The migration you can prove · Open source, AGPL · Proof, not percentages
Bylazora proves a mainframe migration is correct before it goes live. The migrated system must reproduce the legacy output exactly, to the byte, or the migration is not accepted: no automation percentages, no assurance by inspection, and no difference found in production, where it costs the most. The engine is open source, free at any scale, and runs on the commodity hardware and cloud you already buy.
Equivalence gate, 1B rows, per-account aggregation vs the COBOL reference
cpu 28.1x 21.40s IDENTICAL
wgpu 61.3x 9.82s IDENTICAL
cuda 68.8x 8.75s IDENTICAL
3/3 backends IDENTICAL, 0 mismatches
A mainframe estate carries three costs at once: the risk of a migration that goes wrong, the bill for staying where you are, and the clock on the people who understand the code. Bylazora answers the first, and changes the arithmetic on the other two.
A standard and a tool. The standard: a migrated workload's outputs must equal the legacy COBOL reference byte for byte, or the migration is not accepted. The tool: an open-source gate that checks exactly that, on any job's outputs, whoever or whatever produced them. It is the difference between being told a migration is fine and being shown that it is. How you would use it.
Migration is the highest-stakes project an enterprise runs, and the industry's failures are public: TSB's 2018 migration cost 330 million pounds and locked 1.9 million customers out. Those failures share one cause, which is that the work was validated by inspection. Proof is cheaper than an outage, and far cheaper than a regulator asking who checked.
Mainframe software is typically 30–50% of the mainframe budget, large estates pay roughly $1,000–2,000 per MIPS per year, and pricing trends up. A worked 100M-transaction nightly batch runs near $380 a month on commodity cloud hardware: an 87–95% reduction against a conservative mainframe allocation. The migration pays for itself before the estate is finished.
An estimated 220–800 billion lines of COBOL remain in production. Roughly 10% of COBOL developers retire each year and most universities no longer teach it. The estate is not the emergency; the people who understand it are. Every year of delay narrows who can be held accountable for the change.
We are equally honest about the other side: mainframes are reliable and cheap per workload. The argument is the licensing trajectory, the skills cliff, and the strategic cost of lock-in, not that the mainframe is broken. And there is nothing to procure to evaluate any of it: the engine is free, and the proof trial takes one job and an afternoon.
The workload's own characteristics decide which path it takes. We deliver all three.
Business logic re-implemented in a modern stack (a Rust core with parallel chunked reads and GPU-native kernels) on commodity hardware, NVIDIA or not. Removes the COBOL dependency entirely, unlocks modern tooling and AI integration.
The same source, compiled by open-source GnuCOBOL on commodity instances, with JCL batch orchestration re-expressed as cloud-native schedulers. Fastest and lowest-risk; modernize function by function later.
AI reads the estate: code, copybooks, JCL, runbooks. It extracts business rules, and drafts translations and test suites. Humans review and sign every artifact; the equivalence gate verifies it. AI proposes; the gate disposes. Your agent can drive the engine through MCP today.
| Workload characteristic | Path |
|---|---|
| High data volume, aggregations, ETL-heavy | Move off COBOL: GPU/CPU tier |
| Logic-dense, low volume, thin test coverage | Rehost COBOL on cloud |
| Regulatory freeze, zero tolerance for change | Rehost COBOL on cloud |
| Medium complexity, staged transition | AI-assisted, then per-function decision |
A migration is a queue of jobs, and every job is the same loop. The gate does not care what language the replacement is written in, who wrote it, or whether an agent drafted it: it compares outputs, byte for byte. The reference directory defines the contract.
