Strategy — Technical deep dive
The program has proven it can build cloud-native systems off the mainframe: GroupLink Portal runs as a modernization proof in an active lane, and MarketLink went from concept to auditor handoff in six weeks. The remaining constraint is the backend dependency itself — payment processing, the batch estate, and the data bridge. This page is the proposed doctrine for removing it fully.
Everything plan-level on this page is a proposed target strategy submitted for program review. Nothing here is committed scope. Vendor selections, engagement boundaries, and calendar dates attach only after the decision room concludes and discovery figures are validated.
01 — Where the pattern stands
GroupLink Portal demonstrated the full coexistence pattern: a new cloud-native build, a database migrated to PostgreSQL, an IBM CDC bridge keeping DB2 and PostgreSQL synchronized, and parallel operation across both sides. The mainframe no longer constrains what the program can build. It constrains what the program can retire.
02 — What keeps the mainframe alive
Application screens moved off the mainframe without moving the mainframe. Five dependency classes hold it in place, and each has a distinct exit route. The doctrine treats them separately because they fail differently, carry different risk, and retire on different evidence.
| Dependency class | What it does | Why it persists | Exit route |
|---|---|---|---|
| Batch orchestration | The Control-M-scheduled JCL estate executes the nightly and periodic workload. Vendor discovery sized the Finance domain at 295 JCLs, 179 daily jobs, and 7 functional areas, and the Admin domain at 237 JCLs across 4 functional areas (vendor-provided counts). | Decades of accreted jobs with interdependencies documented nowhere but the code; scheduling logic lives in Control-M while business logic lives in JCL and COBOL. | Reverse-engineer into a job catalog and lineage map, then decompose and retire wave by wave with a per-job ledger (Plays 01 and 03). |
| Payment processing core | Premium cash posting, distribution, and non-pay termination across roughly 20 carriers (carrier count vendor-provided). | Highest-risk money-movement domain; grace-period, regulatory notification, and termination rules are embedded in COBOL and evidenced nowhere else. | Carve out last and most carefully: parallel run with penny-level reconciliation, carrier-by-carrier cutover (Play 04). |
| DB2 / VSAM system of record | Holds the authoritative data for legacy domains that have not migrated, feeding the CDC bridge and every downstream mainframe consumer. | Downstream jobs and interfaces still read and write against DB2; no domain has yet flipped sovereignty to PostgreSQL. | Domain-by-domain sovereignty flips with reversed CDC and dual-run reconciliation (Play 02). |
| EDI and file interfaces | 834 enrollment transactions and carrier file exchanges terminate on mainframe endpoints in mainframe formats. | Trading partners are wired to those endpoints; changing them requires coordinated partner migration, not just internal engineering. | Re-terminate feeds onto cloud services behind stable contracts; migrate partner by partner with parity evidence at each step. |
| Nightly file consumers | Downstream systems ingest files produced by the batch estate on fixed shapes and schedules. | Consumers depend on file shape and timing rather than on the mainframe itself, so a job cannot retire until its last consumer is accounted for. | Catalog every consumer in the lineage map; retire the producing job only when each consumer is re-pointed or eliminated (Play 03). |
Module, job, and carrier counts are vendor discovery figures per the vendor proposal, pending program validation. They size the estate for planning; they are not yet verified program inventory.
03 — The exit doctrine
The doctrine is deliberately unexotic: understand the estate before touching it, move data ownership before moving workload, decompose batch rather than porting it, save the money movement for last, and let evidence — not calendars — open every gate.
Parse JCL, COBOL, copybooks, and schedules into three connected artifacts: a job catalog, a data lineage map, and a business-rule corpus in which every extracted rule carries a source anchor back to the code it came from — the same traceability discipline the program already applies to CMS requirements. AI-assisted documentation accelerates the extraction; program engineers and business SMEs supply the industry, regulatory, and business context no tool can infer.
