Modernisation proposal for review; durations are indicative.

delivery-slices.md

This is an unapproved planning proposal. Estimates are elapsed working-day scenarios, not commitments, staffing assumptions, prices, or evidence of production suitability. They assume required work can proceed during working days but allow for uncertain access, shared environments, review availability, suppliers, extract windows, licensing, business calendars, and change freezes. Estimates must be revised after the first accepted end-to-end slice and whenever evidence invalidates a dependency or complexity assumption.

DSL-001 Establish the Deployed and Measurable Baseline

Changes: Establish the Deployed Baseline and Evidence Register; Characterize Behaviour and Define Acceptance Before Replacement; Establish Measures Before Claiming Benefits; Plan Capacity, Scenarios, and Re-Estimation Without Invented Commitments.

Verifications: Verify the Deployed Baseline and Executable Characterization; Verify Measures, Capacity Assumptions, and Final Acceptance Governance.

Prerequisites: None.

Owner: joint.

Agent effort: Agent-led collection, comparison, contradiction tracking, inventory analysis, test-candidate generation, and measurement-definition drafting can accelerate the work, but automated processing cannot determine production relevance, semantic completeness, ownership, or authority.

Human effort: Human owners must provide access, identify active environments and releases, distinguish deployed, optional, historical, generated, and obsolete material, approve expected behaviour, assign ownership, and decide which measures are relevant. Business-rule owners, mainframe specialists, data stewards, security authorities, operations staff, and interface owners may be scarce, but their availability and capacity are unknown.

Waiting time: Waiting may arise from environment and catalog access, representative data, scheduler and log retrieval, supplier responses, ownership decisions, shared test environments, and governance reviews. No access lead time or review cadence is supplied.

Elapsed working days: 20 / 45 / 90.

The outcome is an accountable baseline for the selected scope, an evidence register that retains contradictions, and an executable characterization framework. It must link relevant programs, maps, copybooks, transactions, jobs, procedures, datasets, indexes, database and IMS structures, queues, configurations, generated artifacts, load modules, scheduler definitions, and external interfaces without treating inventory coverage as semantic completeness.

The evidence-resolution gate requires every material contradiction in the selected scope to be resolved through runtime evidence, excluded with supporting evidence, or classified as blocked. Acceptance requires reproducible observations and results classified as passed, failed, blocked by missing evidence, not executable, or not applicable. Measurement acceptance requires a proposed owner, source, sampling period, exclusions, and review cadence for each adopted indicator; targets remain undecided. The low estimate assumes one coherent accessible baseline, the central estimate assumes multiple representations and substantial characterization, and the high estimate assumes relevant conflicting releases, inaccessible runtime evidence, or prolonged supplier and owner involvement.

Related changes: CHG-001, CHG-002, CHG-022, CHG-023

Related verifications: VER-001, VER-012

DSL-002 Resolve Data Authority and Rehearse Migration

Changes: Resolve Data Authority Before Canonical Modelling; Build Rehearsable Migration and Reconciliation Pipelines.

Verifications: Verify Reference Data Authority and Distribution; Verify Rehearsable Migration and Data Reconciliation.

Prerequisites: Establish the Deployed and Measurable Baseline.

Owner: joint.

Agent effort: Agents can compare layouts, keys, formats, counts, transformations, sequence rules, and reconciliation outputs and can generate repeatable test data and discrepancy reports. They cannot decide business authority, acceptable differences, retention duties, or whether conflicting representations are obsolete.

Human effort: Data and application owners must classify representations as authoritative, derived, replicated, synchronized, independently maintained, historical, or obsolete. Data stewards, security and privacy authorities, and operational reviewers must approve meanings, handling rules, migration acceptance, and correction procedures.

Waiting time: Waiting may include source extracts, access to VSAM, sequential, DB2, IMS, MQ, and generated representations, clarification of layouts, approval of test data, and restoration of missing metadata. The unexplained IMS child-layout and unload-allocation discrepancy may cause an indefinite block for affected records.

