Approach
- Assessed architecture and risk using DORA metrics and RFC reviews.
- Introduced a strangler‑fig pattern to incrementally carve out domains.
- Established contract tests and parity checks for dual‑run rollout.
- Instituted SAST/DAST, SBOM, and zero‑trust controls in CI/CD.