Discover and propose removing forced authorization success
ProprietaryDiscover protected native calls and preceding response assignments under reusable authorization result contracts. Derive program identities, CALL and MOVE locations and COPY snapshots. Reuse the counterfactual proof that removing only the forced-allow assignment restores the current result and existing complete rejection. Require a concrete non-allow value to reach the reset and the forced allow value to reach the protected call. Preserve pre-call initialization, comments, periods and the unchanged terminal rejection path. Earlier consumers, changed inputs, unknown effects and incomplete rejection remain barriers. Locate candidates by syntax identity after earlier replacements and record every proof outcome. No source paths, program IDs, statement lines or caller hashes are required. Explicit removal approval is required. Identity and resource correctness remain separate proofs. Application team review remains required.
io.Optional
Strict JSON with version 1 and a rules array. Each rule supplies id, authorizationRoutine, authorizationArguments, responseArgument, allowCondition, allowValues, protectedRoutine, protectedArguments, watchedRecords, removalPolicy and contractSource. removalPolicy must be REMOVE_PROVEN_FORCED_ALLOW. The reusable contract explicitly approves removing a proven forced-allow assignment before every matching protected call. Approve complete interfaces, current response semantics, the complete allow set, unchanged watched inputs and existing rejection behavior. Conflicting protected-routine policies prevent changes. Omit this option to inventory native calls without edits.
mod run .Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.