01 · Why
Migration and security usually invent two different truths
Most modernization tools pick a pair — PHP→Node, Java→Go, COBOL→something — and encode meaning inside a one-off converter. Most app firewalls invent a second model of “what the app is” from packets alone. The two stories diverge the moment AI drafts a change, a framework edge case appears, or live traffic drifts from the last migration memo.
Chrysalis separates those jobs on purpose, then forces them to share a bar:
- One readable genome for what the app claims to be (CWL ↔ WebIR).
- One translator that may propose emits — but must not invent finish (Convert).
- One live identity learned from certified traffic (Helix), optionally compared to that genome.
If a claim cannot be proven, it stays a labeled hole. We do not ship façades. Humans and machines can read the same model. Recorded traffic disposes what actually ships.
02 · Shape
Three pillars. One middle. Shared bar.
CWL matures as a language — grammar, RFCs, parsers, gold fixtures — not as “whatever Convert needed this sprint.” Convert and Secure consume that language; they do not redefine it under migration or firewall deadlines.
┌─────────────┐
│ CWL │ language + specs + tooling
│ (mature) │ DNA of the web
└──────┬──────┘
produce / │ consume / bridge
consume │
┌───────────────┼───────────────┐
▼ │ ▼
┌───────────────┐ │ ┌───────────────┐
│ Convert │◄──────┴──────►│ Secure │
│ (translator) │ shared bar │ (Helix) │
└───────────────┘ propose / └───────────────┘
verify / holesLanguage of record
Routes, pages, data, UI, effects, honest holes. Maps 1:1 to WebIR. Humans audit; machines emit.
Semantic middle
Shared intermediate representation. Peel once, emit many — not a private IR per language pair.
Dispose
Replay and DNA cutover decide. AI may draft; oracles and certified traffic dispose.
03 · CWL
How Chrysalis Web Language works
CWL (Chrysalis Web Language) is not another web framework and not a general-purpose programming language. It is the canonical inscription of web-app identity — what the app is on the wire and on the page — written so people can audit it and so Convert / Secure can consume the same meaning.
Tip 1.0.26 is public at AgenticOp-io/chrysalis-cwl. CWL maps 1:1 to WebIR: WebIR is the semantic IR; CWL is the readable surface.
What a genome contains
- CWL API
- HTTP routes and handlers — methods, paths, params, status contracts.
- CWL Pages
- HTML / page shells, including redirect and error shells that must be preserved honestly.
- CWL Data
- Page data loaders and request-bound data shapes.
- CWL UI
- Component / island UI surface when it is part of the app identity.
- CWL Effects
- Middleware and side effects that change how a request is answered.
- Honest holes
- Explicit unsupported regions — typed reasons, never silent stubs or invented runtimes.
Language work is judged as language work: spec clarity, versioned breaking changes, golden fixtures independent of one customer POC, and tooling to parse / print / diff / validate. Convert and Secure pull CWL releases; they do not own the north star.
04 · Convert
How the Universal Translator works
Convert peels an origin stack into the shared middle (WebIR + CWL), then emits a modern target. The job is translate only. It does not own the language, does not own the DNA cutover spine, and does not get to invent a finished app when origin truth is missing.
-
01
Peel
Origin code (PHP, Java, Node, COBOL, …) → WebIR. Dialects deepen over time; residuals stay catalogued.
-
02
Inscribe
WebIR ↔ readable CWL. Humans review the genome. Holes stay labeled with reasons.
-
03
Propose
AI / agents may draft CWL and emits (Intelligence Shorthand). Draft ≠ dispose.
-
04
Emit
Modern stacks out (Hono, Fastify, TypeScript, Python, Go, …) or CWL for review — from the same middle.
-
05
Verify
Replay recorded production behavior. Mismatch = no ship, whether the draft was human or AI.
Because every honest pair shares one middle, Convert does not need a special-case translator for every language pairing. Depth varies by pair — the Hub shows what is green today versus an honest residual. Nest / LiveView / Flutter façades remain catalogued residuals, not marketing greens.
