Analyze Db2 read provider returns

Proprietary

Prove a bounded native called program returns a freshly selected generated timestamp only with its configured allowed status. Require one complete DISPLAY LINKAGE record and one required BY REFERENCE parameter. Track incoming CHAR primary-key values through equal-width scalar copies. Require one actual SELECT and an immediate complete SQLCODE zero check. Every failure GOBACK must return a known nonallowed status because GOBACK resumes the native caller. On an allowed return require the actual selected timestamp and unchanged input keys. Model character MOVE padding and truncation without treating literals as read evidence. Inspect one normal entry sequence with at most 64 statements including its failure branch. Reject unsupported control flow, aliases, unknown effects and incomplete source. Require exact source, COPY and generated-always schema snapshots. Report parameter byte spans and actual SELECT, check, status assignment and return lines. This read-only analysis makes no caller binding, authorization, transaction or vulnerability claim. A caller must independently check the fresh returned status and preserve the returned values.

io.moderne.mainframe.security.AnalyzeDb2ReadProvider

Required

Exact approved provider path.

Exact program ID. Retain quotes for a literal ID.

Lowercase SHA-256 of the complete approved UTF-8 provider without a byte order mark.

JSON object mapping every ordinary data COPY name to its approved lowercase SHA-256. The independently validated system SQLCA is excluded.

Complete root-first dotted name of the one required native BY REFERENCE LINKAGE record.

JSON object mapping every uppercase primary-key column to its incoming LINKAGE leaf. Names are root-first dotted names.

Root-first dotted name of the PIC X(26) field receiving the selected timestamp.

Root-first dotted name of the PIC X field returning the provider result.

One printable ASCII character denoting a successful provider return. The caller must check this actual returned value.

Exact unquoted uppercase schema and table name.

Exact unquoted uppercase generated row-change timestamp column.

Exact path of the approved complete enforced CREATE TABLE snapshot.

Lowercase SHA-256 of the complete approved schema snapshot.

Provenance of the approved native interface, STDSQL(NO) and complete deployed schema. This input records assumptions. It does not establish an actual caller binding or authorization.

mod run . --recipe=io.moderne.mainframe.security.AnalyzeDb2ReadProvider \ -P sourcePath=security/cbl/VSRPGOOD.cbl \ -P programName=VSRPGOOD \ -P sourceSha256=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef \ -P copybookSnapshots='{}' \ -P recordName=READ-REQUEST \ -P keyFields='{"TENANT":"READ-REQUEST.IN-TENANT","ID":"READ-REQUEST.IN-ID"}' \ -P versionField=READ-REQUEST.OUT-VERSION \ -P statusField=READ-REQUEST.OUT-STATUS \ -P allowedStatus=Y \ -P tableName=VTEST.GENERATED_ITEM \ -P versionColumn=VERSION_TS \ -P schemaSourcePath=security/ddl/VSRVALW.ddl \ -P schemaSha256=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef \ -P contractSource='mainframe-fixtures fictional read provider contract'

Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.