@portll/cobolwork 0.4.0 → 0.6.0

package/README.md

@@ -63,6 +63,19 @@ request and writes SARIF for code scanning: [docs/github-action.md](docs/github-
 | JCL | credentials and security commands in in-stream data, destructive statements, `DLM=` tricks, FTP in cleartext or sending production data, production data touched by a test job |
 | The source | names nothing declares (code that cannot compile), shadowed copybooks, payloads hidden in columns 73-80 or aimed at AI readers |
 | The estate | production names outside production jobs, routable addresses, compiler and runtime versions with published advisories |
+| Assembler | a switch to key zero or supervisor state, an instruction run through `EX`, cross-memory calls, a module named at run time, the security product called directly, and the CSECT or ENTRY a COBOL `CALL` or a job step reaches |
+| Cryptography | a single-length DES key, an MD5 or SHA-1 hash, or a fixed initialization vector asked of ICSF, read from IBM's parameter lists; an outbound CICS connection asking for HTTP |
+| Secrets | a credential written into a program or copybook: a literal `VALUE` on an item named for one, or a literal password in `EXEC SQL CONNECT` or `EXEC CICS SIGNON` |
+
+HLASM is read, not assembled. Each statement is parsed by what its operation is: a machine
+instruction against IBM's operand syntax for its mnemonic (`rules/hlasm-instructions.json`, every
+z/Architecture mnemonic with its page in the Principles of Operation), an assembler instruction,
+or a z/OS, Language Environment or HLASM Toolkit macro against the keywords IBM lists. The location
+and length of each symbol is worked out as the assembler would, and nothing after a statement of
+unknown length is placed. Macros are not expanded and conditional assembly is not evaluated, so an
+operation a site macro issues is seen where the macro is defined, and not where it is used. A scan
+names each macro it did not expand, each COPY member the tree does not hold, and each statement it
+could not read.
 
 [docs/rule-sets.md](docs/rule-sets.md) describes each in full, with what it deliberately leaves out.
 Vendor packs for CA ACF2 and Top Secret, Control-M and Connect:Direct load only for estates that
@@ -107,6 +120,15 @@ that caller's storage. A value the subprogram keeps in its own storage can reach
 Findings carry no source text, so a report can be stored and passed on without carrying the code
 with it.
 
+`trace` is one route, the shortest, and sources that reach one sink are merged into one finding,
+counted in `sources`. With `--all-routes`, `scan` and `flow` give each path finding `routes`: every
+source, and every statement on any route from one of them to the sink, by verb, file and line.
+`complete` is false where the walk stopped at its budget or a step has no statement the engine can
+place. It leaves out no statement on a route the engine follows, and may name one no route takes:
+what a reader needs before saying a run covered every route (`docs/spec/reach.md` §9.8). Routes
+through what the engine does not read, such as an unparsed program or a caller written in another
+language, are not in it.
+
 `fingerprint` is what the finding is, rather than where it is printed today: the rule, the program
 and the paragraph or section it sits in (the job, step and DD for JCL), and the flagged statement's
 own text. No line number goes into it, so code added above a finding does not change it. `diff`
@@ -199,8 +221,13 @@ entered ([docs/spec/evidence.md](docs/spec/evidence.md) §13.5).
 
 `COBOLWORK_ABENDS` names fuzz runs ironwork's harness wrote. Each abend an input caused becomes a
 finding at the line it happened, with the input and the run's journal, once that journal verifies:
-`input-causes-abend-s0c7`, `-s0c4`, `-subscript-range`, or `input-causes-abend` for any other code
-([docs/spec/evidence.md](docs/spec/evidence.md) §13.6).
+`input-causes-abend-s0c7`, `-s0c4` (in a CICS task, the ASRA whose message names that check),
+`-subscript-range`, `input-causes-hang` for an input that keeps a loop running past the statement limit (S322), `input-selects-program`
+for an S806 whose journal shows the input reaching the CALL, or `input-causes-abend` for any other
+code ([docs/spec/evidence.md](docs/spec/evidence.md) §13.6). It reads manifests in format
+`ironwork-fuzz/v1`, and `ironwork-fuzz-interface/v1` from a subprogram fuzzed with generated
+arguments, whose findings say no caller run shows a caller passes them and warn by default; it
+reports one in any other format as a problem instead of guessing at it.
 
 ### What each finding lets someone do, and the fix
 
@@ -328,11 +355,32 @@ stand-in in `diag/precompiler.mjs`, which rewrites what the parser would otherwi
 tests compare the parser with the compiler's answers kept in `test/fixtures/parser/*.golden.json`,
 so they run without GnuCOBOL.
 
