Propose COMMAREA length guards before native calls

Proprietary

Propose a caller guard for an approved full-record native interface when a concrete short arrival reaches a proven provider read. Require exact caller and provider snapshots, matching complete DISPLAY layouts, one literal target and one whole-area BY REFERENCE argument. Reuse the bounded provider entry-read proof from AnalyzeCommareaCallReads. The application must explicitly require the complete declared record at this call. Reject shorter arrivals through an approved existing terminal exit. Require every admitted entry count to fit within the declared record and every arrival to retain its known original count. Preserve exactly the original full-record arrivals and every original source byte outside the inserted guard. Reprove the original call after insertion. Keep a concrete read finding when an unresolved exit or source layout prevents a proposal. Unknown effects, incomplete source, alternate entries and NEXT SENTENCE cannot authorize an edit. Do not infer a fixed-size interface from its first read. Variable-length interfaces need a different approved policy. The proposal covers incoming record length. It does not prove all provider operations, successful return, allocation size, deployed binding or authorization. Application team review remains required.

io.moderne.mainframe.security.ProposeCommareaCallLengthGuard

Required

Exact repository-relative source path covered by the approved contract.

Exact program ID. Retain quotes for a literal ID. Literal contents match case exactly.

Lowercase SHA-256 of the complete UTF-8 source text without a byte order mark. The approved entry and exit contract must cover this exact snapshot.

JSON object mapping every ordinary data COPY name to its approved lowercase SHA-256.

Explicit approval of REQUIRED_FULL_RECORD_CALL. The original call is required only when the complete declared record was received. Every shorter arrival at this site must take the approved exit. This policy must come from the application interface contract.

One-based native CALL line selected by the approved caller snapshot.

Strict version 1 native read binding used by AnalyzeCommareaCallReads. Pin the routine, provider source and COPY snapshots, record name and shared DISPLAY encoding.

Exact outermost-first dotted declaration name of the incoming LINKAGE area.

Exact outermost-first dotted declaration name of the actual received byte count at normal entry. Its storage must be separate from the area.

Smallest admitted incoming byte count. Every integer through the maximum must be admitted by the approved contract.

Largest admitted byte count. Must be at most 32767 and no larger than the declared incoming record. The complete interval must fit the existing numeric proof.

Existing paragraph approved for insufficient received lengths at this exact site. An optional IN or OF section qualifier is supported. The contract must establish that this path preserves required cleanup, messages and transaction behavior.

Provenance of the approved entry counts, native binding, full-record interface and exit behavior. The recipe records this input and does not fetch or infer the contract.

mod run . --recipe=io.moderne.mainframe.security.ProposeCommareaCallLengthGuard \ -P sourcePath=security/cbl/VCGC001.cbl \ -P programName=VCGC001 \ -P sourceSha256=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef \ -P copybookSnapshots='{}' \ -P callPolicy=REQUIRED_FULL_RECORD_CALL \ -P callLine=15 \ -P providerContract='{"version":1,"routine":"READPROV","sameDisplayEncoding":true,"provider":{"sourcePath":"provider.cbl","programName":"READPROV","sourceSha256":"0000000000000000000000000000000000000000000000000000000000000000","copybookSnapshots":{},"recordName":"IN-RECORD"}}' \ -P commarea=DFHCOMMAREA \ -P receivedLength=DFHEIBLK.EIBCALEN \ -P minimumLength=0 \ -P maximumLength=16 \ -P approvedExit='LENGTH-ERROR IN ERROR-HANDLERS' \ -P contractSource='mainframe-fixtures/README.md fictional incoming-area contract'

Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.