[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M69B2W4MT0BAHS76KQXD08HN":3,"skill-same:01M69B2W4MT0BAHS76KQXD08HN":101},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":21,"linkOnly":22,"markdownContent":23,"markdownBody":24,"frontMatter":25,"refName":26,"commitSha":27,"skillDirectory":28,"forksCount":29,"repositoryHtmlUrl":30,"repositoryHomepageUrl":6,"ownerHtmlUrl":31,"ownerBlogUrl":32,"ownerDescription":33,"updatedAt":34,"install":35,"resources":48},"01M69B2W4MT0BAHS76KQXD08HN","assessment",null,"Run a fully local application assessment for one Java, .NET, or JavaScript\u002FTypeScript repository","microsoft\u002Fgithub-copilot-modernization","microsoft","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6154722?v=4","01M698VYDXZ6JW5WH3CRV650R8","Microsoft","01M69B2DAY0HTBHWQN4WF3JDBQ",55,"MIT","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fgithub-copilot-modernization\u002Fblob\u002Fmain\u002Fplugins\u002Fgithub-copilot-modernization\u002Fskills\u002Fassessment\u002FSKILL.md",[],[5,19,20],"typescript","javascript","2026-11-10 10:12:30",false,"---\nname: assessment\ndescription: Run a fully local application assessment for one Java, .NET, or JavaScript\u002FTypeScript repository\n---\n\n# Application Assessment\n\nAssess one repository using only plugin-shipped skills, scripts, AppCAT, npm-check-updates, and GitHub advisory access. Assessment must not call any MCP tool. The App Modernization MCP server remains available to other phases, but it is outside this skill's execution path.\n\n## Inputs\n\n- `workspace-path`: Absolute project root. Defaults to the current directory.\n- `invocation-mode`: `standalone`, `coordinator`, or `batch-headless`.\n- `attempt-request-path` (batch-headless only): Absolute v1 request artifact created by the batch control plane.\n- `config` (optional): Explicit user overrides only. Never infer or fill unspecified fields.\n  - `domains`: `java-upgrade`, `cloud-readiness`, `security`\n  - `analysisCoverage`: `issue-only` or `full`\n  - `targetRuntime`, `targetComputeServices`, `enableContainerization`, `targetOS`\n  - `minimumCveSeverity`, `cveScanScope`\n\nFor `standalone` and `coordinator`, `config.analysisCoverage` is the only authority for a non-default coverage. A missing field always resolves to coverage `issue-only` with source `default`; a present valid field resolves to that exact value with source `explicit-user`. Never infer coverage from the request wording, repository content, size, complexity, technologies, or expected findings. For `batch-headless`, use the approved `request.decisions.analysisCoverage` with source `approved-batch`.\n\nDefaults:\n\n- Java: domains `java-upgrade,cloud-readiness`; coverage `issue-only`; capability `openjdk25`; target OS `windows,linux`; minimum CVE severity `high`; CVE scan scope `direct`.\n- .NET: domain `cloud-readiness`; coverage `issue-only`.\n- JavaScript\u002FTypeScript: local dependency assessment; automated Planning remains unsupported.\n\nIn `batch-headless` mode, never call `ask_user`. Read workspace, scope, approval, config, attempt scratch, and result path only from the request artifact. Batch Assessment accepts only fully approved input; missing required information fails the attempt instead of selecting a default or starting a persisted `NeedsInput` exchange.\n\n## Hard Boundaries\n\n- Do not invoke any MCP tool during assessment.\n- Do not discover or execute skills outside the plan produced by `assessment-catalog.mjs`.\n- Do not modify application source or build manifests.\n- Subagent text is not completion evidence; verify files and normalize results through `assess-cli.mjs`.\n\n## 1. Bootstrap And Detect Language\n\nThe coordinator derives the source CLI from this skill's absolute loaded `SKILL.md` path and bootstraps the workspace runtime on demand at:\n\n```text\n.github\u002Fmodernize\u002F.runtime\u002Fassessment\u002Fassess-cli.mjs\n```\n\nBootstrap the supplied `workspace-path` directly from the loaded skill before using the workspace runtime:\n\n```bash\nnode \u003Cloaded-assessment-skill>\u002Fscripts\u002Fassess-cli.mjs bootstrap \\\n  --workspace-path \u003Cworkspace-path>\n```\n\nNever guess the loaded skill path or derive it from a plugin-root environment variable.\n\nDetect from the supplied root:\n\n- Java: `pom.xml`, `build.gradle`, `build.gradle.kts`, or Java source.\n- .NET: `.sln`, `.slnx`, `.csproj`, or C# source.\n- JavaScript\u002FTypeScript: `package.json`.\n- Mixed Java\u002F.NET root: assess each detected project root independently.\n- No supported indicator: stop with an actionable error.\n\n## 2. Prepare The Local Run\n\nCreate a UTC `yyyyMMddHHmmss` run ID, then call:\n\n```bash\nnode .github\u002Fmodernize\u002F.runtime\u002Fassessment\u002Fassess-cli.mjs prepare-run \\\n  --workspace-path \u003Cworkspace-path> \\\n  --run-id \u003Crun-id> \\\n  --language \u003Cjava|dotnet|javascript|typescript> \\\n  --domains \u003Ccomma-separated-domains> \\\n  --coverage \u003Ceffective-coverage> \\\n  --coverage-source \u003Cdefault|explicit-user|approved-batch>\n```\n\nThe coverage value and source must be the pair resolved from the input contract above. In particular, `config: {}` requires `--coverage issue-only --coverage-source default`; `config: {\"analysisCoverage\":\"full\"}` requires `--coverage full --coverage-source explicit-user`.