AWS Samples CardDemo · Harten Wayfinder (MaaS)

What a replacement must preserve in a payment application.

Three source-checked findings show how financial behaviour becomes specification decisions, verification requirements and a proposed sequence of change.

COBOL · CICS · VSAM · Batch processing

Examine the work

Findings, decisions and the next change.

Selected Harten-generated material, with public-source checks made for this page on 14 September 2026. Source findings, engineering implications and proposed verification are identified separately.

01 · Analysis

Selected source checks

Analysis

The Harten-generated account connected online payments, card maintenance and batch posting to their data effects. The source checks below examine three of those areas. They show why a replacement specification needs more than a list of screens and successful user journeys.

Application review

The bill-payment path settles the current positive balance

Source finding. The payment handler checks confirmation, reads the account and rejects a non-positive current balance. On the confirmed payment path, it copies the current balance into the transaction amount, writes the transaction and then subtracts that amount from the account balance before updating the account.

Engineering consequence. Calling this simply “make a payment” leaves a material choice unstated. A replacement that introduces an arbitrary payment amount has changed this path’s behaviour. That may be desirable, but it should be an explicit business decision with corresponding requirements.

Review required. Establish whether the target should retain balance settlement or introduce partial payments. Separately examine transaction consistency, concurrent requests and recovery if processing is interrupted between the related writes.

Source checked: COBIL00C: payment handling. This check establishes the code path; runtime recovery has not been exercised here.

Application review

A card update protects against a stale view

Source finding. Before rewriting the card record, the update path compares the latest values with the values retained from the earlier read. Differences in the checked card fields cause it to leave the update path and ask the user to review the intervening change.

Engineering consequence. A conventional read–edit–save API can remove this protection if it blindly overwrites the current record. The replacement can look correct to one tester and still lose another user’s change.

Review required. Decide which fields form the concurrency boundary and how conflicts reach the caller. A proposed acceptance check uses two sessions: one saves a change, then the other attempts to save its older view. The expected result must include both retained data and the user-visible conflict.

Source checked: COCRDUPC: update and comparison. The two-session check is proposed verification, not a reported test result.

Application review

A rejected transaction is still an operational output

Source finding. Daily processing separates accepted records from validation failures. A rejected record includes the input transaction and a validation trailer. Rejections are counted, and the program sets return code 4 when the count is greater than zero.

Engineering consequence. Migrating only successful postings would leave out the rejection record and completion signal. Schedulers, reconciliation or support processes may depend on those outputs; their actual consumers must be established.

Review required. Agree how the replacement preserves or deliberately changes rejection information, job status and reconciliation. Check a mixed batch of accepted and rejected records, not only an all-success run.

Source checked: CBTRN02C: batch control flow. Consumer dependencies are an investigation question, not a claim inferred from the return code alone.

Back to journey ↑

02 · App specification

Specification review

App specification

The specification should make the relationship between current behaviour and intended change explicit. A reviewer needs to see which expectations come from source and which are proposed additions.

Behaviour to carry forwardSpecification decisionProposed acceptance evidence
Balance settlementPreserve this positive-balance settlement path or explicitly authorise partial payment.Positive, zero and negative balances; confirmation and cancellation; agreed post-payment records.
Concurrent card editsPreserve conflict handling and define the target concurrency boundary.Two-session stale-write check, unchanged current data and a visible conflict response.
Batch rejectionPreserve rejection detail and completion semantics, or agree changes with consumers.Mixed valid/invalid input, rejected records, counts and the agreed job outcome.
Related financial writesDefine the required consistency and recovery behaviour.Failure injection, retry and reconciliation across account and transaction data.

Application review

Source review corrects the draft as well as validating it

The earlier public summary left zero and negative balance handling unresolved. The payment handler contains an explicit check. This page corrects that summary against the pinned public source.

A genuine operational unknown and an error in generated documentation must not be treated as the same kind of finding. The complete generated specification remains subject to review; these selected checks do not amount to acceptance of the whole application.

Back to journey ↑

03 · Modernisation plan

Proposed plan

Modernisation plan

The generated plan proposes a .NET and TypeScript target, with batch processing, data compatibility and financial reconciliation considered separately. Its first representative journey is sign-on followed by read-only account enquiry.

Application review

Make the first slice useful before introducing financial writes

A read-only enquiry can test access, account mapping and the display contract while leaving balance-changing operations for a later slice. That gives the team an initial integration boundary to examine.

Before introducing writes, the plan needs resolved payment semantics, concurrency handling and an agreed recovery model. Migration review must include record compatibility and reconciliation, including rejected transactions. A new technology stack does not answer those questions.

Planning decisionWhat the review needs to establish
First delivery boundaryWhich enquiry behaviour, identity integration and data mapping the first slice must demonstrate.
Financial writesWhat changes to payment behaviour are authorised and how consistency will be tested.
Data transitionHow balances, transaction records and rejection outputs reconcile across the agreed baseline.
Release decisionWho accepts the results, which failures stop progression and how the change can be reversed.

Back to journey ↑

From a plan to accepted change.

A delivery engagement would need implemented changes, executed verification, data reconciliation and an accepted operational handover. Those outcomes are outside this worked example. No completed production migration is claimed.

Scope and attribution

The selected source checks establish specific implementation observations. They do not validate the complete generated specification or demonstrate runtime behaviour. Harten’s platform implementation remains private; only selected findings are published.

Harten analysis of AWS Samples CardDemo, a public sample application. Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. Upstream source is licensed under Apache 2.0. No AWS endorsement or validation is implied.

Explore DEFRA PRSD-IWS →

What a Harten engagement includes