@portll/cobolwork 0.2.76 → 0.2.117

package/lib/baseline.mjs

@@ -123,6 +123,11 @@ export function applyBaseline(report, baseline, { now = new Date().toISOString()
   s.byRule = tally(open);
   if (s.bySeverity) { s.bySeverity = {}; for (const f of open) s.bySeverity[f.sev] = (s.bySeverity[f.sev] || 0) + 1; }
   if (s.byEvidence) { s.byEvidence = {}; for (const f of open) s.byEvidence[f.evidence] = (s.byEvidence[f.evidence] || 0) + 1; }
+  if (s.byExploitability) {
+    const by = Object.fromEntries(Object.keys(s.byExploitability).map((k) => [k, 0]));
+    for (const f of open) if (f.exploitability) by[f.exploitability.verdict]++;
+    s.byExploitability = by;
+  }
   s.baseline = {
     path: baseline.path,
     source: baseline.source,

package/lib/build.mjs

@@ -2,6 +2,8 @@
 // The build gate, specified in docs/spec/build-gate.md: scan, apply the policy and the baseline,
 // hold the compiler's options to the policy, and run the compiler only on a pass. Every check is the
 // engine's reading of the tree; nothing here asks a model anything.
+import { checkEquivalence } from './equivalence.mjs';
+import { optionChanges } from './option-diff.mjs';
 import { createHash } from 'node:crypto';
 import { spawnSync } from 'node:child_process';
 import { existsSync, readFileSync, statSync } from 'node:fs';
@@ -19,8 +21,10 @@ import { isProgram, isJcl, isSource, readSource, relPath } from './sources.mjs';
 import { parseJclFile } from './jcl.mjs';
 import { POLICY_FILE, treePolicy, floorPolicy, combinePolicies, canonical, policyHash } from './policy.mjs';
 import { classesOf, tierOf, TIERS, TIER_RANK } from './consequence.mjs';
-import { optionCards, enterpriseChecks, cobcChecks, scriptedCobcChecks, cobcInvocations, cobcTasks, compileStepOptions, isCobc } from './options.mjs';
+import { optionCards, enterpriseChecks, compilerChecks, scriptedChecks, compilerInvocations, compilerTasks, compileStepOptions, compilerOf } from './options.mjs';
 import { FLOW_MODEL, TOOL_VERSION } from './version.mjs';
+import { checkWithIronwork, ironworkVerdict, ironworkReasons, ironworkVersion, listed } from './ironwork.mjs';
+import { buildFileIndex } from './parser.mjs';
 
 export const BUILD_SCHEMA_VERSION = 1;
 export const BUILD_EXIT = { pass: 0, fail: 1, undecided: 3, compilerFailed: 4 };
@@ -68,8 +72,8 @@ export function blockingReason(f, { policy, ratchet, introduced, renewed }) {
   return setting === 'block' ? 'rule' : null;
 }
 
-// Build scripts that can run cobc: a Makefile, a shell or batch script, a CI workflow, a Dockerfile,
-// an editor's task file, or a small script with no extension.
+// Build scripts that can run cobc or gcobol: a Makefile, a shell or batch script, a CI workflow, a
+// Dockerfile, an editor's task file, or a small script with no extension.
 const BUILD_SCRIPT = /(^|\/)(makefile|gnumakefile|dockerfile|[^/]*\.(mk|sh|bash|bat|cmd|ps1|ya?ml))$/i;
 const EDITOR_TASKS = /(^|\/)\.vscode\/tasks\.json$/i;
 const MAX_SCRIPT_BYTES = 1 << 20;
@@ -79,18 +83,18 @@ const kindOf = (rel) => (/(^|\/)(gnu)?makefile$|\.mk$/i.test(rel) ? 'make' : /(^
   : /\.(bat|cmd)$/i.test(rel) ? 'batch' : /\.ps1$/i.test(rel) ? 'powershell' : /\.ya?ml$/i.test(rel) ? 'yaml' : 'sh');
 