-`bench/cases/` holds 102 CWE-labelled cases, each paired with a near-miss negative: the same shape
+HLASM is graded against z390, an HLASM-compatible assembler, by `diag/hlasm-oracle.mjs` and
+`diag/hlasm-grade-z390.mjs`. Each file is assembled twice, the second time with sixteen bytes after
+every macro call, and only values the two runs agree on are graded. None of them depends on how
+z390's macros, or IBM's, expand. Measured 2026-10-03 over the files z390 assembles:
+
+| Corpus | Files | Symbol locations | Statement locations | Instruction lengths | External names |
+|---|---|---|---|---|---|
+| 12 repositories, dev | 48 | 935 agree of 936, 0 differ | 2,511 of 2,546, 0 differ | 2,273 of 2,273 | 55 of 55 |
+| 17 repositories, held out | 76 | 546 agree of 557, 0 differ | 1,631 of 1,675, 0 differ | 1,710 of 1,710 | 90 of 92 |
+
+A value not agreeing was not placed, never placed differently: it follows a statement of unknown
+length. Two of z390's values are not graded, because it differs from the Language Reference, which
+the reader follows: an EQU's length, where z390 gives 1 and the reference the length of the
+leftmost term; and anything after a literal pool where z390 pads a literal that the reference packs.
+A file with an error that can move a location is not graded either, such as an undefined symbol in
+a statement holding a literal, which z390 then leaves out of the pool. Of the statements outside conditional
+assembly, 99.5% parse on the dev corpus and 99.7% on the held-out one; the rest are counted by
+kind. `bench/hlasm-locate/` holds small programs, one assembler feature each, with z390's answers
+recorded beside them, so the tests check the locator without z390.
+
+`bench/cases/` holds 137 CWE-labelled cases, each paired with a near-miss negative: the same shape
 with the flaw removed. `node bench/run.mjs` scores any scanner's findings against them, by rule and
 file, never by line, and `npm test` fails if any case scores differently from its declaration.
-`--validate` compiles every COBOL case with GnuCOBOL and checks every JCL case against the
-statement grammar, a weaker witness, and says so.
+`--validate` compiles every COBOL case with GnuCOBOL, assembles every HLASM case with z390 when
+`Z390` names a release (stubbing the macros z390 does not ship), and checks every JCL case against
+the statement grammar, a weaker witness, and says so.
 
 ## Coverage on a busy machine
 

package/bin/cobolwork.mjs

@@ -19,7 +19,7 @@ import { stampFingerprints } from '../lib/kernel/identity.mjs';
 import { pdsExportTree } from '../lib/kernel/source-tree.mjs';
 import { SITE_FILE } from '../lib/site.mjs';
 import { tally } from '../lib/kernel/findings.mjs';
-import { loadBaseline, applyBaseline, baselineEntries, BASELINE_FILE, SUPPRESSING } from '../lib/baseline.mjs';
+import { loadBaseline, applyBaseline, baselineEntries, BASELINE_FILE, BASELINE_VERSION, SUPPRESSING } from '../lib/baseline.mjs';
 import { readReport } from '../lib/tui/model.mjs';
 import { nodeTerminal } from '../lib/tui/terminal.mjs';
 import { runTui } from '../lib/tui/run.mjs';
@@ -28,7 +28,6 @@ import { printable } from '../lib/kernel/printable.mjs';
 import { startEvidence, recordInputs, recordHashed, recordFindings, recordOutput, recordVerdict, recordBaselineWrite, finishEvidence } from '../lib/evidence/run.mjs';
 import { evidenceCommand } from '../lib/evidence/cli.mjs';
 import { slsaStatement } from '../lib/evidence/slsa.mjs';
-import { parseAllowedSigners } from '../lib/evidence/sshsig.mjs';
 
 const STARTED = new Date().toISOString();
 
@@ -80,6 +79,7 @@ Options
   --rules-path gitleaks print the path of the mainframe credential rules and exit
   --quiet               summary only
   --full-trace          list every hop of a data flow path, not its two ends
+  --all-routes          give each data flow finding every statement on any route from its sources (scan, flow)
   --base <ref>          diff: the git revision to compare against
   --head <ref>          diff: the revision under review (default: the working tree)
   --baseline <file>     judgements to apply; without it, ${BASELINE_FILE} in the scanned tree
@@ -107,18 +107,29 @@ Options
                         the SLSA Provenance v1 predicate (unsigned; the pipeline signs it)
   --artifact <path>[,<path>]  build: what the compiler produced, named as subjects of the SLSA statement
   --equivalence <file>[,<file>]  build --base: ironwork equivalence statements for the programs the
-                        change edits; with --allowed-signers each must be signed by one. The policy's
-                        requireEquivalence (never, machineAuthored, always) says when one is required
+                        change edits, each signed by one of --allowed-signers. The policy's
+                        requireEquivalence (never, machineAuthored, always) says when one is required;
+                        where one may be, a build with no --allowed-signers fails the check
   --ironwork <path>     build: after a pass, run ironwork check on every program, for an estate that
                         compiles with IBM Enterprise COBOL; a program ironwork rejects exits 4, one it
                         does not model yet leaves the build undecided
   --evidence <dir>      scan, flow, diff, gate, build, baseline, inventory: record this run in a
                         hash-chained journal and ledger there (or COBOLWORK_EVIDENCE); never inside
                         the tree being read
-  --allowed-signers <file>  evidence verify: OpenSSH allowed_signers for namespace cobolwork-evidence
+  --allowed-signers <file>  evidence verify and build: OpenSSH allowed_signers for namespace
+                        cobolwork-evidence; build refuses one inside the repository
   --anchor-git <repo>, --ref <ref>, --push, --max-unsealed <n>
                         evidence: the git witness, the ref that counts (default @{upstream}), whether
                         anchor pushes, and how many ledger records may follow the newest seal
+  --anchor-pin <commit>  evidence verify: the witness commit an earlier verify reported as
+                        witnessCommit; the witness must still hold every seal it held
+  --tsq <file>, --tsr <file>, --tsa-ca <file>
+                        evidence anchor writes an RFC 3161 request (and keeps it beside the seal);
+                        verify reads the response, checking imprint and nonce, and has OpenSSL check
+                        the authority's signature against the CA certificate
+  --cosign-bundle <file> with --cosign-key <file> or --certificate-identity <id> and
+  --certificate-oidc-issuer <url>, [--trusted-root <file>] [--insecure-ignore-tlog]
+                        evidence verify: a transparency-log bundle over a seal, checked by cosign
 
