docs: legacy-to-AWS migration architecture package

[devin-ai-integration]

Summary

Docs-only migration architecture package for architecture review. No application, build, pipeline or deployment file is touched — the diff is entirely under docs/architecture/.

Four documents, four rendered PNG diagrams, plus a combined self-contained HTML and an A3-landscape PDF of all four docs:

• current-state.md — repository-derived inventory, every claim carrying a file:line citation, anything not read directly labelled Inference:. Includes the zero-count negatives (no @Scheduled, no RestTemplate/WebClient, no JdbcTemplate/EntityManager, no native SQL or @Query, no file I/O, no messaging, and zero @Transactional), because "there are no scheduled jobs and no raw SQL" is what sets the risk level for the engine change.
• target-state.md — target diagram, the ASSUMED service list, the ten guardrails, a 20-row component table (rationale + H/M/L risk + effort per row), OFF-LIST? items with in-list alternatives, and a guardrail-compliance table covering G1–G10.
• open-questions.md — Q1–Q30, grouped, each addressed to a named role.
• migration-plan.md — WS0…WS10 with entry criteria and a dependency graph; WS10 production cutover is last and gated on the correctness/security blockers plus the production entry criteria (multi-region, load balancing, completed DR failover test with measured RTO/RPO).

Missing customer inputs — read before reviewing the target state

Two inputs the playbook requires were not supplied and have been assumed rather than invented as customer policy. Both are labelled as assumptions in the docs, on the HTML/PDF cover page, and raised as the first two open questions:

• No approved ("blessed") AWS service list → target-state.md §1 is an explicitly ASSUMED list; confirming it is Q1 to Platform Engineering. Everything in the component table is contingent on it.
• No customer platform guardrails → target-state.md §2 uses the playbook's default set, labelled assumed defaults; confirming or replacing it is Q2 to Platform Engineering.

Environment assumptions supplied as assumptions: multi-AZ dev, multi-region prod, Aurora PostgreSQL, ECS Fargate, Terraform, org-approved CD tooling.

Highest-value current-state findings (facts, not fixes)

	Finding	Evidence
C1	The pipeline does not build this repository. Both Jenkins jobs check out LondheShubham153/Springboot-BankApp, so nothing committed here is ever built, scanned or deployed	Jenkinsfile:26, GitOps/Jenkinsfile:21
C2	The CD sed edits bankapp-deployment.yaml; the file in the repo is bankapp-deployment.yml — the tag update is a silent no-op	GitOps/Jenkinsfile:40
C3	Four different image identities across CI, Kubernetes, Helm and Compose	Jenkinsfile:74, kubernetes/bankapp-deployment.yml:20, helm/bankapp/values.yaml, .env
C4	Health probes target /actuator/health, but spring-boot-starter-actuator is not a dependency	helm/bankapp/templates/deployment.yml:43-54 vs pom.xml
S1	Database credentials committed in four places (properties, Compose, Kubernetes Secret as base64, Helm values in plaintext). No values are reproduced anywhere in this package; rotate-and-revoke is WS1 and a WS10 entry criterion	see current-state.md §7

C1 is the one to resolve first: if the deployed artefact comes from a different repository, the migration scope changes before any design work does (Q4).

Security and correctness defects (unatomic transfers, no amount validation, CSRF disabled, single USER authority, runtime schema mutation) are deliberately not fixed here — they are recorded as evidence in the current state and tracked as WS6, which gates production cutover.

Verification

• All four Mermaid charts render via @mermaid-js/mermaid-cli@11; the committed PNGs are embedded at the top of each doc with the source in a collapsed <details> block, and the embedded source matches each .mmd byte for byte.
• Combined PDF: 16 pages, A3 landscape (1191×842 pt), guardrails section and guardrail-compliance table both present; pages spot-checked as images for table truncation.
• git status shows only docs/ changes.

Devin-Org: engineering

Link to Devin session: https://app.devin.ai/sessions/282ce6c3e5d24c1ea85743d656e0550b
Requested by: @patrickbradley-cog

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring