The migration you can prove · Open source, AGPL · Proof, not percentages

The migration
you can prove.

Bylazora proves a mainframe migration is correct before it goes live. The migrated system must reproduce the legacy output exactly, to the byte, or the migration is not accepted: no automation percentages, no assurance by inspection, and no difference found in production, where it costs the most. The engine is open source, free at any scale, and runs on the commodity hardware and cloud you already buy.

Equivalence gate, 1B rows, per-account aggregation vs the COBOL reference

cpu     28.1x    21.40s   IDENTICAL
wgpu    61.3x     9.82s   IDENTICAL
cuda    68.8x     8.75s   IDENTICAL

3/3 backends IDENTICAL, 0 mismatches

The business case

A mainframe estate carries three costs at once: the risk of a migration that goes wrong, the bill for staying where you are, and the clock on the people who understand the code. Bylazora answers the first, and changes the arithmetic on the other two.

What it is

A standard and a tool. The standard: a migrated workload's outputs must equal the legacy COBOL reference byte for byte, or the migration is not accepted. The tool: an open-source gate that checks exactly that, on any job's outputs, whoever or whatever produced them. It is the difference between being told a migration is fine and being shown that it is. How you would use it.

Why it is on your desk

Migration is the highest-stakes project an enterprise runs, and the industry's failures are public: TSB's 2018 migration cost 330 million pounds and locked 1.9 million customers out. Those failures share one cause, which is that the work was validated by inspection. Proof is cheaper than an outage, and far cheaper than a regulator asking who checked.

The bill you keep paying

Mainframe software is typically 30–50% of the mainframe budget, large estates pay roughly $1,000–2,000 per MIPS per year, and pricing trends up. A worked 100M-transaction nightly batch runs near $380 a month on commodity cloud hardware: an 87–95% reduction against a conservative mainframe allocation. The migration pays for itself before the estate is finished.

The clock you are on

An estimated 220–800 billion lines of COBOL remain in production. Roughly 10% of COBOL developers retire each year and most universities no longer teach it. The estate is not the emergency; the people who understand it are. Every year of delay narrows who can be held accountable for the change.

We are equally honest about the other side: mainframes are reliable and cheap per workload. The argument is the licensing trajectory, the skills cliff, and the strategic cost of lock-in, not that the mainframe is broken. And there is nothing to procure to evaluate any of it: the engine is free, and the proof trial takes one job and an afternoon.

Three paths off the mainframe

The workload's own characteristics decide which path it takes. We deliver all three.

Move off COBOL

Business logic re-implemented in a modern stack (a Rust core with parallel chunked reads and GPU-native kernels) on commodity hardware, NVIDIA or not. Removes the COBOL dependency entirely, unlocks modern tooling and AI integration.

Take COBOL to the cloud

The same source, compiled by open-source GnuCOBOL on commodity instances, with JCL batch orchestration re-expressed as cloud-native schedulers. Fastest and lowest-risk; modernize function by function later.

The AI-enabled route

AI reads the estate: code, copybooks, JCL, runbooks. It extracts business rules, and drafts translations and test suites. Humans review and sign every artifact; the equivalence gate verifies it. AI proposes; the gate disposes. Your agent can drive the engine through MCP today.

Workload characteristicPath
High data volume, aggregations, ETL-heavyMove off COBOL: GPU/CPU tier
Logic-dense, low volume, thin test coverageRehost COBOL on cloud
Regulatory freeze, zero tolerance for changeRehost COBOL on cloud
Medium complexity, staged transitionAI-assisted, then per-function decision

How you would actually use it

A migration is a queue of jobs, and every job is the same loop. The gate does not care what language the replacement is written in, who wrote it, or whether an agent drafted it: it compares outputs, byte for byte. The reference directory defines the contract.

