Propose Db2 version predicates across temporary storage tasks

Proprietary

Connect an actual provider SELECT, a checked native CALL, a complete checked WRITEQ TS and a complete checked READQ TS to one later UPDATE. Require exact provider, writer, reader, COPY and generated-always schema snapshots. Match every primary-key field and timestamp by actual byte position. Require explicit approval of queue resource identity, the exact saved item, current request binding, trusted writers, unchanged saved bytes, completed write visibility, compatible record encoding, one deployed Db2 table and compatible SQL host encodings. Matching queue literals or item numbers never establishes these premises. Track current received values through at most 64 local statements and equal-width character copies. Require existing UPDATE checks that allow only SQLCODE zero and one affected row. Add only the missing version equality and preserve all existing lifecycle and error handling. Report a conditional CWE-362 under the approved contract. This does not establish actual runtime concurrency, timestamp uniqueness or current authorization. Application-team review remains required. LENGTH OF can supply exact sizes for complete fixed DISPLAY records. A declared size never proves the current contents or the actual received length.

io.moderne.mainframe.security.ProposeCrossTaskDb2VersionPredicate

Required

Exact approved reader path.

Exact reader program ID. Retain quotes for literal IDs.

Lowercase SHA-256 of the complete approved UTF-8 reader without a byte order mark.

JSON object mapping every ordinary reader data COPY to its approved SHA-256. Independently validated system SQLCA is excluded.

One-based selected EXEC CICS READQ TS line.

Root-first name of the complete ordinary DISPLAY record passed to INTO.

JSON object mapping every uppercase primary-key column to its root-first received field.

Root-first name of the received PIC X(26) version field.

One-based selected EXEC SQL UPDATE line in the original reader.

Unique unqualified SQL host holding the current received timestamp or its unchanged character copy.

Strict version 1 JSON with every pinned writer, native provider and schema input. Require distinct provider, writer and reader source paths. See the documentation for the complete member set.

Strict version 1 JSON with queueName, itemNumber and all nine explicit deployment premises. No approval has a default. See the documentation for the complete member set.

Provenance of independently approved source snapshots, runtime bindings, queue premises, STDSQL(NO), enforced schema and concurrency requirement. Approval must cover existing failure paths and transaction behavior. The recipe records this input and does not infer approval.

mod run . --recipe=io.moderne.mainframe.security.ProposeCrossTaskDb2VersionPredicate \ -P sourcePath=reader.cbl \ -P programName=VERREST \ -P sourceSha256=0000000000000000000000000000000000000000000000000000000000000000 \ -P copybookSnapshots='{}' \ -P readLine=16 \ -P recordName=SAVED-RECORD \ -P keyFields='{"TENANT":"SAVED-RECORD.SAVED-TENANT","ID":"SAVED-RECORD.SAVED-ID"}' \ -P versionField=SAVED-RECORD.SAVED-VERSION \ -P updateLine=25 \ -P versionHost=SAVED-VERSION \ -P writerContract='{"sourcePath":"security/cbl/VSRWGOOD.cbl","programName":"VSRWGOOD","sourceSha256":"15b9eee9d978667adaef823e2a021953c05a9e88426833b265c69f7478f826b6","copybookSnapshots":{},"callLine":21,"recordName":"CALL-REQUEST","providerContract":{"version":1,"routine":"VSRPGOOD","provider":{"recordName":"READ-REQUEST","keyFields":{"TENANT_ID":"READ-REQUEST.IN-TENANT","ITEM_ID":"READ-REQUEST.IN-ID"},"versionField":"READ-REQUEST.OUT-VERSION","statusField":"READ-REQUEST.OUT-STATUS","allowedStatus":"Y","tableName":"VTEST.GENERATED_ITEM","versionColumn":"VERSION_TS","schemaSourcePath":"security/ddl/VSRVALW.ddl","schemaSha256":"cc86e9e5ab9696363f20c558b012e3a78a9d7779d2aeb785ce74d781f4b83875","sourcePath":"security/cbl/VSRPGOOD.cbl","programName":"VSRPGOOD","sourceSha256":"0790bbabd35d7e1c155d98acc20e7c34ddf374615d90e01cef274b2cb41b6801","copybookSnapshots":{}},"sameDisplayEncoding":true},"writeLine":29,"savedRecord":"SAVED-RECORD","savedKeyFields":{"TENANT_ID":"SAVED-RECORD.SAVED-TENANT","ITEM_ID":"SAVED-RECORD.SAVED-ID"},"savedVersionField":"SAVED-RECORD.SAVED-VERSION","version":1}' \ -P queueContract='{"version":1,"queueName":"VERSAVE","itemNumber":1,"sameQueueResource":true,"sameSavedItem":true,"currentRequestBinding":true,"trustedWriters":true,"completedWriteVisible":true,"sameRecordEncoding":true,"sameDb2Resource":true,"compatibleSqlEncoding":true,"unchangedSavedBytes":true}' \ -P contractSource='mainframe-fixtures fictional approved cross-task version contract'

Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.