@portll/cobolwork 0.2.117 → 0.2.150

package/rules/compliance-dora.json

@@ -2634,7 +2634,7 @@
    "framework": "dora",
    "clause": "Article 8(2)",
    "title": "Identification",
-   "rationale": "The rule reports: A Zowe MCP server is launched by npx with no pinned version. That is a source of ICT risk in a business-supporting function, identified by reading the source rather than by asking the team that maintains it.",
+   "rationale": "The rule reports: A Zowe MCP server is launched from the registry with no pinned version. That is a source of ICT risk in a business-supporting function, identified by reading the source rather than by asking the team that maintains it.",
    "source": {
     "doc": "dora",
     "retrieved": "2026-09-20",

package/rules/compliance-ffiec.json

@@ -2617,7 +2617,7 @@
    "framework": "ffiec",
    "clause": "DA&M IV",
    "title": "Common Development, Acquisition, and Maintenance Practices",
-   "rationale": "The rule reports: A Zowe MCP server is launched by npx with no pinned version. That is a component or dependency the inventory does not accurately account for, which this practice requires be catalogued.",
+   "rationale": "The rule reports: A Zowe MCP server is launched from the registry with no pinned version. That is a component or dependency the inventory does not accurately account for, which this practice requires be catalogued.",
    "source": {
     "doc": "ffiec",
     "retrieved": "2026-09-20",

package/rules/compliance-nist80053.json

@@ -2617,7 +2617,7 @@
    "framework": "nist-800-53r5",
    "clause": "CM-8",
    "title": "System Component Inventory",
-   "rationale": "The rule reports: A Zowe MCP server is launched by npx with no pinned version. That is a component the inventory does not accurately account for, which this control requires be documented.",
+   "rationale": "The rule reports: A Zowe MCP server is launched from the registry with no pinned version. That is a component the inventory does not accurately account for, which this control requires be documented.",
    "source": {
     "doc": "nist80053",
     "retrieved": "2026-09-20",

package/schema/cobolwork.policy.schema.json

@@ -5,35 +5,83 @@
  "description": "Which findings stop a build, which run-time checks the compiler must generate, and what an incomplete scan means. docs/spec/build-gate.md section 4. lib/policy.mjs validates the same shape and also refuses a rule id cobolwork does not declare.",
  "type": "object",
  "additionalProperties": false,
- "required": ["policyVersion"],
+ "required": [
+  "policyVersion"
+ ],
  "properties": {
-  "_comment": { "type": "string" },
-  "policyVersion": { "const": 1 },
-  "block": { "$ref": "#/$defs/tier", "description": "A finding at or above this tier blocks. Default high." },
-  "always": { "$ref": "#/$defs/tier", "description": "In ratchet mode, a finding at or above this tier blocks whether or not the change introduced it. Default crit." },
+  "_comment": {
+   "type": "string"
+  },
+  "policyVersion": {
+   "const": 1
+  },
+  "block": {
+   "$ref": "#/$defs/tier",
+   "description": "A finding at or above this tier blocks. Default high."
+  },
+  "always": {
+   "$ref": "#/$defs/tier",
+   "description": "In ratchet mode, a finding at or above this tier blocks whether or not the change introduced it. Default crit."
+  },
   "classes": {
    "type": "array",
-   "items": { "enum": ["privilege-escalation", "data-mutation"] },
+   "items": {
+    "enum": [
+     "privilege-escalation",
+     "data-mutation"
+    ]
+   },
    "uniqueItems": true,
    "description": "A finding in one of these consequence classes blocks at any tier. Default both."
   },
   "rules": {
    "type": "object",
-   "additionalProperties": { "enum": ["block", "warn"] },
+   "additionalProperties": {
+    "enum": [
+     "block",
+     "warn"
+    ]
+   },
    "description": "Per rule id: block whatever its tier, or warn whatever its tier or class."
   },
-  "coverage": { "enum": ["block", "warn"], "description": "Incomplete coverage makes the build undecided (block) or is reported (warn). Default block." },
-  "options": { "enum": ["block", "warn"], "description": "A build without a required run-time check fails, and options nothing declares make it undecided (block); or both are reported and the build passes relaxed (warn). An option forbid names, and a check the change removes, fail either way. Default warn." },
+  "coverage": {
+   "enum": [
+    "block",
+    "warn"
+   ],
+   "description": "Incomplete coverage makes the build undecided (block) or is reported (warn). Default block."
+  },
+  "options": {
+   "enum": [
+    "block",
+    "warn"
+   ],
+   "description": "A build without a required run-time check fails, and options nothing declares make it undecided (block); or both are reported and the build passes relaxed (warn). An option forbid names, and a check the change removes, fail either way. Default warn."
+  },
   "waivers": {
    "type": "object",
    "additionalProperties": false,
-   "required": ["maxDays"],
-   "properties": { "maxDays": { "type": "integer", "minimum": 1 } },
+   "required": [
+    "maxDays"
+   ],
+   "properties": {
+    "maxDays": {
+     "type": "integer",
+     "minimum": 1
+    }
+   },
    "description": "A waiver written with an expiry further off than maxDays covers nothing. Default 180."
   },
   "checks": {
    "type": "array",
-   "items": { "enum": ["subscript", "reference-modification", "numeric-data", "argument-length"] },
+   "items": {
+    "enum": [
+     "subscript",
+     "reference-modification",
+     "numeric-data",
+     "argument-length"
+    ]
+   },
    "uniqueItems": true,
    "description": "The run-time checks every program must be compiled with. Default subscript and reference-modification."
   },
@@ -41,15 +89,44 @@
    "type": "object",
    "additionalProperties": false,
    "properties": {
-    "enterprise": { "$ref": "#/$defs/options" },
-    "gnucobol": { "$ref": "#/$defs/options" },
-    "gcobol": { "$ref": "#/$defs/options" }
+    "enterprise": {
+     "$ref": "#/$defs/options"
+    },
+    "gnucobol": {
+     "$ref": "#/$defs/options"
+    },
+    "gcobol": {
+     "$ref": "#/$defs/options"
+    }
    },
    "description": "Options a build must not pass, beyond those that turn a required check off."
+  },
+  "requireEquivalence": {
+   "enum": [
+    "never",
+    "machineAuthored",
+    "always"
+   ],
+   "description": "When every program a change edits, or whose copybooks it edits, needs an ironwork equivalence statement passed to build --equivalence: never, only when a commit in the change names a code assistant or bot as author, committer or co-author (machineAuthored), or always. The stricter of the floor and the repository applies. Default never."
   }
  },
  "$defs": {
-  "tier": { "enum": ["info", "low", "med", "high", "crit", "known-exploitable"] },
-  "options": { "type": "array", "items": { "type": "string", "minLength": 1 } }
+  "tier": {
+   "enum": [
+    "info",
+    "low",
+    "med",
+    "high",
+    "crit",
+    "known-exploitable"
+   ]
+  },
+  "options": {
+   "type": "array",
+   "items": {
+    "type": "string",
+    "minLength": 1
+   }
+  }
  }
 }