@portll/cobolwork 0.2.117 → 0.2.140

package/lib/sets/zowe.mjs

@@ -54,9 +54,9 @@ export const ZOWE_RULES = {
   },
   'zowe-mcp-unpinned': {
     sev: 'low', evidence: 'construct', cwe: 'CWE-829',
-    text: 'A Zowe MCP server is launched by npx with no pinned version',
+    text: 'A Zowe MCP server is launched from the registry with no pinned version',
     impact: 'Whatever version the registry serves next runs with the agent\'s mainframe credentials',
-    remedy: 'Pin the version: npx @zowe/mcp-server@<version>',
+    remedy: 'Pin the version: @zowe/mcp-server@<version>',
   },
   'zowe-mock-credentials': {
     sev: 'med', evidence: 'construct', cwe: 'CWE-798',
@@ -81,7 +81,12 @@ function stripJsonc(text) {
     else if (c === '/' && text[i + 1] === '*') { i += 2; while (i < text.length && !(text[i] === '*' && text[i + 1] === '/')) { if (text[i] === '\n') out += '\n'; i++; } i++; }
     else if (c === ',') {
       let j = i + 1;
-      while (j < text.length && /\s/.test(text[j])) j++;
+      for (;;) {
+        while (j < text.length && /\s/.test(text[j])) j++;
+        if (text[j] === '/' && text[j + 1] === '/') { while (j < text.length && text[j] !== '\n') j++; }
+        else if (text[j] === '/' && text[j + 1] === '*') { j += 2; while (j < text.length && !(text[j] === '*' && text[j + 1] === '/')) j++; j += 2; }
+        else break;
+      }
       if (text[j] !== '}' && text[j] !== ']') out += c;
     } else out += c;
   }
@@ -109,6 +114,7 @@ function kindOf(rel) {
   if (base === 'settings.json' && parent === '.gemini') return 'mcp';
   if (base === 'settings.json' && parent === '.vscode') return 'vscode';
   if (base === 'systems.json' && parts.slice(0, -1).some((p) => /mock/i.test(p))) return 'mock';
+  if (base === 'native-config.json') return 'native';
   return null;
 }
 
@@ -138,7 +144,10 @@ function teamConfig(config, raw, rel, findings) {
   });
 }
 
-const isZoweServer = (s) => s && typeof s === 'object' && /@zowe\/mcp-server|zowe-mcp/.test([s.command, ...(Array.isArray(s.args) ? s.args : [])].map(String).join(' '));
+// The Zowe MCP server by its package or command, or by the ZOWE_MCP_ variables only it reads.
+const isZoweServer = (s) => s && typeof s === 'object' && (/@zowe\/mcp-server|zowe-mcp/.test([s.command, ...(Array.isArray(s.args) ? s.args : [])].map(String).join(' ')) || Object.keys(s.env && typeof s.env === 'object' ? s.env : {}).some((k) => k.startsWith('ZOWE_MCP_')));
+// Commands that run whatever version of a package the registry serves.
+const REGISTRY_RUNNERS = new Set(['npx', 'bunx', 'pnpx', 'pnpm', 'yarn', 'npm']);
 