 Exit codes: 0 the command ran, 2 it could not run. A run that examined nothing says so in
 summary.filesScanned and summary.nosrc rather than reporting a clean zero.
@@ -145,6 +156,7 @@ function parseArgs(argv) {
     else if (a === '--rules-path') opts.rulesPath = argv[++i] || 'gitleaks';
     else if (a === '--quiet') opts.quiet = true;
     else if (a === '--full-trace') opts.fullTrace = true;
+    else if (a === '--all-routes') opts.allRoutes = true;
     else if (a === '--base') opts.base = value();
     else if (a === '--head') opts.head = value();
     else if (a === '--baseline') opts.baseline = value();
@@ -180,6 +192,15 @@ function parseArgs(argv) {
     else if (a === '--push') opts.push = true;
     else if (a === '--max-unsealed') opts.maxUnsealed = value();
     else if (a === '--tsq') opts.tsq = value();
+    else if (a === '--anchor-pin') opts.anchorPin = value();
+    else if (a === '--tsr') opts.tsr = value();
+    else if (a === '--tsa-ca') opts.tsaCa = value();
+    else if (a === '--cosign-bundle') opts.cosignBundle = value();
+    else if (a === '--certificate-identity') opts.certificateIdentity = value();
+    else if (a === '--certificate-oidc-issuer') opts.certificateOidcIssuer = value();
+    else if (a === '--cosign-key') opts.cosignKey = value();
+    else if (a === '--trusted-root') opts.trustedRoot = value();
+    else if (a === '--insecure-ignore-tlog') opts.insecureIgnoreTlog = true;
     else if (a === '--expect-key') opts.expectKey = value();
     else if (a === '--help' || a === '-h') opts.help = true;
     else if (a === '--version' || a === '-v') opts.version = true;
@@ -250,6 +271,10 @@ if (opts.fullTrace && opts._.length && !TRACE_COMMANDS.includes(opts._[0])) {
 `);
   process.exit(2);
 }
+if (opts.allRoutes && opts._.length && !['scan', 'flow'].includes(opts._[0])) {
+  process.stderr.write(`cobolwork: --all-routes is for scan and flow\n`);
+  process.exit(2);
+}
 const ADVISORY_COMMANDS = ['scan', 'baseline', 'tui', 'explain', 'build'];
 if (opts.advisoryFeeds && opts._.length && !ADVISORY_COMMANDS.includes(opts._[0])) {
   process.stderr.write(`cobolwork: ${opts._[0]} reads no advisories; ${ADVISORY_COMMANDS.join(', ')} do\n`);
@@ -291,7 +316,7 @@ if (opts.evidence !== undefined && opts._.length && ![...JOURNALED, 'evidence'].
   process.stderr.write(`cobolwork: ${opts._[0]} records no evidence; ${JOURNALED.join(', ')} and evidence do\n`);
   process.exit(2);
 }
-const evidenceFlag = ['sshKey', 'signer', 'allowedSigners', 'anchorGit', 'ref', 'push', 'maxUnsealed', 'tsq', 'expectKey'].find((k) => opts[k] !== undefined);
+const evidenceFlag = ['sshKey', 'signer', 'allowedSigners', 'anchorGit', 'ref', 'push', 'maxUnsealed', 'tsq', 'expectKey', 'anchorPin', 'tsr', 'tsaCa', 'cosignBundle', 'certificateIdentity', 'certificateOidcIssuer', 'cosignKey', 'trustedRoot', 'insecureIgnoreTlog'].find((k) => opts[k] !== undefined);
 if (opts.equivalence && !opts.base) { process.stderr.write('cobolwork: --equivalence judges a change; it needs --base\n'); process.exit(2); }
 if (evidenceFlag && opts._.length && opts._[0] !== 'evidence' && !(evidenceFlag === 'allowedSigners' && opts._[0] === 'build')) {
   process.stderr.write(`cobolwork: --${evidenceFlag.replace(/[A-Z]/g, (c) => `-${c.toLowerCase()}`)} is for evidence only\n`);
@@ -340,7 +365,7 @@ try {
   } else if (command === 'evidence') {
     process.exitCode = evidenceCommand(target, opts, { toolVersion: VERSION, write: (s) => process.stdout.write(s) });
   } else if (command === 'scan' || command === 'flow') {
-    const flowOpts = { repos, fullTrace: opts.fullTrace === true, systemDirs };
+    const flowOpts = { repos, fullTrace: opts.fullTrace === true, allRoutes: opts.allRoutes === true, systemDirs };
     // The site file sits beside the members and is not one of them, so it is named rather than found.
     const site = resolve(root, SITE_FILE);
     const pds = opts.pdsExport ? pdsExportTree(root, { systemDirs }) : null;
@@ -387,7 +412,7 @@ try {
     if (opts.only || opts.repos) { process.stderr.write('cobolwork: build judges one repository with every rule set; --only and --repos do not apply\n'); process.exit(2); }
     if (opts.baseline) { process.stderr.write('cobolwork: build reads the baseline the change was written against; --baseline does not apply, --no-baseline does\n'); process.exit(2); }
     if (opts.head && !opts.base) { process.stderr.write('cobolwork: build --head needs --base\n'); process.exit(2); }
-    const result = build(root, { base: opts.base || null, head: opts.head || null, policy: opts.policy || null, noBaseline: opts.noBaseline === true, compiler: compilerArgv, ironwork: opts.ironwork || null, advisoryFeeds: opts.advisoryFeeds || null, copylibs: systemDirs, equivalence: opts.equivalence || [], allowed: opts.allowedSigners ? parseAllowedSigners(readFileSync(resolve(opts.allowedSigners), 'utf8')) : null });
+    const result = build(root, { base: opts.base || null, head: opts.head || null, policy: opts.policy || null, noBaseline: opts.noBaseline === true, compiler: compilerArgv, ironwork: opts.ironwork || null, advisoryFeeds: opts.advisoryFeeds || null, copylibs: systemDirs, equivalence: opts.equivalence || [], allowedSigners: opts.allowedSigners || null });
     stampRevisions(result.doc.summary, opts.head || null);
     Object.assign(result.report.summary, { toolRevision: result.doc.summary.toolRevision, revision: result.doc.summary.revision });
     Object.assign(result.provenance, { toolRevision: result.doc.summary.toolRevision, revision: result.doc.summary.revision });
@@ -430,7 +455,7 @@ try {
     if (held.problems.length) { process.stderr.write(`cobolwork: ${path} holds entries that do not validate, so it is left as it is:\n  ${held.problems.join('\n  ')}\n`); process.exit(2); }
     const report = scanAll(root, { repos, only: opts.only, advisoryFeeds: opts.advisoryFeeds, systemDirs });
     const { entries, added } = baselineEntries(report.findings, held.entries, { action, reason: opts.reason, who: opts.who, expires: expires.toISOString(), at, rules: opts.rule || null });
-    const written = JSON.stringify({ _comment: 'Judgements over cobolwork findings, matched by fingerprint. A suppression lapses at its expires date and the finding comes back.', entries }, null, 1) + '\n';
+    const written = JSON.stringify({ _comment: 'Judgements over cobolwork findings, matched by fingerprint. A suppression lapses at its expires date and the finding comes back.', version: BASELINE_VERSION, entries }, null, 1) + '\n';
     writeFileSync(path, written);
     recordInputs(journal, 0, root);
     recordFindings(journal, report);

