Propose exits after failed COBOL checks

Proprietary

Append an approved terminal jump to an existing failed IF branch that otherwise reaches a protected CALL or PERFORM. Require exact source and COPY snapshots and an explicit success-condition contract at the selected operation. Reuse the bounded failed-check proof for level-88 conditions and supported numeric predicates. Preserve every original failure action and the other branch. Require supported returning failure actions and intervening assignments that preserve the failed result. Unknown effects cannot establish fallthrough. Insert no new condition or period. Require the branch boundary on its own fixed-format line and preserve all original bytes outside the jump. Reprove the selected failure branch and terminal exit after insertion. Keep conditional findings when an unresolved exit or layout prevents a proposal. The contract approves the skipped continuation and existing exit behavior. Do not infer the protected routine's effects, reachability or authorization semantics. Application team review remains required.

io.moderne.mainframe.security.ProposeFailedCheckExit

Required

sourcePathString

Exact approved caller source path.

programNameString

Exact program ID. Retain quotes for literal IDs.

sourceSha256String

Lowercase SHA-256 of the complete approved UTF-8 source without a byte order mark.

copybookSnapshotsString

JSON mapping every ordinary data COPY name to its approved lowercase SHA-256.

checkLineint

One-based line of the existing IF whose failed branch reaches the protected operation.

successConditionString

Root-first dotted level-88 declaration required at the selected protected operation under the approved contract.

protectedKindString

PERFORM selects a noniterative local paragraph call. CALL selects a plain literal native call.

protectedTargetString

Exact unqualified paragraph name or native routine literal contents. A local paragraph must resolve uniquely. Its call may use an IN or OF section qualifier.

protectedLineint

One-based line of the protected operation reached after the completed check.

approvedExitString

Existing terminal paragraph approved after the selected failure branch's original actions. Its contract must preserve required cleanup, messages and transaction behavior and approve skipping the intervening continuation. An optional IN or OF section qualifier is supported.

contractSourceString

Provenance of the approved success requirement and failure exit at these exact source and COPY snapshots.

mod run . --recipe=io.moderne.mainframe.security.ProposeFailedCheckExit \
  -P sourcePath=security/cbl/VFEX001.cbl \
  -P programName=VFEX001 \
  -P sourceSha256=0000000000000000000000000000000000000000000000000000000000000000 \
  -P copybookSnapshots='{}' \
  -P checkLine=15 \
  -P successCondition=RESULT.RC.ALLOWED \
  -P protectedKind=PERFORM \
  -P protectedTarget=PROTECTED-PARA \
  -P protectedLine=19 \
  -P approvedExit=DENY-PARA \
  -P contractSource='mainframe-fixtures fictional validation contract'

Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.