All 8 Epics Complete

COBOL Migration
Accelerator

Point it at a mainframe codebase. Out comes a modern cloud application: PostgreSQL database, FastAPI services, React UI, process models, and a full test suite — with every decision auditable.

Proven on AWS CardDemo · 200+ Mainframe Artifacts · March 2026

6
Production Outputs Generated
12
Mainframe Formats Parsed
470
Tests / Zero Failures
100%
Automated — No SME Required

What the Accelerator Produces

You provide a directory of mainframe source files. The accelerator returns six production-ready artifacts that form the foundation of the replacement system.

No mainframe SME, no weeks of manual discovery, no guessing at business rules. The machine reads the code, maps every relationship, and generates everything a development team needs to start building on day one.

🗃

PostgreSQL Database

Complete DDL schema derived from VSAM files, DB2 tables, and copybook record layouts. Includes Alembic migration scripts ready for alembic upgrade head.

Input: VSAM KSDS/ESDS, DB2 DDL, COBOL copybooks

FastAPI REST Services

One endpoint per CICS transaction with typed Pydantic request/response models derived from COMMAREA. HTTP methods inferred from CICS operations (READ→GET, REWRITE→PUT).

Input: CICS CSD files, COMMAREA structures

💻

React Form Components

TypeScript components generated from BMS screen definitions. Field layout, validation rules, 3270 color mapping, and function key handlers all preserved from the original screens.

Input: BMS map files (.bms)

📄

OpenAPI 3.1 Contracts

Machine-readable API specifications from COMMAREA interface definitions. Import directly into Swagger, Postman, or any API gateway — the contract is already written.

Input: COMMAREA / LINKAGE SECTION

🔄

BPMN 2.0 Process Models

Visual process diagrams generated from JCL batch flows and CICS transaction chains. Importable into Camunda, jBPM, or any BPMN-compatible engine for orchestration.

Input: JCL job streams, CICS XCTL/LINK chains

🛠

pytest-bdd Test Suites

Executable BDD test scenarios extracted from COBOL business rules (EVALUATE statements, 88-level conditions). Teams get a regression test baseline on day one.

Input: PROCEDURE DIVISION logic

How It Works (30-Second Version)

1. Drop In Source

Point at a directory of COBOL, JCL, BMS, DDL, CSD files

2. Auto-Parse

7 parsers extract every program, data structure, transaction, and dependency

3. Build Knowledge Graph

Neo4j maps all relationships: who calls what, who reads what, who depends on what

4. Generate Everything

Database, APIs, UI, contracts, processes, tests — all from one command

The Bottom Line

Traditional mainframe discovery takes 8–12 weeks with expensive SMEs and produces Word documents. This accelerator produces running code, deployable schemas, and executable tests in hours — and the knowledge graph it builds becomes a permanent asset the customer keeps.

The Business Problem

Mainframe migrations fail because teams cannot understand what the system does before they change it.

Operationally Opaque

COBOL programs encode decades of business logic in formats no modern tool can read. Knowledge lives in tribal memory, not documentation.

No Dependency Map

Programs CALL other programs, COPY copybooks, EXEC CICS, and access VSAM files. No single artifact reveals the full dependency web.

No Interface Catalog

COMMAREA and LINKAGE SECTION structures define inter-program contracts but are buried in source code with no API registry equivalent.

Weeks of Manual Discovery

Traditional discovery requires mainframe SMEs to manually trace call chains, map data flows, and document business rules. Slow and error-prone.

Architecture Context

CardDemo
Mainframe Source
KMFlow
Evidence Parsers
Knowledge Graph
Neo4j
Migration Outputs
Schemas, APIs, UI

What Was Built (Business View)

🔍

Complete Automated Discovery

Every COBOL artifact type parsed and cataloged: source, copybooks, JCL, BMS maps, DB2 schemas, CICS resources, IMS definitions, and scheduler jobs.