Today CDC flows DB2 → PostgreSQL: the bridge feeds the new platform from the legacy system of record. The flip inverts that. PostgreSQL becomes system of record for a domain; the CDC direction reverses to keep remaining DB2 consumers fed; and when the last consumer is migrated, the subscription is retired. Dual-run reconciliation proves parity before each flip — no domain flips on assertion.
Classify every job in the catalog, then replace by class rather than translating JCL into a new scheduler. A per-job retirement ledger tracks each job from classification to verified retirement.
Premium payment is the highest-risk domain in the estate, so it moves after the patterns are rehearsed everywhere else. The proposed carve-out runs the new system in parallel behind a penny-level reconciliation harness, cuts over carrier by carrier across roughly 20 carriers (vendor-provided count), and preserves — with evidence — the grace-period, regulatory notification, and NSF, refund, and chargeback flows the current core enforces.
No cutover proceeds on schedule pressure. Each gate requires dual-run parity artifacts, a rehearsed rollback, operational baselines for the receiving platform, and an entry in the decommission ledger — consistent with the program's standing rule that savings count only on verified retirement.
04 — The capability gap
The program already holds the capabilities that matter most — building cloud-native systems, running agentic delivery with evidence, and operating CDC coexistence. The gaps cluster around industrial-scale reverse engineering and migration tooling, and each gap has a named closure route.
| Capability | Status today | How we close it |
|---|---|---|
| Cloud-native application build | Proven GroupLink Portal and the MarketLink six-week pathway. |
Self-perform. |
| Agentic delivery and evidence system | Proven WHPS AI SDLC Factory — model-agnostic, human-governed, evidence-first. |
Self-perform. |
| CDC coexistence operations | Proven Running in the production bridge between DB2 and PostgreSQL. |
Self-perform. |
| COBOL / JCL reverse engineering at scale | Gap | Candidate: a bounded vendor tooling pilot — for example, a scoped AWS Transform engagement on the Finance and Admin JCL estate — assessed in the decision room before any commitment. |
| Automated business-rule extraction and documentation | Gap | Build the rule-corpus pipeline in-house; vendor assistance acceptable for extraction tooling. |
| Data migration factory (DB2 z/OS + VSAM → cloud PostgreSQL) | Gap | Vendor tooling with program-owned execution. |
| Batch replacement framework | Gap | Build, reusing the platform event architecture. |
| Parity and reconciliation test harness | Gap | Build, extending the existing test kits and golden-file discipline. |
| MIPS and workload telemetry baselining | Partial | Establish before the first wave, so every retirement is evidenced against a measured baseline. |
Closure routes are proposed, not contracted. Vendor engagement boundaries are a decision-room outcome; the program retains ownership of execution, evidence, and acceptance in every route above.
05 — Proposed sequencing
The order below is the proposal: it front-loads understanding, proves the sovereignty flip where the bridge already runs, and holds the highest-risk domain until the machinery has been rehearsed. Calendar dates attach only after the vendor decision is made and discovery figures are validated.
Build the job catalog and data lineage map for the Finance and Admin domains first — they carry the JCL mass — and stand up the source-anchored business-rule corpus that every later wave depends on.
Flip the GroupLink Portal domain, where the CDC bridge already runs and parallel operation is established. PostgreSQL becomes system of record; the reversed subscription feeds remaining DB2 consumers until each is migrated.
Retire jobs in dependency order, functional area by functional area, with the per-job retirement ledger recording classification, replacement route, consumer disposition, and verified retirement.
The longest parallel run in the program: penny-level reconciliation, carrier-by-carrier cutover, and evidenced preservation of grace-period, notification, and NSF, refund, and chargeback behavior.
Close the remaining CDC subscriptions on their retirement dates, evidence the MIPS step-downs against the telemetry baseline, and complete the decommission ledger that makes every claimed saving verifiable.
Sequence only — no calendar commitments are made on this page. Dates attach after the vendor decision and validation of the vendor discovery figures.
06 — The position
The applications are no longer the constraint. The dependency is — and dependencies can be engineered out.
The program has the build capability, the coexistence bridge, and the evidence discipline. What remains is a sequencing and tooling decision — and that decision has a room.