package/lib/baseline.mjs

@@ -22,6 +22,7 @@ import { resolvesInside } from './kernel/source-tree.mjs';
 import { printable } from './kernel/printable.mjs';
 
 export const BASELINE_FILE = 'cobolwork.baseline.json';
+export const BASELINE_VERSION = 1;
 export const SUPPRESSING = ['accept', 'false-positive', 'wont-fix', 'incorrect-scan-result'];
 export const ACTIONS = [...SUPPRESSING, 'note', 'resolved'];
 
@@ -75,6 +76,14 @@ export function loadBaseline(root, { explicit = null, use = true, mayBeAbsent =
     out.problems.push(`${path} is not readable as JSON: ${printable(err.message, 120)}`);
     return out;
   }
+  // A file with no version predates versioning and is read as version 0, which holds the same entries.
+  const version = raw && typeof raw === 'object' && raw.version !== undefined ? raw.version : 0;
+  if (!Number.isInteger(version) || version < 0) { out.problems.push(`${path} has version ${printable(JSON.stringify(version), 40)}, which is not a whole number from 0`); return out; }
+  if (version > BASELINE_VERSION) {
+    out.problems.push(`${path} is baseline version ${version}, and this cobolwork reads up to version ${BASELINE_VERSION}; upgrade cobolwork, so nothing was suppressed`);
+    return out;
+  }
+  out.version = BASELINE_VERSION;
   const entries = Array.isArray(raw?.entries) ? raw.entries : null;
   if (!entries) { out.problems.push(`${path} has no entries array`); return out; }
   entries.forEach((e, i) => {

package/lib/bms.mjs

@@ -55,6 +55,13 @@ const sublist = (v) => {
   return (inner ? splitOperands(inner[1]) : [v]).map((x) => x.trim()).filter(Boolean);
 };
 
+// L'NAME is NAME's length, and T', S', I', K', N', D' and O' its other attributes: the quote after the
+// letter opens no string when the letter starts a term and a symbol follows. CL8'TEXT' and D'1.5'
+// are constants, and their quotes do open one.
+// https://www.ibm.com/docs/en/hla-and-tf/1.6.0?topic=instructions-data-attributes
+const attributeReference = (text, i) => /[LTSIKNDO]/i.test(text[i - 1] || '')
+  && !/[A-Z0-9$#@_]/i.test(text[i - 2] || '') && /[A-Z$#@_&]/i.test(text[i + 1] || '');
+
 // Folds physical lines into statements. A map continues a statement in two ways, often both in one
 // file. An operand that fills the line to column 71 carries on in column 16 of the next line, which
 // is how a long INITIAL literal is split. A comma followed by a blank ends the line's operands and
@@ -78,6 +85,7 @@ export function foldStatements(src) {
     for (let i = from; i < text.length; i++) {
       const c = text[i];
       if (o.quoted) { o.st.field += c; if (c === "'") o.quoted = false; continue; }
+      if (c === "'" && attributeReference(text, i)) { o.st.field += c; continue; }
       if (c === "'") { o.quoted = true; o.st.field += c; continue; }
       if (c === ' ' || c === '\t') {
         o.reading = o.st.field.endsWith(',');