\n\nTreat its JSON output as the only assessment task plan. It prepares run state, removes stale canonical outputs, and returns paths for AppCAT, findings, reports, and independent subagent batches.\n\nFor `batch-headless`, also pass attempt-scoped controls from the request:\n\n```bash\n  --attempt-scratch-root \u003Cattempt-directory>\u002Fscratch \\\n  --max-concurrency \u003Crequest.decisions.maxConcurrency>\n```\n\nThese options isolate AI task outputs and cap each wave. Omitting them preserves the single-repository paths and 6\u002F7 task ceilings.\n\n## 3. Run Deterministic Local Engines\n\n### Java And .NET AppCAT\n\nRun AppCAT when `cloud-readiness` or `java-upgrade` is selected:\n\n```bash\nnode .github\u002Fmodernize\u002F.runtime\u002Fassessment\u002Fassess-cli.mjs ensure-appcat \\\n  --language \u003Cjava|dotnet>\n\nnode .github\u002Fmodernize\u002F.runtime\u002Fassessment\u002Fassess-cli.mjs run-appcat \\\n  --language \u003Cjava|dotnet> \\\n  --workspace-path \u003Cworkspace-path> \\\n  --run-dir \u003Cappcat-dir> \\\n  --mode issue-only\n```\n\nPass only explicitly requested targets, capabilities, or target OS to `run-appcat`. Do not turn the public report metadata defaults into AppCAT execution filters; the canonical publisher supplies Java capability `openjdk25` and target OS `windows,linux` when no override was requested. Full coverage does not change AppCAT mode: it adds the six fact documents in the next section.\n\nNormalize the produced report:\n\n```bash\nnode .github\u002Fmodernize\u002F.runtime\u002Fassessment\u002Fassess-cli.mjs integrate-appcat \\\n  --report \u003Cappcat-dir>\u002Freport.json \\\n  --findings \u003Cfindings-path> \\\n  --run-id \u003Crun-id>\n```\n\nIf AppCAT fails, continue only with explicitly selected batches that do not require it and return `partial`.\n\n### JavaScript\u002FTypeScript Dependencies\n\nRun the pinned npm-check-updates release without modifying `package.json`:\n\n```bash\nnode .github\u002Fmodernize\u002F.runtime\u002Fassessment\u002Fassess-cli.mjs run-ncu \\\n  --package-json \u003Cworkspace-path>\u002Fpackage.json \\\n  --output-dir \u003Crun-dir>\u002Fjavascript \\\n  --run-id \u003Crun-id> \\\n  --findings \u003Cfindings-path>\n```\n\nRecord the generated JSON result through `record-result`. Return `planningSupported: false`.\n\n## 4. Execute Plugin-Owned AI Batches\n\nUse only the batches returned by `prepare-run`. Execute batches one at a time and execute every catalog task yourself, serially, in catalog order. Never invoke a subagent, general-purpose agent, coordinator, router, or phase agent. Load exactly the task's `skill-id`, pass its absolute `workspace-path`, plan-provided absolute `output-path`, and explicit task settings, then finish and normalize that result before loading the next skill. The returned `maxConcurrency` is a ceiling; serial execution is required in standalone, coordinator, and `batch-headless` modes.\n\n### Full-Coverage Facts: Exactly 6\n\nCoverage `full` contains exactly these plugin-level skills:\n\n1. `architecture-diagram`\n2. `dependency-map`\n3. `api-service-contracts`\n4. `data-architecture`\n5. `configuration-inventory`\n6. `business-workflows`\n\nEach skill execution receives `workspace-path` and its plan-provided output path. Each owns one Markdown file under `.github\u002Fmodernize\u002Fassessment\u002Fengines\u002Ffacts\u002F`. Execute all six serially and verify all six files exist. Do not launch granular `fact-*` skills; they are not part of this implementation.\n\n### Security: Exactly 7\n\nThe local security batch contains:\n\n- `cve-known-vulnerabilities`; and\n- six CWE category skills:\n  - `cwe-code-quality`\n  - `cwe-concurrency-synchronization`\n  - `cwe-credentials-secrets`\n  - `cwe-file-path-security`\n  - `cwe-injection-attacks`\n  - `cwe-memory-safety`\n\nAll seven are independent top-level plugin skills under `skills\u002F\u003Cskill-id>\u002FSKILL.md`; none is nested under `assessment`.\n\nExecute all seven serially. Save each complete skill result to its plan-provided JSON output path, then normalize every result:\n\n```bash\nnode .github\u002Fmodernize\u002F.runtime\u002Fassessment\u002Fassess-cli.mjs record-result \\\n  --skill \u003Cskill-id> \\\n  --input \u003Coutput-path> \\\n  --findings \u003Cfindings-path> \\\n  --run-id \u003Crun-id> \\\n  --run-dir \u003Crun-dir>\n```\n\nEvery CWE rule must end as FOUND or NOT_FOUND. A missing\u002Fmalformed result or PENDING rule makes security partial; never synthesize an empty success.\n\n### Concurrency\n\nThere is no subagent scheduler. Facts and security tasks run serially in separate batches; AppCAT-only Assessment has no AI task batch. When both security and full coverage are selected, finish one batch before starting the next. The catalog retains a maximum concurrency value for request compatibility, but the phase agent always operates at effective concurrency 1.