Propose Db2 SELECT response guards

Proprietary

Propose a guard for application-team review before an immediate full copy of one SELECT output. Require consecutive single-statement sentences in one paragraph and disjoint equal-width ordinary PIC X fields. Support a single plain selected column from one qualified table and optional column-to-host equalities joined by AND. Resolve every host variable under the approved diagnostic mode. Reject indicators, diagnostic references, aliases and unsupported SQL syntax. Under approved STDSQL(YES), require standalone SQLCODE PIC S9(9) COMP-5 and SQLSTATE PIC X(5) with every selected host inside one source-proven DECLARE SECTION. Under approved STDSQL(NO), require an explicit ordinary EXEC SQL INCLUDE SQLCA and the exact standard system-supplied 23-item layout in WORKING-STORAGE. Reject custom SQLCA copybooks, ordinary COPY forms, shadow diagnostics and aliases. Protect every SQLCA member from input, output and copy-destination use. This mode permits direct ordinary host declarations outside a DECLARE SECTION. It does not infer the configured Db2 build option. Reject active non-CONTINUE WHENEVER handlers. Preserve all original SQL and handler directives. Bind the supplied accepted SQLCODE values and approved error paragraph to an exact source path, program, SHA-256 snapshot and command line. Insert a typed IF sentence before the copy. Reject every other code through the approved existing exit. Prove that its jump path reaches GOBACK or plain CICS RETURN within 64 statements and 16 paragraphs. This leaves the current invocation or CICS logical level. It does not prove whole-task termination. Preserve original statements, periods, comments and error paths. Require fixed-format UTF-8 source with consistent LF or CRLF endings. Report the exact barrier when source, declarations, handlers, exits or layout prevent a proposal. The approved contract establishes accepted results and exit suitability. No special handling of +100 or -803 is inferred. This does not establish output completeness, database type compatibility, command success, caller behavior or transaction correctness. Do not add retry, commit, rollback, ABEND or a new error routine. Approved terminal paths may contain bounded literal MOVE stores into validated local scalar fields. For these stores, validate standalone SQLCODE and SQLSTATE and their ordinary declaration pair or the complete standard SQLCA include and its parser-supplied provenance. Keep custom SQLCA includes, copied directives and unknown preprocessing outside this store proof. Preserve every existing assignment. Also permit bounded default INITIALIZE on these terminal jump paths. Validate at most 16 local fields or groups and 64 elementary writes. Require complete ordinary unaliased storage. Integer defaults are zero and PIC X defaults are spaces within 256 characters per field. VALUE and FILLER phrases, replacement phrases, FILLER members, tables and unsupported storage prevent this proof. An explicit TO DEFAULT retains default behavior. Preserve every initialization and message before the existing terminal.

io.moderne.mainframe.security.ProposeSqlSelectResponseGuard

Required

Exact repository-relative source path covered by the approved contract.

Exact program ID. Retain quotes for a literal ID. Literal contents match case exactly.

Lowercase SHA-256 of the complete UTF-8 source text without a byte order mark. The approved contract must cover this exact snapshot. Any source change prevents application.

One-based EXEC SQL SELECT line in the approved source snapshot.

Complete approved set of SQLCODE values that permit copying this SELECT output. Supply 1 to 16 distinct signed 32-bit decimal strings without leading zeros or a plus sign. STDSQL(NO) further limits accepted codes to nine digits. No success, warning or not-found value is inferred. Separate values with commas.

Approved Db2 SQL processing mode for this exact snapshot. Approve STDSQL(YES) with standalone diagnostics or STDSQL(NO) with an explicit standard SQLCA include. The source must prove the corresponding declarations. The recipe does not infer or change the build mode.

Existing paragraph approved for every other response at this exact site. An optional IN or OF section qualifier is supported. The contract must establish that this path preserves required cleanup, messages and transaction behavior.

Provenance of the approved diagnostic mode, response and exit contract. The recipe records this input and does not fetch or infer the contract.

mod run . --recipe=io.moderne.mainframe.security.ProposeSqlSelectResponseGuard \ -P sourcePath=security/cbl/VSSGBAD.cbl \ -P programName=VSSGBAD \ -P sourceSha256=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef \ -P commandLine=15 \ -P acceptedResponses=0 \ -P diagnosticMode='STDSQL(YES)' \ -P approvedExit='SQL-ERROR IN ERROR-HANDLERS' \ -P contractSource='mainframe-fixtures/README.md fictional SELECT response contract'

Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.