Analyze Db2 versions saved to temporary storage

Proprietary

Track the complete key tuple and generated timestamp from an actual checked native read CALL into a selected WRITEQ TS. Require exact caller, provider, COPY and schema snapshots, approved runtime binding and compatible native DISPLAY encoding. Use the source-proven provider and complete fresh caller status gate. Preserve current values through at most 64 local statements and equal-width scalar copies. Require a complete ordinary DISPLAY saved record, exact known halfword LENGTH and an immediate complete rejection of every non-NORMAL WRITEQ response. Support append-only WRITEQ TS without SYSID or extra output operands. Unknown effects, overlapping operands and partial writes prevent proof. Report source evidence without edits or vulnerability findings. A checked write does not establish queue ownership, later item selection, expiry, queue access protection, transaction durability or authorization. LENGTH OF can supply exact sizes for complete fixed DISPLAY records. A declared size never proves the current contents or the actual received length.

io.moderne.mainframe.security.AnalyzeDb2VersionSaves

Required

Exact approved caller path.

Exact caller program ID. Retain quotes for literal IDs.

Lowercase SHA-256 of the complete approved UTF-8 caller without a byte order mark.

JSON object mapping every ordinary caller data COPY to its approved lowercase SHA-256. Independently validated system SQLCA is excluded.

One-based selected native CALL line.

Root-first dotted name of the one ordinary DISPLAY record passed by reference.

Strict version 1 JSON containing the approved literal routine, sameDisplayEncoding and all pinned provider and schema inputs. Require complete member sets. See the recipe documentation for the complete contract.

Provenance of approved runtime binding from this literal routine to the pinned provider, native interface, STDSQL(NO) and complete deployed schema. The recipe records this input and does not infer runtime resolution.

One-based selected EXEC CICS WRITEQ TS line.

Root-first name of the complete ordinary DISPLAY record passed to FROM.

JSON object mapping every approved primary-key column to its exact root-first saved field.

Root-first name of the saved PIC X(26) field holding the actual selected timestamp.

mod run . --recipe=io.moderne.mainframe.security.AnalyzeDb2VersionSaves \ -P sourcePath=caller.cbl \ -P programName=READCALL \ -P sourceSha256=0000000000000000000000000000000000000000000000000000000000000000 \ -P copybookSnapshots='{}' \ -P callLine=15 \ -P recordName=CALL-REQUEST \ -P providerContract='{"version":1,"sameDisplayEncoding":true,"routine":"READPROV","provider":{"sourcePath":"provider.cbl","programName":"READPROV","sourceSha256":"0000000000000000000000000000000000000000000000000000000000000000","copybookSnapshots":{},"recordName":"READ-REQUEST","keyFields":{"TENANT":"READ-REQUEST.IN-TENANT","ID":"READ-REQUEST.IN-ID"},"versionField":"READ-REQUEST.OUT-VERSION","statusField":"READ-REQUEST.OUT-STATUS","allowedStatus":"Y","tableName":"VTEST.ITEM","versionColumn":"VERSION_TS","schemaSourcePath":"schema.ddl","schemaSha256":"0000000000000000000000000000000000000000000000000000000000000000"}}' \ -P contractSource='mainframe-fixtures fictional native read binding' \ -P writeLine=30 \ -P savedRecord=SAVED-RECORD \ -P savedKeyFields='{"TENANT":"SAVED-RECORD.SAVED-TENANT","ID":"SAVED-RECORD.SAVED-ID"}' \ -P savedVersionField=SAVED-RECORD.SAVED-VERSION

Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.