 function scriptInvocations(file, rel) {
-  if (EDITOR_TASKS.test(rel)) return cobcTasks(readSource(file).text);
+  if (EDITOR_TASKS.test(rel)) return compilerTasks(readSource(file).text);
   const size = statSync(file).size;
-  if (BUILD_SCRIPT.test(rel) && size <= MAX_SCRIPT_BYTES) return cobcInvocations(readSource(file).text, { kind: kindOf(rel) });
+  if (BUILD_SCRIPT.test(rel) && size <= MAX_SCRIPT_BYTES) return compilerInvocations(readSource(file).text, { kind: kindOf(rel) });
   if (!extname(file) && size <= MAX_BARE_SCRIPT_BYTES) {
     const bytes = readFileSync(file);
-    return bytes.includes(0) ? [] : cobcInvocations(bytes.toString('latin1'), { kind: 'sh' });
+    return bytes.includes(0) ? [] : compilerInvocations(bytes.toString('latin1'), { kind: 'sh' });
   }
   return [];
 }
 
-// How the repository says it compiles its programs: the cobc commands its build scripts run, and
-// the Enterprise COBOL compile steps its JCL holds.
+// How the repository says it compiles its programs: the cobc and gcobol commands its build scripts
+// run, and the Enterprise COBOL compile steps its JCL holds.
 function declaredCompiles(root, files) {
   const invocations = [];
   const parsedJcl = [];
@@ -113,19 +117,20 @@ const memberName = (file) => basename(file).replace(/\.[^.]*$/, '').toUpperCase(
 
 // The options every program in the tree is compiled with, held to the policy. A program's options
 // come from the estate's declared defaults, the JCL step that compiles it and its own option cards;
-// where it has none of those, from the cobc commands the repository's build scripts run. `ok` is
-// false where a required check is not generated and null where no one can tell; `forbidden` counts
-// options the policy's forbid list names. `generated` maps each program and build script to the
-// checks it generates, for telling a change that removes one.
+// where it has none of those, from the cobc and gcobol commands the repository's build scripts run.
+// `ok` is false where a required check is not generated and null where no one can tell; `forbidden`
+// counts options the policy's forbid list names. `generated` maps each program and build script to
+// the checks it generates, for telling a change that removes one.
 function optionsCheck({ root, allow, site, policy, compiler }) {
   const required = policy.checks;
-  if (compiler && !isCobc(compiler[0])) {
-    return { ok: null, forbidden: 0, reasons: [`the gate reads the options of cobc and of Enterprise COBOL option cards; for ${printable(compiler[0], 60)} it cannot tell what reaches the compiler`], add: [], generated: new Map() };
+  const kind = compiler && compilerOf(compiler[0]);
+  if (compiler && !kind) {
+    return { ok: null, forbidden: 0, reasons: [`the gate reads the options of cobc, of gcobol and of Enterprise COBOL option cards; for ${printable(compiler[0], 60)} it cannot tell what reaches the compiler`], add: [], generated: new Map() };
   }
   if (compiler) {
-    const r = cobcChecks(compiler.slice(1), { required, forbid: policy.forbid.gnucobol });
+    const r = compilerChecks(kind, compiler.slice(1), { required, forbid: policy.forbid[kind] });
     const missing = r.checks.filter((c) => c.ok === false).map((c) => c.why);
-    return { ok: missing.length || r.forbidden.length ? false : true, forbidden: r.forbidden.length, reasons: [...r.forbidden, ...missing], add: r.forbidden.length ? [] : r.add, compiler: 'gnucobol', generated: new Map() };
+    return { ok: missing.length || r.forbidden.length ? false : true, forbidden: r.forbidden.length, reasons: [...r.forbidden, ...missing], add: r.forbidden.length ? [] : r.add, compiler: kind, generated: new Map() };
   }
   const tree = directoryTree(root);
   const files = [...new Set(tree.list())].filter((p) => !allow || allow.has(p)).sort();
@@ -137,7 +142,7 @@ function optionsCheck({ root, allow, site, policy, compiler }) {
   const generated = new Map();
   const fail = (why) => { ok = false; reasons.push(printable(why, 300)); };
   const open = () => { if (ok !== false) ok = null; };
-  // A script generates a check only if every cobc command in it does.
+  // A script generates a check only if every compiler command in it does.
   const record = (key, checks) => {
     const was = generated.get(key) || new Map();
     for (const c of checks) was.set(c.check, was.has(c.check) ? was.get(c.check) && c.ok : c.ok);
@@ -145,7 +150,7 @@ function optionsCheck({ root, allow, site, policy, compiler }) {
   };
 