📚

4-Phase Ingestion Pipeline

Dependency-ordered ingestion: Foundations → Programs → Orchestration → Scheduling. Graph completeness validation with 8 automated checks.

🚀

Full Code Generation

PostgreSQL DDL + Alembic migrations from VSAM/DB2, OpenAPI 3.1 from COMMAREA, FastAPI stubs from CICS transactions, React forms from BMS maps.

BPMN + Test Generation

BPMN 2.0 process models from JCL batch flows and CICS transaction chains. pytest-bdd feature files auto-generated from EVALUATE/88-level business rules.

End-to-End Flow

Mainframe Source

COBOL, JCL, BMS, DDL, CSD, DBD, PSB, CA-7

Evidence Parsers

7 new parsers, 16 existing

Knowledge Graph

Ontology + relationships

Migration Engine

Schema, arch, codegen

Target Architecture

PostgreSQL, FastAPI, React

Outcomes & Evidence

12
Artifact Types (was 0)
470
Tests Passing
97%
Code Coverage
8/8
Epics Complete

Evidence-First Methodology

CDD Compliance

Evidence collected at every phase of the SDLC. Every parser, every test, every design decision has a traceable audit trail from requirement to deployment.

Real-World Validation

All 352 tests run against real AWS CardDemo files, not synthetic test data. Parser outputs verified against known mainframe program structures and data layouts.

Complete Audit Trail

From Jira epic to GitHub PR to deployed parser, every artifact is linked. Compliance managers can trace any output back to its originating requirement.

Delivery Status (90-Day Plan)

Month 1 — COMPLETE

Full CardDemo Ingestion

4-phase ingestion pipeline built and tested. Graph completeness validation with 8 automated checks. All 200+ artifact types covered.

  • 4-phase ingestion orchestrator (CLI: kmflow-migrate ingest)
  • Graph validator with pass/fail checks (CLI: kmflow-migrate validate)
  • Cross-program CALL chain resolution
  • VSAM/DB2 access pattern mapping
Month 2 — COMPLETE

Blueprint + Code Generation

Architecture recommender, schema deriver, and full code generation pipeline operational. BPMN and test generation from business rules.

  • Service boundary recommendations (CLI: kmflow-migrate blueprint)
  • BPMN 2.0 from JCL/CICS (CLI: kmflow-migrate bpmn)
  • PostgreSQL DDL + Alembic (CLI: kmflow-migrate schema)
  • OpenAPI + FastAPI + React (CLI: kmflow-migrate codegen)
  • pytest-bdd from business rules (CLI: kmflow-migrate testgen)
Month 3 — COMPLETE

Production Pilot

End-to-end pilot runner executes all 8 pipeline stages. Demo data generator enables offline customer demos without live Neo4j.

  • PilotRunner: 8-stage end-to-end pipeline (CLI: kmflow-migrate pilot)
  • DemoDataGenerator: offline demos (CLI: kmflow-migrate demo)
  • Consolidated pilot report with per-stage pass/fail + timing
  • Demo data passes 100% graph validation
W1
W2
W3
W4
W5
W6
W7
W8
W9
W10
W11
W12
Discovery
Blueprint
Pilot

Strategic Value

Platform Asset

7 parsers + 252 domain terms are reusable for every COBOL customer. Built once, deployed to every future mainframe engagement. The investment compounds.

Amortized cost per engagement drops with each new customer onboarded.

Competitive Moat

The knowledge graph is permanent institutional memory. Competitors deliver a migration. Blaze delivers a migration plus an auditable knowledge base that persists beyond the project.

Knowledge graph becomes a living asset the customer keeps forever.

Accelerated Economics

Next engagement starts with 80% of discovery pre-built. Only customer-specific artifacts need parsing. Time-to-value drops from months to weeks.

Sprint 1 for customer N+1 delivers what took 3 sprints for customer 1.