 function tierOf(server) {
   const args = Array.isArray(server.args) ? server.args.map(String) : [];
@@ -170,9 +179,9 @@ function mcpConfig(config, raw, rel, findings) {
     const t = tierFinding(tierOf(server), rel, lineOf(raw, 'capability-tier', name) || lineOf(raw, 'ZOWE_MCP_CAPABILITY_TIER', name), `server ${name}`);
     if (t) findings.push(t);
     if (String(env.ZOWE_MCP_DATA_MARKING) === '0') findings.push({ rule: 'zowe-mcp-data-marking-off', path: rel, line: lineOf(raw, 'ZOWE_MCP_DATA_MARKING', name), detail: `server ${name} sets ZOWE_MCP_DATA_MARKING to 0` });
-    if (String(server.command) === 'npx') {
+    if (REGISTRY_RUNNERS.has(String(server.command))) {
       const pkg = (Array.isArray(server.args) ? server.args.map(String) : []).find((a) => a.startsWith('@zowe/mcp-server'));
-      if (pkg && (pkg === '@zowe/mcp-server' || pkg === '@zowe/mcp-server@latest')) findings.push({ rule: 'zowe-mcp-unpinned', path: rel, line: lineOf(raw, pkg, name), detail: `server ${name} runs ${pkg} through npx` });
+      if (pkg && (pkg === '@zowe/mcp-server' || pkg === '@zowe/mcp-server@latest')) findings.push({ rule: 'zowe-mcp-unpinned', path: rel, line: lineOf(raw, pkg, name), detail: `server ${name} runs ${pkg} through ${server.command}` });
     }
   }
 }
@@ -188,7 +197,7 @@ function passwordPaths(value, path, out) {
   else if (value && typeof value === 'object') {
     for (const [k, v] of Object.entries(value)) {
       const p = path ? `${path}.${k}` : k;
-      if (/^password$/i.test(k) && typeof v === 'string' && v) out.push(p);
+      if (/^password$/i.test(k) && ((typeof v === 'string' && v && !isReference(v)) || typeof v === 'number')) out.push(p);
       else passwordPaths(v, p, out);
     }
   }
@@ -199,7 +208,24 @@ function mockSystems(config, raw, rel, findings) {
   for (const p of passwordPaths(config, '', [])) findings.push({ rule: 'zowe-mock-credentials', path: rel, line: lineOf(raw, 'password'), detail: `the mock systems file holds a password at ${p}` });
 }
 
-const READERS = { team: teamConfig, mcp: mcpConfig, vscode: vscodeSettings, mock: mockSystems };
+// The server's own configuration, read without assuming its layout: a literal password, and TLS
+// verification turned off, wherever they are.
+function nativeConfig(config, raw, rel, findings) {
+  for (const p of passwordPaths(config, '', [])) findings.push({ rule: 'zowe-config-secret-in-clear', path: rel, line: lineOf(raw, 'password'), detail: `the Zowe MCP server configuration holds a password at ${p}` });
+  const walk = (v, path) => {
+    if (Array.isArray(v)) v.forEach((x, i) => walk(x, `${path}[${i}]`));
+    else if (v && typeof v === 'object') {
+      for (const [k, x] of Object.entries(v)) {
+        const p = path ? `${path}.${k}` : k;
+        if (k === 'rejectUnauthorized' && x === false) findings.push({ rule: 'zowe-config-tls-verify-off', path: rel, line: lineOf(raw, 'rejectUnauthorized'), detail: `the Zowe MCP server configuration turns TLS verification off at ${p}` });
+        else walk(x, p);
+      }
+    }
+  };
+  walk(config, '');
+}
+
+const READERS = { team: teamConfig, mcp: mcpConfig, vscode: vscodeSettings, mock: mockSystems, native: nativeConfig };
 
 export function scanZowe(root, opts = {}) {
   const tree = treeFor(root, opts);

package/lib/utilities.mjs

@@ -8,6 +8,9 @@
 // statements are not in the job - SYSIN naming a library member - says so, because its copies are
 // then only the ones its DD names decide on their own.
 
+import { ftpSession } from './ftp.mjs';
+import { statementCard } from './card.mjs';
+
 const upper = (s) => String(s).toUpperCase();
 