   for (const inv of declared.invocations) {
-    const r = scriptedCobcChecks(inv.args, { required, forbid: policy.forbid.gnucobol });
+    const r = scriptedChecks(inv.compiler, inv.args, { required, forbid: policy.forbid[inv.compiler] });
     record(inv.file, r.checks);
     forbidden += r.forbidden.length;
     for (const why of [...r.checks.filter((c) => c.ok === false).map((c) => c.why), ...r.forbidden]) fail(`${inv.file}:${inv.line}: ${why}`);
@@ -170,8 +175,9 @@ function optionsCheck({ root, allow, site, policy, compiler }) {
   }
   if (unknown) reasons.push(`${unknown} program(s) have no option this gate can read for ${required.join(', ')}: no compile step or build script names them; declare the estate's defaults as compilerOptions in cobolwork.site.json`);
   return {
-    ok, forbidden, generated, reasons: reasons.slice(0, MAX_PROGRAM_REASONS), add: [], compiler: declared.invocations.length ? 'gnucobol' : 'enterprise',
-    programs: programs.length, sources: { cobcCommands: declared.invocations.length, compileSteps: [...declared.steps.values()].flat().length },
+    ok, forbidden, generated, reasons: reasons.slice(0, MAX_PROGRAM_REASONS), add: [],
+    compiler: declared.invocations.length ? [...new Set(declared.invocations.map((i) => i.compiler))].sort().join(',') : 'enterprise',
+    programs: programs.length, sources: { compilerCommands: declared.invocations.length, compileSteps: [...declared.steps.values()].flat().length },
   };
 }
 
@@ -195,7 +201,25 @@ function sourceHashes(root, allow) {
     .sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
 }
 