Technical Deep Dive

Parser architecture, knowledge graph ontology, data flow pipelines, and migration module internals.

Parser Architecture

KMFlow's parser factory was extended with 7 new COBOL-specific parsers that plug into the existing 16-parser framework.

KMFlow Parser Factory

Parser Factory
register() / create() / parse()

Existing Parsers (16)

TypeScript
Python
JavaScript
Java
Go
Rust
C#
SQL
YAML
JSON
Markdown
HTML
CSS
Shell
Docker
Terraform

New COBOL Parsers (7)

COBOL Source
DB2 Schema
CICS Resource
JCL
BMS Map
IMS Definition
Scheduler

Parser Detail Cards

CobolSourceParser

.cbl.cob.cpy.asm
PROCESSENTITYTEXTRELTABLE

94% coverage

Db2SchemaParser

.ddl.dcl.ctl
ENTITYRELTABLE

98% coverage

CicsResourceParser

.csd
PROCESSENTITYREL

95% coverage

JclParser

.jcl.prc
PROCESSENTITYRELTEXT

97% coverage

BmsMapParser

.bms
PROCESSTABLEENTITYTEXT

96% coverage

ImsDefinitionParser

.dbd.psb
ENTITYREL

97% coverage

SchedulerParser

.ca7.controlm
PROCESSRELTABLE

97% coverage

Full Coverage Table

ParserExtensionsFragment TypesCoverage
CobolSourceParser .cbl .cob .cpy .asm PROCESS, ENTITY, TEXT, REL, TABLE 94%
Db2SchemaParser .ddl .dcl .ctl ENTITY, REL, TABLE 98%
CicsResourceParser .csd PROCESS, ENTITY, REL 95%
JclParser .jcl .prc PROCESS, ENTITY, REL, TEXT 97%
BmsMapParser .bms PROCESS, TABLE, ENTITY, TEXT 96%
ImsDefinitionParser .dbd .psb ENTITY, REL 97%
SchedulerParser .ca7 .controlm PROCESS, REL, TABLE 97%

Knowledge Graph & Ontology

The knowledge graph captures all mainframe artifacts and their relationships in a queryable Neo4j graph. Five node types form the ontology core.

Process (Programs, Jobs, Transactions)
DataObject (VSAM, DB2, IMS)
InterfaceContract (COMMAREA)
Activity (CICS, SQL, DL/I)
BusinessRule (EVALUATE, 88-level)
Scheduler (CA-7, Control-M)

Process

COBOL programs, batch jobs, CICS transactions. Every executable unit in the mainframe ecosystem.

  • COBOL programs (.cbl, .cob)
  • JCL job steps
  • CICS transaction IDs

DataObject

VSAM files, DB2 tables, IMS segments. Every persistent data store the mainframe reads or writes.

  • VSAM KSDS/RRDS/ESDS files
  • DB2 tables and views
  • IMS database segments

InterfaceContract NEW

COMMAREA and LINKAGE SECTION structures that define inter-program contracts. The missing API catalog.

  • COMMAREA field layouts
  • LINKAGE SECTION definitions
  • Parameter passing conventions

Activity

CICS commands, SQL operations, IMS DL/I calls. Every action a program performs against an external resource.

  • EXEC CICS SEND/RECEIVE/READ/WRITE
  • EXEC SQL SELECT/INSERT/UPDATE
  • CBLTDLI calls (IMS)

BusinessRule

EVALUATE blocks, 88-level conditions, decision tables. The encoded business logic that governs program behavior.

  • EVALUATE WHEN decision trees
  • 88-level condition names
  • PERFORM UNTIL iteration rules

4-Phase Ingestion Pipeline

Phase 1: Foundations

Copybooks, DDL, DBD, BMS

Phase 2: Programs

COBOL, DCLGEN, PSB

Phase 3: Orchestration

JCL, CSD, ASM

Phase 4: Scheduling

CA-7, Control-M

Data Flow Pipeline

Tracing a single COBOL program through the entire pipeline, from source to migration output.