The loop, once per job

  1. Scaffold the job. migrate new generates the workspace: the contract, the input directory, the reference capture script, and a Rust target skeleton.
  2. Seal the reference. migrate reference runs the legacy program once and seals its output files as the contract. It refuses to reseal without --force, so the goal posts cannot quietly move.
  3. Rewrite the routine in the target. By hand, or drafted by an agent. The skeleton names the inputs and outputs; the logic is the work.
  4. Run the gate. migrate verify builds the target, runs it, and compares byte for byte. Content that differs, files missing, files the reference never declared: it names each one, and appends the verdict to the job's trail.
  5. Fix the diff and repeat until the verdict is identical. Then dual-run, then cut over per function, with the gate on every nightly batch afterwards.
# one job becomes a sealed workspace
$ bylazora-core migrate new batch-txn \
    --input transactions.csv --input balances.csv \
    --output final_balances.csv --output summary_report.csv \
    --copybook TXNREC.cpy --cobol-source BATCHTXN.cob

# the legacy output is the contract
$ bylazora-core migrate reference batch-txn
sealed reference: 2 file(s)

# write the routine, then run the gate
$ bylazora-core migrate verify batch-txn
IDENTICAL

# the verdict trail is append-only
$ bylazora-core migrate status batch-txn
job batch-txn (rust)
  inputs : transactions.csv, balances.csv
  outputs: final_balances.csv, summary_report.csv
  sealed : yes
  verdict: IDENTICAL (attempt 1, 0 diffs)

What it is not

It is not a COBOL translator. There is no compiler or transpiler in it: the copybook parser reads data layouts, not programs. The rewrite is yours, your team's, or your agents'. What the engine supplies is the part that decides whether a rewrite is acceptable.

Where the runtime stands

The benchmark runtime is one workload shape today, compiled in and byte-exact: per-account aggregation over transaction files. Estate intake, reading copybooks, DB2 schemas and JCL into job specifications, and pluggable backends are roadmap, not shipped. The gate itself is general now, and it is the piece that is hard to replace.

The worked example is in the repository: sample/ is a sealed migrate workspace, a COBOL batch job with its GnuCOBOL capture and its migrated Rust target. CI re-derives the reference from the COBOL, asserts the seal, and runs the gate, so a single differing byte fails the build. That is the template. Copy the shape, swap in your job.

Point your coding agent at the gate

The MCP server ships inside the same binary. Point Claude Code, Cursor, Copilot or any MCP client at it and your agent can drive the engine: draft a migration, run it on your data, and read the verdict back as a diff. What it cannot do is mark anything proven. Only the validator does that, byte for byte, against your legacy reference. The agent proposes; the gate disposes.

Why this is the point

Every other AI coding tool asks you to trust the model. This one makes the model pass a gate. A hallucinated translation is not a style argument here: it is a byte difference, and the difference is the feedback the agent iterates against. Your assistant can be as inventive as it likes while drafting, because nothing reaches production without reproducing the legacy output exactly.

That matters most where the work is worst. A real estate is not one program, it is thousands, each with its own copybook, fixed-point fields, batch window and dead code. The gate turns that from an act of faith into a queue of diffs, and the queue is what your team actually reviews.

The rule pack teaches the agent the invariants before it drafts a line, and the MCP server is open source with the rest of the engine. The rule pack, a worked workspace template, and the one-command wiring ship on npm: npx bylazora setup claude. Get the binary for every platform.

# wire a client in one command
$ npx bylazora setup claude
wrote .mcp.json

# or serve the tools directly
$ bylazora mcp
JSON-RPC 2.0 over stdio, no network

# the config it writes: node plus the CLI;
# the engine path is discovered, never
# hardcoded, and works on every platform
{
  "mcpServers": {
    "bylazora": {
      "command": "node",
      "args": [".../cli.js", "mcp"]
    }
  }
}

# the tools the agent gets
validate        byte-compare against the
                legacy reference
bench           run a tier, report wall time
copybook_parse  read a COBOL copybook
migrate_verify  build + gate a job workspace
migrate_status  the contract and the verdict

# the one thing no tool can do
mark a run proven    <- the validator only

This is what the byte-exact gate was built for. A model that drafts a migration is useful; a model whose draft has to survive a byte comparison with the legacy system is trustworthy. Those are different claims, and only one of them can be checked.

Get the engine

One binary, every platform. Prebuilt and signed for the platforms below, and published as source on crates.io, so any machine with a Rust toolchain can build it too. Every binary carries a sha256 and an Ed25519 signature, verifiable offline against the published public key.

