Analyze current Db2 SELECT output checks

Proprietary

Prove existing immediate checks that permit continuation only for SQLCODE zero and the exact output indicator zero. Require one plain selected column, one ordinary PIC X output and its signed two-byte binary indicator. Resolve every input host and keep outputs, indicators and diagnostics disjoint. Accept one structure qualifier. Reject input indicators, multiple outputs, expressions, aliases and incomplete source. Require source-proven diagnostic storage under an explicitly approved STDSQL mode and inactive WHENEVER handlers. Inspect up to eight adjacent IF or EVALUATE result checks. EVALUATE selects exact SQLCODE literals and retains the remaining values. Preserve those selections across successive checks. Support complete SQLCODE comparisons against integer literals with AND, OR and NOT. Indicator comparisons remain limited to zero. Each reported other-value case represents nonzero integers. Internally keep selected literal values separate until all modeled checks are complete. A negative-only indicator check cannot establish complete rejection of nonzero indicators. Record the first unexamined statement. The proof applies before that statement and does not propagate through its effects. An empty continuing domain is not success. Continuing EVALUATE branches may contain only supported checks and no-ops. Reject ranges, multiple selectors, nested EVALUATE and continuing effects. Record declaration names and existing checks without output values, source edits or vulnerability findings. This is a conditional result-check proof after the SELECT. It does not establish SQL execution, type compatibility, business validity, freshness beyond this point, authorization or transaction completion. Limit each condition to 64 atomic comparisons and the sequence to 1024 distinct nonzero SQLCODE literals. Ordered comparisons preserve exact integer intervals. They require every SQLCODE boundary in the sequence to have an absolute value no greater than 999999998. Unsupported expressions remain unresolved.

io.moderne.mainframe.security.AnalyzeDb2SelectOutputResults

Required

Exact repository-relative source path. Globs are not supported.

Exact program ID. Retain quotes for a literal ID.

Exact unquoted schema and table name for the SELECT.

Independently approved STDSQL(YES) with standalone diagnostics or STDSQL(NO) with the standard system SQLCA. The source must prove the matching declarations.

Provenance of the approved diagnostic mode and exact scope. The recipe does not infer compiler settings or fetch the contract.

mod run . --recipe=io.moderne.mainframe.security.AnalyzeDb2SelectOutputResults \ -P sourcePath=security/cbl/VSIRGOOD.cbl \ -P programName=VSIRGOOD \ -P protectedTable=VTEST.VERSIONED_ITEM \ -P diagnosticMode='STDSQL(YES)' \ -P contractSource='mainframe-fixtures fictional SELECT output contract'

Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.