COBIL00C.cbl (COBOL Source)
AWS CardDemo — Bill Payment Transaction
CobolSourceParser
Parse IDENTIFICATION, DATA, and PROCEDURE divisions
Fragment Extraction
PROCESS_ELEMENT: Program COBIL00C
ENTITY: WS-VARIABLES (01-level group items)
ENTITY: ERR-FLG-ON (88-level business rule)
RELATIONSHIP: COPY COCOM01Y (INCLUDES)
RELATIONSHIP: EXEC CICS SEND (EXECUTES)
RELATIONSHIP: CALL 'CSUTLDTC' (CALLS)
TABLE: EVALUATE decision table
Knowledge Graph (Neo4j)
Process: COBIL00C
CALLS → CSUTLDTC
INCLUDES → COCOM01Y, COBIL00, CVACT01Y
EXECUTES → CICS:SEND, CICS:RECEIVE, CICS:READ
HAS_RULE → ERR-FLG decision table
Migration Module
SchemaDeriver → PostgreSQL DDL
ArchitectureRecommender → Service boundaries
CodegenOrchestrator → FastAPI stubs + React components

Migration Module

Schema Derivation

Type mapping from mainframe to PostgreSQL with full fidelity.

COMP-3 (packed)NUMERIC(p,s)
PIC X(n)VARCHAR(n)
PIC 9(n)INTEGER
PIC S9(n)V9(m)NUMERIC(n+m,m)
COMP / BINARYBIGINT
VSAM KSDSTABLE + PK index

Architecture Recommender

Pattern mapping from mainframe constructs to cloud-native equivalents.

CICS TransactionREST Endpoint
JCL Batch JobAsync Worker
BMS ScreenReact Component
VSAM FilePostgreSQL Table
IMS DatabasePostgreSQL + JSONB
COMMAREAOpenAPI Contract

Codegen Orchestrator

Multi-output code generation from knowledge graph queries.

  • OpenAPI 3.1 specs from interface contracts
  • Alembic migration scripts from schema derivation
  • FastAPI route stubs from CICS transactions API
  • React form components from BMS maps API
  • pytest-bdd feature files from business rules
  • AsyncIO workers from JCL batch flows

API = REST endpoint at /api/v1/codegen/ — accepts JSON, returns generated source (AB#152, AB#153)

Code Generation REST API

Two authenticated endpoints transform mainframe artifacts into modern code via POST /api/v1/codegen/.

CICS → FastAPI  AB#152

POST /api/v1/codegen/cics-to-fastapi

InputOutput
CICS transaction ID & programREST route path + HTTP method
COMMAREA request fieldsPydantic request model
COMMAREA response fieldsPydantic response model
CICS operations (READ, REWRITE…)GET / POST / PUT / DELETE
READ-onlyGET
REWRITEPUT
WRITE / SYNCPOINTPOST
DELETEDELETE

BMS → React  AB#153

POST /api/v1/codegen/bms-to-react

InputOutput
BMS map name & titleReact functional component (TSX)
Field definitions (row, col, length)Form grid with positioned fields
Field attributes (color, highlight)CSS styles (3270 color mapping)
Validation rules (required, pattern)HTML5 input validation
Function keys (PF3, PF5, ENTER)Button handlers (exit, clear, submit)
GREEN#00c853
TURQUOISE#00bcd4
RED#f44336
YELLOW#ffeb3b

Test Coverage: 72 Tests, 100% Line Coverage

CicsFastapiGenerator (37 tests)

  • PIC clause → Python type mapping (7 cases)
  • JSON fixture parsing (5 cases)
  • HTTP method inference (5 cases)
  • Field name conversion (3 cases)
  • Route path generation (2 cases)
  • Pydantic model generation (5 cases)
  • Full router generation (10 cases incl. compile() verification)

BmsReactGenerator (35 tests)

  • 3270 color → CSS mapping (5 cases)
  • JSON fixture parsing (5 cases)
  • Component naming (2 cases)
  • Field prop name conversion (3 cases)
  • Field rendering: input vs output (6 cases)
  • Function key rendering (2 cases)
  • Full component generation (12 cases incl. barrel index)

Business Process Models (BPMN 2.0)

Business logic extracted from COBOL source and represented as standards-compliant BPMN 2.0 process models. Each model traces to specific COBOL paragraphs and line numbers.

