Module 3: Incorporating policy and tribal knowledge with Solution Server

# In Dev Spaces terminal, create a policies directory
mkdir -p .devlightspeed/policies

cat > .devlightspeed/policies/logging-standard.md << 'EOF'
# ACME Corp Logging Standard

## Policy
All application logs must use SLF4J with Logback.

## Requirements
- Use SLF4J Logger interface, not System.out or printStackTrace()
- Include correlation IDs in all log statements
- Use appropriate log levels: ERROR, WARN, INFO, DEBUG
- Include context information (user, request ID, operation)

## Example
```java
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

private static final Logger logger = LoggerFactory.getLogger(MyClass.class);

public void processRequest(String requestId, String userId) {
    logger.info("Processing request - requestId: {}, userId: {}", requestId, userId);
    try {
        // business logic
        logger.debug("Request processed successfully - requestId: {}", requestId);
    } catch (Exception e) {
        logger.error("Failed to process request - requestId: {}, error: {}",
                     requestId, e.getMessage(), e);
    }
}
```

## Anti-patterns to avoid
- System.out.println() - never use in production code
- e.printStackTrace() - use logger.error() instead
- Missing context - always include requestId and userId
EOF

cat > .devlightspeed/policies/configuration-standard.md << 'EOF'
# ACME Corp Configuration Standard

## Policy
All configuration must be externalized for OpenShift deployment.

## Requirements
- Use Spring Boot @ConfigurationProperties
- Never hardcode URLs, credentials, or environment-specific values
- Support environment variable override
- Provide sensible defaults for development

## Example
```java
import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.context.annotation.Configuration;

@Configuration
@ConfigurationProperties(prefix = "acme.app")
public class AcmeAppConfig {

    private String apiEndpoint = "http://localhost:8080"; // default
    private int timeout = 30;
    private String environment = "dev";

    // getters and setters
}
```

## OpenShift Deployment
```yaml
env:
  - name: ACME_APP_API_ENDPOINT
    value: "https://api.production.acme.com"
  - name: ACME_APP_TIMEOUT
    value: "60"
  - name: ACME_APP_ENVIRONMENT
    value: "production"
```
EOF

cat > .devlightspeed/policies/security-standard.md << 'EOF'
# ACME Corp Security Standard

## Policy
All applications must follow secure coding practices.

## Requirements
- Never log sensitive data (passwords, tokens, PII)
- Validate all user input
- Use parameterized queries (never string concatenation for SQL)
- Encrypt data in transit and at rest
- Follow principle of least privilege

## Example: Input Validation
```java
import org.springframework.util.StringUtils;

public void processUserInput(String input) {
    if (!StringUtils.hasText(input)) {
        throw new IllegalArgumentException("Input cannot be empty");
    }

    if (input.length() > 255) {
        throw new IllegalArgumentException("Input exceeds maximum length");
    }

    // Validate format (e.g., email, phone number)
    if (!input.matches("^[a-zA-Z0-9_-]+$")) {
        throw new IllegalArgumentException("Input contains invalid characters");
    }

    // Process validated input
}
```

## What NOT to do
```java
// NEVER DO THIS - SQL Injection vulnerability
String query = "SELECT * FROM users WHERE name = '" + userName + "'";

// NEVER DO THIS - Logging sensitive data
logger.info("User login: username={}, password={}", username, password);
```
EOF

# List indexed policies
ls -la .devlightspeed/policies/

# Create a simple service class
cat > src/main/java/org/springframework/samples/petclinic/service/OrderService.java << 'EOF'
package org.springframework.samples.petclinic.service;

public class OrderService {

    public void processOrder(String orderId, String userId) {
        // TODO: Implement order processing with proper logging
    }
}
EOF

private static final Logger logger = LoggerFactory.getLogger(OrderService.class);

public void processOrder(String orderId, String userId) {
    logger.info("Processing order - orderId: {}, userId: {}", orderId, userId);
    try {
        // business logic here
        logger.debug("Order processed successfully - orderId: {}", orderId);
    } catch (Exception e) {
        logger.error("Failed to process order - orderId: {}, error: {}",
                     orderId, e.getMessage(), e);
    }
}

cat > migration-wave-analysis.md << 'EOF'
# ACME Corp Migration Wave 1 Analysis

## Scope
- 15 legacy applications requiring modernization
- Target: OpenShift containerization
- Standards: ACME coding policies and best practices

## Approach Comparison

### Traditional Manual Approach
- Developer manually codes each modernization
- References policy documents repeatedly
- Code review ensures compliance
- **Estimated time**: 75-105 days
- **Risk**: Inconsistencies between applications

### AI-Accelerated with Solution Server
- AI generates code following ACME policies automatically
- Solution Server ensures consistency
- Policies embedded in code generation
- **Estimated time**: 15-30 days
- **Quality**: Guaranteed consistency across all apps

## Business Impact
- **Time savings**: 45-90 days
- **Cost reduction**: 60-85% less developer effort
- **Quality improvement**: Zero policy violations
- **Scalability**: Approach proven for future waves

## Recommendation
Adopt Developer Lightspeed with Solution Server for all migration waves.
EOF