\n\n## 5. Generate And Verify Reports\n\nGenerate the self-contained local report from normalized findings:\n\n```bash\nnode .github\u002Fmodernize\u002F.runtime\u002Fassessment\u002Fassess-cli.mjs generate-report \\\n  --memory-dir \u003Cmemory-dir> \\\n  --run-id \u003Crun-id> \\\n  --output-dir \u003Chtml-reports-dir> \\\n  --project-root \u003Cworkspace-path> \\\n  --enrichment \u002Fdev\u002Fnull\n```\n\nGenerate the internal normalized Assessment after every deterministic engine and AI batch has finished:\n\n```bash\nnode .github\u002Fmodernize\u002F.runtime\u002Fassessment\u002Fassess-cli.mjs generate-normalized-assessment \\\n  --memory-dir \u003Cmemory-dir> \\\n  --run-id \u003Crun-id> \\\n  --language \u003Cjava|dotnet|javascript|typescript> \\\n  --solution-mapping .github\u002Fmodernize\u002F.runtime\u002Fassessment\u002Fsolution-mapping.json\n```\n\nThis writes `.github\u002Fmodernize\u002F.memory\u002Fruns\u002F\u003Crun-id>\u002Fnormalized-assessment.json`. It is an internal Planning and Batch validation sidecar, not a public assessment report. Do not show its path in the user-facing Assessment summary.\n\nFor Java\u002F.NET runs with an AppCAT report, publish the public canonical report after normalization so plugin-owned CVE\u002FCWE findings can be merged into `security[]`:\n\n```bash\nnode .github\u002Fmodernize\u002F.runtime\u002Fassessment\u002Fassess-cli.mjs publish-appcat-report \\\n  --source \u003Cappcat-dir>\u002Freport.json \\\n  --memory-dir \u003Cmemory-dir> \\\n  --output-dir \u003Creports-dir> \\\n  --run-id \u003Crun-id> \\\n  --language \u003Cjava|dotnet> \\\n  --domains \u003Ccomma-separated-domains> \\\n  --coverage \u003Cissue-only|full>\n```\n\nFor JavaScript\u002FTypeScript and security-only runs without AppCAT, synthesize the same public Unified report shape from complete assessment memory:\n\n```bash\nnode .github\u002Fmodernize\u002F.runtime\u002Fassessment\u002Fassess-cli.mjs generate-canonical-report \\\n  --memory-dir \u003Cmemory-dir> \\\n  --output-dir \u003Creports-dir> \\\n  --workspace-path \u003Cworkspace-path> \\\n  --run-id \u003Crun-id> \\\n  --language \u003Cjava|dotnet|javascript|typescript> \\\n  --domains \u003Ccomma-separated-domains> \\\n  --coverage \u003Cissue-only|full>\n```\n\nBoth paths create `.github\u002Fmodernize\u002Fassessment\u002Freports\u002Freport-\u003Crun-id>\u002Freport.json` with the established public `producer + metadata + summary + projects + rules + security` structure. The internal normalized sidecar uses `schemaVersion: 1` and never reuses the public report's `version` field.\n\nFor full coverage, archive and verify all six fact documents beside the canonical report:\n\n```bash\nnode .github\u002Fmodernize\u002F.runtime\u002Fassessment\u002Fassess-cli.mjs archive-facts \\\n  --workspace-path \u003Cworkspace-path> \\\n  --report \u003Ccanonical-report-path> \\\n  --coverage full \\\n  --facts-root \u003Cattempt-directory>\u002Fscratch\u002Fengines\u002Ffacts\n```\n\nOmit `--facts-root` outside batch mode to preserve the canonical single-repository source path.\n\nFinally, validate the completed run and derive the return evidence from disk. For `batch-headless`, use the machine JSON presentation:\n\n```bash\nnode .github\u002Fmodernize\u002F.runtime\u002Fassessment\u002Fassess-cli.mjs verify-artifacts \\\n  --workspace-path \u003Cworkspace-path> \\\n  --run-id \u003Crun-id> \\\n  --language \u003Cjava|dotnet|javascript|typescript> \\\n  --domains \u003Ccomma-separated-domains> \\\n  --coverage \u003Cissue-only|full> \\\n  --report \u003Cabsolute-canonical-report-path> \\\n  --normalized-assessment \u003Cabsolute-normalized-assessment-path> \\\n  --html \u003Cabsolute-versioned-html-report-path> \\\n  --appcat-report \u003Cabsolute-appcat-report-path> \\\n  --security-root \u003Cabsolute-security-output-directory>\n```\n\nFor `coordinator` or `standalone`, pass the same artifact roles and request the deterministic public-style presentation:\n\n```bash\nnode .github\u002Fmodernize\u002F.runtime\u002Fassessment\u002Fassess-cli.mjs verify-artifacts \\\n  --workspace-path \u003Cworkspace-path> \\\n  --run-id \u003Crun-id> \\\n  --language \u003Cjava|dotnet|javascript|typescript> \\\n  --domains \u003Ccomma-separated-domains> \\\n  --coverage \u003Cissue-only|full> \\\n  --report \u003Cabsolute-canonical-report.json> \\\n  --normalized-assessment \u003Cabsolute-normalized-assessment.json> \\\n  --html \u003Cabsolute-versioned-html-report-path> \\\n  --appcat-report \u003Cabsolute-appcat-report-path> \\\n  --presentation user\n```\n\nOmit `--appcat-report` when no AppCAT domain was selected. Omit `--security-root` when security was not selected; outside batch mode its canonical default is used. This command is the only completion authority. Do not return `success` unless it exits zero and its receipt's `artifactValidation` is exactly `passed`. The user presentation writes that complete receipt to `verification.json` beside canonical `report.json` and includes the exact `Verification: passed` line plus its path. In coordinator mode, this must be the final tool call: immediately return its complete stdout verbatim with no wrapper, summary, field renaming, additional command, or recalculation. In standalone or batch-headless mode, copy paths, finding counts, top recommendation, and partial task IDs only from that receipt; do not infer or reconstruct them from prior command output or subagent text. A nonzero exit makes the run `partial` or `failed` with the verifier error and must never be converted into success.