Source-derived document; review findings and open questions with the application owner.

Executive Current System Overview

Purpose and Evidence Boundary

The supplied evidence describes a partially reconstructed CardDemo mainframe system using COBOL, CICS, BMS, VSAM, DB2, IMS, MQ, JCL, REXX, and related utilities. It establishes artifacts and intended behavior, but not successful execution, complete topology, compiler semantics, processing sequence, or production behavior. Evidence also conflicts on whether all identified artifacts execute together. E0001 E0010 E0017 E0018 E0020 E0021

Inference: The strongest supported characterization is a configured or partially reconstructed IBM mainframe architecture that expresses intended functions more clearly than confirmed runtime behavior. Execution, deployment, versions, encodings, timing, availability, and end-to-end outcomes remain unresolved. E0023 E0037 E0038 E0041 E0045 E0046

Current-System Scope

Observed functional areas include account and customer management, card and transaction processing, security, authorization, fraud, reporting, migration, statements, interest, fees, and rejection handling. The evidence identifies both online and batch-oriented capabilities, but does not establish that these areas form one complete operational system. E0002 E0003 E0005 E0006 E0018

The system includes CICS programs and BMS maps, copybooks, VSAM KSDSs and indexes, DB2 and IMS artifacts, MQ flows, batch programs, JCL, GDGs, REXX procedures, reports, and data-model diagrams. Duplicate, malformed, stale, contradictory, or incomplete artifacts are identified as risks rather than confirmed defects. E0006 E0019 E0026 E0035 E0047

An optional Transaction Type Management module is explicitly associated with the CardDemo application and is described as maintaining data in both DB2 and VSAM. The evidence also identifies transaction-type category foreign-key handling with `ON DELETE RESTRICT`. E0010 E0011

Users, Security, and Access

Regular users, administrators, operators, and a Control-M scheduling environment on UNIX at `MY-HOST` are identified. Ownership, role definitions, permissions, and enforcement are not established. E0026 E0028 E0035 E0036 E0044 E0047

Authentication and security-related artifacts include `USRSEC`, RACF, and `DUSRSECJ`. The user-maintenance flows add, update, and delete `USRSEC` records, while login transaction `CC00` invokes `COSGN00C`; validated `ADMIN` credentials route to `COADM01C`, and other validated credentials route to `COMEN01C` through `XCTL`. E0016 E0017 E0034 E0038

Encryption, masking, authorization enforcement, audit controls, queue permissions, and network boundaries are unknown. Literal or example credentials and sensitive-looking fields occur in the evidence, but no security incident is established. E0009 E0032 E0033 E0036 E0040

Processing and Interfaces

Online capabilities include login, routing, account inquiry, maintenance, payment, confirmation, and reporting. Batch and utility capabilities include posting, VSAM loading and indexing, date conversion, compilation, migration, backups, `REPRO`, and optional DB2, IMS, and MQ integration. These capabilities are described but are not uniformly confirmed as operational. E0027 E0038 E0039 E0040 E0041 E0042 E0043 E0012 E0022 E0024

Identified interfaces include CICS, BMS, `XCTL`, commareas, VSAM, MQ, IMS, DB2, JCL, temporary data queues, REXX, FTP, sorting, and reporting tools. Contracts, keys, transformations, queue behavior, and runtime compatibility remain unresolved. E0001 E0003 E0007 E0035 E0039 E0046

Specific evidence connects `COACTUPC` with account update and `COACTVWC` with account view. `COBIL00C` uses `ACCTDAT` for payment lookup and balance validation; `COTRN02C.cbl` writes validated transactions to `TRANSACT`; and failed validations are reported to `DALYREJS`. E0001 E0002 E0007 E0008 E0022 E0029

Information and Rules

Identified information includes accounts, customers, cards, users, transactions, authorization and fraud records, classifications, cross-references, reports, statements, and imports or exports. Layouts, encoding, timestamps, index offsets, naming conventions, and a six-byte unload discrepancy remain unresolved. E0004 E0009 E0010 E0021 E0037 E0043 E0045

Observed rules concern credentials, validation, dates, balances, expiry, limits, duplicate handling, referential integrity, paging, retention, return codes, interest, fees, and deletion. Fraud criteria, rates, checksums, filtering, and complete return-code semantics are unknown. The meaning of `COND=(4,LT)` is disputed under ordinary JCL interpretation. E0011 E0013 E0017 E0026 E0027 E0041 E0042

Inference: Validation appears intended to separate accepted processing from rejection, but decision ownership, rationale, and complete lifecycle behavior are unknown. Observed decisions include add, update, delete, view, list, cancel, page, submit, approve, decline, accept, reject, and fraud insert versus duplicate-key update. E0003 E0010 E0022 E0025 E0028 E0038

Operations and Dependencies

Operational evidence includes scheduling, waits, reruns, backups, GDGs, indexing, reporting, logging, rollback, abends, SQL handling, and internal-reader submission. The monthly flow identifies `WAITSTEP` triggering `OPENFIL`; reporting invokes `REPROC.prc`; and `REPRO` reads `FILEIN` and writes `FILEOUT`. Monitoring, alerting, restart, disaster recovery, ownership, atomicity, and completion guarantees are unknown, and two-phase commit is disputed. E0015 E0028 E0031 E0042 E0044 E0045 E0046

Dependencies include CICS, DB2, IMS, MQ, VSAM, RACF, JES/TSO, SDSF, IDCAMS, UNIX, Control-M, FTP, CEEDAYS, and an Ensono-hosted mainframe. Topology, ownership, availability, and actual integration are unknown; z/OS and AWS interpretations remain inferences. E0003 E0018 E0026 E0035 E0038 E0042

Principal Uncertainties

Complete schemas, mappings, actors, ownership, security controls, deployment topology, sequencing, business rules, calculations, configuration, restart and recovery, retention, external contracts, version alignment, and production suitability are not established. Conflicts concerning PF7 behavior, maps, copybooks, deployed artifacts, source coverage, and diagram meaning remain unresolved. E0009 E0011 E0014 E0017 E0020 E0021 E0025 E0036 E0039 E0047

Potential hazards include destructive replacement or recreation, partial updates, ineffective conditions, malformed input, unstable paging, duplicate identifiers, inconsistent indexes, exposed credentials, FTP failure, critical VSAM errors, and abends. These are potential hazards only; no incident or confirmed production failure is established. E0001 E0006 E0014 E0018 E0019 E0026 E0037 E0040 E0042