migrate new generates the workspace: the contract, the input directory, the reference capture script, and a Rust target skeleton.migrate reference runs the legacy program once and seals its output files as the contract. It refuses to reseal without --force, so the goal posts cannot quietly move.migrate verify builds the target, runs it, and compares byte for byte. Content that differs, files missing, files the reference never declared: it names each one, and appends the verdict to the job's trail.# one job becomes a sealed workspace
$ bylazora-core migrate new batch-txn \
--input transactions.csv --input balances.csv \
--output final_balances.csv --output summary_report.csv \
--copybook TXNREC.cpy --cobol-source BATCHTXN.cob
# the legacy output is the contract
$ bylazora-core migrate reference batch-txn
sealed reference: 2 file(s)
# write the routine, then run the gate
$ bylazora-core migrate verify batch-txn
IDENTICAL
# the verdict trail is append-only
$ bylazora-core migrate status batch-txn
job batch-txn (rust)
inputs : transactions.csv, balances.csv
outputs: final_balances.csv, summary_report.csv
sealed : yes
verdict: IDENTICAL (attempt 1, 0 diffs)
It is not a COBOL translator. There is no compiler or transpiler in it: the copybook parser reads data layouts, not programs. The rewrite is yours, your team's, or your agents'. What the engine supplies is the part that decides whether a rewrite is acceptable.
The benchmark runtime is one workload shape today, compiled in and byte-exact: per-account aggregation over transaction files. Estate intake, reading copybooks, DB2 schemas and JCL into job specifications, and pluggable backends are roadmap, not shipped. The gate itself is general now, and it is the piece that is hard to replace.
The worked example is in the repository: sample/ is a sealed migrate workspace, a COBOL batch job with its GnuCOBOL capture and its migrated Rust target. CI re-derives the reference from the COBOL, asserts the seal, and runs the gate, so a single differing byte fails the build. That is the template. Copy the shape, swap in your job.
The MCP server ships inside the same binary. Point Claude Code, Cursor, Copilot or any MCP client at it and your agent can drive the engine: draft a migration, run it on your data, and read the verdict back as a diff. What it cannot do is mark anything proven. Only the validator does that, byte for byte, against your legacy reference. The agent proposes; the gate disposes.
Every other AI coding tool asks you to trust the model. This one makes the model pass a gate. A hallucinated translation is not a style argument here: it is a byte difference, and the difference is the feedback the agent iterates against. Your assistant can be as inventive as it likes while drafting, because nothing reaches production without reproducing the legacy output exactly.
That matters most where the work is worst. A real estate is not one program, it is thousands, each with its own copybook, fixed-point fields, batch window and dead code. The gate turns that from an act of faith into a queue of diffs, and the queue is what your team actually reviews.
The rule pack teaches the agent the invariants before it drafts a line, and the MCP server is open source with the rest of the engine. The rule pack, a worked workspace template, and the one-command wiring ship on npm: npx bylazora setup claude. Get the binary for every platform.
# wire a client in one command
$ npx bylazora setup claude
wrote .mcp.json
# or serve the tools directly
$ bylazora mcp
JSON-RPC 2.0 over stdio, no network
# the config it writes: node plus the CLI;
# the engine path is discovered, never
# hardcoded, and works on every platform
{
"mcpServers": {
"bylazora": {
"command": "node",
"args": [".../cli.js", "mcp"]
}
}
}
# the tools the agent gets
validate byte-compare against the
legacy reference
bench run a tier, report wall time
copybook_parse read a COBOL copybook
migrate_verify build + gate a job workspace
migrate_status the contract and the verdict
# the one thing no tool can do
mark a run proven <- the validator only
This is what the byte-exact gate was built for. A model that drafts a migration is useful; a model whose draft has to survive a byte comparison with the legacy system is trustworthy. Those are different claims, and only one of them can be checked.