-function judge({ baseDir, headDir, allow, policyRoot, floor, noBaseline, compiler, compilerPath, now, advisoryFeeds, copylibs }) {
+// ironwork checks the head tree, which in ratchet mode exists only while judge runs, so it runs
+// here rather than after the verdict the way a caller's compiler does.
+function ironworkCompile(path, { root, allow, copylibs, env }) {
+  const result = checkWithIronwork(path, root, { allow, copylibs, env });
+  const check = ironworkVerdict(result);
+  const libraries = [...buildFileIndex(root).copyDirs.map((d) => relPath(root, d) || '.'), ...copylibs];
+  return {
+    check,
+    reasons: ironworkReasons(result),
+    compiled: {
+      tool: 'ironwork', path, version: ironworkVersion(path, { env }),
+      argv: ['check', '<program>', ...libraries.flatMap((d) => ['-I', d])],
+      status: check === true ? 0 : check === false ? 12 : null,
+      ...listed(result),
+    },
+  };
+}
+
+function judge({ baseDir, headDir, allow, policyRoot, floor, noBaseline, compiler, compilerPath, ironworkPath, env, now, advisoryFeeds, copylibs, equivalenceFiles = [], allowed = null, refs = null }) {
   const repoPolicy = treePolicy(policyRoot);
   if (repoPolicy && repoPolicy.problems.length) throw refusal(`the repository policy does not validate: ${repoPolicy.problems.join('; ')}`);
   const { policy, setBy, ignored } = combinePolicies({ floor: floor ? floor.raw : null, repository: repoPolicy ? repoPolicy.raw : null });
@@ -216,7 +240,8 @@ function judge({ baseDir, headDir, allow, policyRoot, floor, noBaseline, compile
     const because = blockingReason(f, { policy, ratchet, introduced, renewed });
     return {
       fingerprint: f.fingerprint, rule: f.rule, tier: tierOf(f), sev: f.sev, classes: classesOf(f).filter((c) => policy.classes.includes(c)),
-      path: f.path, line: Number(f.line) || 0, ...(ratchet ? { introduced: introduced.has(f) } : {}),
+      path: f.path, line: Number(f.line) || 0, ...(f.exploitability ? { exploitability: f.exploitability.verdict } : {}),
+      ...(ratchet ? { introduced: introduced.has(f) } : {}),
       blocking: because !== null, ...(because ? { because } : {}),
     };
   });
@@ -238,6 +263,16 @@ function judge({ baseDir, headDir, allow, policyRoot, floor, noBaseline, compile
   // policy forbids by name, and a check the change itself removed, still fail.
   const removed = ratchet && !compiler ? optionsRemoved(optionsCheck({ root: baseDir, allow: null, site, policy, compiler }), options) : [];
   reasons.push(...removed.slice(0, MAX_PROGRAM_REASONS));
+  const optionsChanged = ratchet ? programOptionChanges(baseDir, headDir, allow) : [];
+  for (const c of optionsChanged.slice(0, MAX_PROGRAM_REASONS)) reasons.push(`${c.path}:${c.line} changes ${c.option} from ${c.base} to ${c.head}, which changes what the program's statements do without changing a statement`);
+  const equivalence = ratchet && (equivalenceFiles.length || policy.requireEquivalence !== 'never')
+    ? checkEquivalence({ baseDir, headDir, allow, files: equivalenceFiles, allowed, mode: policy.requireEquivalence, ...(refs || {}), systemDirs: copylibs, env })
+    : null;
+  if (equivalence) {
+    reasons.push(...equivalence.problems);
+    if (equivalence.required === null) reasons.push('the policy requires equivalence for machine-authored changes, and whether this one is could not be read from the commits');
+    if (equivalence.required) for (const p of equivalence.programs.filter((x) => !x.ok).slice(0, MAX_PROGRAM_REASONS)) reasons.push(`${p.path}: ${p.because}, and the policy requires equivalence${equivalence.mode === 'machineAuthored' ? ' for a machine-authored change' : ''}`);
+  }
   const relaxOptions = policy.options === 'warn' && options.ok !== true && !options.forbidden && !removed.length;
   if (relaxOptions) reasons.push(options.ok === null ? 'the options of some programs are unknown, and the policy says warn' : 'some programs are built without a check the policy names, and the policy says warn');
 
@@ -246,10 +281,19 @@ function judge({ baseDir, headDir, allow, policyRoot, floor, noBaseline, compile
     coverage: incomplete && policy.coverage === 'block' ? null : true,
     options: options.forbidden || removed.length ? false : relaxOptions ? true : options.ok,
     compile: null,
+    ...(equivalence ? { equivalence: equivalence.problems.length ? false : equivalence.required === null ? null : equivalence.required ? equivalence.programs.every((p) => p.ok) : true } : {}),
   };
   const relaxed = [...(incomplete && policy.coverage === 'warn' ? ['coverage'] : []), ...(relaxOptions ? ['options'] : [])];
-  const decided = [checks.findings, checks.coverage, checks.options];
+  const decided = [checks.findings, checks.coverage, checks.options, ...('equivalence' in checks ? [checks.equivalence] : [])];
   const verdict = decided.includes(false) ? 'fail' : decided.includes(null) ? 'undecided' : 'pass';
+  let compiled = null;
+  if (ironworkPath && verdict === 'pass') {
+    const iw = ironworkCompile(ironworkPath, { root: headDir, allow, copylibs, env });
+    compiled = iw.compiled;
+    checks.compile = iw.check;
+    reasons.push(...iw.reasons);
+    if (iw.check === null && policy.coverage === 'warn') relaxed.push('compile');
+  }
 
