The Obsession with Environmental Containment

We are awake fixing this so you can sleep.

When confronting a ten-year-old monolithic core like app-main.php or dashboard.php, the instinct is often to burn it down. Static analyzers and FCG Auditors frequently flag these procedurally-written, tightly-coupled legacy systems as “Critical Security Risks”. They are technically correct. However, we recognize this code not as a terminal vulnerability, but as “Dark Matter”—a heavy, unseen mass of maintenance debt that functions securely solely because of its environment. The containment does not deny the risk; it reclassifies it from a Critical Vulnerability to Managed Debt.

The Mess: Dark Matter and Managed Debt

Legacy systems are filled with raw SQL queries, intertwined HTML, and pervasive global variables like $_SESSION.

// The Dark Matter
require_once 'database.php';
$result = mysql_query("SELECT * FROM users WHERE id = " . $_SESSION['user_id']);
echo "<div>" . $result['name'] . "</div>";

Auditors scream at this code. Technically, they are right: mysql_query is dead and direct concatenation is a classic injection vector. But the auditors see the symptom; we control the context. A naive approach would be a complete rewrite from scratch, risking a catastrophic loss of implicit business logic. But a rewrite is a gamble we do not take.

The Strategy: The Strangler Fig & Environmental Containment

Instead of destroying the monolith, we enclose it within a modern armored vault. This is Environmental Containment. We leverage the Strangler Fig pattern to keep the legacy state intact under the umbrella of a modern, secure Kernel.

Our legacy core is never exposed directly. It is shielded by two critical barriers:

Initialization Hijacking: Every legacy script is intercepted at boot. As we detailed in The Sovereign Kernel, the V5 Kernel seizes the lifecycle, forcing environment variable loads and dependency injections before the old code even wakes up.
The Identity Bridge: Before any business logic executes, the perimeter guardian (app-lock.php) sanitizes the state. Our Sovereign Bridge intercepts cryptographic hashes and strictly configures the tenant context.

The Craft: Securing the Perimeter

By the time the legacy code reads $_SESSION['user_id'], the session data has already passed through strict typing, cryptographic validation, and session_write_close() in the Kernel. The injection is impossible not because the query is inherently safe, but because the data is no longer controllable by the user.

// app-lock.php - The Toll
require_once __DIR__ . '/Kernel.php';
$kernel = new \Erpbsg\Legado\Kernel(dirname(__DIR__));

// 1. Validates .env, cryptographic signature, and tenant context
$kernel->bootstrapLegacy();

// 2. Converts $_SESSION into a clean integer and closes writing
setupTenantSession($kernel->impersonateTenant());

No one executes a legacy query without paying the V5 toll. The risk is reduced to mere maintenance debt, entirely contained within a secure execution context.

The Result: The Sovereign Vault

We do not rewrite; we contain and strangle. By maintaining strict environmental boundaries, we ensure that what static analysis sees as a critical vulnerability is, in reality, a safely managed artifact. The monolith is contained, operating inside a vault while being slowly absorbed by the new architecture. And if anything ever attempts to escape this vault, our Sentinel guardian generates an Incident ID, traps the failure, and enforces the final layer of containment.

dammgo labs - Engineering as Art.