Description:

The Agentic Development Orchestration Module (ADOM), developed by AutoBridge Systems, is a secure, end-to-end agentic AI pipeline purpose built for the demands of government and defense grade software delivery. This session focuses on the challenge at the center of DAFITC Track 1: modernizing the mission-critical legacy systems the Air Force depends on, systems written in COBOL, FORTRAN, MUMPS, JCL, and assembler, maintained by a workforce that is retiring, and documented nowhere except in the source code itself.

The session is built around a principle that separates ADOM from conventional modernization tools: legacy modernization is not a code translation problem. Line by line conversion is a multistep chain that introduces error at every step and faithfully reproduces the legacy system's technical debt in the new codebase. ADOM takes the opposite approach. Its Refactor pipeline treats legacy code as a knowledge source to be analyzed, not a text to be translated. It extracts the business logic, data relationships, and undocumented behaviors a system depends on, validates that knowledge with subject-matter experts, and produces a clean, verified specification. That specification, not the legacy code, becomes the input to the build. The modern system is built fresh from a description of what it must do, carrying forward the logic, not the debt.

The core of the session follows a single thread end to end: how a legacy codebase becomes a clean specification, and how that specification is handed off to ADOM's agentic build pipeline to become a modern, deployed, authorization ready application.

Part One: Refactoring Legacy Code into a Verified Specification

Attendees will walk through ADOM's six-phase Refactor pipeline and the human checkpoints that gate it:

• Holistic analysis of polyglot systems. The pipeline indexes and parses an entire codebase across all languages at once, maps cross language dependencies, and enforces 100 percent index coverage before analysis can close. Every parse failure is triaged as decorative, structural, or unknown, with zero tolerance for an unanalyzed load-bearing file, so the system is never modernized on the basis of a partial reading.
• Capturing what a rewrite would miss. An Anomaly Register surfaces the bug as feature behaviors, environmental dependencies, and implicit side effects that downstream systems silently rely on, the behaviors that cause a technically correct rewrite to fail in production.
• Extraction you can trust. Every business rule is extracted with a line level citation back to the frozen source mirror, and rules parsed deterministically from a known grammar are explicitly separated from AI-drafted advisory rules, so model inference never carries the same authority as grammar verified fact. Dual subject matter expert validation confirms the logic before it advances.
• The specification as the deliverable. Phase 3 consolidates everything, business rules, workflows, data schemas, API contracts, security requirements, and the anomaly register, into a single unified build specification. A confidence dashboard maps every legacy element to its corresponding specification element and reports honestly, showing "calibrating" rather than inventing a number where data is thin. A human confirms the target architecture and approves the specification, in full or domain by domain, before any code is written.

Part Two: The Handoff, Where ADOM Builds the Modernized Application

This is the pivot of the session. Once the specification is approved, it crosses into ADOM's standard build pipeline, the same proven, security-hardened pipeline ADOM uses to produce any new application. The session demonstrates how the refactored specification drives the seven-phase ADOM lifecycle: Specify, Plan, Task, Build, ATO, Deploy, and Configure.

• Specification becomes the boundary. The generated specification itself constrains the agent workforce. ADOM's specialized agents, Frontend, Backend, Database, API, Security, and QA, build exactly what the spec defines, no more and no less, under the orchestration of a PM agent.
• Verification against the legacy system. As each module is built, ADOM's QA agent validates it against a legacy-derived test suite. Through a three-layer test architecture, the final layer compares the new system's outputs directly against the legacy system, using live sandbox comparison, historical I/O replay, shadow deployment, or pilot-domain observation. This turns the central fear of any modernization, that the new system will behave differently, into a measured, evidenced answer before cutover.
• Compliance generated from the build itself. ADOM's accelerated ATO phase, designed around the NIST Risk Management Framework, runs automated security scans, maps evidence to NIST 800-53 controls, generates the System Security Plan, control mappings, Security Assessment Report, and Plan of Action and Milestones, and assembles an eMASS ready authorization package. Because the evidence is drawn directly from the system ADOM just built, the package is populated with real system data rather than template language. ATO functions as a blocking quality gate between Build and Deploy, so the modernized application arrives authorization-ready, with the compliance evidence already assembled.

Throughout: Governance, Traceability, and Human Control

A deterministic orchestrator runs the mechanical work but stops at every human gate, never approving a spend or signing off on its own. Per-agent tool allow-lists make it architecturally impossible for an agent to act outside its lane, a four-layer prompt-injection defense screens every model interaction, and consequential actions require multiple human approvers, each cryptographically signed into a tamper-evident chain. Every action, from rule extraction to code commit to deployment, lands in immutable, timestamped audit logs, producing a complete chain of custody from legacy line to modern artifact to authorization evidence, the documentation required for compliance reviews, Inspector General audits, and program oversight.

Attendees will leave with a concrete understanding of how a legacy system becomes a modern, authorized application through a single governed pipeline, and how agentic AI can be responsibly deployed in the defense software ecosystem, not as a black box, but as a transparent, auditable, and governable modernization partner.

Tags:
Legacy Modernization; Agentic AI; Code Refactoring; RMF; ATO; eMASS; Behavioral Equivalence; Human-in-the-Loop; Software Supply Chain