Elapsed working days: 20 / 50 / 110.

The outcome is an authority decision for each in-scope representation and a repeatable non-production migration pipeline covering extraction, transfer, framing, decoding, transformation, loading, rejection, restart, restoration, cleanup, and rerun. Meaningful distinctions in compound keys, blanks, zeroes, signs, encodings, dates, monetary precision, statuses, physical layouts, indexes, and access paths must be retained.

The gate requires controlled counts plus referential, uniqueness, sequence, status-distribution, and applicable balance or financial reconciliation; matching counts or tool completion alone do not pass. Differences affecting authoritative keys, financial values, security, customer continuity, or external effects block acceptance unless explained and accepted by accountable owners. The low estimate assumes coherent layouts and clear authority, while the high estimate allows for conflicting representations, unresolved framing, failed rehearsals, and recovery defects.

Related changes: CHG-015, CHG-016

Related verifications: VER-007, VER-008

DSL-003 Deliver the Read-Only Servicing Path

Changes: Replace CICS and BMS Presentation Incrementally; Introduce Read-Only Servicing as the First Candidate Slice; Apply Least-Privilege Security and Sensitive-Data Controls; Introduce End-to-End Observability and SRE Operations; Automate Supported Build, Release, and Rollback Paths.

Verifications: Verify Presentation Contracts and Read-Only Servicing; Verify Security and Operational Observability; Verify Build, Release, Coexistence, and Retirement Controls.

Prerequisites: Establish the Deployed and Measurable Baseline; Resolve Data Authority and Rehearse Migration.

Owner: joint.

Agent effort: Agents can implement and test adapters, presentation and API paths, automated deployment, telemetry correlation, field-level comparisons, failure injection, and routing rollback. Automated comparison must avoid exposing sensitive values and cannot approve semantic differences.

Human effort: Business and data owners must approve the selected inquiry scope, authoritative keys, masking, field meanings, messages, paging, sorting, and comparison rules. Security, platform, accessibility, operations, and release reviewers must decide applicable controls and accept support and recovery procedures.

Waiting time: Hybrid connectivity, identity access, firewall changes, representative data, enterprise interface standards, shared integration environments, and release governance may create waiting. Accessibility requirements, latency targets, availability targets, and traffic-progression gates remain unsupplied decisions.

Elapsed working days: 25 / 55 / 105.

The outcome is a reversible account or card inquiry path with coexistence adapters, delivery automation, protected telemetry, reconciliation, and routing back to the legacy path. It preserves confirmed cross-reference lookup, identity and role routing, authoritative keys, not-found distinctions, filtering, sorting, paging, masking, formatting, validation, messages, and unavailable-option behaviour for the accepted scope.

The evidence gate requires conflicting card keys, any omitted account-key component, page sizes, attention-key meanings, maps, transfer targets, snapshots, and presentation-to-storage mappings to be tested rather than normalized. Acceptance requires no unexplained difference in an authoritative key or material meaning, preserved error distinctions, actionable telemetry without sensitive payloads, and rehearsed routing rollback. This slice is low risk only if evidence confirms low coupling; otherwise scope or estimates must be revised.

Related changes: CHG-004, CHG-005, CHG-017, CHG-018, CHG-020

Related verifications: VER-003, VER-010, VER-011

DSL-004 Modernize Workforce Identity and User Administration

Changes: Modernize Workforce Identity and Application Authorization; Preserve User Administration While Replacing Credential Handling.

Verifications: Verify Workforce Identity, Authorization, and User Administration; Verify Security and Operational Observability; Verify Build, Release, Coexistence, and Retirement Controls.

Prerequisites: Establish the Deployed and Measurable Baseline; Deliver the Read-Only Servicing Path.

Owner: joint.