package/lib/build.mjs

@@ -7,12 +7,13 @@ import { optionChanges } from './option-diff.mjs';
 import { createHash } from 'node:crypto';
 import { spawnSync } from 'node:child_process';
 import { existsSync, readFileSync, statSync } from 'node:fs';
-import { basename, extname, join } from 'node:path';
+import { basename, extname, join, resolve } from 'node:path';
+import { parseAllowedSigners } from './evidence/sshsig.mjs';
 import { scanAll } from './scan.mjs';
 import { withRefs, configurationChanges, WORKING_TREE } from './diff.mjs';
 import { pairLists, findExecutable } from './gate.mjs';
 import { pairingKeys } from './kernel/identity.mjs';
-import { directoryTree } from './kernel/source-tree.mjs';
+import { directoryTree, resolvesInside } from './kernel/source-tree.mjs';
 import { printable } from './kernel/printable.mjs';
 import { ALL_RULES } from './kernel/registry.mjs';
 import { loadBaseline, applyBaseline, SUPPRESSING } from './baseline.mjs';
@@ -21,7 +22,8 @@ import { isProgram, isJcl, isSource, readSource, relPath } from './sources.mjs';
 import { parseJclFile } from './jcl.mjs';
 import { POLICY_FILE, treePolicy, floorPolicy, combinePolicies, canonical, policyHash } from './policy.mjs';
 import { classesOf, tierOf, TIERS, TIER_RANK } from './consequence.mjs';
-import { optionCards, enterpriseChecks, compilerChecks, scriptedChecks, compilerInvocations, compilerTasks, compileStepOptions, compilerOf } from './options.mjs';
+import { optionCards, enterpriseChecks, compilerChecks, scriptedChecks, compilerInvocations, compilerTasks, compileStepOptions, compilerOf, olderThan } from './options.mjs';
+import { isBuildFile, pinsIn } from './sets/build.mjs';
 import { FLOW_MODEL, TOOL_VERSION } from './version.mjs';
 import { checkWithIronwork, ironworkVerdict, ironworkReasons, ironworkVersion, listed } from './ironwork.mjs';
 import { buildFileIndex } from './parser.mjs';
@@ -62,8 +64,11 @@ function introducedIn(before, after, baseRoot, headRoot) {
 // Why a finding blocks, or null. `renewed` is a finding whose waiver expired or ran past maxDays: in
 // ratchet mode it is judged as new, because the promise that carried it has lapsed.
 export function blockingReason(f, { policy, ratchet, introduced, renewed }) {
+  if (f.abend?.inputFrom === 'interface' && policy.interface !== 'tier') return null;
   const setting = policy.rules[f.rule];
   if (setting === 'warn') return null;
+  // A rule whose firing rate the corpus has not recorded blocks only where the policy names it.
+  if (ALL_RULES[f.rule]?.measured === false) return setting === 'block' ? 'rule' : null;
   const tier = tierOf(f);
   if (ratchet && TIER_RANK[tier] >= TIER_RANK[policy.always]) return 'tier';
   if (ratchet && !introduced.has(f) && !renewed.has(f.fingerprint)) return null;
@@ -115,6 +120,19 @@ function declaredCompiles(root, files) {
 
 const memberName = (file) => basename(file).replace(/\.[^.]*$/, '').toUpperCase();
 
+// The GnuCOBOL version the repository's build files pin, the oldest where they pin several.
+function pinnedGnucobol(root, files) {
+  let oldest = null;
+  for (const file of files.filter(isBuildFile)) {
+    let text;
+    try { text = readSource(file).text; } catch { continue; }
+    for (const p of pinsIn(text)) {
+      if (p.product === 'gnucobol' && (!oldest || olderThan(p.version, oldest.version))) oldest = { version: p.version, where: relPath(root, file) };
+    }
+  }
+  return oldest;
+}
+
 // The options every program in the tree is compiled with, held to the policy. A program's options
 // come from the estate's declared defaults, the JCL step that compiles it and its own option cards;
 // where it has none of those, from the cobc and gcobol commands the repository's build scripts run.
@@ -127,13 +145,14 @@ function optionsCheck({ root, allow, site, policy, compiler }) {
   if (compiler && !kind) {
     return { ok: null, forbidden: 0, reasons: [`the gate reads the options of cobc, of gcobol and of Enterprise COBOL option cards; for ${printable(compiler[0], 60)} it cannot tell what reaches the compiler`], add: [], generated: new Map() };
   }
+  const tree = directoryTree(root);
+  const files = [...new Set(tree.list())].filter((p) => !allow || allow.has(p)).sort();
+  const pinned = pinnedGnucobol(root, files);
   if (compiler) {
-    const r = compilerChecks(kind, compiler.slice(1), { required, forbid: policy.forbid[kind] });
+    const r = compilerChecks(kind, compiler.slice(1), { required, forbid: policy.forbid[kind], pinned });
     const missing = r.checks.filter((c) => c.ok === false).map((c) => c.why);
     return { ok: missing.length || r.forbidden.length ? false : true, forbidden: r.forbidden.length, reasons: [...r.forbidden, ...missing], add: r.forbidden.length ? [] : r.add, compiler: kind, generated: new Map() };
   }
-  const tree = directoryTree(root);
-  const files = [...new Set(tree.list())].filter((p) => !allow || allow.has(p)).sort();
   const programs = files.filter(isProgram);
   const declared = declaredCompiles(root, files);
   let ok = true;
@@ -150,7 +169,7 @@ function optionsCheck({ root, allow, site, policy, compiler }) {
   };
 
   for (const inv of declared.invocations) {
-    const r = scriptedChecks(inv.compiler, inv.args, { required, forbid: policy.forbid[inv.compiler] });
+    const r = scriptedChecks(inv.compiler, inv.args, { required, forbid: policy.forbid[inv.compiler], pinned });
     record(inv.file, r.checks);
     forbidden += r.forbidden.length;
     for (const why of [...r.checks.filter((c) => c.ok === false).map((c) => c.why), ...r.forbidden]) fail(`${inv.file}:${inv.line}: ${why}`);
@@ -364,9 +383,15 @@ function policyChanged(baseDir, headDir) {
 
