CSI baseline CSI-CARD-2026-10-22 · 22 October 2026. Limited to the registered source set. Application execution and proposed tests were not run; source findings do not establish runtime behaviour.

CardDemo: evidence and lookups

Assessment baseline: 22 October 2026. This register explains the evidence behind the source identifiers used throughout the reports. It presents the original assessment's observations, reference coverage and limitations. The dates identify those observations; later checks do not replace this dated baseline.

Retained artefacts are identified by title and source type and remain available for review under their source identifiers. Public vendor references below identify the documentation consulted; they do not establish installed product versions.

Source register

CARD-SRC-01

Retained CardDemo source provenance

Type: retained provenance. Observed: 22 October 2026. Access: retained for review.

The provenance identifies a retained 329-file source archive. No analysed upstream Git commit is established. The assessment used the archive identity for source facts; it did not bind a running executable to that source. The evidence establishes the archive boundary, not runtime correctness or an installed environment.

CARD-SRC-02

COPAUA0C authorisation source

Type: retained application source. Observed: 22 October 2026. Access: retained for review.

The complete source was inspected in the assessment. It receives through MQGET with MQGMO-NO-SYNCPOINT, makes the available-credit decision and sends the correlated MQPUT1 reply with MQPMO-NO-SYNCPOINT before the IMS summary/detail write. A later CICS syncpoint appears in the processing loop. This is source evidence; deployment and actual message/database outcomes were not observed.

CARD-SRC-03

COACTUPC account-maintenance source

Type: retained application source. Observed: 22 October 2026. Access: retained for review.

The complete source was inspected. It contains account/customer reads for update, original-value comparisons, account rewrite followed by customer rewrite, and a SYNCPOINT ROLLBACK request after a failed customer rewrite. These statements establish control flow and intended checks, not successful recovery or concurrency behaviour in an installation.

CARD-SRC-04

CARDDEMO.CSD sample configuration

Type: retained sample resource configuration. Observed: 22 October 2026. Access: retained for review.

The sample defines the account-update program and CAUP transaction and declares JOURNAL(NO) and RECOVERY(NONE) for ACCTDAT and CUSTDAT. It does not establish the installed FILE definitions or ICF catalog attributes. Effective recoverability remains unresolved.

CARD-SRC-05

Base application README

Type: retained source documentation. Observed: 22 October 2026. Access: retained for review.

The README identifies a 1.0.0 sample-project badge and prerequisites including CICS/VSAM/JCL with optional Db2/IMS/MQ. It does not supply installed middleware versions. The project label cannot be used as a runtime version for notice matching.

CARD-SRC-06

Optional authorisation-extension README

Type: retained source documentation. Observed: 22 October 2026. Access: retained for review.

The extension depends on the base application and describes IMS databases and PSBs. It does not establish deployed MQ, IMS, CICS, Db2 or z/OS releases. Its presence in the archive does not establish that the extension is enabled in a particular installation.

CARD-SRC-07

Public CardDemo documentation edition manifest

Type: public PDF-edition provenance. Observed: 22 October 2026. Edition: documentation derived from the 76-page PDF created on 18 October 2026.

The public edition contains sixteen chapters. Its analysed upstream commit is unverified, so it remains separate from the retained source archive. Older specification, modernisation and schedule deliverables, original source and supporting evidence assets are outside that public edition. Exact edition records are retained for review.

CARD-SRC-08

Public integration catalogue

Type: public PDF-derived documentation, chapter 8. Observed: 22 October 2026.

The catalogue describes the optional COPAUA0C MQ request/reply path, available-credit decision and IMS DBPAUTP0 summary/detail persistence through PAUTSUM0 and PAUTDTL1. It also identifies unresolved transaction/configuration boundaries. These descriptions support the application trace while retaining the separate edition qualification.

CARD-SRC-09

Public candidate characterisation tests

Type: public PDF-derived documentation, chapter 13. Observed: 22 October 2026.

C13-03 proposes paired account/customer update checks, C13-04 proposes concurrent modification, and C13-13 proposes authorisation response versus a subsequent IMS failure. The chapter explicitly presents candidate scenarios, not executed tests. Their baseline and expected-result authority must be reconciled before they are used to assess the retained source or a running build.

CARD-SRC-10

IBM MQ put-message options

Type: official vendor API documentation. Observed: 22 October 2026. Reference: IBM MQ: MQPMO options field details.

The assessment inspected official indexed text for MQPMO_NO_SYNCPOINT; direct page access returned an error. IBM describes a put outside syncpoint as immediately available and not undone by backing out the unit of work. This supplies semantic context for the inspected source. It does not establish that CardDemo runs MQ 9.4.

CARD-SRC-11

Archived IBM MQ get-message options

Type: official archived vendor API documentation. Observed: 22 October 2026. Reference: IBM archived MQGET option documentation.

The accessible archive describes MQGMO_NO_SYNCPOINT and distinguishes the commit/backout behaviour of a get under syncpoint. It provides additional primary-source API context. Historic documentation cannot identify the deployed product release.

CARD-SRC-12

IBM CICS SYNCPOINT ROLLBACK

Type: official vendor API documentation. Observed: 22 October 2026. Reference: IBM CICS: SYNCPOINT ROLLBACK.

Direct access returned an error; official indexed text was inspected. IBM describes backing out changes to recoverable resources since the last syncpoint. This supports the resource-recoverability dependency. It does not identify an installed CICS 6.x release or prove an actual rollback result.

CARD-SRC-13

IBM CICS FILE recovery attributes

Type: official vendor configuration documentation. Observed: 22 October 2026. Reference: IBM CICS: FILE resource definitions.

Direct access was blocked; official indexed text was inspected. The documentation describes how an ICF catalog LOG setting can determine recoverability instead of the FILE RECOVERY setting, including non-RLS access. This is why the sample CSD cannot establish the installed recovery outcome by itself.

CARD-SRC-14

Retained publication provenance

Type: retained publication-state and verification record. Observed: 22 October 2026. Access: retained for review.

The retained export records completed documentation, specification and modernisation deliveries, with verification limited to byte/hash integrity and publication state. It does not establish runtime correctness or source/documentation equivalence. Older specifications were not adopted as current requirements in this assessment.

External reference coverage

The following coverage and outcomes were recorded on 22 October 2026. Retained application evidence and official technical references serve different purposes: the former describes the assessed material; the latter supplies product semantics without identifying an installed environment.

The external technical reference coverage is limited to IBM Documentation and IBM's archived MQ API documentation. This baseline contains no separately recorded vulnerability-database search and no matched lifecycle notice. It therefore cannot establish that all vulnerabilities or support notices were searched and excluded.

Every external statement remains subject to the source's recorded access and version limits. These dated observations are not a continuous-monitoring result and do not establish the current contents of every linked page.