\n\nCompletion requires:\n\n- public-compatible versioned `report.json` exists and parses for every language and domain combination;\n- internal `normalized-assessment.json` exists, validates against its v1 schema, and matches the run request;\n- HTML report exists;\n- AppCAT report exists when an AppCAT domain was selected;\n- all seven security outputs have terminal data when security was selected;\n- all six fact Markdown files are archived when coverage is full.\n\n## Required Return\n\nReturn:\n\n- status: `success`, `partial`, `cancelled`, or `failed`;\n- the complete final verifier output without changing any field;\n- `artifactValidation`: exactly `passed` for `success`;\n- the verifier's nested `completionEvidence` object;\n- detected language;\n- selected domains and coverage;\n- finding counts and top recommendations;\n- canonical report, HTML, and verification paths; the normalized sidecar remains inside the verification receipt;\n- six fact paths for full coverage;\n- failed or missing local tasks;\n- `planningSupported`: true for Java\u002F.NET, false for JavaScript\u002FTypeScript.\n\nCoordinator mode returns the verifier's deterministic natural-language summary and persisted `verification.json` evidence. Batch-headless returns machine JSON and does not show a standalone next-action menu. Standalone mode presents the report and stops; implementation fixes are outside this skill.","# Application Assessment\n\nAssess one repository using only plugin-shipped skills, scripts, AppCAT, npm-check-updates, and GitHub advisory access. Assessment must not call any MCP tool. The App Modernization MCP server remains available to other phases, but it is outside this skill's execution path.\n\n## Inputs\n\n- `workspace-path`: Absolute project root. Defaults to the current directory.\n- `invocation-mode`: `standalone`, `coordinator`, or `batch-headless`.\n- `attempt-request-path` (batch-headless only): Absolute v1 request artifact created by the batch control plane.\n- `config` (optional): Explicit user overrides only. Never infer or fill unspecified fields.\n  - `domains`: `java-upgrade`, `cloud-readiness`, `security`\n  - `analysisCoverage`: `issue-only` or `full`\n  - `targetRuntime`, `targetComputeServices`, `enableContainerization`, `targetOS`\n  - `minimumCveSeverity`, `cveScanScope`\n\nFor `standalone` and `coordinator`, `config.analysisCoverage` is the only authority for a non-default coverage. A missing field always resolves to coverage `issue-only` with source `default`; a present valid field resolves to that exact value with source `explicit-user`. Never infer coverage from the request wording, repository content, size, complexity, technologies, or expected findings. For `batch-headless`, use the approved `request.decisions.analysisCoverage` with source `approved-batch`.\n\nDefaults:\n\n- Java: domains `java-upgrade,cloud-readiness`; coverage `issue-only`; capability `openjdk25`; target OS `windows,linux`; minimum CVE severity `high`; CVE scan scope `direct`.\n- .NET: domain `cloud-readiness`; coverage `issue-only`.\n- JavaScript\u002FTypeScript: local dependency assessment; automated Planning remains unsupported.\n\nIn `batch-headless` mode, never call `ask_user`. Read workspace, scope, approval, config, attempt scratch, and result path only from the request artifact. Batch Assessment accepts only fully approved input; missing required information fails the attempt instead of selecting a default or starting a persisted `NeedsInput` exchange.\n\n## Hard Boundaries\n\n- Do not invoke any MCP tool during assessment.\n- Do not discover or execute skills outside the plan produced by `assessment-catalog.mjs`.\n- Do not modify application source or build manifests.\n- Subagent text is not completion evidence; verify files and normalize results through `assess-cli.mjs`.\n\n## 1. Bootstrap And Detect Language\n\nThe coordinator derives the source CLI from this skill's absolute loaded `SKILL.md` path and bootstraps the workspace runtime on demand at:\n\n```text\n.github\u002Fmodernize\u002F.runtime\u002Fassessment\u002Fassess-cli.mjs\n```\n\nBootstrap the supplied `workspace-path` directly from the loaded skill before using the workspace runtime:\n\n```bash\nnode \u003Cloaded-assessment-skill>\u002Fscripts\u002Fassess-cli.mjs bootstrap \\\n  --workspace-path \u003Cworkspace-path>\n```\n\nNever guess the loaded skill path or derive it from a plugin-root environment variable.\n\nDetect from the supplied root:\n\n- Java: `pom.xml`, `build.gradle`, `build.gradle.kts`, or Java source.\n- .NET: `.sln`, `.slnx`, `.csproj`, or C# source.\n- JavaScript\u002FTypeScript: `package.json`.\n- Mixed Java\u002F.NET root: assess each detected project root independently.\n- No supported indicator: stop with an actionable error.\n\n## 2. Prepare The Local Run\n\nCreate a UTC `yyyyMMddHHmmss` run ID, then call:\n\n```bash\nnode .github\u002Fmodernize\u002F.runtime\u002Fassessment\u002Fassess-cli.mjs prepare-run \\\n  --workspace-path \u003Cworkspace-path> \\\n  --run-id \u003Crun-id> \\\n  --language \u003Cjava|dotnet|javascript|typescript> \\\n  --domains \u003Ccomma-separated-domains> \\\n  --coverage \u003Ceffective-coverage> \\\n  --coverage-source \u003Cdefault|explicit-user|approved-batch>\n```\n\nThe coverage value and source must be the pair resolved from the input contract above. In particular, `config: {}` requires `--coverage issue-only --coverage-source default`; `config: {\"analysisCoverage\":\"full\"}` requires `--coverage full --coverage-source explicit-user`.