The challenge
The core ran on a system whose original authors had retired. It worked, which was the problem: nobody could justify the risk of touching it, so every new product was built as another integration around the outside.
Two previous rewrite attempts had been cancelled. Both were big-bang cutovers, and both ran out of political capital before they ran out of code.
What we did
No rewrite. We put a facade in front of the core and moved capabilities behind it one at a time, so the old system and the new services served the same traffic during every migration step.
Each capability moved only once its replacement had run in shadow mode against production traffic for long enough to prove parity — including the edge cases the original team had encoded and never documented.
The order was chosen by risk, not by ease. The pieces that scared people most moved first, while the appetite to reverse them still existed.
Where it landed
Forty-plus services now sit behind the facade, with the remaining core reduced to a shrinking set of ledger operations on a documented path out.
The migration completed without a maintenance window. Not one customer-visible outage was attributed to it.
Something similar on your side? Tell us the shape of it.