More: Convert · AgenticOp-io/chrysalis · hub.agenticop.io.
05 · Secure
How Helix (the DNA firewall) works
Secure asks one question: is this still the certified app? Out of the box it does not require CWL. Its primary identity artifact is app-dna-v1 — traffic-proved DNA (routes, schemas, statuses) learned from live requests.
Modes separate pass from trust so you can allow while securing — augment an NGFW without rewriting NAT homework overnight.
- 01 Learn record DNA
- 02 Promote sign identity
- 03 Shadow alert only
- 04 Enforce block DNA holes
Optional CWL bridge: seed DNA from a CWL surface, or export DNA→CWL to compare with Convert.
Any bridge must follow chrysalis-cwl semantics — Helix must not fork the language.
CWL is not the firewall; Secure must not require the Convert monorepo to enforce.
06 · Interaction
How the pillars connect
Convert authors and closes holes in CWL terms. CWL upgrades unlock better peels and emits. Secure learns and enforces without needing CWL. When cutover demands that a migration matches live identity, the shared spine compares CWL surface ⊆ certified DNA.
| From → To | What happens |
|---|---|
| Convert → CWL | Emit / author CWL; close holes in CWL terms. |
| CWL → Convert | Language tip upgrades unlock better peels and emits. |
| Secure → DNA | Learn / shadow / enforce without requiring CWL. |
| CWL ↔ Secure | Optional bridge: CWL route surface ↔ DNA routes; cutover gate “convert matches live DNA.” |
| All three | Same bar: propose · verify dispose · honest holes · no façades. |
The Universal Translator identity gate (CWL ↔ Helix spine) is owned by CWL, not Convert: language gold → contract gate → Helix seed / promote → compare CWL surface ⊆ certified DNA → allow/deny. Convert translates into that world; it does not own the spine.
Propose ≠ dispose. Holes stay labeled. No façades. Traffic decides.
07 · Loop
End-to-end: watch → write DNA → prove → ship
The operational loop is the same whether you are lifting a legacy PHP app or authoring greenfield CWL. Depth of testing varies by language pair; the spine does not.
-
01 · Watch
Record reality
Capture real requests, effects, and responses. That tape is the oracle — not a design memo.
-
02 · Read
Peel to WebIR / CWL
Origin code to shared model — or author routes directly in CWL when greenfield.
-
03 · Draft
AI proposes
Agents suggest CWL and emits, flag uncertainty, reuse proven patterns. Draft is never dispose.
-
04 · Emit
Real code out
Modern stack or CWL for review. Unsure pieces stay holes — never façades.
-
05 · Verify
Replay the tape
Side-by-side against step one. Same bar for AI drafts and human edits.
-
06 · Cut over
Side by side
Mirror, then slice, then more. Any route rolls back the moment DNA or replay looks wrong.
08 · Law
Standing bar — and what this is not
- Propose ≠ dispose — LLMs and agents draft; oracles and traffic dispose.
- Honest holes — unsupported truth stays labeled; never silent invention.
- No façades — demo finishes that paper over missing origin fail the bar.
- Language first — CWL semantics land in
chrysalis-cwl; Convert/Secure pull. - Traffic decides — recorded behavior beats migration memos.
This is not:
- “CWL is the firewall.”
- “Secure must load the Convert monorepo.”
- One mega-repo forever — pillars stay separate so the language can mature.
- A claim that every framework pair is finished — residuals stay catalogued.
Public npm is still GitHub Packages / file: pins by default.
Patent and counsel drafts stay private.
09 · Ecosystem
Platforms & siblings under the same org
- WPTP — wptp-ir, adapters, emitters, wptp-matrix — compatibility grades, not marketing greens.
- fragility-discovery-engine — adversarial search over simulations.
- ghost-museum — still-answering hall. Evidence surface; do not integrate as a product dependency.
10 · Start
Where to go next
Open source
All three pillars are public. Tip language 1.0.26.