The Clean Core Accelerator

A deterministic evidence scanner with token- and rule-based ABAP analysis maps custom-table access, RFC calls and dynpro patterns to concrete findings — before any AI runs. A defensible baseline you can take into an audit, not a black-box guess.

For most legacy programs the documentation was never written or is long gone, the process behind it was never described, and the person who built it has left. The source is the one document that still says what the thing does. A run reads it back in both directions — down into released SAP APIs for the developer, up into process, roles and procedure for the business — and hands both sides a draft to correct rather than a blank page.

Replacing unreleased database dependencies with officially released SAP APIs (e.g. I_Customer, API_PRODUCT_SRV) helps keep your ERP core upgrade-stable — reducing coupling between custom code and the core update cycle.

Matching unit tests are generated with the code — ABAP Unit doubles for RAP, or Express/Node suites for CAP — and executed in a sandboxed Node process (filesystem-scoped and time-limited). QA starts covered, not empty.

A transparency panel shows exactly why a route (RAP / CAP) and score were chosen: the deterministic router rationale, a confidence indicator, and the driving data-coupling findings by risk. Evidence you can defend.

A LOC-weighted treemap of detected ABAP objects grouped by module: tile size = share of the codebase, colour = worst criticality inside it. See at a glance which modules carry the most weight and the most risk.

Every signed evidence pack includes a Markdown ADR: the decision, the engine recommendation and any architect override, the rationale, considered options, scope & consequences, and known limitations.

Because every analysis is an immutable, signed run, the board deck can show a tamper-evident trend: Clean Core Score, findings and complexity deltas versus the previous run — remediation progress, not a re-editable slide.

Bring Your Own Key is optional: without it, every account gets 5 free transformations on a shared community key; with your own Google Gemini key, usage is unlimited. Your key is encrypted at rest with AES-256-GCM in a server-only store — never returned to the browser (only the last four characters are shown), and used solely via a secure server-side proxy.

Every AI call is proxied through a hardened server route: a strict model allowlist, a prompt-size cap, per-user rate limiting, and an MFA gate on sensitive actions. Provider keys never touch client code.

Under Google’s applicable Gemini API data-use terms, the code you send is not used to train Google’s foundational models. When you use your own key (BYOK), the terms of your own Google account apply. Your IP stays yours.

Optional S/4HANA connections are strictly read-only (OData metadata reads and test execution) — no write operations. Credentials are encrypted at rest (AES-256-GCM), stored server-side only and never returned to the browser; live connections are restricted to an administrator-managed allowlist; every live-tenant request is admin-approved before activation.

Every analysis is captured as an immutable, HMAC-signed “Run”. The evidence pack is generated and signed server-side, so a valid signature protects the integrity of the generated package; provenance is shown per evidence class.

Anyone can verify a pack’s manifest hash and signature. The AI narrative is deliberately excluded from the signed payload — the signature attests to evidence, not to free text.

Application storage and primary processing run in europe-west1 (Belgium). Account deletion runs an idempotent, multi-system erasure of your live database and authentication entries; residual encrypted backups age out within 30 days. AI and email subprocessors are disclosed separately under their own terms and transfer safeguards.

A Content-Security-Policy (with documented compatibility exceptions), server-side HTML sanitization, CI secret scanning, a dependency-audit gate and a CycloneDX SBOM generated by the security workflow. Only strictly necessary Firebase Auth storage — no analytics or marketing trackers.