 // The DDs of a step by name, each followed by the datasets concatenated to it.
@@ -93,7 +96,7 @@ function commands(lines) {
   let comment = false;
   for (const { line, text } of lines) {
     let t = '';
-    const s = text.slice(0, 72);
+    const s = statementCard(text).text;
     for (let i = 0; i < s.length; i++) {
       if (comment) { if (s[i] === '*' && s[i + 1] === '/') { comment = false; i++; } continue; }
       if (s[i] === '/' && s[i + 1] === '*') { comment = true; i++; continue; }
@@ -189,11 +192,42 @@ function sortCopies(step, dds) {
 //   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.3.0/com.ibm.zos.v2r3.idai200/da6i211.htm
 //   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.3.0/com.ibm.zos.v2r3.idai200/import.htm
 //   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.3.0/com.ibm.zos.v2r3.idai200/da6i2221.htm
+// PRINT reads INFILE(ddname) or INDATASET(entryname) and writes the listing to OUTFILE(ddname),
+// SYSPRINT when it names none, so a production data set printed to SYSOUT leaves by that DD.
+//   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.3.0/com.ibm.zos.v2r3.idai200/print.htm
+//   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.3.0/com.ibm.zos.v2r3.idai200/da6i2244.htm
+//   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.3.0/com.ibm.zos.v2r3.idai200/da6i2245.htm
+// ALTER entryname NEWNAME(newname), abbreviated NEWNM, gives the entry a new name, so the data the
+// old name held is read under the new one. A generic name (both must then be generic) or a member
+// of a partitioned data set leaves the data set where it was, and is not followed.
+//   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.3.0/com.ibm.zos.v2r3.idai200/da6i2052.htm
+//   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.3.0/com.ibm.zos.v2r3.idai200/da6i2055.htm
+//   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.3.0/com.ibm.zos.v2r3.idai200/da6i2056.htm
+function renamed(cmd) {
+  const m = /^ALTER\s+'?([^\s(),'*]+)'?(?=[\s,]|$)/i.exec(cmd.text);
+  const to = m && param(cmd.text, ['NEWNAME', 'NEWNM']);
+  if (!to || /[*(]/.test(to[0])) return null;
+  return { from: [{ dsn: upper(m[1]) }], to: [{ dsn: to[0] }], line: cmd.line };
+}
+
 function reproCopies(step, dds) {
   const { lines, unread } = cards(dds.get('SYSIN'));
-  const notes = unread ? [{ line: step.line, text: `${who(step)} runs IDCAMS with commands in ${unread}, which this reader cannot see, so any REPRO, EXPORT or IMPORT it runs is not known` }] : [];
+  const notes = unread ? [{ line: step.line, text: `${who(step)} runs IDCAMS with commands in ${unread}, which this reader cannot see, so any REPRO, EXPORT, IMPORT, PRINT or rename it runs is not known` }] : [];
   const moves = [];
   for (const cmd of commands(lines)) {
+    if (/^ALTER\b/i.test(cmd.text)) {
+      const move = renamed(cmd);
+      if (move) moves.push(move);
+      continue;
+    }
+    if (/^PRINT\b/i.test(cmd.text)) {
+      const input = param(cmd.text, ['INFILE', 'IFILE']);
+      const ds = !input && param(cmd.text, ['INDATASET', 'IDS']);
+      const out = param(cmd.text, ['OUTFILE', 'OFILE']);
+      const from = input ? [{ dd: input[0] }] : ds ? [{ dsn: ds[0] }] : [];
+      moves.push({ from, to: [{ dd: out ? out[0] : 'SYSPRINT' }], line: cmd.line });
+      continue;
+    }
     const verb = /^(REPRO|EXPORT|EXP|IMPORT)\b/i.exec(cmd.text);
     if (!verb) continue;
     const entry = /^EXP/i.test(verb[1]) && /^\S+\s+([^\s(),]+)/.exec(cmd.text);
@@ -293,7 +327,7 @@ function icetoolCopies(step, dds) {
   const statements = [];
   let cur = null;
   for (const { line, text } of lines) {
-    const s = text.slice(0, 72);
+    const s = statementCard(text).text;
     if (!cur && (/^\*/.test(s) || !s.trim())) continue;
     const tokens = s.trim().split(/\s+/);
     const hyphen = tokens.findIndex((t) => t.endsWith('-'));
@@ -321,6 +355,21 @@ function icetoolCopies(step, dds) {
   return { moves, notes };
 }
 
