Propose Db2 version predicates from checked native calls

Proprietary

Add one missing version equality to an approved UPDATE after an actual checked native read CALL. Bind exact caller, provider, COPY and generated-always schema snapshots through the approved runtime interface. Require the same native DISPLAY encoding, the same deployed Db2 table resource and compatible SQL host encodings. These are explicit input assumptions. Prove the provider returns a selected timestamp and unchanged complete key tuple only after a successful SELECT. Require an immediate complete caller rejection of every other status. Track current keys and timestamp through up to 64 local statements and equal-width character copies. Unknown effects and later SQL discard the read receipt. Require existing UPDATE checks that allow only SQLCODE zero and one affected row. Preserve source bytes outside the added predicate and preserve all existing calls, failure paths and transaction behavior. Report a conditional CWE-362 under the approved concurrency contract. This does not establish actual concurrency, timestamp uniqueness, authorization or transaction completion. Application-team review remains required.

io.moderne.mainframe.security.ProposeCalledDb2VersionPredicate

Required

Exact approved caller path.

Exact program ID. Retain quotes for a literal ID.

Lowercase SHA-256 of the complete approved UTF-8 caller without a byte order mark.

JSON object mapping every ordinary data COPY name to its approved lowercase SHA-256. The independently validated system SQLCA is excluded. Use an empty object when there are no data COPY statements.

One-based EXEC SQL UPDATE line in the approved original source.

One-based selected native CALL line.

Root-first dotted name of the one ordinary DISPLAY record passed by reference.

Strict version 1 JSON containing the approved literal routine, sameDisplayEncoding and all pinned provider and schema inputs. Require complete member sets. See the recipe documentation for the complete contract.

Unique unqualified SQL host holding the actual returned timestamp or its unchanged equal-width copy.

Explicit approval that the provider SELECT and caller UPDATE address the same deployed Db2 table resource. Matching SQL names and DDL alone do not establish this premise.

Explicit approval that provider output and caller input host variables use compatible Db2 character encodings for every bound key and timestamp.

Provenance of independently approved STDSQL(NO), deployed schema completeness and enforcement, and the requirement to reject a changed version. Approval must cover existing failure paths and transaction behavior at these exact snapshots. The recipe records this input and does not infer or fetch approval.

mod run . --recipe=io.moderne.mainframe.security.ProposeCalledDb2VersionPredicate \ -P sourcePath=security/cbl/VSVDGOOD.cbl \ -P programName=VSVDGOOD \ -P sourceSha256=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef \ -P copybookSnapshots='{}' \ -P updateLine=25 \ -P callLine=15 \ -P recordName=CALL-REQUEST \ -P providerContract='{"version":1,"sameDisplayEncoding":true,"routine":"READPROV","provider":{"sourcePath":"provider.cbl","programName":"READPROV","sourceSha256":"0000000000000000000000000000000000000000000000000000000000000000","copybookSnapshots":{},"recordName":"READ-REQUEST","keyFields":{"TENANT":"READ-REQUEST.IN-TENANT","ID":"READ-REQUEST.IN-ID"},"versionField":"READ-REQUEST.OUT-VERSION","statusField":"READ-REQUEST.OUT-STATUS","allowedStatus":"Y","tableName":"VTEST.ITEM","versionColumn":"VERSION_TS","schemaSourcePath":"schema.ddl","schemaSha256":"0000000000000000000000000000000000000000000000000000000000000000"}}' \ -P versionHost=CALL-VERSION \ -P sameDb2Resource=true \ -P compatibleSqlEncoding=true \ -P contractSource='mainframe-fixtures fictional approved version predicate contract'

Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.