# The Obsession with Environmental Containment

We are awake fixing this so you can sleep.

When confronting a ten-year-old monolithic core like `app-main.php` or `dashboard.php`, the instinct is often to burn it down. Static analyzers and FCG Auditors frequently flag these procedurally-written, tightly-coupled legacy systems as "Critical Security Risks". They are technically correct. However, we recognize this code not as a terminal vulnerability, but as "Dark Matter"—a heavy, unseen mass of maintenance debt that functions securely solely because of its environment. The containment does not deny the risk; it reclassifies it from a Critical Vulnerability to Managed Debt.

---

## The Mess: Dark Matter and Managed Debt

Legacy systems are filled with raw SQL queries, intertwined HTML, and pervasive global variables like `$_SESSION`. 

```php
// The Dark Matter
require_once 'database.php';
$result = mysql_query("SELECT * FROM users WHERE id = " . $_SESSION['user_id']);
echo "<div>" . $result['name'] . "</div>";
```

Auditors scream at this code. Technically, they are right: `mysql_query` is dead and direct concatenation is a classic injection vector. But the auditors see the symptom; we control the context. A naive approach would be a complete rewrite from scratch, risking a catastrophic loss of implicit business logic. But a rewrite is a gamble we do not take.

---

## The Strategy: The Strangler Fig & Environmental Containment

Instead of destroying the monolith, we enclose it within a modern armored vault. This is Environmental Containment. We leverage the **Strangler Fig** pattern to keep the legacy state intact under the umbrella of a modern, secure Kernel.

Our legacy core is never exposed directly. It is shielded by two critical barriers:

1. **Initialization Hijacking**: Every legacy script is intercepted at boot. As we detailed in [The Sovereign Kernel](https://kr.dammgo.com/blog/the-sovereign-kernel), the V5 Kernel seizes the lifecycle, forcing environment variable loads and dependency injections before the old code even wakes up.
2. **The Identity Bridge**: Before any business logic executes, the perimeter guardian (`app-lock.php`) sanitizes the state. Our [Sovereign Bridge](https://kr.dammgo.com/blog/the-sovereign-bridge) intercepts cryptographic hashes and strictly configures the tenant context. 

---

## The Craft: Securing the Perimeter

By the time the legacy code reads `$_SESSION['user_id']`, the session data has already passed through strict typing, cryptographic validation, and `session_write_close()` in the Kernel. The injection is impossible not because the query is inherently safe, but because the data is no longer controllable by the user.

```php
// app-lock.php - The Toll
require_once __DIR__ . '/Kernel.php';
$kernel = new \Erpbsg\Legado\Kernel(dirname(__DIR__));

// 1. Validates .env, cryptographic signature, and tenant context
$kernel->bootstrapLegacy();

// 2. Converts $_SESSION into a clean integer and closes writing
setupTenantSession($kernel->impersonateTenant());
```

No one executes a legacy query without paying the V5 toll. The risk is reduced to mere maintenance debt, entirely contained within a secure execution context.

---

## The Result: The Sovereign Vault

We do not rewrite; we contain and strangle. By maintaining strict environmental boundaries, we ensure that what static analysis sees as a critical vulnerability is, in reality, a safely managed artifact. The monolith is contained, operating inside a vault while being slowly absorbed by the new architecture. And if anything ever attempts to escape this vault, our [Sentinel guardian](https://kr.dammgo.com/blog/the-sentinel-guardian) generates an Incident ID, traps the failure, and enforces the final layer of containment.

---
**dammgo labs** - _Engineering as Art._