CSI baseline CSI-CARD-2026-10-22 · 22 October 2026. Limited to the registered source set. Application execution and proposed tests were not run; source findings do not establish runtime behaviour.

CardDemo: baseline and limitations

Assessment baseline: 22 October 2026. This is a static assessment of selected retained application paths, public documentation and official vendor semantics. It establishes four findings, eight component records and five unexecuted verification tasks. No deployed middleware version, applicable CVE, deprecation notice or support deadline is established. CARD-SRC-01 CARD-SRC-05 CARD-SRC-06 CARD-SRC-09

The evidence baselines remain separate

Agreement between the public descriptions and retained source makes C13-03, C13-04 and C13-13 useful candidates. It does not make the two input editions identical. CARD-FIND-04 preserves this distinction and CARD-TEST-05 requests the missing binding or targeted comparison. CARD-SRC-01 CARD-SRC-07 CARD-SRC-09 CARD-SRC-14

Scope of the inspected application paths

The assessment covers the optional authorisation extension's MQ request/reply and IMS persistence path, and the base account-maintenance program's paired account/customer update path. It does not assume that the optional extension is installed wherever base CardDemo is installed. CARD-SRC-05 CARD-SRC-06 CARD-SRC-08

Within those paths, source order, called interfaces, named records, sample resource settings and proposed scenarios are inspectable evidence. Their relationship to a production environment remains unknown. No runtime credentials, live operational endpoints or private evidence-pack links are needed to understand the public conclusions.

Finding status at the baseline

The inventory gap is bounded to the inspected material. It does not prove that no inventory exists elsewhere. The provenance gap does not invalidate directly inspected source statements; it limits how evidence from different editions may be combined.

Runtime and notice limits

The assessment has no bound installed versions or service levels for MQ, CICS, IMS, Db2, the COBOL compiler or z/OS. The sample project's 1.0.0 badge is a project label. IBM documentation URL versions are reference editions. Neither supplies an installed version. CARD-SRC-05 CARD-SRC-06 CARD-SRC-10 CARD-SRC-12

No affected advisory range, fixed release or lifecycle deadline has been matched to an installation. The reports make no claim of exhaustive vulnerability absence, exploitability, production safety or workload suitability. The two integrity findings identify precise questions to investigate, without asserting a deployed failure.

Verification limits

CARD-TEST-01 through CARD-TEST-05 are all not run. The assessment contains no application execution, production incident observation, successful remediation test or pass/fail result. The candidate scenarios are described in the public documentation; their existence does not establish that they have been executed. CARD-SRC-09

Source reading can establish that the program asks for rollback, but not that both records were restored. A send call can establish source order, but not that the requester received a reply. A sample FILE definition can establish the sample setting, but not the effective installed setting. Those distinctions explain why configuration and runtime observations are separate evidence requests. CARD-SRC-02 CARD-SRC-03 CARD-SRC-04 CARD-SRC-12 CARD-SRC-13

External lookup limits

The source register records vendor material observed on 22 October 2026. Some current IBM pages failed direct access; the assessment used official indexed text, with accessible archived MQGET documentation as additional API context. These reports preserve those original observations. CARD-SRC-10 CARD-SRC-11 CARD-SRC-12 CARD-SRC-13

No separately recorded vulnerability-database search supports this assessment. The assessment is not a continuous-monitoring result, and its dated observations should not be presented as an automatically refreshed statement about future notices.

How a later assessment should extend this baseline

Keep this dated edition and add the new inventory, baseline comparison, configuration records or execution observations with their own dates and identifiers. State which finding changed and why. Record whether a graph relationship moved from unresolved to documented or whether a conditional consequence was observed, rejected for that case or left uncertain.

A future pass, failure or notice match should refer to the actual environment and selected build. It should not silently replace the retained source facts, erase the separate PDF edition or convert the present not-run tasks into historical test results.