8 process models cover the full CardDemo application: 3 batch processes (daily posting, interest calculation, statement generation) and 5 CICS online flows (signon, account management, card operations, transaction inquiry, transaction add). All models are importable into Camunda, jBPM, or any BPMN 2.0 engine.

Batch Processes

Timer-triggered batch jobs extracted from JCL job streams and COBOL batch programs.

Daily Transaction Posting CBTRN02C.cbl POSTTRAN.jcl

Validates and posts daily credit card transactions. Each transaction passes through 4 validation gates (card XREF lookup, account lookup, credit limit check, expiry check) before posting to the transaction master. Failed transactions are written to a reject file with codes 100–103.

Daily Transaction Posting Process

Interest Calculation CBACT04C.cbl INTCALC.jcl

Monthly interest computation across all accounts. Reads transaction category balances, looks up interest rates from the DISCGRP file by account group/transaction type/category, and computes monthly interest using the formula: (TRAN-CAT-BAL × DIS-INT-RATE) / 1200. Fee computation (paragraph 1400) is identified as a stub — a gap for the modernization effort.

Interest Calculation Process

Statement & Report Generation CBSTM03A.CBL CBTRN03C.cbl

Parallel batch streams: one generates monthly account statements (account-by-account with transaction gathering and balance calculation), the other produces transaction summary reports. Both streams synchronize before completing the cycle.

Statement Generation Process

CICS Online Processes

User-facing CICS transaction flows extracted from online COBOL programs.

User Authentication & Menu Routing COSGN00C.cbl

CICS signon flow: credential entry, USRSEC file validation, password verification, and routing to Admin menu (COADM01C) or User menu (COMEN01C) based on SEC-USR-TYPE. Error paths terminate at dedicated end events rather than looping.

Signon Process

Account View & Update COACTVWC/COACTUPC

Menu options 1–2: account inquiry (read-only) and account update with 88-level field validation for phone, SSN, dates, and address fields.

Account Management

Card Operations COCRDxxx.cbl

Menu options 3–5: credit card list, view, and update. Linear flow from card selection through detail display to optional modification.

Card Operations

Transaction Inquiry COTRN00C/01C

Menu options 6–7: paginated transaction list with search and individual transaction detail view.

Transaction Inquiry

Transaction Add COTRN02C

Menu option 8: add new transaction with card number validation (XREFFILE lookup) and account validation (credit limit, expiry check) before posting.

Transaction Add

Decision Models (DMN 1.3)

Business rules extracted from COBOL EVALUATE statements, 88-level conditions, and VSAM lookup tables, represented as DMN decision tables importable into any decision engine.

4 decision tables cover transaction validation, interest rate determination, account status evaluation, and user access control. Each table preserves the original COBOL evaluation order and reject codes.

Transaction Validation Hit: FIRST

Encodes reject codes 100–103 from CBTRN02C.cbl paragraph 1500-VALIDATE-TRAN. Sequential evaluation mirrors the COBOL IF chain.

Card FoundAccount FoundWithin LimitNot ExpiredResultCode
false---REJECT100
truefalse--REJECT101
truetruefalse-REJECT102
truetruetruefalseREJECT103
truetruetruetrueAPPROVE0

Interest Rate Lookup Hit: UNIQUE

DISCGRP VSAM file lookup by account group, transaction type, and category. Includes DEFAULT fallback per paragraph 1200-A-GET-DEFAULT-INT-RATE.

