gitgalaxy 2.0.7__tar.gz → 2.0.8__tar.gz

gitgalaxy-2.0.8/.github/workflows/deploy-docs.yml

@@ -0,0 +1,37 @@
+name: Deploy Museum of Code Docs
+
+on:
+  push:
+    branches:
+      - main # Triggers the action when you push to the main branch
+  workflow_dispatch: # Allows you to manually trigger the build from the GitHub UI
+
+# Grants the action permission to push the built site to the gh-pages branch
+permissions:
+  contents: write
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0 # Required for git info/history (like last updated timestamps)
+
+      - name: Configure Git Credentials
+        run: |
+          git config user.name github-actions[bot]
+          git config user.email 41898282+github-actions[bot]@users.noreply.github.com
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: 3.x
+
+      - name: Install Dependencies
+        # Installs Material theme and the PyMdown extensions required by your mkdocs.yml
+        run: pip install mkdocs-material pymdown-extensions
+
+      - name: Build and Deploy Docs
+        run: mkdocs gh-deploy --force

{gitgalaxy-2.0.7 → gitgalaxy-2.0.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitgalaxy
-Version: 2.0.7
+Version: 2.0.8
 Summary: An AST-free, LLM-free zero-trust static analysis engine for mapping architectural risk, securing CI/CD pipelines, and modernizing legacy monoliths.
 Author: Joe Esquibel
 Project-URL: Homepage, https://gitgalaxy.io

gitgalaxy-2.0.8/gitgalaxy/README.md

@@ -0,0 +1,72 @@
+# GitGalaxy: The Core Engine & GalaxyScope Orchestrator
+
+[![Architecture](https://img.shields.io/badge/Architecture-blAST_Engine-00BFFF.svg)](#)
+[![Velocity](https://img.shields.io/badge/Velocity-40k%2B_LOC%2Fsec-00C957.svg)](#)
+[![CLI](https://img.shields.io/badge/Interface-GalaxyScope_CLI-8A2BE2.svg)](#)
+
+Welcome to the internal source code for the **GitGalaxy Core Engine**. 
+
+This directory contains the central orchestrator—**GalaxyScope**—alongside the core physics, optical routing, and mathematical heuristics that power the entire system. If you are a developer looking to contribute, understand the pipeline, or run the primary CLI, here is your architectural map.
+
+### 🗺️ The Developer Map (How the Pipeline Flows)
+
+When you trigger the `galaxyscope` command, the data flows through these five physical directories:
+
+* **`/core/` (The Frontline):** The optical routing layer. Contains the [Aperture Filter](https://squid-protocol.github.io/gitgalaxy/02-03-aperture-filter/) and [The Prism](https://squid-protocol.github.io/gitgalaxy/02-07-the-prism/), which break down source code into structural signals, separating executable logic from ghost mass (comments) and inert binaries.
+* **`/physics/` (The Math):** The heuristics engine. Contains the [Signal Processor](https://squid-protocol.github.io/gitgalaxy/02-09-signal-processing/) and [Neural Auditor](https://squid-protocol.github.io/gitgalaxy/02-19-neural-auditor/), which apply GitGalaxy mathematics to score O(N) complexity, topological blast radius, and state flux without using ASTs.
+* **`/recorders/` (The Exporters):** The translation layer. Converts the internal state maps into highly relational [SQLite Databases](https://squid-protocol.github.io/gitgalaxy/02-21-record-keeper/), AI-agent JSON tickets, and the final 3D WebGPU payload.
+* **`/security/` (The Sentinel):** The zero-trust validation layer. Contains the [Security Lens](https://squid-protocol.github.io/gitgalaxy/02-06-security-lens/) responsible for intercepting embedded malware, hardcoded secrets, and logic bombs on the fly.
+* **`/tools/` (The Spokes):** The enterprise automation layer. Contains specialized controllers for CI/CD pipelines—like the [Supply Chain Firewall](https://squid-protocol.github.io/gitgalaxy/04-03-supply-chain-firewall/) and [PII Leak Hunter](https://squid-protocol.github.io/gitgalaxy/04-06-pii-leak-hunter/)—that consume the core engine's telemetry.
+
+---
+
+### ⚡ Performance Showcase: NVDA (NonVisual Desktop Access)
+
+To demonstrate the GalaxyScope orchestrator's capability on complex, cross-language system architecture, we unleashed it on **NVDA**, the open-source Windows screen reader. 
+
+Because NVDA relies heavily on bridging Python application logic with low-level C++ system hooks, it requires advanced polyglot dependency mapping. The blAST engine successfully parsed the mixed-language architecture, analyzing **236,754 lines of code** in just **5.59 seconds** (a velocity of 42,357 LOC/sec). 
+
+Crucially, during the import resolution phase, the Air-Gapped Dependency Radar successfully intercepted a structural naming collision (`fstream` vs `sstream`), proving the real-time typosquatting defenses are fully operational without relying on cloud APIs.
+
+> **Note on False Positives:** Because `fstream` and `sstream` are both standard C++ libraries, this specific flag is a false positive. To prevent the engine from halting on trusted internal libraries, contributors can whitelist them by adding them to the global `approved_imports.json` registry (see [GitGalaxy Config](https://squid-protocol.github.io/gitgalaxy/06-01-gitgalaxy-config/)).
+
+![NVDA Processing Demo](../../docs/wiki/assets/nvda_processing.gif)
+
+```text
+[INFO] PASS_1.5: Running Air-Gapped Typosquatting & Dependency Confusion Radar...
+[CRITICAL] 🚨 TYPOSQUATTING DETECTED: 'fstream' in nvdaHelper/vbufBase/storage.cpp closely matches anchor 'sstream'!
+[WARNING] Intercepted 1 typosquatting attempts via repository baseline analysis.
+...
+[INFO] --- MISSION_SUCCESS: 849 files mapped in 5.59s ---
+[INFO] --- ENGINE_TELEMETRY: Processed 236,754 lines of code at 42,357 LOC/s ---
+```
+
+---
+
+### 🛠️ Local Development & GalaxyScope Execution
+
+If you are modifying the internal physics or optical routing, it is highly recommended to install the package in editable mode so your CLI commands instantly reflect your local code changes.
+
+From the **root directory** of the repository, run:
+```bash
+pip install -e .
+```
+
+Once installed, you can trigger the main orchestrator globally from your terminal. This command runs the full [Data Pipeline](https://squid-protocol.github.io/gitgalaxy/02-01-pipeline-overview/) and outputs the final artifact.
+```bash
+galaxyscope /path/to/test/repo --debug
+```
+
+Before submitting a Pull Request, ensure your changes do not skew the core baseline risk equations by running the test suite:
+```bash
+python3 -m unittest discover tests/
+```
+
+---
+### 🌌 Deep Dive into the Pipeline Architecture
+To fully understand how GalaxyScope processes data, maps files, and applies risk exposures, explore the official documentation:
+
+* 📖 **[GalaxyScope CLI Reference](https://squid-protocol.github.io/gitgalaxy/01-02-galaxyscope-cli-reference/)** (Flags, outputs, and behaviors)
+* 📖 **[The Data Pipeline Overview](https://squid-protocol.github.io/gitgalaxy/02-01-pipeline-overview/)** (Step-by-step breakdown of the runtime)
+* 📖 **[Risk Exposures & Methodology](https://squid-protocol.github.io/gitgalaxy/08-01-methodology/)** (The math behind the heuristics)
+* 🪐 **[Return to the Main GitGalaxy Hub](https://github.com/squid-protocol/gitgalaxy)**

