Propose removing forced authorization success

Proprietary

Propose replacing one approved forced-allow assignment with CONTINUE. Require a pending current authorization invocation and a literal MOVE to the exact response field. Prove that removing only this assignment restores the existing complete non-allow rejection before the protected CALL. Allow only no-ops and literal messages before that check. Require unchanged response and watched inputs afterward. Independent read-only terminal rejections can preserve the receipt before the reset or after its complete allow check. Earlier consumers of the forged response still prevent removal. Bind the proposal to the caller SHA-256, every resolved COPY hash and both selected statement lines. Preserve comments, sentence periods, pre-call initialization and the existing denial path. Require an ordinary single-line MOVE and consistent UTF-8 LF or CRLF source without a byte order mark. Retain a scoped CWE-754 finding when the restored-result proof is complete but the replacement layout is unsupported. Application-team review and explicit removal approval remain required. Identity and resource correctness are not established.

io.moderne.mainframe.security.ProposeRemovingAuthorizationResultReset

Required

sourcePathString

Exact repository-relative caller covered by the result contract.

programNameString

Exact program ID. Retain quotes for a literal ID. Literal contents match case exactly.

authorizationRoutineString

Exact literal routine approved to write the complete response for each invocation. Its implementation and policy are not inferred from its name.

authorizationArgumentsList

One to 16 exact outermost-first dotted root record declarations in required BY REFERENCE order. Approve their complete declared layouts for this source version. All records must be ordinary local DISPLAY storage and disjoint. Separate values with commas.

responseArgumentint

One-based position of the response record written by the current authorization invocation.

allowConditionString

Exact outermost-first dotted level 88 declaration inside the response record. Its parent must be an ordinary unsigned DISPLAY integer of one to four digits.

allowValuesList

One to 16 distinct decimal numbers from 0 through 9999. The condition declaration must contain exactly these values. Every other result denies continuation. Separate values with commas.

protectedRoutineString

Exact literal protected CALL target. It must differ from the authorization routine.

protectedArgumentsList

One to 16 exact root DISPLAY record declarations in required BY REFERENCE order. Ordinary local and LINKAGE records are supported. Approve their entire layouts and disjoint storage. The authorization response cannot be passed. Separate values with commas.

watchedRecordsList

One to 16 exact disjoint root DISPLAY records whose values must remain unchanged after authorization. Include every non-response authorization argument. Also include each required provider, saved or resource context from the approved contract. Ordinary local and LINKAGE records are supported. Separate values with commas.

contractSourceString

Provenance of the complete interfaces, current response semantics, allow set and watched input records. The contract must establish disjoint storage for every named record. The contract must explicitly approve removing the selected forced-allow assignment. It must approve the existing complete rejection check and exit while preserving required messages, cleanup and transaction behavior. Identity and resource correctness remain separate.

sourceSha256String

Lowercase SHA-256 of the complete original UTF-8 caller without a byte order mark. Any caller change prevents application.

copybookSnapshotsString

JSON object containing the independently approved SHA-256 of every resolved data COPY. Use uppercase names and lowercase hashes. An empty object applies only to a program without COPY dependencies. Changed, missing or extra dependencies prevent application.

protectedLineint

One-based CALL line in the approved caller snapshot. The line must select exactly one call to the protected routine.

resetLineint

One-based line of the literal MOVE explicitly approved for removal. It must force the allow condition parent to one approved allow value after the current authorizer call.

mod run . --recipe=io.moderne.mainframe.security.ProposeRemovingAuthorizationResultReset \
  -P sourcePath=security/cbl/VSAKGOOD.cbl \
  -P programName=VSAKGOOD \
  -P authorizationRoutine=VSAUTHZ \
  -P authorizationArguments='[VS-AUTH-REQUEST, VS-AUTH-RESPONSE]' \
  -P responseArgument=2 \
  -P allowCondition=VS-AUTH-RESPONSE.VS-AUTH-RC.VS-AUTH-ALLOW \
  -P allowValues='[0]' \
  -P protectedRoutine=VSREAD \
  -P protectedArguments='[VS-INBOUND, VS-ACCOUNT-RECORD]' \
  -P watchedRecords='[VS-AUTH-REQUEST, VS-IDENTITY, VS-INBOUND]' \
  -P contractSource='mainframe-fixtures/README.md fictional current authorization result contract' \
  -P sourceSha256=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef \
  -P copybookSnapshots='{}' \
  -P protectedLine=30 \
  -P resetLine=27

Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.