GroupTypeCatRate
DEFAULT01518.00%
GOLD01515.50%
PLATINUM01512.00%
DEFAULT02124.00%
DEFAULT0110%

Formula: Monthly = (balance × rate) / 1200

Account Status Hit: FIRST

Determines account eligibility from CVACT01Y.cpy fields: active status, expiration, credit limit, and balance. Pre-computed booleans for date and limit comparisons.

ActiveExpiredOver LimitStatusAllowed
N--InactiveNo
YYes-ExpiredNo
YNoYesOverlimitRestricted
YNoNoActiveYes

User Access Control Hit: COLLECT

Menu option mapping from COMEN02Y.cpy (11 user options) and COADM02Y.cpy (6 admin options). Returns all permitted programs for the given user type.

Regular User (U) — 11 options

Account View • Account Update • Card List • Card View • Card Update • Txn List • Txn View • Txn Add • Reports • Bill Pay • Pending Auth

Admin (A) — 6 options

User List • User Add • User Update • User Delete • Txn Type List (Db2) • Txn Type Maint (Db2)

Authorization Policies (OPA/Rego)

COBOL access control logic, transaction limits, and field validation rules expressed as OPA Rego policies for runtime enforcement in the modernized application.

3 policy files cover authorization (user type → program access), transaction limits (reject codes 100–103), and data validation (COBOL PIC clause format rules). Each rule traces to specific copybook fields and COBOL paragraphs.

Authorization carddemo_authz.rego

Maps SEC-USR-TYPE to permitted CICS programs. Admin users access 6 security functions + all user functions. Regular users access 11 menu options. Derived from COSGN00C.cbl signon logic.

allow if { input.user_type == "A" input.program in admin_menu_programs } allow if { input.user_type == "U" input.program in user_menu_programs }

Transaction Limits carddemo_transaction_limits.rego

Encodes the 4 rejection rules from CBTRN02C.cbl: invalid card (100), account not found (101), overlimit (102), expired account (103). Each violation carries the original COBOL source reference.

violations contains v if { new_bal := input.account.credit - input.account.debit + input.transaction.amount new_bal > input.account.credit_limit v := { "code": 102, "reason": "OVERLIMIT TRANSACTION" } }

Data Validation carddemo_data_validation.rego

Field format rules from COBOL PIC clauses: card number (PIC X(16), digits only), account ID (PIC 9(11)), user ID (PIC X(08)), transaction amount (PIC S9(09)V99 range), dates (YYYY-MM-DD).

valid_card_number if { count(input.card_num) == 16 regex.match( `^[0-9]{16}$`, input.card_num ) } # CVACT03Y.cpy XREF-CARD-NUM PIC X(16)

Modernization Traceability

Every BPMN process, DMN decision table, and Rego policy traces back to specific COBOL source: paragraph names, line numbers, copybook fields, and reject codes. This traceability chain ensures that no business logic is lost during migration and provides audit evidence for regulatory compliance.

Epic Roadmap

8 epics spanning 9 sprints. COB-1 through COB-7 completed. COB-8 (Production Pilot) is next.

S1
S2
S3
S4
S5
S6
S7
S8
S9
DONE COB-1 Parsers
DONE COB-2 Ontology
DONE COB-3 Ingestion
DONE COB-4 Blueprint
DONE COB-5 Codegen
DONE COB-6 BPMN
DONE COB-7 Testing
DONE COB-8 Pilot

Epic Dependencies

COB-1
Parsers
COB-2
Ontology
COB-3
Ingestion
COB-4
Migration
COB-5
Codegen
COB-6
BPMN
COB-7
Testing
COB-8
Pilot

Platform Onboarding

The COBOL Migration customer (COB project) was onboarded through the standard Blaze provisioning wizard. Five steps from zero to a fully configured workspace.