   const configurationChanged = ratchet ? [
     ...configurationChanges(baseDir, headDir).map((c) => c.file),
@@ -271,12 +315,15 @@ function judge({ baseDir, headDir, allow, policyRoot, floor, noBaseline, compile
     expired: expired.map((e) => ({ fingerprint: e.fingerprint, rule: e.rule, who: e.who, expired: e.expired })),
     overlong,
     optionsAdded: options.add,
+    optionsChanged,
+    ...(equivalence ? { equivalence } : {}),
     configurationChanged,
     policy: { sha256: policyHash(policy), setBy, ignored, applied: policy },
-    compiled: null,
+    compiled,
     reasons: reasons.slice(0, MAX_REASONS).map((x) => printable(x, 400)),
     ...(reasons.length > MAX_REASONS ? { reasonsNotShown: reasons.length - MAX_REASONS } : {}),
-    repositoryText: ['blocking[].path', 'findings[].path', 'waived[].who', 'waived[].reason', 'expired[].who', 'overlong[].who', 'reasons'],
+    repositoryText: ['blocking[].path', 'findings[].path', 'waived[].who', 'waived[].reason', 'expired[].who', 'overlong[].who', 'reasons',
+      ...(compiled ? ['compiled.failed[]', 'compiled.notModelled[]', 'compiled.unresolved[]', 'compiled.unrun[]'] : [])],
     summary: {
       flowModel: FLOW_MODEL,
       toolVersion: TOOL_VERSION,
@@ -292,6 +339,22 @@ function judge({ baseDir, headDir, allow, policyRoot, floor, noBaseline, compile
   return { doc, report: after, policy, setBy, hashes, add: options.add, compilerPath };
 }
 
+// The watched options in force changed by the change, per program present on both sides.
+function programOptionChanges(baseDir, headDir, allow) {
+  const out = [];
+  const files = directoryTree(headDir).list().filter((p) => isProgram(p) && (!allow || allow.has(p))).sort();
+  for (const head of files) {
+    const path = relPath(headDir, head);
+    const base = join(baseDir, path);
+    if (!existsSync(base)) continue;
+    let before;
+    let after;
+    try { before = readSource(base).text; after = readSource(head).text; } catch { continue; }
+    for (const c of optionChanges(before, after)) out.push({ path, ...c });
+  }
+  return out;
+}
+
 function policyChanged(baseDir, headDir) {
   const bytes = (root) => { const p = join(root, POLICY_FILE); return existsSync(p) ? readFileSync(p) : null; };
   const was = bytes(baseDir);
@@ -301,9 +364,10 @@ function policyChanged(baseDir, headDir) {
 
 // Runs the gate over `repo`. `compiler` is the argument vector after `--`, or null. Returns
 // { doc, report, provenance, exit }; throws with code EBUILD when it could not run.
-export function build(repo, { base = null, head = null, policy = null, noBaseline = false, compiler = null, advisoryFeeds = null, copylibs = [], now = new Date().toISOString(), env = process.env } = {}) {
+export function build(repo, { base = null, head = null, policy = null, noBaseline = false, compiler = null, ironwork = null, advisoryFeeds = null, copylibs = [], equivalence = [], allowed = null, now = new Date().toISOString(), env = process.env } = {}) {
   const floor = policy ? floorPolicy(policy, repo) : null;
   if (floor && floor.problems.length) throw refusal(floor.problems.join('; '));
+  if (compiler && ironwork) throw refusal('one compiler per build: -- names one and --ironwork another');
   let compilerPath = null;
   if (compiler) {
     if (!compiler.length) throw refusal('nothing follows --, so there is no compiler to run');
@@ -311,7 +375,13 @@ export function build(repo, { base = null, head = null, policy = null, noBaselin
     if (!found.path) throw refusal(`the compiler: ${found.why}`);
     compilerPath = found.path;
   }
-  const run = (baseDir, headDir, allow, policyRoot) => judge({ baseDir, headDir, allow, policyRoot, floor, noBaseline, compiler, compilerPath, now, advisoryFeeds, copylibs });
+  let ironworkPath = null;
+  if (ironwork) {
+    const found = findExecutable(ironwork, { repo, env });
+    if (!found.path) throw refusal(`--ironwork: ${found.why}`);
+    ironworkPath = found.path;
+  }
+  const run = (baseDir, headDir, allow, policyRoot) => judge({ baseDir, headDir, allow, policyRoot, floor, noBaseline, compiler, compilerPath, ironworkPath, env, now, advisoryFeeds, copylibs, equivalenceFiles: equivalence, allowed, refs: base ? { repo, base, head: head || 'HEAD' } : null });
   const judged = base
     ? withRefs(repo, base, head, {}, (baseDir, headDir, scoped) => {
       const r = run(baseDir, headDir, scoped.allow || null, baseDir);
@@ -323,6 +393,12 @@ export function build(repo, { base = null, head = null, policy = null, noBaselin
 