PlatformWhat it carries
Linux x86_64 (glibc)CPU, wgpu and the CUDA tier
Linux x86_64 (musl, static)CPU and wgpu; runs on any distro
Linux aarch64 (ARM64)CPU and wgpu; Graviton and ARM cloud
macOS, Apple SiliconCPU and wgpu
macOS, IntelCPU and wgpu
Windows x86_64CPU and wgpu; the sample gate itself stays bash on Linux

Which tier runs where

TierRuns on
CPUeverywhere
wgpuany GPU: NVIDIA, AMD, Intel, Apple - or no GPU at all, through software Vulkan
CUDANVIDIA hardware and drivers only, and only in the Linux x86_64 binary

The honest NVIDIA point: CUDA is an optional acceleration path, never a requirement. The wgpu tier is byte-exact on the same NVIDIA cards, which is why it ships on every platform while CUDA ships on one. An estate without NVIDIA hardware loses nothing but a fraction of headline speed, and the gate's verdict is identical either way.

# from crates.io (any platform with Rust)
cargo install bylazora-core

# or the signed binary for your platform
# https://github.com/bylazora/bylazora/releases

# the agent CLI on npm: setup, rules,
# template, and the delegated loop
npm install -g bylazora

# wire your agent in one command
bylazora setup claude

# then point your agent at the gate
bylazora mcp

The governed migration cycle

Seven phases. Governance artifacts at every step, inspectable by you at any time.

  1. Grab. We take custody of your code and documentation with provenance and access controls.
  2. Review. AI-assisted analysis builds the function inventory: what each program does, what it touches, what is dead code.
  3. Rebuild. Each function is re-implemented, recompiled, or AI-drafted then engineered onto its assigned tier. Logic is preserved 1:1 in semantics.
  4. Deploy. Functions become containerized jobs on the target platform, orchestrated by a scheduler that preserves batch windows and dependencies.
  5. Migrate data. DB2 tables, VSAM files, and generation datasets move to canonical formats with fixed-point decimal semantics preserved exactly, at the precision the schema declares. No float drift.
  6. Test. The equivalence gate: every function must reproduce its legacy output byte-for-byte, continuously enforced. One differing byte is a failure.
  7. Roll over. Dual-run shadowing against production, reconciliation, then per-function cutover. Every step reversible until sign-off.

The engine is free. The run is how we get paid.

The byte-exact gate, the three tiers, and the parsers are open source: AGPL for the engine, Apache-2.0 for the parsers. Anyone can read the validator, run it, and prove their own migration, without asking us for anything. Bylazora earns its keep on two things: the commercial licence, for estates that cannot accept AGPL, and doing the migration with you when you would rather not do it alone.

The open engine

AGPL-3.0 / Apache-2.0

Clone it, build it, hand it to your agents. The gate is the product and the product is free: byte-exact verification, three compute tiers, the C ABI, the MCP interface, and the agent rule packs. Forever.

GitHub Sample migration

SHA-256 + Ed25519 signed; verifiable offline with the public key.

The commercial licence

USD 4,900/year per production team

For estates that cannot accept AGPL, or that embed the engine in closed products: a commercial licence with support, covering the organisation's own and client workloads at any scale and any number of installs. Offline-signed key, verified locally, air-gapped by construction.

How the licence works

The engagement

Run with you, fixed fee

Everything the engine does, you can do yourself, and we will tell you so. When you would rather have it run with you: the proof trial, the migration waves, dual-run and cutover, and the assurance pack. Quoted against your assessed function inventory.

What we actually do

What is in the box: the byte-exact validator, the three-tier engine (CPU, wgpu, cudarc), the C ABI, the MCP server, the copybook parser and DB2 importer, the judge harness, the sample migration, and the evidence annex. What stays ours: the playbook, the corpora, the replication recipes, and pricing, the know-how, not the code. And the AI boundary: your assistant can operate the engine through its MCP interface, propose, and measure. It cannot mark a job proven. Only the validator can.

Proof, not percentages

Vendors market automation rates such as “99.7% automated”. An automation rate is a claim about effort. It says nothing about correctness.

Our acceptance criterion is mechanical: exact fixed-point arithmetic (money stays integer cents, provably exact), byte-exact outputs (field values, totals, ordering, formatting), and continuous enforcement (the check runs in CI, in benchmarks, and during dual-run).

