Analyze classified character ranges in CICS TSQ writes
ProprietaryTrace individual character origins into the literal-length prefix requested by WRITEQ TS. Require an explicit classification that prohibits queuing any character or substring from the named sources. Track equal-width MOVEs, bounded STRING DELIMITED BY SIZE and retained receiver suffixes. Across supported IF and EVALUATE branches, retain only origins with the same source declaration and position on every branch. Support bounded nested qualified paragraph PERFORMs. Limit character fields to 256 positions, STRING operands to 16, condition nesting to 16, expanded performed statements to 64 and active paragraphs to 16. Limit each character to 64 transfer steps and evidence sites. Unknown effects discard prior facts. Require FROM to name one ordinary standalone PIC X field. Require a positive literal LENGTH within that field. Validate queue name shapes and response or item storage. Only the first EXEC island can use a host's incoming snapshot. Unsupported commands, dynamic lengths, groups, aliases and incomplete source remain unresolved. Report attempted writes of classified characters. Do not infer successful storage, queue access, ownership, freshness or a CWE. Unknown origins and missing rows do not prove safe storage or erasure. Do not mask, truncate, delete or change transaction behavior. Preserve character origins across supported DISPLAY statements with up to 16 ordinary PIC X fields, literal slices and bounded ASCII text operands. Validate every operand before preserving facts. Device options, expressions, dynamic slices and unsupported storage remain barriers.
io. moderne. mainframe. security. AnalyzeClassifiedCharacterTsqWritesRequired
Exact repository-relative source path covered by the classification. Globs are not supported.
Exact program ID covered by the classification. Retain quotes for literal IDs. Nested programs have their own scope.
One to 64 approved declarations whose data is prohibited in every WRITEQ TS request, including any individual copied character or substring. Use exact outermost-first dotted names. A group covers its descendants. Names do not establish sensitivity. Separate values with commas.
Provenance of the approved prohibition on queuing any character from these fields. The reference is recorded and is not fetched or interpreted as policy.
mod run . --recipe= io. moderne. mainframe. security. AnalyzeClassifiedCharacterTsqWrites \
-P sourcePath= security/ cbl/ VSQRTAIL. cbl \
-P programName= VSQRTAIL \
-P prohibitedFields= '[VS-SECRET]' \
-P contractSource= 'mainframe-fixtures README queued character classification'Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.