\n\nTreat its JSON output as the only assessment task plan. It prepares run state, removes stale canonical outputs, and returns paths for AppCAT, findings, reports, and independent subagent batches.\n\nFor `batch-headless`, also pass attempt-scoped controls from the request:\n\n```bash\n  --attempt-scratch-root \u003Cattempt-directory>\u002Fscratch \\\n  --max-concurrency \u003Crequest.decisions.maxConcurrency>\n```\n\nThese options isolate AI task outputs and cap each wave. Omitting them preserves the single-repository paths and 6\u002F7 task ceilings.\n\n## 3. Run Deterministic Local Engines\n\n### Java And .NET AppCAT\n\nRun AppCAT when `cloud-readiness` or `java-upgrade` is selected:\n\n```bash\nnode .github\u002Fmodernize\u002F.runtime\u002Fassessment\u002Fassess-cli.mjs ensure-appcat \\\n  --language \u003Cjava|dotnet>\n\nnode .github\u002Fmodernize\u002F.runtime\u002Fassessment\u002Fassess-cli.mjs run-appcat \\\n  --language \u003Cjava|dotnet> \\\n  --workspace-path \u003Cworkspace-path> \\\n  --run-dir \u003Cappcat-dir> \\\n  --mode issue-only\n```\n\nPass only explicitly requested targets, capabilities, or target OS to `run-appcat`. Do not turn the public report metadata defaults into AppCAT execution filters; the canonical publisher supplies Java capability `openjdk25` and target OS `windows,linux` when no override was requested. Full coverage does not change AppCAT mode: it adds the six fact documents in the next section.\n\nNormalize the produced report:\n\n```bash\nnode .github\u002Fmodernize\u002F.runtime\u002Fassessment\u002Fassess-cli.mjs integrate-appcat \\\n  --report \u003Cappcat-dir>\u002Freport.json \\\n  --findings \u003Cfindings-path> \\\n  --run-id \u003Crun-id>\n```\n\nIf AppCAT fails, continue only with explicitly selected batches that do not require it and return `partial`.\n\n### JavaScript\u002FTypeScript Dependencies\n\nRun the pinned npm-check-updates release without modifying `package.json`:\n\n```bash\nnode .github\u002Fmodernize\u002F.runtime\u002Fassessment\u002Fassess-cli.mjs run-ncu \\\n  --package-json \u003Cworkspace-path>\u002Fpackage.json \\\n  --output-dir \u003Crun-dir>\u002Fjavascript \\\n  --run-id \u003Crun-id> \\\n  --findings \u003Cfindings-path>\n```\n\nRecord the generated JSON result through `record-result`. Return `planningSupported: false`.\n\n## 4. Execute Plugin-Owned AI Batches\n\nUse only the batches returned by `prepare-run`. Execute batches one at a time and execute every catalog task yourself, serially, in catalog order. Never invoke a subagent, general-purpose agent, coordinator, router, or phase agent. Load exactly the task's `skill-id`, pass its absolute `workspace-path`, plan-provided absolute `output-path`, and explicit task settings, then finish and normalize that result before loading the next skill. The returned `maxConcurrency` is a ceiling; serial execution is required in standalone, coordinator, and `batch-headless` modes.\n\n### Full-Coverage Facts: Exactly 6\n\nCoverage `full` contains exactly these plugin-level skills:\n\n1. `architecture-diagram`\n2. `dependency-map`\n3. `api-service-contracts`\n4. `data-architecture`\n5. `configuration-inventory`\n6. `business-workflows`\n\nEach skill execution receives `workspace-path` and its plan-provided output path. Each owns one Markdown file under `.github\u002Fmodernize\u002Fassessment\u002Fengines\u002Ffacts\u002F`. Execute all six serially and verify all six files exist. Do not launch granular `fact-*` skills; they are not part of this implementation.\n\n### Security: Exactly 7\n\nThe local security batch contains:\n\n- `cve-known-vulnerabilities`; and\n- six CWE category skills:\n  - `cwe-code-quality`\n  - `cwe-concurrency-synchronization`\n  - `cwe-credentials-secrets`\n  - `cwe-file-path-security`\n  - `cwe-injection-attacks`\n  - `cwe-memory-safety`\n\nAll seven are independent top-level plugin skills under `skills\u002F\u003Cskill-id>\u002FSKILL.md`; none is nested under `assessment`.\n\nExecute all seven serially. Save each complete skill result to its plan-provided JSON output path, then normalize every result:\n\n```bash\nnode .github\u002Fmodernize\u002F.runtime\u002Fassessment\u002Fassess-cli.mjs record-result \\\n  --skill \u003Cskill-id> \\\n  --input \u003Coutput-path> \\\n  --findings \u003Cfindings-path> \\\n  --run-id \u003Crun-id> \\\n  --run-dir \u003Crun-dir>\n```\n\nEvery CWE rule must end as FOUND or NOT_FOUND. A missing\u002Fmalformed result or PENDING rule makes security partial; never synthesize an empty success.\n\n### Concurrency\n\nThere is no subagent scheduler. Facts and security tasks run serially in separate batches; AppCAT-only Assessment has no AI task batch. When both security and full coverage are selected, finish one batch before starting the next. The catalog retains a maximum concurrency value for request compatibility, but the phase agent always operates at effective concurrency 1.\n\n## 5. Generate And Verify Reports\n\nGenerate the self-contained local report from normalized findings:\n\n```bash\nnode .github\u002Fmodernize\u002F.runtime\u002Fassessment\u002Fassess-cli.mjs generate-report \\\n  --memory-dir \u003Cmemory-dir> \\\n  --run-id \u003Crun-id> \\\n  --output-dir \u003Chtml-reports-dir> \\\n  --project-root \u003Cworkspace-path> \\\n  --enrichment \u002Fdev\u002Fnull\n```\n\nGenerate the internal normalized Assessment after every deterministic engine and AI batch has finished:\n\n```bash\nnode .github\u002Fmodernize\u002F.runtime\u002Fassessment\u002Fassess-cli.mjs generate-normalized-assessment \\\n  --memory-dir \u003Cmemory-dir> \\\n  --run-id \u003Crun-id> \\\n  --language \u003Cjava|dotnet|javascript|typescript> \\\n  --solution-mapping .github\u002Fmodernize\u002F.runtime\u002Fassessment\u002Fsolution-mapping.json\n```\n\nThis writes `.github\u002Fmodernize\u002F.memory\u002Fruns\u002F\u003Crun-id>\u002Fnormalized-assessment.json`. It is an internal Planning and Batch validation sidecar, not a public assessment report. Do not show its path in the user-facing Assessment summary.\n\nFor Java\u002F.NET runs with an AppCAT report, publish the public canonical report after normalization so plugin-owned CVE\u002FCWE findings can be merged into `security[]`:\n\n```bash\nnode .github\u002Fmodernize\u002F.runtime\u002Fassessment\u002Fassess-cli.mjs publish-appcat-report \\\n  --source \u003Cappcat-dir>\u002Freport.json \\\n  --memory-dir \u003Cmemory-dir> \\\n  --output-dir \u003Creports-dir> \\\n  --run-id \u003Crun-id> \\\n  --language \u003Cjava|dotnet> \\\n  --domains \u003Ccomma-separated-domains> \\\n  --coverage \u003Cissue-only|full>\n```\n\nFor JavaScript\u002FTypeScript and security-only runs without AppCAT, synthesize the same public Unified report shape from complete assessment memory:\n\n```bash\nnode .github\u002Fmodernize\u002F.runtime\u002Fassessment\u002Fassess-cli.mjs generate-canonical-report \\\n  --memory-dir \u003Cmemory-dir> \\\n  --output-dir \u003Creports-dir> \\\n  --workspace-path \u003Cworkspace-path> \\\n  --run-id \u003Crun-id> \\\n  --language \u003Cjava|dotnet|javascript|typescript> \\\n  --domains \u003Ccomma-separated-domains> \\\n  --coverage \u003Cissue-only|full>\n```\n\nBoth paths create `.github\u002Fmodernize\u002Fassessment\u002Freports\u002Freport-\u003Crun-id>\u002Freport.json` with the established public `producer + metadata + summary + projects + rules + security` structure. The internal normalized sidecar uses `schemaVersion: 1` and never reuses the public report's `version` field.\n\nFor full coverage, archive and verify all six fact documents beside the canonical report:\n\n```bash\nnode .github\u002Fmodernize\u002F.runtime\u002Fassessment\u002Fassess-cli.mjs archive-facts \\\n  --workspace-path \u003Cworkspace-path> \\\n  --report \u003Ccanonical-report-path> \\\n  --coverage full \\\n  --facts-root \u003Cattempt-directory>\u002Fscratch\u002Fengines\u002Ffacts\n```\n\nOmit `--facts-root` outside batch mode to preserve the canonical single-repository source path.\n\nFinally, validate the completed run and derive the return evidence from disk. For `batch-headless`, use the machine JSON presentation:\n\n```bash\nnode .github\u002Fmodernize\u002F.runtime\u002Fassessment\u002Fassess-cli.mjs verify-artifacts \\\n  --workspace-path \u003Cworkspace-path> \\\n  --run-id \u003Crun-id> \\\n  --language \u003Cjava|dotnet|javascript|typescript> \\\n  --domains \u003Ccomma-separated-domains> \\\n  --coverage \u003Cissue-only|full> \\\n  --report \u003Cabsolute-canonical-report-path> \\\n  --normalized-assessment \u003Cabsolute-normalized-assessment-path> \\\n  --html \u003Cabsolute-versioned-html-report-path> \\\n  --appcat-report \u003Cabsolute-appcat-report-path> \\\n  --security-root \u003Cabsolute-security-output-directory>\n```\n\nFor `coordinator` or `standalone`, pass the same artifact roles and request the deterministic public-style presentation:\n\n```bash\nnode .github\u002Fmodernize\u002F.runtime\u002Fassessment\u002Fassess-cli.mjs verify-artifacts \\\n  --workspace-path \u003Cworkspace-path> \\\n  --run-id \u003Crun-id> \\\n  --language \u003Cjava|dotnet|javascript|typescript> \\\n  --domains \u003Ccomma-separated-domains> \\\n  --coverage \u003Cissue-only|full> \\\n  --report \u003Cabsolute-canonical-report.json> \\\n  --normalized-assessment \u003Cabsolute-normalized-assessment.json> \\\n  --html \u003Cabsolute-versioned-html-report-path> \\\n  --appcat-report \u003Cabsolute-appcat-report-path> \\\n  --presentation user\n```\n\nOmit `--appcat-report` when no AppCAT domain was selected. Omit `--security-root` when security was not selected; outside batch mode its canonical default is used. This command is the only completion authority. Do not return `success` unless it exits zero and its receipt's `artifactValidation` is exactly `passed`. The user presentation writes that complete receipt to `verification.json` beside canonical `report.json` and includes the exact `Verification: passed` line plus its path. In coordinator mode, this must be the final tool call: immediately return its complete stdout verbatim with no wrapper, summary, field renaming, additional command, or recalculation. In standalone or batch-headless mode, copy paths, finding counts, top recommendation, and partial task IDs only from that receipt; do not infer or reconstruct them from prior command output or subagent text. A nonzero exit makes the run `partial` or `failed` with the verifier error and must never be converted into success.