Tarsius: Behavioral Safety Layer for IBM Bob 2.0

Over $3 Trillion in daily global financial transactions rely on mission-critical legacy enterprise systems written in IBM i RPGLE and Mainframe COBOL. Today, the organizations maintaining these foundational systems face an unprecedented demographic challenge: 72% of RPG developers are over the age of 50, and the institutional skills shortage has become the number one concern across enterprise IT. When senior engineers retire, decades of vital institutional tacit knowledge vanish with them—including undocumented edge cases, oral operational carve-outs, and unwritten regulatory agreements. While modern AI coding assistants like IBM Bob 2.0 excel at syntactic translation, they can only read what has been explicitly written down. Peer-reviewed research indicates that unconstrained LLM translations retain merely 9% to 19% behavioral equivalence on legacy edge cases, leading industry analysts to project that over 70% of mainframe exit modernizations will fail to deliver their anticipated returns. Tarsius solves this critical knowledge gap by serving as a native behavioral safety layer engineered directly into IBM Bob 2.0. Rather than hoping an AI model will accurately guess implicit behavior, Tarsius captures undocumented institutional rules before code generation begins, formalizes them into binding governance contracts, and rigorously verifies the modernized software using differential behavioral testing. Our primary target users are enterprise engineering teams modernizing core legacy systems and the senior subject matter experts whose specialized operational knowledge must be permanently preserved before retirement. Users interact with Tarsius seamlessly through IBM Bob 2.0 and a dedicated governance dashboard. During the discovery phase, Bob's Legacy Analyzer inspects legacy source code alongside existing specifications to uncover undocumented branches and specification contradictions. When an anomaly is detected, Bob engages the domain expert in a brief Socratic inquiry directly within the chat interface, converting oral rationale into structured business rules. These rules enter an inventory where a zero-LLM deterministic triage classifier routes them into auto-approved, glance, or must-review categories. Architects use the Tarsius Studio dashboard to inspect rules against explainable risk heatmaps and record immutable approvals into an append-only SHA-256 hash-chained ledger. Approved rules automatically compile into binding contract documents that are re-injected into Bob's subagents across context compaction cycles to guarantee total alignment. What makes Tarsius unique is its pre-generation governance model. Existing developer tools focus exclusively on post-hoc debugging or code archaeology, whereas Tarsius asks the foundational question that no other tool addresses: what must not change? By separating knowledge extraction from code synthesis, Tarsius eliminates the self-fulfilling test fallacy where an AI writes unit tests that merely confirm its own incomplete assumptions. Through its Behavioral Equivalence Test Harness, Tarsius verifies modernized outputs against legacy behavior using deterministic test vectors. On our dual-workload benchmark spanning IBM i RPGLE order validation and Mainframe COBOL funds transfer, Tarsius elevated behavioral equivalence from 67% to 100%, transforming fleeting human memory into verifiable, permanent enterprise governance.