The ScaledNative Migration Engine
One governed run, from the first read of a mainframe to a deployed cloud-native workflow — and the estate it touches stays untouched. Seven named stages, each governed by construction. This is the stage-by-stage spec, with the honest real-vs-roadmap stated in the open.
ScaledNative connects to a legacy estate read-only, inside your boundary, ingests its schema, data, and code, builds the EstateGraph of how it actually works, then either transforms it directly or extracts the requirements that feed the development agents to build it new — proving equivalence as signed evidence before any governed, WORM-sealed cutover. The data never leaves.
The pipeline
For each stage: what it does, the real technique behind it, and how it stays governed and in-boundary. Where a stage's live surface is a build-out, the honest boundary says so — in the stage.
CONNECT
Establish a read-only-first connection from inside the customer's network: the mainframe source store over SFTP, the relational catalog over JDBC, the CMDB inventory, the operational logs. We discover; we don't touch.
The real technique
Three live-reader interfaces exist today — SFTP source reader, JDBC schema reader, CMDB reader — structured so a real endpoint drops in by config with zero pipeline change. The SFTP reader is a read-only overlay by construction: it fetches source files only and never writes to any source system.
Governed + in-boundary
Connectors normalize into structural metadata only — names, LOC, complexity, dependency targets — and do not copy verbatim source into the snapshot. The egress gate sits in front of any external routing; assertReadOnly fails closed. A run cannot execute against a connector that isn't in an approved, production-ready binding.
The honest boundary
All connectors are fixture-backed today — the reader code is identical for fixture vs. live, but none is wired to a real customer system, and no working DB2 connector exists. Connecting one live read-only reader to a lower environment is documented pre-pilot setup work, not missing capability.
INGEST
Pull the four estate inputs across the read-only connection: schema (DB2 catalog), data (table extracts / VSAM-IMS unloads), code (COBOL, copybooks, JCL, CICS maps), and logs (CICS transaction logs, SMF records, batch run logs, DB2 audit trails).
The real technique
Code ingest is real and runnable today. The deterministic COBOL/copybook/JCL parser extracts, per program: PROGRAM-ID, divisions, COPY and CALL dependencies, every paragraph with its PERFORM in-degree (real dead-code candidates), a complexity proxy, and a line-anchored business-rule list — each IF / WHEN / EVALUATE / COMPUTE lifted with its exact source line number as the audit anchor.
Governed + in-boundary
Ingest writes into a discovery snapshot of canonical entities, not a copy of your data warehouse. Restricted data is runtime-only and never lands in the snapshot. Code ingest runs on metadata; data ingest, when wired, runs in-boundary against the unload.
The honest boundary
Code parse is real today, and so is the field-level COMP-3 packed-decimal byte decode — a unit-tested pure function (decodeComp3) that reads the sign nibble + implied scale and returns the value cents-exact. The trap it solves: a naive EBCDIC pass over a packed-decimal field destroys it — text fields are transcoded, binary fields are arithmetically unpacked, and the copybook is the schema-of-record that drives the unpack. What remains the build-out for a data-bearing pilot is the full record-stream pipeline: driving that decoder over a live DB2 unload with EBCDIC→UTF-8 transcode across complete copybook-described records.
UNDERSTAND
Turn raw ingest into understanding: a dependency graph of how the estate fits together, the as-is operational process recovered from logs, and the data lineage. This is the EstateGraph — the run's central artifact.
The real technique
Three layers. The dependency graph (real today) — program→copybook, program→program, JCL job→program, table→program edges, with dead-code candidates and complexity riding on it. Process mining (the as-is, technique to wire) reconstructs the real process from event logs — every variant and exception path, not the idealized flowchart. Data lineage (real spine) records where each entity and transform came from.
Governed + in-boundary
The EstateGraph is built in-boundary from in-boundary ingest. Every node and edge is lineage-stamped — auditable, not a black box. It's deterministic graph construction over the parse; no external model is required to build it.
The honest boundary
The dependency graph and lineage spine are real and run today over the parsed estate. Process mining over live CICS/SMF/JCL logs is the technique-to-wire — the graph it feeds already exists. Crucially, the lineage layer surfaces the #1 hidden risk: referential integrity enforced in COBOL, not in the DB2 catalog — implicit relationships the catalog never knew about, mined out of the code so the new schema can enforce them.
TRANSFORM & MAP
Two jobs. First, the mapping: how each DB2 construct becomes a PostgreSQL construct. Second, the per-component decision: for each program, transpile it faithfully, or rewrite it from extracted intent. That decision is the fork.
The real technique
The mapping is mechanical but trap-laden — DECIMAL and packed-decimal land in NUMERIC where the sign-nibble and implied decimal must be exact; DECFLOAT has no exact PG equivalent; DB2 TIMESTAMP carries more fractional digits than PG; every IDENTITY/SEQUENCE must have its last_value reset to MAX(id)+1 after bulk load or you get PK collisions. Copybook structure maps to relational: OCCURS becomes a child table, REDEFINES a discriminated union, 88-levels become CHECK constraints.
Governed + in-boundary
The mapping and the per-component decision are scored from the EstateGraph — complexity, fan-in/out, business-rule density, dead-code ratio — and lineage-stamped. COMP-3 / packed-decimal mishandling is the #1 data-fidelity risk, and the thing the validate stage is built to catch.
BUILD
The fork resolves. Transform emits converted schema and code, ready to prove. Build-new hands a requirements baseline — the process-mined as-is plus the line-anchored business rules — to the development agents, which construct the new system against verified legacy intent.