 // Runs the gate over `repo`. `compiler` is the argument vector after `--`, or null. Returns
 // { doc, report, provenance, exit }; throws with code EBUILD when it could not run.
-export function build(repo, { base = null, head = null, policy = null, noBaseline = false, compiler = null, ironwork = null, advisoryFeeds = null, copylibs = [], equivalence = [], allowed = null, now = new Date().toISOString(), env = process.env } = {}) {
+export function build(repo, { base = null, head = null, policy = null, noBaseline = false, compiler = null, ironwork = null, advisoryFeeds = null, copylibs = [], equivalence = [], allowed: given = null, allowedSigners = null, now = new Date().toISOString(), env = process.env } = {}) {
   const floor = policy ? floorPolicy(policy, repo) : null;
   if (floor && floor.problems.length) throw refusal(floor.problems.join('; '));
+  let allowed = given;
+  if (allowedSigners) {
+    const path = resolve(allowedSigners);
+    if (resolvesInside(repo, path)) throw refusal(`--allowed-signers ${path} is inside the repository; signers the change can edit vouch for nothing`);
+    allowed = parseAllowedSigners(readFileSync(path, 'utf8'));
+  }
   if (compiler && ironwork) throw refusal('one compiler per build: -- names one and --ironwork another');
   let compilerPath = null;
   if (compiler) {

package/lib/capabilities.mjs

@@ -12,13 +12,14 @@ import { VERDICT_EXIT } from './gate.mjs';
 import { CHECKS, COMPILERS, DEFAULT_POLICY } from './policy.mjs';
 import { CLASSES, TIERS } from './consequence.mjs';
 import { toolRevision } from './revision.mjs';
+import { IRONWORK_FORMATS, IRONWORK_MINIMUM, NOT_RUN_ABENDS, RUN_ENDINGS } from './ironwork-ids.mjs';
 
 export const CAPABILITIES_SCHEMA_VERSION = 1;
 
 // Each command, what it takes and what it writes.
 export const COMMANDS = {
-  scan: { args: ['<path>'], options: ['--format', '--out', '--repos', '--only', '--quiet', '--full-trace', '--baseline', '--no-baseline', '--advisories', '--copylib', '--pds-export', '--evidence'], documents: ['cobolwork', 'sarif'] },
-  flow: { args: ['<path>'], options: ['--out', '--repos', '--quiet', '--full-trace', '--baseline', '--no-baseline', '--copylib', '--evidence'], documents: ['cobolwork-flow'] },
+  scan: { args: ['<path>'], options: ['--format', '--out', '--repos', '--only', '--quiet', '--full-trace', '--all-routes', '--baseline', '--no-baseline', '--advisories', '--copylib', '--pds-export', '--evidence'], documents: ['cobolwork', 'sarif'] },
+  flow: { args: ['<path>'], options: ['--out', '--repos', '--quiet', '--full-trace', '--all-routes', '--baseline', '--no-baseline', '--copylib', '--evidence'], documents: ['cobolwork-flow'] },
   inventory: { args: ['<path>'], options: ['--out', '--quiet', '--copylib', '--evidence'], documents: ['cobolwork-inventory'] },
   parse: { args: ['<file>'], options: ['--out'], documents: ['cobolwork-parse'] },
   sbom: { args: ['<path>'], options: ['--name', '--out', '--quiet', '--copylib', '--evidence'], documents: ['cyclonedx'] },
@@ -28,7 +29,7 @@ export const COMMANDS = {
   explain: { args: ['<path>', '<fingerprint>'], options: ['--report', '--out', '--baseline', '--no-baseline', '--advisories', '--copylib'], documents: ['cobolwork-explain'] },
   gate: { args: ['<repo>'], options: ['--base', '--head', '--target', '--cobc', '--exit-code', '--target-only', '--out', '--evidence'], documents: ['cobolwork-gate'] },
   build: { args: ['<repo>', '[-- <compiler> <arg>...]'], options: ['--base', '--head', '--policy', '--provenance', '--provenance-format', '--artifact', '--equivalence', '--allowed-signers', '--ironwork', '--advisories', '--copylib', '--no-baseline', '--format', '--out', '--evidence'], documents: ['cobolwork-build', 'cobolwork-build-provenance', 'sarif'] },
-  evidence: { args: ['verify|seal|anchor|sign', '[statement]'], options: ['--evidence', '--ssh-key', '--signer', '--expect-key', '--allowed-signers', '--anchor-git', '--ref', '--push', '--max-unsealed', '--tsq', '--out', '--quiet'], documents: ['cobolwork-evidence'] },
+  evidence: { args: ['verify|seal|anchor|sign', '[statement]'], options: ['--evidence', '--ssh-key', '--signer', '--expect-key', '--allowed-signers', '--anchor-git', '--ref', '--anchor-pin', '--push', '--max-unsealed', '--tsq', '--tsr', '--tsa-ca', '--cosign-bundle', '--cosign-key', '--certificate-identity', '--certificate-oidc-issuer', '--trusted-root', '--insecure-ignore-tlog', '--out', '--quiet'], documents: ['cobolwork-evidence'] },
   capabilities: { args: [], options: ['--json'], documents: ['cobolwork-capabilities'] },
 };
 
@@ -81,5 +82,7 @@ export function capabilities() {
       exit: { ...BUILD_EXIT, couldNotRun: 2 },
     },
     gate: { exit: { ...VERDICT_EXIT, couldNotRun: 2 } },
+    // The ironwork releases cobolwork reads: from `minimum` on, each format from the release it names.
+    ironwork: { minimum: IRONWORK_MINIMUM, formats: IRONWORK_FORMATS, runEndings: RUN_ENDINGS, notRunAbends: NOT_RUN_ABENDS },
   };
 }