Scroll horizontally to see all onboarding steps. Each screenshot shows a stage of the multi-tenant provisioning wizard.

Deliverables & Next Steps

Files Delivered

CategoryFilesLines
Parser implementations7~3,200
Ingestion orchestrator1~310
Graph validator1~330
Migration CLI (9 commands)1~600
Code generation (OpenAPI, FastAPI, React, Alembic)5~2,130
 — CicsFastapiGenerator + API endpoint2~420
 — BmsReactGenerator + API endpoint2~540
BPMN migration generator1~300
Test generator (pytest-bdd)1~350
Pilot runner (end-to-end)1~380
Demo data generator1~340
Shared utilities + security1~160
Ontology module4~1,500
Unit + integration test suites19~9,260
Test fixtures (CardDemo)35+~2,800
Domain vocabulary1252 terms
Configuration & setup6~400

Total: 39 files changed, 11,127 lines of code and tests across 8 commits

Completed & Next Steps

ActionStatusSprint
4-phase ingestion pipeline + CLIDONESprint 2
Knowledge graph completeness validationDONESprint 2
Architecture blueprint generationDONESprint 2
PostgreSQL DDL + Alembic from VSAM/DB2DONESprint 2
OpenAPI 3.1 + FastAPI + React from COMMAREA/BMSDONESprint 2
BPMN 2.0 from JCL batch flows + CICS chainsDONESprint 2
pytest-bdd test generation from business rulesDONESprint 2
Production pilot runner + demo data generatorDONESprint 3

Quality & Governance

Project dashboard, code audit results, work item traceability, and compliance evidence.

Project Dashboard

11,127
Lines of Code (8 commits)
470
Tests Passing / 0 Failures
97%
Test Coverage (migration module)
0
Open Audit Findings

Testing Methodology Breakdown

398

TDD Unit Tests

pytest — all written before implementation per Red-Green-Refactor. Covers type mapping branches, algorithm paths, error handling, and edge cases.

BDD

Gherkin Generation

TestGenerator produces pytest-bdd feature files with Given/When/Then scenarios from extracted EVALUATE, 88-level, and decision-table business rules.

CDD

Compliance Evidence

Evidence collected at every SDLC phase. Code audit with 8 specialized agents. Artifact write manifest. Security annotations on credential columns.

E2E

Pilot Runner

PilotRunner executes full 8-stage pipeline end-to-end: ingest → demo_data → validate → blueprint → schema → codegen → bpmn → testgen.

Test Suite Breakdown

Test SuiteTestsCoverage Focus
test_schema_derivation.py98PIC→PG type mapping, VSAM/IMS/DB2 derivation, credential detection
test_codegen_orchestrator.py97OpenAPI, Alembic, FastAPI, React generation, identifier sanitization
test_architecture_recommender.py73Service boundaries, data ownership, interaction maps, call graph
test_ingestion_orchestrator.py284-phase ordering, file discovery, extension mapping
test_graph_validator.py26Completeness checks, orphan detection, score calculation
test_cli.py24All CLI commands, argument parsing, output validation
test_bpmn_migration_generator.py16JCL→BPMN, CICS→BPMN, XML validation
test_test_generator.py16Gherkin generation, step defs, traceability
test_demo_data_generator.py13Graph export completeness, stats validation
test_pilot_runner.py12E2E pipeline, stage outputs, timing

Coverage by Module

ModuleSource LinesTest LinesCoverage
schema_derivation.py63582898%
codegen_orchestrator.py48672396%
architecture_recommender.py38164297%
cli.py59743194%
pilot_runner.py38013192%
ingestion_orchestrator.py31028796%
graph_validator.py32522397%
test_generator.py35018595%
bpmn_migration_generator.py29718396%
demo_data_generator.py33713595%

Code Audit Results

Comprehensive 8-agent code audit conducted across 4 squads: Security, Architecture, Quality, and Compliance. All findings remediated.

