Discover and propose called Db2 version predicates

Proprietary

Discover UPDATE statements and their preceding native read-provider calls under reusable interface and concurrency contracts. Find the unique provider by explicitly approved PROGRAM-ID binding and the complete schema by independently approved fingerprint. Derive caller and provider paths, statement locations, source and COPY snapshots, caller records and surviving version hosts. Require a proven provider read, checked returned status, unchanged complete key and timestamp tokens and existing single-row UPDATE rejection. Add only the missing version predicate and retain existing failure paths and transaction behavior. Duplicate providers, missing schemas and unresolved call chains remain barriers. No source paths, program IDs, statement lines or caller version-host names are required. Application team review remains required.

io.moderne.mainframe.security.ProposeCalledDb2VersionPredicates

Optional

Strict JSON with version 1 and a rules array. Each rule supplies id, table, versionColumn, schemaSha256, providerRoutine, providerInterface, routineMatchesProgramId, sameDisplayEncoding, sameDb2Resource, compatibleSqlEncoding and contractSource. All four deployment premises must be explicitly true. providerInterface supplies recordName, keyFields, versionField, statusField and allowedStatus. Approve every matching native call and UPDATE. The literal routine must resolve to the unique matching PROGRAM-ID in the input set. Quoted IDs match exactly and unquoted IDs ignore case. Schema fingerprints independently approve the complete enforced schema. Omit policies to inventory UPDATE candidates without edits.

mod run . --recipe=io.moderne.mainframe.security.ProposeCalledDb2VersionPredicates

Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.