One binary, every platform. Prebuilt and signed for the platforms below, and published as source on crates.io, so any machine with a Rust toolchain can build it too. Every binary carries a sha256 and an Ed25519 signature, verifiable offline against the published public key.
| Platform | What it carries |
|---|---|
| Linux x86_64 (glibc) | CPU, wgpu and the CUDA tier |
| Linux x86_64 (musl, static) | CPU and wgpu; runs on any distro |
| Linux aarch64 (ARM64) | CPU and wgpu; Graviton and ARM cloud |
| macOS, Apple Silicon | CPU and wgpu |
| macOS, Intel | CPU and wgpu |
| Windows x86_64 | CPU and wgpu; the sample gate itself stays bash on Linux |
Which tier runs where
| Tier | Runs on |
|---|---|
| CPU | everywhere |
| wgpu | any GPU: NVIDIA, AMD, Intel, Apple - or no GPU at all, through software Vulkan |
| CUDA | NVIDIA hardware and drivers only, and only in the Linux x86_64 binary |
The honest NVIDIA point: CUDA is an optional acceleration path, never a requirement. The wgpu tier is byte-exact on the same NVIDIA cards, which is why it ships on every platform while CUDA ships on one. An estate without NVIDIA hardware loses nothing but a fraction of headline speed, and the gate's verdict is identical either way.
# from crates.io (any platform with Rust)
cargo install bylazora-core
# or the signed binary for your platform
# https://github.com/bylazora/bylazora/releases
# the agent CLI on npm: setup, rules,
# template, and the delegated loop
npm install -g bylazora
# wire your agent in one command
bylazora setup claude
# then point your agent at the gate
bylazora mcp
Seven phases. Governance artifacts at every step, inspectable by you at any time.
The byte-exact gate, the three tiers, and the parsers are open source: AGPL for the engine, Apache-2.0 for the parsers. Anyone can read the validator, run it, and prove their own migration, without asking us for anything. Bylazora earns its keep on two things: the commercial licence, for estates that cannot accept AGPL, and doing the migration with you when you would rather not do it alone.
AGPL-3.0 / Apache-2.0
Clone it, build it, hand it to your agents. The gate is the product and the product is free: byte-exact verification, three compute tiers, the C ABI, the MCP interface, and the agent rule packs. Forever.
SHA-256 + Ed25519 signed; verifiable offline with the public key.
USD 4,900/year per production team
For estates that cannot accept AGPL, or that embed the engine in closed products: a commercial licence with support, covering the organisation's own and client workloads at any scale and any number of installs. Offline-signed key, verified locally, air-gapped by construction.
Run with you, fixed fee
Everything the engine does, you can do yourself, and we will tell you so. When you would rather have it run with you: the proof trial, the migration waves, dual-run and cutover, and the assurance pack. Quoted against your assessed function inventory.
What is in the box: the byte-exact validator, the three-tier engine (CPU, wgpu, cudarc), the C ABI, the MCP server, the copybook parser and DB2 importer, the judge harness, the sample migration, and the evidence annex. What stays ours: the playbook, the corpora, the replication recipes, and pricing, the know-how, not the code. And the AI boundary: your assistant can operate the engine through its MCP interface, propose, and measure. It cannot mark a job proven. Only the validator can.
Vendors market automation rates such as “99.7% automated”. An automation rate is a claim about effort. It says nothing about correctness.
Our acceptance criterion is mechanical: exact fixed-point arithmetic (money stays integer cents, provably exact), byte-exact outputs (field values, totals, ordering, formatting), and continuous enforcement (the check runs in CI, in benchmarks, and during dual-run).
We do not promise a percentage. We promise a measurement.
compare_outputs(legacy, migrated)
final_balances.csv IDENTICAL
summary_report.csv IDENTICAL
60/60 records validated
0 mismatches
The engine is the runtime of the new solution. Six positions in a migration, one tool:
| Specify | Golden reference | Build inside the gate | Route by benchmark | Cut over, running | Stay proven |
| Every job becomes a specification with a byte-level output contract | Legacy outputs and timings captured once - the contract everything is built against | Developers build backends of the engine; every iteration returns a byte diff, not a hunch | The harness measures each backend on candidate hardware; profiling picks the target state | The same binary that validated the jobs runs them; dual-run reconciles continuously | Every nightly run passes the gate; drift fails loudly with a diff |
The migrated system does not merely pass a test once. It runs on the engine that tests it, and the gate is the safety system of the new estate.
Three failure classes break every home-grown migration - and one more worry breaks every AI-drafted one. Each is neutralised here by a gate, not a habit.
