Propose Db2 UPDATE result guards

Proprietary

Check an UPDATE before its approved literal success report. Require an explicit contract that only SQLCODE zero and SQLERRD(3) one permit success. Use separate approved existing exits for SQLCODE 100, every other nonzero code and unexpected row counts after SQLCODE zero. Require exact caller and ordinary COPY snapshots, complete direct UPDATE syntax, resolved scalar hosts, system SQLCA and inactive WHENEVER handlers under approved STDSQL(NO). Accept one structure qualifier and resolve each host to its exact ordinary scalar declaration. Keep every host disjoint from SQL diagnostic storage. Support adjacent top-level statements in one paragraph, including shared sentences. Preserve original bytes and periods. Insert a typed EVALUATE and independently prove the changed tree permits continuation only for the required result. Report conditional CWE-252 only when the exact report can receive a result rejected by the approved policy. Support up to seven adjacent IF or EVALUATE checks that still permit both an approved result and a rejected result. Preserve exact SQLCODE selections and affected-count correlations. Support complete SQLCODE comparisons with integer literals, AND, OR and NOT. Existing complete checks remain unchanged. Unsupported checks and intervening effects remain unresolved without a finding. Eight incomplete gates or exclusion of every approved result can retain a finding but prevent a proposal. An unproven exit or insertion leaves a finding without an edit. Application-team review remains required. This does not establish execution, unique keys, authorization, concurrency protection or transaction completion. It does not undo an UPDATE or add retries, commits, rollbacks, ABEND or new error routines. Limit each condition to 64 atomic comparisons and the sequence to 1024 distinct nonzero SQLCODE literals. Ordered comparisons preserve exact integer intervals. They require every SQLCODE boundary in the sequence to have an absolute value no greater than 999999998. Unsupported expressions remain unresolved.

io.moderne.mainframe.security.ProposeDb2UpdateResultGuard

Required

Exact approved caller path.

Exact program ID. Retain quotes for a literal ID.

Lowercase SHA-256 of the complete approved UTF-8 caller without a byte order mark.

JSON object mapping every ordinary data COPY name to its approved lowercase SHA-256. The independently validated system SQLCA is excluded.

One-based EXEC SQL UPDATE line in the approved source.

One-based plain literal DISPLAY line approved as this UPDATE's success report.

Exact unquoted uppercase schema and table name.

Existing paragraph approved for every SQLCODE 100 outcome at this site. An optional IN or OF section qualifier is supported. Preserve required messages, cleanup and transaction behavior. This code does not distinguish a changed row from a deleted row.

Existing paragraph approved for every nonzero SQLCODE other than 100 at this site. Preserve required messages, cleanup and transaction behavior.

Existing paragraph approved when SQLCODE is zero and SQLERRD(3) differs from one. Preserve required messages, cleanup and transaction behavior. This guard does not undo the UPDATE.

Provenance of independently approved STDSQL(NO), this success report and all three failure exits at these exact snapshots. The contract must require SQLCODE zero and exactly one affected row before reporting success. The recipe records this input and does not infer or fetch approval.

mod run . --recipe=io.moderne.mainframe.security.ProposeDb2UpdateResultGuard \ -P sourcePath=security/cbl/VSUXGOOD.cbl \ -P programName=VSUXGOOD \ -P sourceSha256=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef \ -P copybookSnapshots='{}' \ -P updateLine=15 \ -P successLine=19 \ -P tableName=VTEST.ITEM \ -P notFoundExit=NOT-FOUND-EXIT \ -P errorExit=SQL-ERROR-EXIT \ -P resultExit=ROW-COUNT-EXIT \ -P contractSource='mainframe-fixtures fictional approved single-row UPDATE result contract'

Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.