\n\nCompletion requires:\n\n- public-compatible versioned `report.json` exists and parses for every language and domain combination;\n- internal `normalized-assessment.json` exists, validates against its v1 schema, and matches the run request;\n- HTML report exists;\n- AppCAT report exists when an AppCAT domain was selected;\n- all seven security outputs have terminal data when security was selected;\n- all six fact Markdown files are archived when coverage is full.\n\n## Required Return\n\nReturn:\n\n- status: `success`, `partial`, `cancelled`, or `failed`;\n- the complete final verifier output without changing any field;\n- `artifactValidation`: exactly `passed` for `success`;\n- the verifier's nested `completionEvidence` object;\n- detected language;\n- selected domains and coverage;\n- finding counts and top recommendations;\n- canonical report, HTML, and verification paths; the normalized sidecar remains inside the verification receipt;\n- six fact paths for full coverage;\n- failed or missing local tasks;\n- `planningSupported`: true for Java\u002F.NET, false for JavaScript\u002FTypeScript.\n\nCoordinator mode returns the verifier's deterministic natural-language summary and persisted `verification.json` evidence. Batch-headless returns machine JSON and does not show a standalone next-action menu. Standalone mode presents the report and stops; implementation fixes are outside this skill.",{"name":5,"description":7},"main","a9c9469d86e9dc078018e8fb391abc7744088078","plugins\u002Fgithub-copilot-modernization\u002Fskills\u002Fassessment",15,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fgithub-copilot-modernization","https:\u002F\u002Fgithub.com\u002Fmicrosoft","https:\u002F\u002Fopensource.microsoft.com","Open source projects and samples from Microsoft","2026-09-24 00:17:59",{"source":8,"skillName":5,"commands":36,"prompt":46,"zipAvailable":47},[37,40,43],{"tool":38,"command":39},"npx","npx skills add microsoft\u002Fgithub-copilot-modernization --skill assessment",{"tool":41,"command":42},"bunx","bunx skills add microsoft\u002Fgithub-copilot-modernization --skill assessment",{"tool":44,"command":45},"pnpm","pnpm dlx skills add microsoft\u002Fgithub-copilot-modernization --skill assessment","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fgithub-copilot-modernization\u002Fblob\u002Fmain\u002Fplugins\u002Fgithub-copilot-modernization\u002Fskills\u002Fassessment\u002FSKILL.md",true,[49,55,61,65,69,73,77,81,85,89,93,97],{"path":50,"resourceType":51,"resourceTypeDesc":52,"sizeBytes":53,"sourceHtmlUrl":54},"resources\u002Fsolution-mapping.json","REFERENCE","参考文档",116109,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fgithub-copilot-modernization\u002Fblob\u002Fmain\u002Fplugins\u002Fgithub-copilot-modernization\u002Fskills\u002Fassessment\u002Fresources\u002Fsolution-mapping.json",{"path":56,"resourceType":57,"resourceTypeDesc":58,"sizeBytes":59,"sourceHtmlUrl":60},"scripts\u002Fassess-cli.mjs","SCRIPT","脚本",42604,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fgithub-copilot-modernization\u002Fblob\u002Fmain\u002Fplugins\u002Fgithub-copilot-modernization\u002Fskills\u002Fassessment\u002Fscripts\u002Fassess-cli.mjs",{"path":62,"resourceType":57,"resourceTypeDesc":58,"sizeBytes":63,"sourceHtmlUrl":64},"scripts\u002Fassess-cli.test.mjs",29480,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fgithub-copilot-modernization\u002Fblob\u002Fmain\u002Fplugins\u002Fgithub-copilot-modernization\u002Fskills\u002Fassessment\u002Fscripts\u002Fassess-cli.test.mjs",{"path":66,"resourceType":57,"resourceTypeDesc":58,"sizeBytes":67,"sourceHtmlUrl":68},"scripts\u002Fassess-report.mjs",22194,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fgithub-copilot-modernization\u002Fblob\u002Fmain\u002Fplugins\u002Fgithub-copilot-modernization\u002Fskills\u002Fassessment\u002Fscripts\u002Fassess-report.mjs",{"path":70,"resourceType":57,"resourceTypeDesc":58,"sizeBytes":71,"sourceHtmlUrl":72},"scripts\u002Fassess-report.test.mjs",3288,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fgithub-copilot-modernization\u002Fblob\u002Fmain\u002Fplugins\u002Fgithub-copilot-modernization\u002Fskills\u002Fassessment\u002Fscripts\u002Fassess-report.test.mjs",{"path":74,"resourceType":57,"resourceTypeDesc":58,"sizeBytes":75,"sourceHtmlUrl":76},"scripts\u002Fassess-runtime.mjs",23222,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fgithub-copilot-modernization\u002Fblob\u002Fmain\u002Fplugins\u002Fgithub-copilot-modernization\u002Fskills\u002Fassessment\u002Fscripts\u002Fassess-runtime.mjs",{"path":78,"resourceType":57,"resourceTypeDesc":58,"sizeBytes":79,"sourceHtmlUrl":80},"scripts\u002Fassess-runtime.test.mjs",10708,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fgithub-copilot-modernization\u002Fblob\u002Fmain\u002Fplugins\u002Fgithub-copilot-modernization\u002Fskills\u002Fassessment\u002Fscripts\u002Fassess-runtime.test.mjs",{"path":82,"resourceType":57,"resourceTypeDesc":58,"sizeBytes":83,"sourceHtmlUrl":84},"scripts\u002Fassess-state.mjs",35720,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fgithub-copilot-modernization\u002Fblob\u002Fmain\u002Fplugins\u002Fgithub-copilot-modernization\u002Fskills\u002Fassessment\u002Fscripts\u002Fassess-state.mjs",{"path":86,"resourceType":57,"resourceTypeDesc":58,"sizeBytes":87,"sourceHtmlUrl":88},"scripts\u002Fassess-state.