Propose CICS routing character policy guards

Proprietary

Propose a character policy guard before a simple CICS routing command when every established local target value is disallowed. Bind the approved characters and existing rejection path to an exact source snapshot and command line. Preserve case, padding and embedded quotes. Support LINK, XCTL and LOAD with an eight-character PROGRAM field. Support START and RETURN with a four-character TRANSID field. Require ordinary local PIC X storage and complete source with native character comparisons. Use bounded local values with at most 16 alternatives and 64 evidence steps. Unknown, mixed and already allowed values remain unchanged. Require one standalone command with only its target and existing RESP, RESP2 or NOHANDLE options. Preserve those options and all existing handlers. Data passing, scheduling, remote-system and other options remain outside this proposal. Add no response or handler options. Alternate ENTRY, NEXT SENTENCE, aliases and unsupported source modes prevent a proposal. The existing rejection path must reach GOBACK or plain CICS RETURN within 64 statements and 16 paragraphs. Allow validated literal messages, literal local stores and bounded default initialization on that path. Source snapshots use fixed-format UTF-8 with consistent LF or CRLF endings and no byte order mark. Application-team review remains required. Resource selection, external control, authorization, exploitability and a CWE are not inferred from field characters. Do not add a replacement target, retry or syncpoint.

io.moderne.mainframe.security.ProposeCicsRoutingCharacterGuard

Required

sourcePathString

Exact repository-relative source path covered by the approved contract.

programNameString

Exact program ID. Retain quotes for a literal ID. Literal contents match case exactly.

sourceSha256String

Lowercase SHA-256 of the complete UTF-8 source text without a byte order mark. Any source change prevents application.

commandLineint

One-based EXEC CICS line in the approved source snapshot.

operationString

Exact CICS routing verb selected by the approved contract.

targetFieldString

Exact outermost-first dotted declaration name covered by the character policy at this command.

allowedCharactersString

JSON array of one to 16 distinct printable ASCII strings. Preserve case and all padding. Each value must equal the field width. PROGRAM fields have eight characters and TRANSID fields have four characters.

approvedExitString

Existing paragraph approved to reject other character values at this command. An optional IN or OF section qualifier is supported. The contract must preserve required cleanup, messages and transaction behavior.

contractSourceString

Provenance of the approved character policy and rejection path. The recipe records this input and does not fetch or infer the contract.

mod run . --recipe=io.moderne.mainframe.security.ProposeCicsRoutingCharacterGuard \
  -P sourcePath=security/cbl/VSCWLINK.cbl \
  -P programName=VSCWLINK \
  -P sourceSha256=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef \
  -P commandLine=15 \
  -P operation=LINK \
  -P targetField=VS-TARGET \
  -P allowedCharacters='["VSCLONE "]' \
  -P approvedExit=DENY-PARA \
  -P contractSource='mainframe-fixtures fictional CICS routing character contract'

Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.