Float intermediates silently corrupt money. The legacy reference computes in exact fixed-point and the validator requires identical bytes: no epsilon, no tolerance. A float artifact is a failed job with a diff, and a planted corpus that crosses 2^53 proves the gate catches it.
Windows that see tomorrow corrupt every calculation downstream. Backends run as pure functions of their declared inputs in fresh processes, windows are trailing-only by contract, and a planted look-ahead trap fails any implementation that peeks.
The same job run twice must return the same bytes. The harness re-runs every backend and byte-compares repetitions; warm and cold cache runs must agree; seeds are fixed and cross-machine reproductions are byte-identical by assertion.
AI-drafted migrations are verified by output, not provenance. The gate compares bytes against the legacy reference, so a hallucination fails with a diff before it can ship.
Why we can claim this: before the migration engine, we built quant and ML infrastructure at scale and made every one of these mistakes the expensive way. We catalogued the lessons, then rebuilt them as machine-checkable gates. The library does not ask your team to be careful. It refuses to certify anything else.
A representative COBOL batch program, per-account aggregation over transaction files, certified on the shipped Rust engine across three tiers and four scales, up to one billion rows: the CPU tier, the vendor-neutral wgpu GPU tier, and the CUDA container tier. Every output byte-identical to the COBOL reference. Three tiers share one parallel chunked host read (0.3.1): the cudarc CUDA tier leads on NVIDIA (68.8x at 1B, 8.75s), the wgpu tier holds 61.3x on any GPU or none, and the CPU tier 28.1x with no GPU.
| Scale | COBOL (baseline) | CPU tier (Rust) | GPU tier (wgpu, any GPU) | GPU tier (CUDA) |
|---|---|---|---|---|
| 1M rows | 1.00x | 26.3x | 39.5x | 39.5x |
| 10M rows | 1.00x | 48.5x | 48.5x | 44.5x |
| 100M rows | 1.00x | 25.5x | 36.1x | 60.4x |
| 1B rows | 1.00x | 28.1x | 61.3x | 68.8x |
Wall time in seconds, measured, lower is better
| SCALE | COBOL | CPU TIER | GPU TIER | GPU TIER |
| | (BASELINE) | (RUST) | (WGPU) | (CUDA, CUDARC) |
+-----------+-------------+-------------+-------------+-----------------+
| 1M ROWS | 0.79 | 0.03 | 0.02 | 0.02 |
| 10M ROWS | 5.34 | 0.11 | 0.11 | 0.12 |
| 100M ROWS | 55.59 | 2.18 | 1.54 | 0.92 |
| 1B ROWS | 601.56 | 21.40 | 9.82 | 8.75 |
+-----------+-------------+-------------+-------------+-----------------+The honest detail: the read path is the whole game, and all three tiers now share the same 8-thread parallel chunked reader (0.3.1). The cudarc CUDA tier holds 68.8x at 1B rows (8.75s against the COBOL reference's 601.6s), the wgpu tier 61.3x on the same card or none, and the CPU tier 28.1x with no GPU. The RAPIDS container the cudarc tier replaces measured 0.2x at 1M and 8.9x at 1B; those numbers are provenance in the annex, and the container remains the escape hatch for arbitrary jobs. The vendor-neutral wgpu tier is byte-exact on NVIDIA, and on software Vulkan with no GPU at all: the same binary runs on AMD, Intel, Apple, and the web. We publish the crossover because it feeds profiling, not verdicts: the ratios say what is worth testing on each tier. The migration team balances infrastructure and cloud options, job complexity, and batch size to choose the best value-for-money target state. You never pay for acceleration that does not accelerate.
The test every migrated platform must pass: the day demand hits ten times normal. Tax time for a revenue agency. Month-end for a bank.
Migrated online workloads become stateless, horizontally-scalable services behind load balancers. Auto-scaling on request rate and latency SLOs; the data tier scales independently. Capacity is rehearsed against replays of captured production peak traffic.