We do not promise a percentage. We promise a measurement.

compare_outputs(legacy, migrated)
final_balances.csv     IDENTICAL
summary_report.csv     IDENTICAL

60/60 records validated
0 mismatches

Not a test at the end

The engine is the runtime of the new solution. Six positions in a migration, one tool:

SpecifyGolden referenceBuild inside the gateRoute by benchmarkCut over, runningStay proven
Every job becomes a specification with a byte-level output contractLegacy outputs and timings captured once - the contract everything is built againstDevelopers build backends of the engine; every iteration returns a byte diff, not a hunchThe harness measures each backend on candidate hardware; profiling picks the target stateThe same binary that validated the jobs runs them; dual-run reconciles continuouslyEvery nightly run passes the gate; drift fails loudly with a diff

The migrated system does not merely pass a test once. It runs on the engine that tests it, and the gate is the safety system of the new estate.

The correctness contract

Three failure classes break every home-grown migration - and one more worry breaks every AI-drafted one. Each is neutralised here by a gate, not a habit.

Floating-point drift

Float intermediates silently corrupt money. The legacy reference computes in exact fixed-point and the validator requires identical bytes: no epsilon, no tolerance. A float artifact is a failed job with a diff, and a planted corpus that crosses 2^53 proves the gate catches it.

Future-data leakage

Windows that see tomorrow corrupt every calculation downstream. Backends run as pure functions of their declared inputs in fresh processes, windows are trailing-only by contract, and a planted look-ahead trap fails any implementation that peeks.

Non-idempotent runs

The same job run twice must return the same bytes. The harness re-runs every backend and byte-compares repetitions; warm and cold cache runs must agree; seeds are fixed and cross-machine reproductions are byte-identical by assertion.

Hallucinated code

AI-drafted migrations are verified by output, not provenance. The gate compares bytes against the legacy reference, so a hallucination fails with a diff before it can ship.

Why we can claim this: before the migration engine, we built quant and ML infrastructure at scale and made every one of these mistakes the expensive way. We catalogued the lessons, then rebuilt them as machine-checkable gates. The library does not ask your team to be careful. It refuses to certify anything else.

The evidence

A representative COBOL batch program, per-account aggregation over transaction files, certified on the shipped Rust engine across three tiers and four scales, up to one billion rows: the CPU tier, the vendor-neutral wgpu GPU tier, and the CUDA container tier. Every output byte-identical to the COBOL reference. Three tiers share one parallel chunked host read (0.3.1): the cudarc CUDA tier leads on NVIDIA (68.8x at 1B, 8.75s), the wgpu tier holds 61.3x on any GPU or none, and the CPU tier 28.1x with no GPU.

ScaleCOBOL (baseline)CPU tier (Rust)GPU tier (wgpu, any GPU)GPU tier (CUDA)
1M rows1.00x26.3x39.5x39.5x
10M rows1.00x48.5x48.5x44.5x
100M rows1.00x25.5x36.1x60.4x
1B rows1.00x28.1x61.3x68.8x

Wall time in seconds, measured, lower is better

The honest detail: the read path is the whole game, and all three tiers now share the same 8-thread parallel chunked reader (0.3.1). The cudarc CUDA tier holds 68.8x at 1B rows (8.75s against the COBOL reference's 601.6s), the wgpu tier 61.3x on the same card or none, and the CPU tier 28.1x with no GPU. The RAPIDS container the cudarc tier replaces measured 0.2x at 1M and 8.9x at 1B; those numbers are provenance in the annex, and the container remains the escape hatch for arbitrary jobs. The vendor-neutral wgpu tier is byte-exact on NVIDIA, and on software Vulkan with no GPU at all: the same binary runs on AMD, Intel, Apple, and the web. We publish the crossover because it feeds profiling, not verdicts: the ratios say what is worth testing on each tier. The migration team balances infrastructure and cloud options, job complexity, and batch size to choose the best value-for-money target state. You never pay for acceleration that does not accelerate.

Peak-proven scaling

The test every migrated platform must pass: the day demand hits ten times normal. Tax time for a revenue agency. Month-end for a bank.

Online demand

Migrated online workloads become stateless, horizontally-scalable services behind load balancers. Auto-scaling on request rate and latency SLOs; the data tier scales independently. Capacity is rehearsed against replays of captured production peak traffic.

