Propose CALL character policy guards

Proprietary

Propose a character policy guard before a simple dynamic CALL when every established local target value is disallowed. Bind the approved characters and existing rejection path to an exact source snapshot and CALL line. Preserve case, padding and embedded quotes. Require ordinary local PIC X storage of at most 32 characters and complete source with native character comparisons. Use bounded local values with at most 16 alternatives and 64 evidence steps. Unknown, mixed and already allowed values remain unchanged. Require a standalone CALL without arguments, return targets or exception clauses. Alternate ENTRY, NEXT SENTENCE, aliases and unsupported source modes prevent a proposal. The existing rejection path must reach GOBACK or plain CICS RETURN within 64 statements and 16 paragraphs. Allow validated literal messages, literal local stores and bounded default initialization on that path. Source snapshots use fixed-format UTF-8 with consistent LF or CRLF endings and no byte order mark. Application-team review remains required. Do not infer executable resolution, external control, exploitability or a CWE from field characters. Do not choose a replacement target.

io.moderne.mainframe.security.ProposeCallCharacterGuard

Required

Exact repository-relative source path covered by the approved contract.

Exact program ID. Retain quotes for a literal ID. Literal contents match case exactly.

Lowercase SHA-256 of the complete UTF-8 source text without a byte order mark. Any source change prevents application.

One-based CALL line in the approved source snapshot.

Exact outermost-first dotted declaration name covered by the character policy at this CALL.

JSON array of one to 16 distinct printable ASCII strings. Preserve case and all padding. Each value must equal the field width of at most 32 characters. The single-quoted COBOL literal must fit within 56 characters after escaping apostrophes.

Existing paragraph approved to reject other character values at this CALL. An optional IN or OF section qualifier is supported. The contract must preserve required cleanup, messages and transaction behavior.

Provenance of the approved character policy and rejection path. The recipe records this input and does not fetch or infer the contract.

mod run . --recipe=io.moderne.mainframe.security.ProposeCallCharacterGuard \ -P sourcePath=security/cbl/VSCJGOOD.cbl \ -P programName=VSCJGOOD \ -P sourceSha256=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef \ -P callLine=15 \ -P targetField=VS-TARGET \ -P allowedCharacters='["VSCLONE "]' \ -P approvedExit=DENY-PARA \ -P contractSource='mainframe-fixtures fictional CALL character contract'

Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.