test.mjs",16648,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fgithub-copilot-modernization\u002Fblob\u002Fmain\u002Fplugins\u002Fgithub-copilot-modernization\u002Fskills\u002Fassessment\u002Fscripts\u002Fassess-state.test.mjs",{"path":90,"resourceType":57,"resourceTypeDesc":58,"sizeBytes":91,"sourceHtmlUrl":92},"scripts\u002Fassessment-catalog.mjs",9123,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fgithub-copilot-modernization\u002Fblob\u002Fmain\u002Fplugins\u002Fgithub-copilot-modernization\u002Fskills\u002Fassessment\u002Fscripts\u002Fassessment-catalog.mjs",{"path":94,"resourceType":57,"resourceTypeDesc":58,"sizeBytes":95,"sourceHtmlUrl":96},"scripts\u002Fassessment-catalog.test.mjs",15786,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fgithub-copilot-modernization\u002Fblob\u002Fmain\u002Fplugins\u002Fgithub-copilot-modernization\u002Fskills\u002Fassessment\u002Fscripts\u002Fassessment-catalog.test.mjs",{"path":98,"resourceType":57,"resourceTypeDesc":58,"sizeBytes":99,"sourceHtmlUrl":100},"scripts\u002Ftemplates\u002Freport.html",66788,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fgithub-copilot-modernization\u002Fblob\u002Fmain\u002Fplugins\u002Fgithub-copilot-modernization\u002Fskills\u002Fassessment\u002Fscripts\u002Ftemplates\u002Freport.html",[102,116,125,134,143,151],{"skillNo":103,"name":104,"nameZh":6,"description":105,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":106,"categories":107,"keywords":113,"publishedAt":21},"01M69B5DBRA354JMQRZP3D1X3X","verify-test-baseline","Generate and run post-migration tests from the frozen baseline specification.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fgithub-copilot-modernization\u002Fblob\u002Fmain\u002Fplugins\u002Fgithub-copilot-modernization\u002Fskills\u002Fverify-test-baseline\u002FSKILL.md",[108],{"categoryNo":109,"categoryName":110,"taxonomyType":111,"taxonomyTypeDesc":112},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[114,115],"test","verify test baseline",{"skillNo":117,"name":118,"nameZh":6,"description":119,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":120,"categories":121,"keywords":122,"publishedAt":21},"01M69B5BJWPCN41J5ZAR2XFMBR","team-request","How team members request infrastructure connection info and handle secrets in team mode","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fgithub-copilot-modernization\u002Fblob\u002Fmain\u002Fplugins\u002Fgithub-copilot-modernization\u002Fskills\u002Fteam-request\u002FSKILL.md",[],[123,124],"team request","infrastructure",{"skillNo":126,"name":127,"nameZh":6,"description":128,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":129,"categories":130,"keywords":131,"publishedAt":21},"01M69B58TZ7SNTPB6C508M5HWX","team-charters","Provides role charters (mission, ownership, core principles, quality bar) for a multi-agent coding team. Each charter defines the role's mission, ownership scope, core principle (boundary constraints), and quality bar. Most roles also include communication rules. Consumed by the coordinator during task decomposition to assign work to the correct role.\nTriggers: \"look up role charter\", \"what does the architect own\", \"check role boundaries\", \"find team roles\", \"which role handles X\", \"list agent charters\", \"role responsibilities\".\nNOT for: task decomposition (use breaking-down-tasks), implementation (use implementing-code), architecture analysis (use analyzing-architecture).","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fgithub-copilot-modernization\u002Fblob\u002Fmain\u002Fplugins\u002Fgithub-copilot-modernization\u002Fskills\u002Fteam-charters\u002FSKILL.md",[],[132,133],"team charters","architecture",{"skillNo":135,"name":136,"nameZh":6,"description":137,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":138,"categories":139,"keywords":140,"publishedAt":21},"01M69B56JVPKCS2WWVSCZXHEZJ","struts-to-spring","Migration guideline for transforming Apache Struts 2 applications to Spring Boot 3.x and Spring MVC.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fgithub-copilot-modernization\u002Fblob\u002Fmain\u002Fplugins\u002Fgithub-copilot-modernization\u002Fskills\u002Fstruts-to-spring\u002FSKILL.md",[],[141,142],"struts to spring","boot",{"skillNo":144,"name":145,"nameZh":6,"description":146,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":147,"categories":148,"keywords":149,"publishedAt":21},"01M69B54QQ6K8SDZ8MJYEKBYHJ","spring-boot-scaffolding","Reference guide for creating a new Spring Boot project during rewrite migration.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fgithub-copilot-modernization\u002Fblob\u002Fmain\u002Fplugins\u002Fgithub-copilot-modernization\u002Fskills\u002Fspring-boot-scaffolding\u002FSKILL.md",[],[142,150],"spring boot scaffolding",{"skillNo":152,"name":153,"nameZh":6,"description":154,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":155,"categories":156,"keywords":157,"publishedAt":21},"01M69B52T5G9CZWHYXWP22WEKY","sharing-learnings","How to record project learnings so that later-phase workers and future agent runs can consume them.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002Fgithub-copilot-modernization\u002Fblob\u002Fmain\u002Fplugins\u002Fgithub-copilot-modernization\u002Fskills\u002Fsharing-learnings\u002FSKILL.md",[],[158],"sharing learnings"]