+// An FTP step's transfers, from the session lib/ftp.mjs reads: what PUt, MPut and APpend send leaves
+// for the remote host, and what Get and MGet fetch is written locally. The remote end names the host
+// and file, and the FILETYPE a SIte gave it.
+function ftpCopies(step, dds) {
+  const s = ftpSession(step, dds);
+  const localEnds = (x) => (x.dd ? [{ dd: x.dd }] : x.dsns.map((dsn) => ({ dsn })));
+  const remote = (name, x) => ({ remote: { host: s.host, name, ...(x.filetype ? { filetype: x.filetype } : {}) } });
+  const moves = [
+    ...s.sends.map((x) => ({ from: localEnds(x), to: [remote(x.foreign, x)], line: x.line })),
+    ...s.gets.map((x) => ({ from: [remote(x.name, x)], to: localEnds(x), line: x.line })),
+  ].sort((a, b) => a.line - b.line);
+  const notes = s.inputUnread ? [{ line: step.line, text: `${who(step)} runs FTP with subcommands in ${s.inputUnread}, which this reader cannot see, so what it sends or fetches is not known` }] : [];
+  return { moves, notes };
+}
+
 const TABLE = [
   [['IEBGENER', 'ICEGENER', 'IEBPTPCH', 'IEBUPDTE'], generCopy],
   [['SORT', 'ICEMAN', 'DFSORT', 'SYNCSORT'], sortCopies],
@@ -328,6 +377,7 @@ const TABLE = [
   [['IEBCOPY'], iebcopyCopies],
   [['ADRDSSU'], dssCopies],
   [['ICETOOL'], icetoolCopies],
+  [['FTP'], ftpCopies],
 ];
 const BY_PROGRAM = new Map(TABLE.flatMap(([names, fn]) => names.map((n) => [n, fn])));
 