Agent effort: Agents can support account correlation, policy testing, authorization-matrix checks, audit validation, deployment automation, and failure simulations. They cannot determine identity authority, approve credential handling, or define segregation of duties.

Human effort: Business and security authorities must decide the target identity population, legacy-record authority, role model, user-type meaning, lockout and session standards, privileged and break-glass access, deletion policy, federation or reset approach, and audit obligations. Operations must accept recovery from identity-provider or connectivity failure.

Waiting time: Identity governance, security review, tenant integration, account matching, network access, and approval of reset or federation procedures may dominate waiting. Legacy password migration remains blocked unless protection and migration safety are demonstrated and accepted.

Elapsed working days: 20 / 45 / 90.

The outcome is workforce authentication through the approved identity path, explicit application authorization, auditable ordinary and administrative routing, and preserved confirmed user-administration outcomes. Azure role assignments must not silently replace business authorization, and legacy passwords must not be copied without demonstrated safe and supported handling.

Acceptance requires least privilege, segregation of duties, session and failure behaviour, account correlation, controlled unmatched identities, audit continuity, and a rehearsed rollback that does not lock authorized users out of both paths. Retry, lockout, session-duration, access-review, and privileged-access thresholds remain owner decisions.

Related changes: CHG-003, CHG-007

Related verifications: VER-002, VER-010, VER-011

DSL-005 Establish Reference Data and Servicing Updates

Changes: Establish Authoritative Reference Data and Distribution; Consolidate Party, Account, and Card Servicing Transactions.

Verifications: Verify Reference Data Authority and Distribution; Verify Servicing Transactions and Concurrency; Verify Security and Operational Observability.

Prerequisites: Resolve Data Authority and Rehearse Migration; Deliver the Read-Only Servicing Path; Modernize Workforce Identity and User Administration.

Owner: joint.

Agent effort: Agents can implement versioned distribution, validation tests, concurrency and deadlock simulations, idempotent propagation, lag detection, and reconciliation. They cannot decide authoritative ownership, compound identity, acceptable compensation, or security-value retention.

Human effort: Domain owners must decide transaction-type and category authority, synchronization direction, card identity and uniqueness, compound keys, update scope, lock and retry policy, and whether compensation is acceptable. Security reviewers must determine permitted handling of CVV-like and personal data.

Waiting time: Consumer discovery, source-owner decisions, representative concurrent workloads, security assessment, and correction of divergent copies may delay progress. Unknown runtime consumers or unresolved authority block distribution or update cutover.

Elapsed working days: 30 / 65 / 130.

The outcome is controlled reference-data distribution and a servicing update path that preserves confirmed validation, not-found distinctions, referential restrictions, concurrency protection, and intended account-and-customer rollback. One authority must be declared during coexistence; ungoverned dual writes are not acceptable.

The gate requires testing unchanged values, stale reads, concurrent updates, deadlocks, retries, compound keys, uniqueness, expiry and status rules, dependent deletion, propagation failure, and possible card-security overwrite without presuming a defect. Acceptance requires exact agreed state transitions and either one demonstrated local transaction or an explicitly accepted compensation model, with durable propagation and reconciliation where more than one store receives changes.

Related changes: CHG-012, CHG-006

Related verifications: VER-007, VER-004, VER-010

DSL-006 Cut Over Payments and Transaction Outcomes

Changes: Establish Atomic and Idempotent Payment Processing; Separate Accepted and Rejected Transaction Outcomes.

Verifications: Verify Atomic Payment and Transaction Outcomes; Verify Security and Operational Observability; Verify Build, Release, Coexistence, and Retirement Controls.

Prerequisites: Resolve Data Authority and Rehearse Migration; Establish Reference Data and Servicing Updates.

Owner: joint.

Agent effort: Agents can execute boundary, duplicate, concurrency, failure-injection, restart, rerun, shadow-validation, and reconciliation tests and can automate stop and recovery controls. They cannot approve financial calculations, duplicate semantics, tolerances, or corrective entries.