package/lib/consequence.mjs

@@ -69,6 +69,7 @@ const RULE_CLASSES = {
   'vendor-privileged-command': [ESCALATES],
   'jcl-instream-security-command': [ESCALATES],
   'jcl-instream-credential': [ESCALATES],
+  'credential-in-source': [ESCALATES],
   'web-uri-carries-a-credential': [ESCALATES],
   'log-writes-a-credential': [ESCALATES],
   'zowe-config-secret-in-clear': [ESCALATES],
@@ -122,8 +123,24 @@ const RULE_CLASSES = {
   // have landed, where the input chose.
   'input-causes-abend-s0c7': [],
   'input-causes-abend': [],
+  'input-causes-hang': [],
+  'input-selects-program': [ESCALATES],
   'input-causes-abend-s0c4': [MUTATES],
   'input-causes-abend-subscript-range': [MUTATES],
+  // Key zero or supervisor state is the operating system's authority, taken by the code itself.
+  'hlasm-supervisor-state-change': [ESCALATES],
+  // Nothing says input reaches EX's register, or which address space a cross-memory call reaches:
+  // the linkage tables grant that, and the source does not show them. Severity decides.
+  'hlasm-executes-built-instruction': [],
+  'hlasm-cross-memory-service': [],
+  'hlasm-runtime-module-name': [ESCALATES],
+  // Disclosure in transit; severity decides.
+  'web-client-opens-cleartext': [],
+  'web-receive-length-exceeds-area': [MUTATES],
+  // Weak cryptography discloses or lets data be changed undetected; severity decides.
+  'icsf-single-length-des-key': [],
+  'icsf-weak-hash': [],
+  'icsf-fixed-initialization-vector': [],
 };
 
 // Coverage and context assert no defect, so they carry no consequence.

package/lib/constants.mjs

@@ -0,0 +1,60 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// The literals that can be in a data item when a statement reads it, from the program's text: its
+// VALUE clause and its subordinates', each MOVE and STRING into it or into a group holding it, and a
+// hop or two back through an item those name. Anything else that can write it - a computation, a
+// READ or ACCEPT INTO, a CALL it is passed to by reference, a MOVE from a field with no constant -
+// leaves it open, which a caller reads as "and something this cannot see".
+const FIGURATIVE = /^(LOW-VALUES?|HIGH-VALUES?|SPACES?|ZEROS?|ZEROES|QUOTES?|NULLS?)$/;
+const WRITERS = new Set(['COMPUTE', 'ADD', 'SUBTRACT', 'MULTIPLY', 'DIVIDE', 'READ', 'ACCEPT', 'UNSTRING', 'INITIALIZE', 'SET', 'RETURN', 'INSPECT']);
+const NOT_OPERANDS = new Set(['TO', 'INTO', 'DELIMITED', 'BY', 'SIZE', 'OF', 'IN', 'ALL']);
+
+// The item, its subordinates and the groups that hold it.
+function family(p, name) {
+  const self = p.items.find((x) => x.name === name);
+  if (!self) return null;
+  const under = [];
+  const down = (it) => { for (const c of it.children || []) { if (c.level === 88) continue; under.push(c); down(c); } };
+  down(self);
+  const over = [];
+  for (let up = self.parent; up; up = up.parent) over.push(up);
+  return { self, under, over };
+}
+
+const nameOf = (t) => (typeof t === 'string' ? t : t && t.u);
+
+const valuesOf = (item) => (item.values || []).map((v) => (v.t === 'lit' ? String(v.v) : FIGURATIVE.test(v.u || '') ? v.u : null)).filter((v) => v !== null);
+
+// `ignoreCall(call)` names calls that read the item and do not write it, such as the one being judged.
+export function constantsReaching(p, name, { depth = 2, ignoreCall = () => false } = {}, seen = new Set()) {
+  const out = { values: [], open: false };
+  if (seen.has(name)) return out;
+  seen.add(name);
+  const f = family(p, name);
+  if (!f) return { values: [], open: true };
+  const names = new Set([name, ...f.under.map((x) => x.name), ...f.over.map((x) => x.name)]);
+  out.values.push(...valuesOf(f.self), ...f.under.flatMap(valuesOf));
+  for (const st of p.statements || []) {
+    if (!(st.targets || []).some((t) => names.has(nameOf(t)))) continue;
+    if (st.verb === 'MOVE' || st.verb === 'STRING') {
+      for (const t of st.sources || []) if (t && t.t === 'lit') out.values.push(String(t.v));
+      for (const l of st.literals || []) out.values.push(String(l && l.v !== undefined ? l.v : l));
+      for (const w of (st.sources || []).filter((t) => !(t && t.t === 'lit')).map(nameOf).filter((x) => x && !NOT_OPERANDS.has(x))) {
+        if (FIGURATIVE.test(w) || /^[+-]?\d/.test(w) || names.has(w)) { if (FIGURATIVE.test(w)) out.values.push(w); continue; }
+        if (depth === 0) { out.open = true; continue; }
+        const r = constantsReaching(p, w, { depth: depth - 1, ignoreCall }, seen);
+        out.values.push(...r.values);
+        if (r.open || !r.values.length) out.open = true;
+      }
+      continue;
+    }
+    if (WRITERS.has(st.verb)) out.open = true;
+  }
+  for (const c of p.calls || []) {
+    if (ignoreCall(c)) continue;
+    if ((c.using || []).some((u) => names.has(u.word) && u.mode !== 'CONTENT' && u.mode !== 'VALUE')) out.open = true;
+  }
+  return out;
+}
+
+// A rule array is eight-byte keywords side by side; one held in several fields reads the same.
+export const keywordsOf = (values) => new Set(values.flatMap((v) => (FIGURATIVE.test(v) ? [] : String(v).match(/.{1,8}/g) || []).map((k) => k.trim().toUpperCase()).filter(Boolean)));