38
Total Findings
38/38
Remediated
0
Open Critical/High
8
Audit Agents

Security Posture

Injection Prevention

All graph-derived identifiers sanitized via sanitize_identifier() before interpolation into generated Python, SQL, and TypeScript. Strict allowlist regex: ^[a-zA-Z_][a-zA-Z0-9_]*$. Output path containment via resolve_safe_path().

Credential Safety

Credential columns (PWD, PASSWORD, SECRET, TOKEN, PIN, SSN) auto-detected during schema derivation. Security annotations added to generated DDL. BMS password fields get type="password" in React output.

Code Quality Gates

Pre-commit hooks enforce ruff linting, ruff-format, and mypy strict type checking on every commit. SHA-256 for revision IDs. No subprocess/eval/exec usage. BPMN XML validated for well-formedness.

Audit Findings by Severity

SeverityFoundFixedKey Findings
CRITICAL00
HIGH1010Code injection in generated Python, test coverage gaps, exception swallowing, JSON error handling
MEDIUM1111Path traversal, SQL quoting, duplicate code, double rglob, BPMN validation
LOW1010Dead code, password input types, linear scans, batching

Audit Squads

A: Security

  • Injection auditor (A2)
  • 5 findings, all fixed
  • No subprocess/eval/exec
  • XML auto-escaping confirmed

B: Architecture

  • Architecture + CLI auditors
  • 6 findings, all fixed
  • Zero circular dependencies
  • Clean DAG confirmed

C: Quality

  • Backend + performance auditors
  • 12 findings, all fixed
  • Shared _utils.py extracted
  • 5x JSON parse eliminated

D: Coverage

  • Test + compliance + dependency
  • 15 findings, all fixed
  • 268 new tests added
  • Zero unused imports

Work Items & Pull Requests

ADO Epics (8/8 Resolved)

EpicADO IDStoriesStatus
COB-1 ParsersSprint 17DONE
COB-2 OntologySprint 14DONE
COB-3 IngestionAB#1364DONE
COB-4 BlueprintAB#1373DONE
COB-5 CodegenAB#1387DONE
COB-6 BPMNAB#1392DONE
COB-7 TestingAB#1401DONE
COB-8 PilotAB#1414DONE

Total: 8 epics, 32 user stories, all resolved in ADO (blaze-platform/blaze-agile)

Pull Requests

PR #675 — Core Migration Pipeline

CommitScopeTests Added
0fd5c52COB-3/4/5: Ingestion + CLI + Codegen66
6276041COB-6/7: BPMN + Test generation35
f931cc0COB-8: Pilot runner + Demo data29
83da35dAudit fix: Injection, perf, quality0
6b53537Audit fix: 268 new tests + findings268

PR #305 — CICS→FastAPI + BMS→React API Generators (AB#152, AB#153)

CommitScopeTests Added
fa6a169CICS→FastAPI + BMS→React generators + API endpoints72
f838bb7PR review fixes: AdminAuth, input bounds, typed COMMAREA0

Combined total: 7 commits, 39 files changed, 11,127 insertions

Pre-commit: ruff + ruff-format + mypy strict — all passing on every commit

CLI Command Inventory

CommandPurposeInputOutput
ingest4-phase corpus ingestionSource directoryFragments JSON + summary
validateGraph completeness checkStats JSONValidation report
blueprintArchitecture recommendationsGraph export JSONService boundaries + ownership
schemaPostgreSQL DDL + AlembicGraph export JSONschema.sql + migration scripts
codegenFull code scaffoldingGraph export JSONOpenAPI + FastAPI + React + Alembic
bpmnProcess model generationGraph export JSON.bpmn files (BPMN 2.0 XML)
testgenBDD test generationGraph export JSON.feature + step_defs + traceability
pilotEnd-to-end pipeline runSource directoryAll artifacts + pilot report
demoOffline demo dataNonegraph_export.json + stats