@@ -346,7 +396,7 @@ export function copiesOf(step) {
   // An end naming a DD stands for every dataset concatenated under that name. A DD the step does
   // not define is kept, with no dataset: a statement naming it still says where the data went.
   const expand = (end) => {
-    if (!end.dd) return [{ dd: null, dsn: end.dsn }];
+    if (!end.dd) return [{ dd: null, dsn: end.dsn ?? null, ...(end.remote ? { remote: end.remote } : {}) }];
     const group = dds.get(end.dd);
     if (!group) return [{ dd: end.dd, dsn: null }];
     return group.map((dd) => ({ dd: end.dd, dsn: dd.dsn || null, ...(dd.inStream ? { inStream: true } : {}) }));
@@ -366,3 +416,95 @@ export function copiesOf(step) {
   }
   return { copies, uses, notes };
 }
+
+// A TSO command's operands: KEYWORD(value) with the value's parentheses and quotes kept, a quoted
+// string, or a bare word, split on blanks and commas. Blanks may stand between a keyword and its
+// parenthesis, as in PROGRAM (GETTAB).
+function tsoOperands(text) {
+  const out = [];
+  let i = 0;
+  while (i < text.length) {
+    if (/[\s,]/.test(text[i])) { i++; continue; }
+    const start = i;
+    let depth = 0, quoted = false;
+    for (; i < text.length; i++) {
+      const c = text[i];
+      if (c === "'") quoted = !quoted;
+      else if (quoted) continue;
+      else if (c === '(') depth++;
+      else if (c === ')') depth = Math.max(0, depth - 1);
+      else if (depth === 0 && /[\s,]/.test(c)) {
+        const next = /^\s*\(/.exec(text.slice(i));
+        if (next && /^[A-Z][A-Z0-9$#@]*$/i.test(text.slice(start, i))) { text = text.slice(0, i) + text.slice(i + next[0].length - 1); i--; continue; }
+        break;
+      }
+    }
+    const tok = text.slice(start, i);
+    const kw = /^([A-Z][A-Z0-9$#@]*)\((.*)\)$/is.exec(tok);
+    out.push(kw ? { key: upper(kw[1]), value: kw[2] } : { word: tok });
+  }
+  return out;
+}
+
+const unquote = (s) => s.replace(/^'(.*)'$/s, '$1').replace(/''/g, "'");
+
+// ALLOCATE's keywords, abbreviated as far as IBM's rule allows: to any leading part that no other
+// ALLOCATE keyword shares. FILE shares F, FI and FIL with FILEDATA, FCB, FLASH and FORMS, and DSNAME
+// shares DS and DSN with DSNTYPE and DSORG.
+const ALLOC_DATASET = /^(DA|DAT|DATA|DATAS|DATASE|DATASET|DSNA|DSNAM|DSNAME)$/;
+const ALLOC_FILE = /^(FILE|DD|DDN|DDNA|DDNAM|DDNAME)$/;
+const ALLOC_STATUS = new Set(['OLD', 'SHR', 'MOD', 'NEW']);
+
+// What a TSO batch step (IKJEFT01, IKJEFT1A, IKJEFT1B) does in its commands, from the step's PARM,
+// which TSO runs as its first command, and the in-stream SYSTSIN:
+//   allocations: ALLOCATE's DDs, which the programs the step runs open as if the JCL defined them.
+//     A data set name in quotes is the whole name; one without has the user's prefix added, which
+//     the job does not say, so it is kept as written with no dsn.
+//   runs: the programs the step starts, by TSO CALL, whose parameter string reaches the program as
+//     EXEC PARM does, and by the DSN subcommand RUN PROGRAM, with PARMS.
+//   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.1.0/com.ibm.zos.v2r1.ikjc500/allocsyn.htm
+//   https://www.ibm.com/docs/api/v1/content/SSLTBW_3.2.0/com.ibm.zos.v3r2.ikjc500/alloccmd.htm
+//   https://www.ibm.com/docs/api/v1/content/SSLTBW_3.1.0/com.ibm.zos.v3r1.ikjp100/ikjp100114.htm
+//   https://www.ibm.com/docs/api/v1/content/SSLTBW_2.5.0/com.ibm.zos.v2r5.ikjc200/ikj2o20039.htm
+//   https://www.ibm.com/docs/api/v1/content/SSLTBW_3.1.0/com.ibm.zos.v3r1.ikjc500/ikj2l2_CALL_command_operands.htm
+//   https://www.ibm.com/docs/api/v1/content/SSEPEK_13.0.0/comref/src/tpc/db2z_cmd_run.html
+export const TSO_BATCH = new Set(['IKJEFT01', 'IKJEFT1A', 'IKJEFT1B']);
+
+export function tsoCommands(step) {
+  const out = { allocations: [], runs: [], notes: [] };
+  if (!step.pgm || !TSO_BATCH.has(upper(step.pgm))) return out;
+  const { lines, unread } = cards(ddGroups(step).get('SYSTSIN'));
+  if (unread) out.notes.push({ line: step.line, text: `${who(step)} runs TSO with commands in ${unread}, which this reader cannot see, so any ALLOCATE, CALL or RUN it runs is not known` });
+  // PARM keeps JCL's doubled apostrophes; TSO sees one.
+  const cmds = [...(step.parm ? [{ line: step.line, text: step.parm.replace(/''/g, "'") }] : []), ...commands(lines)];
+  for (const cmd of cmds) {
+    const verb = upper(/^\S*/.exec(cmd.text)[0]);
+    const ops = tsoOperands(cmd.text.slice(verb.length));
+    if (verb === 'ALLOC' || verb === 'ALLOCATE') {
+      const file = ops.find((o) => o.key && ALLOC_FILE.test(o.key));
+      if (!file) continue;
+      const names = ops.find((o) => o.key && ALLOC_DATASET.test(o.key));
+      const words = ops.filter((o) => o.word).map((o) => upper(o.word));
+      const sysout = ops.find((o) => o.key === 'SYSOUT') || (words.includes('SYSOUT') ? { value: '' } : null);
+      const datasets = names ? tsoOperands(names.value).map((o) => o.word).filter((w) => w && w !== '*') : [];
+      if (!datasets.length && !sysout) continue;
+      out.allocations.push({
+        dd: upper(unquote(file.value)), line: cmd.line,
+        status: words.find((w) => ALLOC_STATUS.has(w)) || null,
+        sysout: sysout ? upper(sysout.value) || '*' : null,
+        datasets: datasets.map((w) => ({ written: w, dsn: /^'.*'$/.test(w) ? upper(unquote(w)) : null })),
+      });
+    } else if (verb === 'CALL') {
+      const target = ops[0]?.word || (ops[0]?.key ? `${ops[0].key}(${ops[0].value})` : '');
+      const member = /\(([A-Z0-9$#@]{1,8})\)'?$/i.exec(target);
+      const parm = ops[1]?.word && /^'.*'$/s.test(ops[1].word) ? unquote(ops[1].word) : null;
+      out.runs.push({ program: member ? upper(member[1]) : 'TEMPNAME', parm, line: cmd.line, via: 'TSO CALL' });
+    } else if (verb === 'RUN') {
+      const program = ops.find((o) => o.key === 'PROGRAM');
+      if (!program || !/^[A-Z0-9$#@]{1,8}$/i.test(program.value.trim())) continue;
+      const parms = ops.find((o) => o.key === 'PARMS');
+      out.runs.push({ program: upper(program.value.trim()), parm: parms ? unquote(parms.value.trim()) : null, line: cmd.line, via: 'DSN RUN' });
+    }
+  }
+  return out;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@portll/cobolwork",
-  "version": "0.2.117",
+  "version": "0.2.140",
   "description": "COBOL, JCL and CICS security analysis with zero runtime dependencies: reference-format parser, cross-program data flow, mainframe credential rules. Plugs into commitwork.",
   "license": "AGPL-3.0-or-later",
   "author": "Portll <john@portll.net>",