GPU and CPU node pools pre-warm before the season opens and expand with the work queue. Spot fleets add cost-efficient burst capacity for checkpointable jobs; reserved capacity guarantees the floor. Sharded workloads add shards.
For every peak season we deliver the demand forecast from your run statistics, the capacity plan, the pre-warm runbook, SLOs with alerting, and the seasonal cost model. Peak days become a planned, budgeted, rehearsed event.
Beyond one GPU: workloads shard by business key (account, customer, policy), never by time, preserving inter-row semantics per shard. On commodity hardware the cudarc CUDA tier processed 100M rows in 0.92 seconds and 1B rows in 8.75 seconds end to end (60.4x and 68.8x the compiled COBOL baseline), the wgpu tier 1.54s and 9.8s (36.1x and 61.3x), and the CPU tier 2.18s and 21.4s. Larger estates partition across GPUs and nodes with near-linear scaling. Absolute seconds vary by machine; the ratios travel.
A representative estate, end to end, in six months. The calendar is fixed; the scope scales through parallel migration waves, each one safe because every function carries its own byte-exact proof.
| Program phase | Weeks | What happens |
|---|---|---|
| Grab + Review (discovery) | 1–4 | Code and documentation intake; AI-assisted inventory; hot-path ranking; data-interface catalog; replication test environment |
| Rebuild + Deploy + Migrate data | 5–16 | Parallel migration waves: every function re-implemented or rehosted on its tier and equivalence-proven before it proceeds |
| Test + shadow run | 17–20 | Dual-run against production through a full business cycle, reconciled continuously |
| Roll over + decommission | 21–24 | Per-function cutover, parallel-run sign-off, decommissioning, handover |
| Steady state | 25+ | Your team runs it on the open engine: continuous equivalence monitoring, seasonal peak plans, and drift failing loudly with a diff. We stay on hand if you want us. |
A worked example: nightly batch of 100M transactions, 3 hours of daily processing, one L40S-class GPU instance (18,176 CUDA cores) plus one CPU instance, 2 TB object storage, 200 GB monthly egress.
Roughly $380/month on AWS on-demand, before spot and commitment discounts: an 87–95% reduction against a conservative $3,000–8,000/month mainframe allocation. Commodity and non-NVIDIA GPU capacity generally prices below dedicated NVIDIA instances, and the wgpu tier runs on either, so the profiling step prices the difference per estate.
Fixed-fee, value-anchored pricing - quoted against your assessed function inventory, not hours, and shared at proposal stage. The acceptance criterion is contractual and unchanged: byte-exact equivalence and the benchmark evidence.
Every engagement begins with a fixed-price proof trial: one representative job from your estate, reproduced byte-exact on your hardware, benchmarked across CPU and any GPU, with the gate demonstrated live. The trial fee is credited in full against the first migration wave.
Acceptance criteria are contractual: byte-exact equivalence and the benchmark evidence. All figures are indicative planning ranges, not quotes.
Everything below you can do without us. The engine is free, the gate is in the binary, and the run records are yours to keep. Bylazora is who you call when you want the exit run with you: someone accountable for the proof, the waves, and the cutover.
One representative job from your estate, and an afternoon. Byte-exact reproduction on your own hardware, benchmarked across CPU and any GPU, with the gate demonstrated live. No production change. Fixed price, credited in full against the first wave.
Your estate moves in waves. Every function is re-implemented or rehosted onto its tier and equivalence-proven before it is allowed to proceed. Nothing advances on a promise.
Shadow running against production through a full business cycle, reconciled continuously, then per-function cutover. Every step is reversible until you sign it off.
The run records, the gate's verdicts, and the dual-run reconciliation stream: the evidence your steering committee and your auditor actually ask for. Produced by the engine on your estate, and kept by you.
If you would rather do it yourself, that is the point of the whole project: clone the engine, run the gate, and the sample migration shows the entire flow. No licence is needed for AGPL use, and no part of this page requires us.
Email: [email protected]
Read The Engine The Governed Exit (method) The Evidence Annex Why migrations fail
*** END OF SCREEN ***