wireframes pass to the build loop, and with --brd before a BRD is signed off: dead #/route links, orphan screens, controls with no data-bind and no data-cut, BRD routes no screen has, screens no use case walks (design-artifacts.md Step 3c, brd-validation.md check 8) |
 | `skills/cloud-dev-environment.md` | Setting up or resuming an mxcli project in a cloud/ephemeral container |
 | `skills/existing-app-change.md` | Changing an EXISTING Mendix app |
+| `skills/decompose-app.md` | Splitting an existing Mendix monolith into several apps |
+| `skills/mendix-service-seam.md` | Wiring a service seam between two Mendix apps |
 | `project-bin/app-facts.sh` | Collecting the facts an app dossier is written from: forces a full catalog build, module edges through the real module column, strongly connected components, describes every loop-containing microflow and parses the loop bodies; exit 2 on a stale, fast-mode or schema-incomplete catalog, never a verdict |
 | `skills/app-analysis.md` | Building or refreshing the standing dossier of an EXISTING app before changing it: inventory, module dependency shape, loop risk patterns, each section with a verdict and a fault where nothing was measured (a standing document; nothing else in the toolkit reads it yet) |
 | `skills/layering-review.md` | Checking whether an EXISTING app's module boundaries still hold: the layer map (bin/app-layer-map.sh) computes the order the modules would stack in and draws only the edges that point back up, so one tangle of N mutually reachable modules becomes a named list of edges with a weight and a ref kind; Stage 3 in existing-app-change mode, and the honest blast radius for a slice |

agents/ba-agent.md

@@ -75,6 +75,7 @@ This table is your whole list. The baseline table in the project's CLAUDE.local.
 | `skills/layering-review.md` | Checking whether an EXISTING app's module boundaries still hold: the layer map (bin/app-layer-map.sh) computes the order the modules would stack in and draws only the edges that point back up, so one tangle of N mutually reachable modules becomes a named list of edges with a weight and a ref kind; Stage 3 in existing-app-change mode, and the honest blast radius for a slice |
 | `skills/assess-migration.md` | Assessing or planning a migration up front, before any pipeline is chosen |
 | `skills/migration-pipeline.md` | Running the extraction pipeline |
+| `skills/rehost-app.md` | Rehosting an existing Mendix .mpr into a fresh app |
 | `skills/migrate-general.md` | Migrating from a stack that has no dedicated pipeline |
 | `skills/migrate-outsystems.md` | Migrating an OutSystems app |
 | `skills/source-os11.md` | Understanding OutSystems 11 source |

agents/mdl-agent.md

@@ -68,7 +68,10 @@ This table is your whole list. The baseline table in the project's CLAUDE.local.
 | `project-bin/context-pack.sh` | Dispatching a build step to a helper |
 | `bug-logs/mxcli-bugs.md` | Reading a whole class of tool defects (a retest, a new mxcli release, an audit) |
 | `skills/cloud-dev-environment.md` | Setting up or resuming an mxcli project in a cloud/ephemeral container |
+| `skills/decompose-app.md` | Splitting an existing Mendix monolith into several apps |
+| `skills/mendix-service-seam.md` | Wiring a service seam between two Mendix apps |
 | `skills/microflow-loop-antipatterns.md` | Reading what loop bodies do (LOOP_TQ, deferred commit, nested loop, REST in loop, transaction control per item, scheduled-event reachability) from described MDL; the catalog holds top-level activities only and cannot see inside a loop |
+| `skills/rehost-app.md` | Rehosting an existing Mendix .mpr into a fresh app |
 | `skills/iterative-build-loop.md` | An exec.sh guard refused a write (not a permission prompt), or building a module with mxcli |
 | `skills/mdl-cookbook-microflows.md` | Writing MDL microflow scripts |
 | `skills/build/mdl/oneshot-mdl-method.md` | Writing a single MDL script that takes a project from nothing to a working vertical slice |