   const { doc } = judged;
   let exit = BUILD_EXIT[doc.verdict];
+  // A program ironwork could not decide leaves the build undecided, as unread source does, unless the
+  // policy says warn for coverage; judge has then marked compile relaxed.
+  if (ironwork && doc.verdict === 'pass') {
+    if (doc.checks.compile === false) exit = BUILD_EXIT.compilerFailed;
+    else if (doc.checks.compile === null && !doc.relaxed.includes('compile')) exit = BUILD_EXIT.undecided;
+  }
   if (compiler && doc.verdict === 'pass') {
     const argv = [...compiler.slice(1), ...judged.add];
     // The compiler's own output goes to standard error: standard output carries the document.
@@ -338,14 +414,15 @@ export function build(repo, { base = null, head = null, policy = null, noBaselin
   return { doc, report: judged.report, provenance: provenanceRecord(judged, { base, head, env, copylibs }), exit };
 }
 
-function provenanceRecord({ doc, policy, setBy, hashes, compilerPath }, { base, head, env, copylibs }) {
+function provenanceRecord({ doc, policy, setBy, hashes }, { base, head, env, copylibs }) {
   const epoch = env.SOURCE_DATE_EPOCH;
   const builtAt = epoch && /^\d+$/.test(epoch) ? new Date(Number(epoch) * 1000).toISOString() : null;
   let compiler = null;
   if (doc.compiled) {
     let digest = null;
-    try { digest = sha256(readFileSync(compilerPath)); } catch { /* unreadable binary: recorded as null */ }
+    try { digest = sha256(readFileSync(doc.compiled.path)); } catch { /* unreadable binary: recorded as null */ }
     compiler = { path: doc.compiled.path, sha256: digest, argv: doc.compiled.argv, status: doc.compiled.status };
+    if (doc.compiled.tool === 'ironwork') Object.assign(compiler, { tool: 'ironwork', version: doc.compiled.version, programs: doc.compiled.programs, counts: doc.compiled.counts });
   }
   return {
     tool: 'cobolwork-build-provenance',
@@ -380,7 +457,12 @@ export function buildSummaryLine(doc) {
   if (advisory.length) parts.push(`advisory ${count(advisory)}`);
   if (doc.checks.coverage === null) parts.push('coverage incomplete');
   if (doc.checks.options !== true) parts.push(`options ${doc.checks.options === false ? 'refused' : 'unknown'}`);
-  if (doc.compiled && doc.compiled.status !== 0) parts.push(`compiler exited ${doc.compiled.status}`);
+  if (doc.compiled && doc.compiled.tool === 'ironwork') {
+    const c = doc.compiled.counts;
+    if (c.failed) parts.push(`ironwork: ${c.failed} of ${doc.compiled.programs} programs do not compile`);
+    const open = c.notModelled + c.unresolved + c.unrun;
+    if (open) parts.push(`ironwork: ${open} program${open === 1 ? '' : 's'} not decided`);
+  } else if (doc.compiled && doc.compiled.status !== 0) parts.push(`compiler exited ${doc.compiled.status}`);
   return parts.join('; ');
 }
 

package/lib/capabilities.mjs

@@ -17,16 +17,18 @@ export const CAPABILITIES_SCHEMA_VERSION = 1;
 
