Lesson 6 of 7
Worked example: fixing an ATC finding through abapGit
9 min
Listen to this lesson
The second example uses Route B, and a different kind of problem. An ATC run with Contoso's variant ZCMC_CLASSIC_DEV on the deposit objects in package ZCMC_SD reports a priority 2 finding from the check that searches for problematic statements whose result depends on a SELECT without ORDER BY. The finding is in ZCL_CMC_AGREEMENT_READER, the class behind ZIF_CMC_AGREEMENT_READER that ZCL_CMC_CORE_DEPOSIT calls. Its method get_agreement reads one row of ZCMC_CORE_AGR for a customer with SELECT ... UP TO 1 ROWS and no ORDER BY.
SAP introduced this check for HANA migrations: code that relied on a database's implicit sort order is not robust on SAP HANA. Contoso converted from a non-HANA database, so the finding is real. When a customer has two agreements, which one the deposit uses is not defined.
Why Route B for this fix
- The deposit code is classic ABAP in a converted package, and the team reviews converted code in git anyway (repository
cmc-sd, linked to ZCMC_SD with folder logic Prefix). - The fix touches an interface, its implementation, a class and its tests: easier to see as one diff in files than as four MCP edits.
- Claude needs no SAP access to write it. It reads
zcl_cmc_agreement_reader.clas.abap,zif_cmc_agreement_reader.intf.abap,zcl_cmc_core_deposit.clas.abapandzcl_cmc_core_deposit.clas.testclasses.abapin the local clone, and the path-scoped test-class rules load when it opens the test file.
The fix is a business decision first
Kenji gives Claude the finding text and asks for options before code. Claude offers three, and they show why ATC findings are not just syntax:
| Option | What it does | Verdict |
|---|---|---|
Add ORDER BY PRIMARY KEY | Makes the result deterministic: always the lowest agreement number | Silences the finding but picks the oldest agreement, which may have expired; the deposit can still be wrong |
| Filter on the order date and status OPEN, ORDER BY ValidFrom DESCENDING | Returns the agreement valid on the date, newest first | Matches the rule Maria confirms: the agreement valid on the order date applies |
| Request an ATC exemption | Leaves the code as is | Denied in settings and against the definition of done; exemptions are a human decision with a reason |
Three ways to make an ATC finding disappear; only one makes the deposit right.
The second option needs a key date, which get_agreement doesn't take. Claude's first proposal changes the interface method to require it. Kenji stops that: other callers outside the repository would break, and there is no where-used tool in SAP's MCP tool list, so the agent can't see them. Claude finds callers inside the clone with Grep, but files only show what was serialized. The agreed design adds an optional parameter key_date that defaults to the current date, so existing callers keep working, and ZCL_CMC_CORE_DEPOSIT passes the order date.
Pull, check and the lock you will meet
Kenji approves the push of branch cmdk900458-order-by, reads the diff on the git server, and pulls the branch with abapGit into CMD on request CMDK900458. The pull stops: ZCL_CMC_CORE_DEPOSIT is locked in another developer's open request. SAP's CTS documentation explains why: the first user to change an object assigns it to a request, which locks it so that only users with a task in that request can change it, until the request is released. Kenji asks the other developer. Her change is already reviewed, she releases it that afternoon, and Kenji pulls again the next morning. Had she needed more time, the alternative was a task for Kenji in her request, which would tie both changes together for import: a decision for Luis, the release manager, not for the agent. The agent is not part of that conversation. It must never work around a lock by copying an object to a new name or picking another request.
After the pull activates the objects, Claude runs abap_run_unit_tests and abap_run_atc through the ADT tools, which are all in the allow list, and reports: tests green, the ORDER BY finding gone, no new priority 1 or 2 findings. Kenji reruns both in ADT, opens the pull request with the evidence, and asks Maria to confirm the rule in the description.
- Does the finding have a deterministic quick fix SAP attaches?Yes → the agent may propose it (ask rule); a person reads the result · No → next question
- Does fixing it change behavior a user would notice?Yes → the key user confirms the rule first; write a test for it · No → fix and prove with existing tests
- Would the fix change a public signature?Yes → prefer an optional parameter; callers outside the repository can't be seen · No → proceed
- Is the finding a false positive?Yes → a person requests an exemption with a reason; the agent never does · No → fix it
What would you do?
While fixing the finding, Claude says: "The cleanest solution is to replace the SELECT with a call to the function module that reads agreement data in the standard sales module, which already sorts correctly." No such call exists in the current code. What should Kenji do?
- Route B: Claude edits abapGit files locally; a person pushes, reviews and pulls; ADT tools run tests and ATC.
- An ATC fix can silence a finding without fixing the behavior; decide the business rule, then pin it with a test.
- Prefer optional parameters over signature changes: SAP's MCP tools have no where-used list, and files show only the repository.
- Object locks follow requests: coordinate with the owner; the agent never works around a lock.
- Unnamed "standard" APIs are a warning sign: make the agent prove the object exists and is released.
Check your understanding · not graded
Lesson check
1. Why is ORDER BY PRIMARY KEY a poor fix for this finding even though it removes the ATC message?
2. Why did Kenji insist on an optional key_date parameter instead of a required one?
3. The abapGit pull stops because ZCL_CMC_CORE_DEPOSIT is locked in another developer's open request. What is correct?
4. On Route B in this example, which step writes objects into CMD?