The real technique
Transpilation carries the old shape forward — equivalence guaranteed, readability poor ("Java that thinks in COBOL"). The build-new fork instead makes legacy intent explicit and feeds it to the dev agents as the build spec, through a brainstorm → spec → plan → build loop. The pattern that works: parser + AST → model, never raw code → model. This is the rebuild-compression mechanic — the agents build from the extracted baseline instead of re-deriving requirements by hand.
Governed + in-boundary
The candidate reimagined artifact is a real in-boundary model generation, held for acceptance — never auto-applied. Generated IaC (Terraform / Bicep / Pulumi per target) holds at the apply gate; the 6R disposition holds for an architect override. A build-new component is held to the same equivalence bar as a transpiled one — that's the discipline.
The honest boundary
The in-boundary model-router and the routing posture are real. No served model endpoint is wired for ScaledNative yet — so candidate generation falls back to a deterministic in-boundary path, and the console reports it as such. Per-customer fork-and-train is proven in our model foundry (one sealed model, a signed model passport); the per-customer fork API is on the roadmap. We sell the shared in-boundary base for a first pilot and the per-customer fork as architecture-proven.
VALIDATE & RECONCILE
Prove the new component does what the old one did — at the byte level and the business-meaning level — and emit that proof as signed evidence, not a green checkmark. This is the engine's load-bearing differentiator.
The real technique
The parallel-run engine replays a fixture set through the legacy behavior and the reimagined candidate and diffs the outputs. Deterministic — same fixtures, models, and threshold produce a byte-identical report, with a content-derived report id. Field-level diff with severity-ranked divergences. A hard severity-ceiling gate: PASS requires both equivalence ≥ threshold and no divergence above the ceiling — a single critical divergence fails the run at 99.9% equivalence. Fail-closed on an empty fixture set and on any restricted fixture.
Governed + in-boundary
The report is the evidence: a Behavioral Equivalence Report, lineage-stamped, written to the WORM audit chain. Cutover is offered only on a PASS verdict. This is reconciliation as signed evidence — submit-ready for an auditor, not a black box. The seeded banker's-rounding edge is engineered to fail if the candidate drops the rule, so a dropped rule provably diverges.
The honest boundary
The engine and the gate are real and run today on recorded synthetic fixtures (restricted fixtures fail closed by contract). Capturing and governing live recorded production traffic for replay is the build-out — the architecture extends cleanly: governed capture into fixtures behind the egress gate, then replay through the existing engine.
CUTOVER
Move traffic from legacy to new in a controlled, reversible way, with a go/no-go authorized by the validate-stage evidence — and seal the whole act immutably.
The real technique
Three strategies, strangler default. Strangler-fig: a façade routes each request to legacy or new, migrating one capability at a time with per-slice rollback — the default for a large can't-go-dark estate. Parallel run: both systems run on the same inputs, kept in sync by log-based CDC, outputs diffed until confidence is high — the gold standard for proving correctness before the flip. Big-bang: freeze, migrate, switch — only for small systems or hard regulatory freeze dates.
Governed + in-boundary
The high-risk cutover tools require human review and always return executed: false — the real flip is a connected-instance runtime act that is never simulated as done. The go/no-go is authorized by the PASS report. The decision, the evidence it cites, and the act are WORM-sealed. Rollback is designed in: keep the source authoritative through the parallel-run window so it stays a hot fallback.
The honest boundary
Held by design. The orchestration, the gate, and the evidence binding are real; the execution is the one act the platform refuses to fake. It flips only against a connected instance in a real pilot.
Inside Stage 4
The mapping is mostly mechanical. The risk is in the traps — and the worst of them, packed-decimal mishandling, silently corrupts production money. This is the kind of thing the equivalence report exists to catch.
DB2 (z/OS)
PostgreSQL
The trap to govern
DECIMAL(p,s) / NUMERIC(p,s)
NUMERIC(p,s)
where packed-decimal lands — sign-nibble + implied decimal must be exact
DECFLOAT(16/34)
double precision / NUMERIC
no exact PG equivalent — decide per column: precision or range
CHAR(n)
VARCHAR(n) / TEXT
blank-padding semantics differ
CHAR(n) FOR BIT DATA
BYTEA
FOR BIT DATA dropped; it's binary, not text
TIMESTAMP
TIMESTAMP
DB2 supports 12 fractional digits, PG max 6 — truncation risk
IDENTITY / SEQUENCE
GENERATED AS IDENTITY
reset last_value to MAX(id)+1 after bulk load or get PK collisions
DB2 RI ON DELETE …
FOREIGN KEY … ON DELETE …
~1:1 — but mine COBOL for the RI the catalog never recorded
Copybook structure maps to relational shape: OCCURS becomes a child table with a foreign key (a repeating group is a 1-to-many, not N columns); REDEFINES becomes a discriminated union; 88-levels become CHECK constraints or lookup tables. WITH DEFAULT must be made explicit; CCSID and FOR BIT DATA clauses are dropped on the way over.
The line we won't cross
We hand a buyer's technical lead our own gap-and-risk register before they ask for it. Here is the engine view of it — stated plainly, because a demo that survives diligence is the whole point.
Real and runnable today
Roadmap / build-out — never demoed as live
Connect, parse real COBOL, build the EstateGraph, extract the rules, generate a held candidate, prove it through the equivalence gate — where a dropped rule provably fails — and watch the cutover stay held. Honestly narrated, end to end.