 // Each command, what it takes and what it writes.
 export const COMMANDS = {
-  scan: { args: ['<path>'], options: ['--format', '--out', '--repos', '--only', '--quiet', '--full-trace', '--baseline', '--no-baseline', '--advisories', '--copylib'], documents: ['cobolwork', 'sarif'] },
-  flow: { args: ['<path>'], options: ['--out', '--repos', '--quiet', '--full-trace', '--baseline', '--no-baseline', '--copylib'], documents: ['cobolwork-flow'] },
-  inventory: { args: ['<path>'], options: ['--out', '--quiet', '--copylib'], documents: ['cobolwork-inventory'] },
+  scan: { args: ['<path>'], options: ['--format', '--out', '--repos', '--only', '--quiet', '--full-trace', '--baseline', '--no-baseline', '--advisories', '--copylib', '--evidence'], documents: ['cobolwork', 'sarif'] },
+  flow: { args: ['<path>'], options: ['--out', '--repos', '--quiet', '--full-trace', '--baseline', '--no-baseline', '--copylib', '--evidence'], documents: ['cobolwork-flow'] },
+  inventory: { args: ['<path>'], options: ['--out', '--quiet', '--copylib', '--evidence'], documents: ['cobolwork-inventory'] },
   parse: { args: ['<file>'], options: ['--out'], documents: ['cobolwork-parse'] },
-  diff: { args: ['<repo>'], options: ['--base', '--head', '--format', '--out', '--only', '--quiet', '--full-trace', '--copylib'], documents: ['cobolwork-diff', 'sarif'] },
-  baseline: { args: ['<path>'], options: ['--reason', '--who', '--expires', '--action', '--rule', '--out', '--repos', '--only', '--advisories', '--copylib'], documents: ['cobolwork-baseline'] },
+  sbom: { args: ['<path>'], options: ['--name', '--out', '--quiet', '--copylib', '--evidence'], documents: ['cyclonedx'] },
+  diff: { args: ['<repo>'], options: ['--base', '--head', '--format', '--out', '--only', '--quiet', '--full-trace', '--copylib', '--evidence'], documents: ['cobolwork-diff', 'sarif'] },
+  baseline: { args: ['<path>'], options: ['--reason', '--who', '--expires', '--action', '--rule', '--out', '--repos', '--only', '--advisories', '--copylib', '--evidence'], documents: ['cobolwork-baseline'] },
   tui: { args: ['[path]'], options: ['--report', '--keys', '--baseline', '--no-baseline', '--advisories', '--copylib'], documents: [] },
   explain: { args: ['<path>', '<fingerprint>'], options: ['--report', '--out', '--baseline', '--no-baseline', '--advisories', '--copylib'], documents: ['cobolwork-explain'] },
-  gate: { args: ['<repo>'], options: ['--base', '--head', '--target', '--cobc', '--exit-code', '--target-only', '--out'], documents: ['cobolwork-gate'] },
-  build: { args: ['<repo>', '[-- <compiler> <arg>...]'], options: ['--base', '--head', '--policy', '--provenance', '--advisories', '--copylib', '--no-baseline', '--format', '--out'], documents: ['cobolwork-build', 'cobolwork-build-provenance', 'sarif'] },
+  gate: { args: ['<repo>'], options: ['--base', '--head', '--target', '--cobc', '--exit-code', '--target-only', '--out', '--evidence'], documents: ['cobolwork-gate'] },
+  build: { args: ['<repo>', '[-- <compiler> <arg>...]'], options: ['--base', '--head', '--policy', '--provenance', '--provenance-format', '--artifact', '--equivalence', '--allowed-signers', '--ironwork', '--advisories', '--copylib', '--no-baseline', '--format', '--out', '--evidence'], documents: ['cobolwork-build', 'cobolwork-build-provenance', 'sarif'] },
+  evidence: { args: ['verify|seal|anchor|sign', '[statement]'], options: ['--evidence', '--ssh-key', '--signer', '--expect-key', '--allowed-signers', '--anchor-git', '--ref', '--push', '--max-unsealed', '--tsq', '--out', '--quiet'], documents: ['cobolwork-evidence'] },
   capabilities: { args: [], options: ['--json'], documents: ['cobolwork-capabilities'] },
 };
 
