Propose Db2 version predicates from successful reads

Proprietary

Add one version equality to an approved UPDATE that already selects a complete primary key. Require an actual preceding successful SELECT of the generated timestamp for the same key tuple. Track unchanged values and equal-width character copies through up to 64 local statements. Also recognize actual noniterative PERFORM calls to checked-read paragraphs. Prove every normal return and expand at most 64 statements through 16 active paragraphs. Reject recursion, early returns, unknown effects and calls that do not produce a checked read. Report the actual call chain without changing it. Require an immediate complete SQLCODE zero rejection check after SELECT and existing terminal checks that permit only SQLCODE zero and one affected row after UPDATE. Recognize existing IF gates and ordered EVALUATE SQLCODE result handling without changing their branch-specific exits. Require exact caller, COPY and schema snapshots, system SQLCA, inactive WHENEVER handlers, CHAR keys and a nonnull TIMESTAMP generated always for each row on update. Reject unknown effects, transaction boundaries, unsupported SQL and unproven storage. Preserve existing SQL, checks, error paths, comments and transaction behavior. Support fixed-format UTF-8 with consistent LF or CRLF endings. Report a conditional CWE-362 under the approved concurrency contract. This does not establish actual concurrent execution, timestamp uniqueness, authorization or transaction completion. Application-team review of the exact proposed correction remains required.

io.moderne.mainframe.security.ProposeDb2VersionPredicate

Required

Exact approved caller path.

Exact program ID. Retain quotes for a literal ID.

Lowercase SHA-256 of the complete approved UTF-8 caller without a byte order mark.

JSON object mapping every ordinary data COPY name to its approved lowercase SHA-256. The independently validated system SQLCA is excluded. Use an empty object when there are no data COPY statements.

One-based EXEC SQL UPDATE line in the approved original source.

Exact unquoted uppercase schema and table name.

Exact unquoted uppercase generated row-change timestamp column.

Unique unqualified SQL host name holding the actual SELECT version or its unchanged equal-width copy.

Exact path of the approved complete enforced CREATE TABLE snapshot.

Lowercase SHA-256 of the complete approved UTF-8 schema without a byte order mark.

Provenance of independently approved STDSQL(NO), deployed schema completeness and enforcement, and the requirement to reject a changed version. Approval must cover existing failure paths and transaction behavior at these exact snapshots. The recipe records this input and does not infer or fetch approval.

mod run . --recipe=io.moderne.mainframe.security.ProposeDb2VersionPredicate \ -P sourcePath=security/cbl/VSVDGOOD.cbl \ -P programName=VSVDGOOD \ -P sourceSha256=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef \ -P copybookSnapshots='{}' \ -P updateLine=25 \ -P tableName=VTEST.GENERATED_ITEM \ -P versionColumn=VERSION_TS \ -P versionHost=VS-SAVED-TS \ -P schemaSourcePath=security/ddl/VSRVALW.ddl \ -P schemaSha256=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef \ -P contractSource='mainframe-fixtures fictional approved version predicate contract'

Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.