Analyze checked native Db2 read calls

Proprietary

Bind an actual native CALL to a source-proven Db2 read provider under an explicit runtime interface contract. Require exact caller, provider, COPY and complete generated-always schema snapshots. Require explicit approval of the same native DISPLAY encoding in both programs. Match one BY REFERENCE DISPLAY record by all elementary byte spans and types rather than field names. Require an immediate complete terminal rejection of every returned status other than the provider's allowed character. Prove that the provider returns the actual selected timestamp and unchanged incoming key tuple only after a successful SELECT. Report actual caller and provider source lines without changing source or emitting findings. The positive proof applies immediately after the caller's status gate. It does not establish that values remain current at a later UPDATE, runtime target resolution, authorization or transaction completion.

io.moderne.mainframe.security.AnalyzeDb2ReadCalls

Required

sourcePathString

Exact approved caller path.

programNameString

Exact caller program ID. Retain quotes for literal IDs.

sourceSha256String

Lowercase SHA-256 of the complete approved UTF-8 caller without a byte order mark.

copybookSnapshotsString

JSON object mapping every ordinary caller data COPY to its approved lowercase SHA-256. Independently validated system SQLCA is excluded.

callLineint

One-based selected native CALL line.

recordNameString

Root-first dotted name of the one ordinary DISPLAY record passed by reference.

providerContractString

Strict version 1 JSON containing the approved literal routine, sameDisplayEncoding and all pinned provider and schema inputs. Require complete member sets. See the recipe documentation for the complete contract.

contractSourceString

Provenance of approved runtime binding from this literal routine to the pinned provider, native interface, STDSQL(NO) and complete deployed schema. The recipe records this input and does not infer runtime resolution.

mod run . --recipe=io.moderne.mainframe.security.AnalyzeDb2ReadCalls \
  -P sourcePath=caller.cbl \
  -P programName=READCALL \
  -P sourceSha256=0000000000000000000000000000000000000000000000000000000000000000 \
  -P copybookSnapshots='{}' \
  -P callLine=15 \
  -P recordName=CALL-REQUEST \
  -P providerContract='{"version":1,"sameDisplayEncoding":true,"routine":"READPROV","provider":{"sourcePath":"provider.cbl","programName":"READPROV","sourceSha256":"0000000000000000000000000000000000000000000000000000000000000000","copybookSnapshots":{},"recordName":"READ-REQUEST","keyFields":{"TENANT":"READ-REQUEST.IN-TENANT","ID":"READ-REQUEST.IN-ID"},"versionField":"READ-REQUEST.OUT-VERSION","statusField":"READ-REQUEST.OUT-STATUS","allowedStatus":"Y","tableName":"VTEST.ITEM","versionColumn":"VERSION_TS","schemaSourcePath":"schema.ddl","schemaSha256":"0000000000000000000000000000000000000000000000000000000000000000"}}' \
  -P contractSource='mainframe-fixtures fictional native read binding'

Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.