@@ -54,6 +56,8 @@ export function capabilities() {
       'cobolwork-explain': null,
       'cobolwork-baseline': null,
       'cobolwork-parse': null,
+      'cobolwork-evidence': null,
+      cyclonedx: '1.6',
       sarif: '2.1.0',
     },
     identity: { version: FINGERPRINT_VERSION },
@@ -64,6 +68,7 @@ export function capabilities() {
       jcl: JCL_EXT,
       bms: BMS_EXT,
       extensionless: 'sniffed by content: a file with no extension is classified by what it holds',
+      zowe: ['zowe.config.json', 'zowe.config.user.json', '.mcp.json', '.vscode/mcp.json', '.cursor/mcp.json', '.claude/settings.json', '.claude/settings.local.json', '.gemini/settings.json', 'claude_desktop_config.json', '.vscode/settings.json', 'systems.json under a mock directory'],
     },
     evidenceKinds: Object.keys(EVIDENCE),
     build: {

package/lib/consequence.mjs

@@ -40,6 +40,13 @@ const SINK_CLASSES = {
   'arithmetic': [],
   'record-key': [],
   'log': [],
+  'storage-length': [],
+  'xml-document': [],
+  'connection-target': [],
+  'screen': [],
+  'cics-sysid': [],
+  // A system-programming command acts with the region's authority on whatever resource it names.
+  'cics-system-resource': [ESCALATES],
 };
 
 // Past a table or a reference with SSRANGE abending, a bad index stops the program instead of
@@ -50,6 +57,11 @@ const RULE_CLASSES = {
   // A variable names the program, and nothing says input reaches it: over the 500-repository corpus
   // every one read held a literal. Input that does reach it is *-to-cics-dynamic-transfer.
   'cics-transfer-to-variable-program': [],
+  // A failure carried on from: what follows depends on the program, and severity decides.
+  'cics-condition-ignored': [],
+  // Disclosure of stored secrets and a weaker check; severity decides.
+  'program-checks-stored-password': [],
+  'password-case-folded-before-compare': [],
   'cics-signon-bypassed': [ESCALATES],
   'csd-defines-diagnostic-transaction': [ESCALATES],
   'csd-transaction-without-command-security': [ESCALATES],
@@ -59,6 +71,12 @@ const RULE_CLASSES = {
   'jcl-instream-credential': [ESCALATES],
   'web-uri-carries-a-credential': [ESCALATES],
   'log-writes-a-credential': [ESCALATES],
+  'zowe-config-secret-in-clear': [ESCALATES],
+  'zowe-mcp-password-in-config': [ESCALATES],
+  'zowe-mock-credentials': [ESCALATES],
+  // An agent at the full tier submits jobs and runs commands as the user it logs on as.
+  'zowe-mcp-tier-full': [ESCALATES],
+  'zowe-mcp-tier-writes': [MUTATES],
   // A crafted source file compiled by an affected cobc runs in the build, with the build's authority.
   'build-pins-vulnerable-compiler': [ESCALATES],
   'build-pins-exploited-compiler': [ESCALATES],
@@ -87,8 +105,19 @@ const RULE_CLASSES = {
   'web-link-opens-without-noopener': [],
   'cics-listener-accepts-cleartext': [],
   'compile-undefined-name': [],
+  // A value the generated code gets wrong with no input driving it; severity decides.
+  'binary-store-exceeds-picture-under-trunc-opt': [],
+  'intermediate-result-loses-high-order-digits': [],
+  'character-range-reverses-in-ascii': [],
   'log-writes-personal-data': [],
   'display-echoes-a-credential': [],
+  'control-cards-from-dataset': [],
+  'sort-exit-named': [],
+  'tso-batch-runs-program': [],
+  'zowe-config-tls-verify-off': [],
+  'zowe-config-cleartext': [],
+  'zowe-mcp-data-marking-off': [],
+  'zowe-mcp-unpinned': [],
 };
 
 // Coverage and context assert no defect, so they carry no consequence.