package/rules/compliance-dora.json

@@ -2634,7 +2634,7 @@
    "framework": "dora",
    "clause": "Article 8(2)",
    "title": "Identification",
-   "rationale": "The rule reports: A Zowe MCP server is launched by npx with no pinned version. That is a source of ICT risk in a business-supporting function, identified by reading the source rather than by asking the team that maintains it.",
+   "rationale": "The rule reports: A Zowe MCP server is launched from the registry with no pinned version. That is a source of ICT risk in a business-supporting function, identified by reading the source rather than by asking the team that maintains it.",
    "source": {
     "doc": "dora",
     "retrieved": "2026-09-20",

package/rules/compliance-ffiec.json

@@ -2617,7 +2617,7 @@
    "framework": "ffiec",
    "clause": "DA&M IV",
    "title": "Common Development, Acquisition, and Maintenance Practices",
-   "rationale": "The rule reports: A Zowe MCP server is launched by npx with no pinned version. That is a component or dependency the inventory does not accurately account for, which this practice requires be catalogued.",
+   "rationale": "The rule reports: A Zowe MCP server is launched from the registry with no pinned version. That is a component or dependency the inventory does not accurately account for, which this practice requires be catalogued.",
    "source": {
     "doc": "ffiec",
     "retrieved": "2026-09-20",

package/rules/compliance-nist80053.json

@@ -2617,7 +2617,7 @@
    "framework": "nist-800-53r5",
    "clause": "CM-8",
    "title": "System Component Inventory",
-   "rationale": "The rule reports: A Zowe MCP server is launched by npx with no pinned version. That is a component the inventory does not accurately account for, which this control requires be documented.",
+   "rationale": "The rule reports: A Zowe MCP server is launched from the registry with no pinned version. That is a component the inventory does not accurately account for, which this control requires be documented.",
    "source": {
     "doc": "nist80053",
     "retrieved": "2026-09-20",

