Production cutovers fit inside a four-hour change window with no room to retry on a failed object.

The 14-phase orchestrator runs in dependency order with automatic retry across passes. Phases commit atomically. Cutover plans run end to end in dry-run mode against staging before they touch production.

Auditors need line-by-line evidence that every Oracle object was either converted, deployed, and validated, or explicitly flagged as out of scope.

Every conversion decision lands in an exportable audit log with rule reference and before-and-after artifact. Out-of-scope items are tagged with a rationale. No silent gaps.

Rollback must be a reversible action, not a backup restore. Failed deployments cannot leave the target in an undefined state.

Each phase emits a deterministic rollback artifact alongside the forward deployment. If a phase fails verification, the orchestrator restores the prior state from that artifact, not from a snapshot.

Customer financial data is subject to data-residency, sanctions, and outbound-transfer controls. The migration tool cannot become the exfiltration vector.

Trekport runs entirely in your environment. Source data, schemas, and PL/SQL never leave the operator's machine. The license handshake is the only outbound call; it carries no customer data. Air-gapped activation is available for environments without internet access.

Separation of duties: the team that converts PL/SQL is not the team that approves production deploys, and neither is the team that validates row counts.

Each phase exports a signed artifact that can be reviewed independently of the engine. Conversion, deployment, and validation operate against artifacts on disk, so each function can be performed by a different role and verified by a different reviewer without re-running the conversion.