Propose approved TSQ read capacity limits

Proprietary

Insert one typed MOVE of the approved record maximum into LENGTH immediately before a proven oversized READQ TS. Require exact caller and COPY snapshots and a complete ordinary level 01 buffer allocation. The approved maximum must equal that allocation. Require existing explicit RESP and an immediate complete terminal rejection of every non-NORMAL response before output consumers. Preserve the command, handler options, queue selection, original assignments, checks, failure path and sentence periods. Require fixed-format UTF-8 with consistent LF or CRLF and no byte order mark. Support direct statements on separate physical lines and qualified ordinary request fields. Report CWE-120 only for the independently proven oversized request. The finding is conditional on reading a record larger than the allocation. Unsupported failure behavior or layout retains a proven finding without changing source. No queue contents or actual overwrite are inferred. Application-team review of the exact correction and approved rejection behavior remains required.

io.moderne.mainframe.security.ProposeTsqReadCapacityLimit

Required

Exact repository-relative caller path covered by the approved contract.

Exact program ID. Retain quotes for a literal ID.

Lowercase SHA-256 of the complete approved UTF-8 caller without a byte order mark.

JSON object mapping every resolved COPY name to its lowercase SHA-256. Approve these independently from the caller. Use an empty object when there are no COPY statements.

One-based READQ TS line in the approved original caller.

One-based existing complete rejection of every non-NORMAL response. It must immediately follow the selected read in one local sequence.

Explicitly approved record limit. It must equal the complete level 01 INTO allocation and fit the supported positive CICS range.

Provenance of approval to reject larger records through the existing failure path. The approval must cover required cleanup, messages and transaction behavior at these exact snapshots. The recipe records this input and does not infer or fetch it.

mod run . --recipe=io.moderne.mainframe.security.ProposeTsqReadCapacityLimit \ -P sourcePath=security/cbl/VSRCGOOD.cbl \ -P programName=VSRCGOOD \ -P sourceSha256=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef \ -P copybookSnapshots='{}' \ -P commandLine=12 \ -P responseCheckLine=16 \ -P maximumRecordLength=8 \ -P contractSource='mainframe-fixtures fictional approved TSQ read capacity limit'

Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.