package/schema/cobolwork.policy.schema.json

@@ -5,35 +5,83 @@
  "description": "Which findings stop a build, which run-time checks the compiler must generate, and what an incomplete scan means. docs/spec/build-gate.md section 4. lib/policy.mjs validates the same shape and also refuses a rule id cobolwork does not declare.",
  "type": "object",
  "additionalProperties": false,
- "required": ["policyVersion"],
+ "required": [
+  "policyVersion"
+ ],
  "properties": {
-  "_comment": { "type": "string" },
-  "policyVersion": { "const": 1 },
-  "block": { "$ref": "#/$defs/tier", "description": "A finding at or above this tier blocks. Default high." },
-  "always": { "$ref": "#/$defs/tier", "description": "In ratchet mode, a finding at or above this tier blocks whether or not the change introduced it. Default crit." },
+  "_comment": {
+   "type": "string"
+  },
+  "policyVersion": {
+   "const": 1
+  },
+  "block": {
+   "$ref": "#/$defs/tier",
+   "description": "A finding at or above this tier blocks. Default high."
+  },
+  "always": {
+   "$ref": "#/$defs/tier",
+   "description": "In ratchet mode, a finding at or above this tier blocks whether or not the change introduced it. Default crit."
+  },
   "classes": {
    "type": "array",
-   "items": { "enum": ["privilege-escalation", "data-mutation"] },
+   "items": {
+    "enum": [
+     "privilege-escalation",
+     "data-mutation"
+    ]
+   },
    "uniqueItems": true,
    "description": "A finding in one of these consequence classes blocks at any tier. Default both."
   },
   "rules": {
    "type": "object",
-   "additionalProperties": { "enum": ["block", "warn"] },
+   "additionalProperties": {
+    "enum": [
+     "block",
+     "warn"
+    ]
+   },
    "description": "Per rule id: block whatever its tier, or warn whatever its tier or class."
   },
-  "coverage": { "enum": ["block", "warn"], "description": "Incomplete coverage makes the build undecided (block) or is reported (warn). Default block." },
-  "options": { "enum": ["block", "warn"], "description": "A build without a required run-time check fails, and options nothing declares make it undecided (block); or both are reported and the build passes relaxed (warn). An option forbid names, and a check the change removes, fail either way. Default warn." },
+  "coverage": {
+   "enum": [
+    "block",
+    "warn"
+   ],
+   "description": "Incomplete coverage makes the build undecided (block) or is reported (warn). Default block."
+  },
+  "options": {
+   "enum": [
+    "block",
+    "warn"
+   ],
+   "description": "A build without a required run-time check fails, and options nothing declares make it undecided (block); or both are reported and the build passes relaxed (warn). An option forbid names, and a check the change removes, fail either way. Default warn."
+  },
   "waivers": {
    "type": "object",
    "additionalProperties": false,
-   "required": ["maxDays"],
-   "properties": { "maxDays": { "type": "integer", "minimum": 1 } },
+   "required": [
+    "maxDays"
+   ],
+   "properties": {
+    "maxDays": {
+     "type": "integer",
+     "minimum": 1
+    }
+   },
    "description": "A waiver written with an expiry further off than maxDays covers nothing. Default 180."
   },
   "checks": {
    "type": "array",
-   "items": { "enum": ["subscript", "reference-modification", "numeric-data", "argument-length"] },
+   "items": {
+    "enum": [
+     "subscript",
+     "reference-modification",
+     "numeric-data",
+     "argument-length"
+    ]
+   },
    "uniqueItems": true,
    "description": "The run-time checks every program must be compiled with. Default subscript and reference-modification."
   },
@@ -41,15 +89,44 @@
    "type": "object",
    "additionalProperties": false,
    "properties": {
-    "enterprise": { "$ref": "#/$defs/options" },
-    "gnucobol": { "$ref": "#/$defs/options" },
-    "gcobol": { "$ref": "#/$defs/options" }
+    "enterprise": {
+     "$ref": "#/$defs/options"
+    },
+    "gnucobol": {
+     "$ref": "#/$defs/options"
+    },
+    "gcobol": {
+     "$ref": "#/$defs/options"
+    }
    },
    "description": "Options a build must not pass, beyond those that turn a required check off."
+  },
+  "requireEquivalence": {
+   "enum": [
+    "never",
+    "machineAuthored",
+    "always"
+   ],
+   "description": "When every program a change edits, or whose copybooks it edits, needs an ironwork equivalence statement passed to build --equivalence: never, only when a commit in the change names a code assistant or bot as author, committer or co-author (machineAuthored), or always. The stricter of the floor and the repository applies. Default never."
   }
  },
  "$defs": {
-  "tier": { "enum": ["info", "low", "med", "high", "crit", "known-exploitable"] },
-  "options": { "type": "array", "items": { "type": "string", "minLength": 1 } }
+  "tier": {
+   "enum": [
+    "info",
+    "low",
+    "med",
+    "high",
+    "crit",
+    "known-exploitable"
+   ]
+  },
+  "options": {
+   "type": "array",
+   "items": {
+    "type": "string",
+    "minLength": 1
+   }
+  }
  }
 }