Propose approved public DISPLAY traces

Proprietary

Replace a classified payload DISPLAY at program entry with an explicitly approved public field and literal label. Bind classification and required audit behavior to an exact source snapshot and DISPLAY line. Require the first executable statement before any program effect. Reject alternate ENTRY and declaratives. An unnamed entry cannot be targeted by local procedure transfers. A named entry also requires no procedure references or embedded commands other than plain CICS RETURN. Require a complete unaliased level 01 LINKAGE group passed as the sole required BY REFERENCE parameter. Validate its bounded DISPLAY layout and a contained PIC X trace field of at most 256 characters. The public field must not overlap any prohibited declaration. Support plain single-line DISPLAY of the group with an optional literal label. Preserve following code and periods. Require ordinary fixed-format UTF-8 source with consistent LF or CRLF endings and no byte order mark. The contract must guarantee the public value at every entry and approve the entire replacement trace. Application-team review remains required. Do not infer public classification from names or from the absence of a known sensitive origin. Do not invent redaction or delete required audit behavior.

io.moderne.mainframe.security.ProposeApprovedDisplayTrace

Required

sourcePathString

Exact repository-relative source path covered by the approved contract.

programNameString

Exact program ID. Retain quotes for a literal ID. Literal contents match case exactly.

sourceSha256String

Lowercase SHA-256 of the complete UTF-8 source text without a byte order mark. Any source change prevents application.

displayLineint

One-based DISPLAY line in the approved source snapshot.

prohibitedFieldsList

Exact outermost-first dotted declarations whose approved classification prohibits DISPLAY output. Every declaration must resolve. Separate values with commas.

approvedTraceFieldString

Exact outermost-first dotted PIC X field. The contract must guarantee a public value at every program entry and approve its output at this site.

approvedTraceLabelString

Required public literal label of one to 32 printable ASCII characters. Preserve case and spaces. The escaped COBOL literal must fit within 56 characters.

contractSourceString

Provenance of the full incoming record, public entry value, prohibited output and required replacement audit behavior. The recipe records this approval and does not infer or fetch it.

mod run . --recipe=io.moderne.mainframe.security.ProposeApprovedDisplayTrace \
  -P sourcePath=security/cbl/VSDTGOOD.cbl \
  -P programName=VSDTGOOD \
  -P sourceSha256=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef \
  -P displayLine=9 \
  -P prohibitedFields=VS-INBOUND.VS-GOVERNMENT-ID \
  -P approvedTraceField=VS-INBOUND.VS-REQUEST-ID \
  -P approvedTraceLabel=REQUEST-ID= \
  -P contractSource='mainframe-fixtures fictional approved entry trace contract'

Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.