package/lib/control-reuse.mjs

@@ -0,0 +1,113 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// A program's control analysis, kept so that a byte-identical copy of it elsewhere in the repository
+// is not analysed again.
+//
+// The analysis refers to objects of the program's parse: statements, items, tokens. Kept, each such
+// reference is the object's position in a walk of the parse that visits it in one fixed order, so the
+// copy's parse, walked the same way, supplies the copy's own objects. A string equal to one of the
+// program's file paths is kept as that file's place in the program's list of files, and becomes the
+// copy's path. Anything else the analysis holds is copied as it is. A path inside a longer string, or
+// a value that is not plain data, makes the analysis not kept at all: the copy is analysed afresh.
+
+const FAIL = Symbol('not kept');
+
+// The objects reachable from root, breadth first: array elements, Map keys and values, Set values and
+// own enumerable properties, in their order. Typed arrays are not entered.
+export function parseOrder(root) {
+  const order = [root];
+  const seen = new Set(order);
+  for (let i = 0; i < order.length; i++) {
+    const o = order[i];
+    const visit = (v) => { if (v !== null && typeof v === 'object' && !seen.has(v)) { seen.add(v); order.push(v); } };
+    if (ArrayBuffer.isView(o)) continue;
+    if (Array.isArray(o)) for (const v of o) visit(v);
+    else if (o instanceof Map) for (const [k, v] of o) { visit(k); visit(v); }
+    else if (o instanceof Set) for (const v of o) visit(v);
+    else for (const k of Object.keys(o)) visit(o[k]);
+  }
+  return order;
+}
+
+const plain = (o) => {
+  const proto = Object.getPrototypeOf(o);
+  return (proto === Object.prototype || proto === null)
+    && Object.getOwnPropertySymbols(o).length === 0
+    && Object.getOwnPropertyNames(o).length === Object.keys(o).length;
+};
+
+// `files` lists the program's file and its resolved copybooks, in the parse's order.
+export function keep(value, order, files) {
+  const at = new Map(order.map((o, i) => [o, i]));
+  const fileAt = new Map(files.map((f, i) => [f, i]));
+  const table = [];
+  const index = new Map();
+  const enc = (v) => {
+    if (typeof v === 'string') {
+      if (fileAt.has(v)) return { f: fileAt.get(v) };
+      for (const f of files) if (f && v.includes(f)) throw FAIL;
+      return v;
+    }
+    if (v === null || typeof v !== 'object') {
+      if (typeof v === 'function' || typeof v === 'symbol') throw FAIL;
+      return v;
+    }
+    if (at.has(v)) return { p: at.get(v) };
+    if (index.has(v)) return { r: index.get(v) };
+    const i = table.length;
+    index.set(v, i);
+    const entry = {};
+    table.push(entry);
+    if (ArrayBuffer.isView(v)) { entry.t = v; return { r: i }; }
+    if (Array.isArray(v)) {
+      if (Object.keys(v).length !== v.length || !plainArray(v)) throw FAIL;
+      entry.a = v.map(enc);
+    } else if (v instanceof Map) entry.m = [...v].map(([k, x]) => [enc(k), enc(x)]);
+    else if (v instanceof Set) entry.s = [...v].map(enc);
+    else {
+      if (!plain(v)) throw FAIL;
+      entry.o = Object.keys(v).map((k) => [k, enc(v[k])]);
+      if (Object.getPrototypeOf(v) === null) entry.n = true;
+    }
+    return { r: i };
+  };
+  try { return { root: enc(value), table }; } catch (e) { if (e === FAIL) return null; throw e; }
+}
+
+const plainArray = (a) => Object.getPrototypeOf(a) === Array.prototype && Object.getOwnPropertySymbols(a).length === 0;
+
+export function restore(kept, order, files) {
+  const made = kept.table.map((e) => (e.t ? e.t : e.a ? [] : e.m ? new Map() : e.s ? new Set() : e.n ? Object.create(null) : {}));
+  const dec = (x) => {
+    if (x === null || typeof x !== 'object') return x;
+    if ('p' in x) return order[x.p];
+    if ('f' in x) return files[x.f];
+    return made[x.r];
+  };
+  kept.table.forEach((e, i) => {
+    const o = made[i];
+    if (e.a) for (const x of e.a) o.push(dec(x));
+    else if (e.m) for (const [k, x] of e.m) o.set(dec(k), dec(x));
+    else if (e.s) for (const x of e.s) o.add(dec(x));
+    else if (e.o) for (const [k, x] of e.o) o[k] = dec(x);
+  });
+  return dec(kept.root);
+}
+
+// Whether two analyses are the same, objects of the parse compared as themselves.
+export function sameAnalysis(a, b, parse) {
+  const pairs = new Map();
+  const eq = (x, y) => {
+    if (x === y) return true;
+    if (x === null || y === null || typeof x !== 'object' || typeof y !== 'object') return Object.is(x, y);
+    if (parse.has(x) || parse.has(y)) return false;
+    if (pairs.has(x)) return pairs.get(x) === y;
+    pairs.set(x, y);
+    if (Object.getPrototypeOf(x) !== Object.getPrototypeOf(y)) return false;
+    if (ArrayBuffer.isView(x)) return x.length === y.length && x.every((v, i) => v === y[i]);
+    if (x instanceof Map) { if (x.size !== y.size) return false; const ys = [...y]; return [...x].every(([k, v], i) => eq(k, ys[i][0]) && eq(v, ys[i][1])); }
+    if (x instanceof Set) { if (x.size !== y.size) return false; const ys = [...y]; return [...x].every((v, i) => eq(v, ys[i])); }
+    const kx = Object.keys(x), ky = Object.keys(y);
+    return kx.length === ky.length && kx.every((k, i) => k === ky[i] && eq(x[k], y[k]));
+  };
+  return eq(a, b);
+}