Propose complete authorization allow guards

Proprietary

Propose a complete non-allow rejection before one approved protected CALL when a current authorization response remains unchecked. Require the exact authorizer and protected interfaces, complete numeric level 88 allow set and unchanged response and watched input records. Retain a specific invocation across bounded returning IF branches only when every alternative preserves those records. Also retain it across independent read-only terminal rejections. A check of only one denial code still needs the complete allow guard. Require a proven existing exit approved for all non-allow outcomes. Do not create an authorizer, policy, cleanup path or transaction behavior. Bind the proposal to the caller SHA-256, all resolved data COPY contents and the selected protected CALL line. Insert a typed IF without a period immediately before the standalone call. Preserve every original statement, comment and earlier message. Require UTF-8 without a byte order mark and consistent LF or CRLF endings. Include the new guard within the 64-statement proof budget. Leave already checked results unchanged. Forged responses, changed inputs, unknown effects and unsupported interfaces prevent changes. Require a concrete representable non-allow result that passes the modeled intervening checks before reporting CWE-754. Missing numeric witnesses do not establish authorization success. Retain a finding when this witness is established but the approved exit or insertion proof is missing. Application-team review remains required. This does not prove identity provenance, action or resource mapping, result initialization or complete resource authorization.

io.moderne.mainframe.security.ProposeAuthorizationAllowGuard

Required

Exact repository-relative caller covered by the result contract.

Exact program ID. Retain quotes for a literal ID. Literal contents match case exactly.

Exact literal routine approved to write the complete response for each invocation. Its implementation and policy are not inferred from its name.

One to 16 exact outermost-first dotted root record declarations in required BY REFERENCE order. Approve their complete declared layouts for this source version. All records must be ordinary local DISPLAY storage and disjoint. Separate values with commas.

One-based position of the response record written by the current authorization invocation.

Exact outermost-first dotted level 88 declaration inside the response record. Its parent must be an ordinary unsigned DISPLAY integer of one to four digits.

One to 16 distinct decimal numbers from 0 through 9999. The condition declaration must contain exactly these values. Every other result denies continuation. Separate values with commas.

Exact literal protected CALL target. It must differ from the authorization routine.

One to 16 exact root DISPLAY record declarations in required BY REFERENCE order. Ordinary local and LINKAGE records are supported. Approve their entire layouts and disjoint storage. The authorization response cannot be passed. Separate values with commas.

One to 16 exact disjoint root DISPLAY records whose values must remain unchanged after authorization. Include every non-response authorization argument. Also include each required provider, saved or resource context from the approved contract. Ordinary local and LINKAGE records are supported. Separate values with commas.

Provenance of the complete interfaces, current response semantics, allow set and watched input records. The contract must establish disjoint storage for every named record. The contract must also approve the existing exit for every non-allow result while preserving required messages, cleanup and transaction behavior. Identity and resource correctness remain separate.

Lowercase SHA-256 of the complete original UTF-8 caller without a byte order mark. Any caller change prevents application.

JSON object containing the independently approved SHA-256 of every resolved data COPY. Use uppercase names and lowercase hashes. An empty object applies only to a program without COPY dependencies. Changed, missing or extra dependencies prevent application.

One-based CALL line in the approved caller snapshot. The line must select exactly one call to the protected routine.

Existing paragraph approved for every authorizer non-allow outcome. An optional IN or OF section qualifier is supported. Its bounded path must terminate without reaching protected work.

mod run . --recipe=io.moderne.mainframe.security.ProposeAuthorizationAllowGuard \ -P sourcePath=security/cbl/VSAGGOOD.cbl \ -P programName=VSAGGOOD \ -P authorizationRoutine=VSAUTHZ \ -P authorizationArguments='[VS-AUTH-REQUEST, VS-AUTH-RESPONSE]' \ -P responseArgument=2 \ -P allowCondition=VS-AUTH-RESPONSE.VS-AUTH-RC.VS-AUTH-ALLOW \ -P allowValues='[0]' \ -P protectedRoutine=VSREAD \ -P protectedArguments='[VS-INBOUND, VS-ACCOUNT-RECORD]' \ -P watchedRecords='[VS-AUTH-REQUEST, VS-IDENTITY, VS-INBOUND]' \ -P contractSource='mainframe-fixtures/README.md fictional current authorization result contract' \ -P sourceSha256=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef \ -P copybookSnapshots='{}' \ -P protectedLine=30 \ -P approvedExit=DENY-EXIT

Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.