Analyze current authorization results at protected calls

Proprietary

Prove that a specific authorization invocation passes its entire allow check before a configured protected CALL in the same local sequence. Require exact approved BY REFERENCE record interfaces and a complete numeric level 88 allow set. Every non-allow outcome must reach a proven terminal exit before continuing. A check of one failure code is insufficient. Writes to the response or any configured watched input invalidate the result. Unknown effects, other calls and unsupported branches also invalidate it. A new authorization invocation needs its own check. Constants, declaration values and cached status bytes never establish a current result. Preserve proof across disjoint scalar MOVEs, validated default initialization, no-ops and literal messages. Also preserve the same receipt across supported read-only IF branches when every alternative returns through those disjoint effects. Independent read-only terminal rejections preserve pending or checked receipts without granting allow. Numeric class reads require a complete unsigned DISPLAY integer of at most 18 digits. Never promote an allow check inside only one branch. Count both alternatives toward 64 intervening statements and limit nesting to 16 IFs. Require complete ordinary source and unaliased DISPLAY records. Alternate ENTRY and NEXT SENTENCE prevent the proof. Report invocation, allow-check and protected-call lines without changing source or assigning a CWE. A positive row establishes only this current checked result and the configured unchanged inputs. It does not prove identity provenance, action or resource mapping, result initialization, reachability, authorization internals or validity across tasks.

io.moderne.mainframe.security.AnalyzeCurrentAuthorizationResult

Required

Exact repository-relative caller covered by the result contract.

Exact program ID. Retain quotes for a literal ID. Literal contents match case exactly.

Exact literal routine approved to write the complete response for each invocation. Its implementation and policy are not inferred from its name.

One to 16 exact outermost-first dotted root record declarations in required BY REFERENCE order. Approve their complete declared layouts for this source version. All records must be ordinary local DISPLAY storage and disjoint. Separate values with commas.

One-based position of the response record written by the current authorization invocation.

Exact outermost-first dotted level 88 declaration inside the response record. Its parent must be an ordinary unsigned DISPLAY integer of one to four digits.

One to 16 distinct decimal numbers from 0 through 9999. The condition declaration must contain exactly these values. Every other result denies continuation. Separate values with commas.

Exact literal protected CALL target. It must differ from the authorization routine.

One to 16 exact root DISPLAY record declarations in required BY REFERENCE order. Ordinary local and LINKAGE records are supported. Approve their entire layouts and disjoint storage. The authorization response cannot be passed. Separate values with commas.

One to 16 exact disjoint root DISPLAY records whose values must remain unchanged after authorization. Include every non-response authorization argument. Also include each required provider, saved or resource context from the approved contract. Ordinary local and LINKAGE records are supported. Separate values with commas.

Provenance of the complete interfaces, current response semantics, allow set and watched input records. The contract must establish disjoint storage for every named record. This analysis does not infer identity or resource correctness.

mod run . --recipe=io.moderne.mainframe.security.AnalyzeCurrentAuthorizationResult \ -P sourcePath=security/cbl/VSAZGOOD.cbl \ -P programName=VSAZGOOD \ -P authorizationRoutine=VSAUTHZ \ -P authorizationArguments='[VS-AUTH-REQUEST, VS-AUTH-RESPONSE]' \ -P responseArgument=2 \ -P allowCondition=VS-AUTH-RESPONSE.VS-AUTH-RC.VS-AUTH-ALLOW \ -P allowValues='[0]' \ -P protectedRoutine=VSREAD \ -P protectedArguments='[VS-INBOUND, VS-ACCOUNT-RECORD]' \ -P watchedRecords='[VS-AUTH-REQUEST, VS-IDENTITY, VS-INBOUND]' \ -P contractSource='mainframe-fixtures/README.md fictional current authorization result contract'

Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.