Discover and propose Db2 SELECT output guards
ProprietaryDiscover singleton SELECT statements and full output copies under reusable table and column policies. Derive source paths, program identities, SQL and copy locations and COPY snapshots. Require matching diagnostic declarations, disjoint ordinary hosts and absent lexical handlers. Propose SQLCODE rejection for unchecked plain outputs or complete SQLCODE and indicator rejection for indicator outputs. Preserve supported partial checks for indicator results and verify the changed result proof. Relocate candidates by syntax identity after earlier insertions and record every proof outcome. No source paths, program IDs, statement lines or caller hashes are required. Accepted result semantics and terminal failure behavior remain explicit approvals. Application team review remains required.
io. moderne. mainframe. security. ProposeDb2SelectOutputGuardsOptional
Strict JSON with version 1 and a rules array. Each rule supplies id, table, column, resultPolicy, diagnosticMode, approvedExit and contractSource. Approve every matching SELECT and full output copy in the input set. resultPolicy is SQLCODE_ZERO for a SELECT without indicators or SQLCODE_ZERO_AND_INDICATOR_ZERO for one output indicator. Diagnostic mode is STDSQL(YES) or STDSQL(NO). Approve the existing terminal exit for all rejected results while preserving messages, cleanup and transaction behavior. Omit policies for inventory without edits.
mod run . --recipe= io. moderne. mainframe. security. ProposeDb2SelectOutputGuardsInstall it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.