Human effort: Business and finance-rule owners must approve authoritative balances, exact calculations, identifiers, states, rejection reasons, reversals, refunds, fees, interest, limits, and reconciliation criteria. Data, security, operations, and risk reviewers must accept atomicity and recovery procedures.

Waiting time: Recovery of posting rules, representative financial data, review of reconciliation differences, controlled test windows, and approval of cutover or forward recovery may be prolonged. Any unexplained authoritative financial difference blocks progression.

Elapsed working days: 35 / 80 / 170.

The outcome is an atomic and idempotent payment path and an explicit separation of accepted and rejected transaction outcomes. Confirmed account-state, confirmation, duplicate-identifier, limit, expiry, insufficient-funds, validation, and failure-reason distinctions must be preserved, and rejected work must never be counted as successful.

Acceptance requires failure injection around creation, balance adjustment, state change, publication, acknowledgement, and commit; no duplicate real financial effects during comparison; no unaccounted external effect; and a rehearsed stop, rollback, or forward-recovery procedure. Automatic rollback is allowed only when no unaccounted target effect exists. The high estimate reflects unresolved calculations, cross-technology boundaries, unsafe replay, or repeated reconciliation failures.

Related changes: CHG-008, CHG-009

Related verifications: VER-005, VER-010, VER-011

DSL-007 Migrate Authorization, Fraud, Batch, Reporting, and Recovery

Changes: Reconcile Authorization Messaging and Persistence; Keep Fraud Processing Logically Distinct; Rebuild Batch Workflows from Dependencies Rather Than Job Names; Preserve Reports and Statements Through Data Reconciliation; Prove Backup, Restore, and External-Effect Recovery; Deliver Incrementally with Controlled Coexistence and Retirement.

Verifications: Verify Authorization Messaging and Fraud Separation; Verify Batch, Reports, Statements, and Recovery; Verify Build, Release, Coexistence, and Retirement Controls; Verify Security and Operational Observability.

Prerequisites: Establish the Deployed and Measurable Baseline; Resolve Data Authority and Rehearse Migration; Cut Over Payments and Transaction Outcomes.

Owner: joint.

Agent effort: Agents can model dependencies, automate orchestration and reconciliation, inject queue and batch failures, compare reports, test restoration, and trace correlated events. They cannot decide observable message timing, fraud policy, report obligations, retention, recovery objectives, or retirement authority.

Human effort: Business, fraud, messaging, data, records, security, operations, recovery, and external-interface owners must resolve schemas, ordering, reply timing, lifecycle rules, batch outcomes, report meanings, retention, and recovery obligations. They must separately authorize each cutover and any retirement.

Waiting time: Queue access, scheduler evidence, supplier participation, batch and extract windows, report-cycle timing, retention decisions, and restore environments may dominate elapsed time. Change freezes and business calendars are unknown.

Elapsed working days: 45 / 110 / 240.

The outcome is characterized authorization messaging, separately governed fraud processing, dependency-based batch orchestration, reconciled reports and statements, and tested restoration including external effects. Response-before-persistence, if confirmed and preserved, requires durable recovery; changing it through an outbox requires explicit acceptance. Fraud must remain distinct until evidence proves a shared lifecycle.

The gate requires failure injection before and after receipt, evaluation, persistence, publication, acknowledgement, timeout, retry, expiry, destructive file operations, posting, and index rebuilding. Acceptance requires controlled handling of in-flight messages, no lost or duplicate processing, restartable batch operations, reconciled content and totals, and restoration reconciled with queues, files, reports, payments, and externally observed responses. Retirement remains a separate decision and is blocked by unknown consumers, unresolved discrepancies, untested recovery, unmet retention duties, or continuing fallback dependence.

Related changes: CHG-010, CHG-011, CHG-013, CHG-014, CHG-019, CHG-021

Related verifications: VER-006, VER-009, VER-011, VER-010