Source-derived document; review findings and open questions with the application owner.

Recovered Requirements

Scope and system character

The evidence covers a partially reconstructed CardDemo mainframe application using COBOL, CICS, BMS, VSAM, DB2, IMS, MQ, JCL, REXX, and related utilities. It establishes artifacts and stated intent, but not successful execution, complete topology, compiler semantics, sequencing, or production behavior. E0001 E0010 E0017 E0020 E0021

Inference: The recovered requirements should therefore be treated as an intent-oriented baseline for validation and further investigation, not as a semantically complete specification. E0023 E0037 E0038 E0041 E0045 E0046

Functional requirements

The system is intended to support account, customer, card, transaction, security, authorization, fraud, reporting, migration, statement, interest, fee, and rejection-related processing. The evidence conflicts on whether all identified artifacts execute together. E0002 E0003 E0005 E0006 E0018

The online capability is intended to provide login, account inquiry and maintenance, payment processing, confirmation, administrative dispatch, paging, acceptance or rejection, and approval or decline decisions. Operational status and complete transaction coverage are not established. E0027 E0029 E0030 E0034 E0038

Batch and utility capability is intended to provide posting, reporting, VSAM loading and indexing, date conversion, compilation, migration, backup, data extraction, unload, and file replacement or copy operations. Runtime outcomes, restoration behavior, and sequencing remain incomplete. E0031 E0035 E0039 E0041 E0042 E0043 E0046

The system is intended to record validated transactions and rejected input separately, support account and customer lookups, maintain transaction and security records, and produce reports or statements. Exact layouts, encodings, timestamps, index offsets, naming conventions, and an identified six-byte unload discrepancy remain unresolved. E0004 E0007 E0008 E0009 E0010 E0021 E0037 E0045

Actors and access

Regular users, administrators, operators, and a UNIX-hosted Control-M scheduler environment are identified. Ownership, role definitions, permissions, and enforcement mechanisms are unknown. E0026 E0028 E0035 E0036 E0044 E0047

Validated login credentials are intended to route administrators and non-administrators through different CICS paths, with an identified login transaction and administrative dispatch. The evidence does not establish authorization enforcement beyond these routing descriptions. E0034 E0038

Business and processing rules

The evidence describes requirements or intended rules for credentials, input validation, dates, balances, expiry, limits, duplicate handling, referential integrity, paging, retention, return codes, interest, fees, and deletion. Fraud criteria, rates, checksums, filtering, and complete return-code semantics are unknown. E0011 E0013 E0017 E0026 E0027 E0041 E0042

Observed decisions include add, update, delete, view, list, cancel, page, submit, approve, decline, accept, reject, and fraud insertion versus duplicate-key update. Inference: Validation appears intended to separate normal processing from rejection, but decision ownership and rationale are unknown. E0003 E0010 E0022 E0025 E0028 E0038

A transaction-type extension is described as optionally supporting the CardDemo application and maintaining data in DB2 and VSAM. A category-to-type foreign-key relationship with restrictive deletion is also stated, but the complete schema and consistency behavior are not established. E0010 E0011

Journeys and state handling

The recovered journeys include sign-on and routing, account payment with confirmation, administrative dispatch, batch posting, reporting, VSAM loading and indexing, compilation, backup, unload, and file copy or replacement. Mappings between journeys, sequencing, restoration, and runtime results remain incomplete. E0025 E0029 E0030 E0031 E0034 E0046

Observed states include validation, confirmation, routing, acceptance, rejection, approval, decline, end-of-file, concurrent update, backup, error, abend, deployment, and generation increments. A complete lifecycle, retry model, and recovery-state model are unknown. E0015 E0017 E0018 E0045

Interfaces and dependencies

The intended interfaces include CICS screens and transactions, BMS maps, XCTL routing, commareas, VSAM files and indexes, MQ flows, IMS and DB2 artifacts, JCL, transient data queues, REXX, FTP, sorting, reporting tools, and date services. Interface contracts, keys, transformations, queue behavior, and runtime compatibility are unresolved. E0001 E0003 E0007 E0035 E0039 E0046

Named dependencies include CICS, DB2, IMS, MQ, VSAM, RACF, JES/TSO, SDSF, IDCAMS, UNIX, Control-M, FTP, a date-conversion API, and an Ensono-hosted mainframe. Topology, ownership, availability, and actual integration are unknown; interpretations involving z/OS and AWS are inferences. E0003 E0018 E0026 E0038 E0042

Security and operations

Authentication and security-related artifacts include a security file, RACF, and a security-management job. Literal or example credentials and sensitive-looking fields occur in the evidence. Encryption, masking, audit, authorization enforcement, queue permissions, and network boundaries are unknown. E0001 E0009 E0016 E0032 E0033 E0036 E0040

Operations are intended to include scheduling, waits, reruns, backups, generation data groups, indexing, reporting, logging, rollback, abend handling, SQL handling, and internal-reader submission. Monitoring, alerting, restart, disaster recovery, ownership, atomicity, and completion guarantees are unknown; two-phase commit is disputed. E0015 E0028 E0031 E0039 E0044 E0045

Risks and unresolved requirements

Potential hazards include destructive replacement or recreation, partial updates, ineffective conditions, malformed input, unstable paging, duplicate identifiers, inconsistent indexes, exposed credentials, FTP failure, critical VSAM errors, abends, and uncertain atomicity. No incident is established by the evidence. E0001 E0006 E0014 E0018 E0019 E0026 E0037 E0040 E0042

Unknown: Complete schemas, mappings, actors, ownership, security controls, deployment topology, sequencing, business rules, balances, calculations, configuration, restart and recovery, retention, external contracts, version alignment, and production suitability are not established. Conflicts concerning paging keys, maps, copybooks, deployed artifacts, source coverage, and diagram meaning remain unresolved. E0009 E0011 E0014 E0017 E0020 E0021 E0025 E0036 E0039 E0047