Batch demand

GPU and CPU node pools pre-warm before the season opens and expand with the work queue. Spot fleets add cost-efficient burst capacity for checkpointable jobs; reserved capacity guarantees the floor. Sharded workloads add shards.

The capacity contract

For every peak season we deliver the demand forecast from your run statistics, the capacity plan, the pre-warm runbook, SLOs with alerting, and the seasonal cost model. Peak days become a planned, budgeted, rehearsed event.

Beyond one GPU: workloads shard by business key (account, customer, policy), never by time, preserving inter-row semantics per shard. On commodity hardware the cudarc CUDA tier processed 100M rows in 0.92 seconds and 1B rows in 8.75 seconds end to end (60.4x and 68.8x the compiled COBOL baseline), the wgpu tier 1.54s and 9.8s (36.1x and 61.3x), and the CPU tier 2.18s and 21.4s. Larger estates partition across GPUs and nodes with near-linear scaling. Absolute seconds vary by machine; the ratios travel.

The six-month program

A representative estate, end to end, in six months. The calendar is fixed; the scope scales through parallel migration waves, each one safe because every function carries its own byte-exact proof.

Program phaseWeeksWhat happens
Grab + Review (discovery)1–4Code and documentation intake; AI-assisted inventory; hot-path ranking; data-interface catalog; replication test environment
Rebuild + Deploy + Migrate data5–16Parallel migration waves: every function re-implemented or rehosted on its tier and equivalence-proven before it proceeds
Test + shadow run17–20Dual-run against production through a full business cycle, reconciled continuously
Roll over + decommission21–24Per-function cutover, parallel-run sign-off, decommissioning, handover
Steady state25+Your team runs it on the open engine: continuous equivalence monitoring, seasonal peak plans, and drift failing loudly with a diff. We stay on hand if you want us.

Indicative economics

The platform

A worked example: nightly batch of 100M transactions, 3 hours of daily processing, one L40S-class GPU instance (18,176 CUDA cores) plus one CPU instance, 2 TB object storage, 200 GB monthly egress.

Roughly $380/month on AWS on-demand, before spot and commitment discounts: an 87–95% reduction against a conservative $3,000–8,000/month mainframe allocation. Commodity and non-NVIDIA GPU capacity generally prices below dedicated NVIDIA instances, and the wgpu tier runs on either, so the profiling step prices the difference per estate.

Our engagement

Fixed-fee, value-anchored pricing - quoted against your assessed function inventory, not hours, and shared at proposal stage. The acceptance criterion is contractual and unchanged: byte-exact equivalence and the benchmark evidence.

Every engagement begins with a fixed-price proof trial: one representative job from your estate, reproduced byte-exact on your hardware, benchmarked across CPU and any GPU, with the gate demonstrated live. The trial fee is credited in full against the first migration wave.

Acceptance criteria are contractual: byte-exact equivalence and the benchmark evidence. All figures are indicative planning ranges, not quotes.

When you want it run with you

Everything below you can do without us. The engine is free, the gate is in the binary, and the run records are yours to keep. Bylazora is who you call when you want the exit run with you: someone accountable for the proof, the waves, and the cutover.

The proof trial

One representative job from your estate, and an afternoon. Byte-exact reproduction on your own hardware, benchmarked across CPU and any GPU, with the gate demonstrated live. No production change. Fixed price, credited in full against the first wave.

The migration waves

Your estate moves in waves. Every function is re-implemented or rehosted onto its tier and equivalence-proven before it is allowed to proceed. Nothing advances on a promise.

Dual-run and cutover

Shadow running against production through a full business cycle, reconciled continuously, then per-function cutover. Every step is reversible until you sign it off.

The assurance pack

The run records, the gate's verdicts, and the dual-run reconciliation stream: the evidence your steering committee and your auditor actually ask for. Produced by the engine on your estate, and kept by you.

If you would rather do it yourself, that is the point of the whole project: clone the engine, run the gate, and the sample migration shows the entire flow. No licence is needed for AGPL use, and no part of this page requires us.

Email: [email protected]

Read The Engine The Governed Exit (method) The Evidence Annex Why migrations fail

*** END OF SCREEN ***