{gitgalaxy-2.0.7 → gitgalaxy-2.0.8}/gitgalaxy/recorders/record_keeper.py

@@ -215,6 +215,10 @@ class RecordKeeper:
             )
         ''')
 
+        # ---> NEW: INDEXES TO PREVENT CASCADE DELETE HANGS <---
+        cursor.execute("CREATE INDEX IF NOT EXISTS idx_class_file_id ON class_data(file_id);")
+        cursor.execute("CREATE INDEX IF NOT EXISTS idx_function_file_id ON function_data(file_id);")
+
         cursor.execute('''
             CREATE TABLE IF NOT EXISTS dark_matter_data (
                 id INTEGER PRIMARY KEY AUTOINCREMENT,

{gitgalaxy-2.0.7 → gitgalaxy-2.0.8}/gitgalaxy/tools/ai_guardrails/README.md

@@ -8,38 +8,38 @@ Welcome to the **GitGalaxy AI Guardrails Suite**.
 
 The adoption of Generative AI has created two massive security blind spots for modern enterprise teams. First, developers are building AI features that grant LLMs dangerous levels of system access (The AppSec Threat). Second, developers are utilizing autonomous coding agents that can silently introduce architectural degradation into complex codebases (The DevSec Threat).
 
-Legacy security scanners cannot fix this. They look for traditional SQL injection, not Prompt Injection. They rely on slow compilation cycles that fail to keep pace with AI development.
+Legacy security scanners ([like SonarQube or Checkmarx](https://squid-protocol.github.io/gitgalaxy/04-00-security_landscape/)) cannot fix this. They look for traditional SQL injection, not Prompt Injection. They rely on slow compilation cycles that fail to keep pace with AI development, leaving you completely blind to Agentic logic loops and context shredders.
 
-GitGalaxy maps the architectural reality of your code in seconds. We use AST-free mathematical heuristics to generate deep, contextual reports, allowing you to block dangerous AI behavior before it hits production.
+GitGalaxy maps the architectural reality of your code in seconds. We use AST-free mathematical heuristics to generate deep, contextual reports, allowing you to block dangerous AI behavior before it ever hits production.
 
 ---
 
 ### 🛡️ Side 1: The AI AppSec Sensor (`AIAppSecSensor`)
 *Protects your application from the AI features you build.*
 
-Standard AST scanners frequently miss "Weaponized AI Architectures." This sensor maps the physical call-path distance between an LLM API execution and your critical system functions.
+Standard AST scanners frequently miss "Weaponized AI Architectures." This sensor acts as a physical boundary, mapping the physical call-path distance between an LLM API execution and your critical system functions.
 
-* **The RCE Funnel:** Detects LLMs wired directly to OS commands or shell executions. Prevents Prompt-Injection-to-RCE attacks.
-* **The "God-Mode" Agent:** Flags autonomous tools with raw, unfiltered database access. Blocks autonomous data corruption.
-* **The Exfiltration Vector:** Identifies LLMs accessing network sockets and cryptographic secrets. Stops SSRF and key exfiltration vulnerabilities.
+* **The RCE Funnel:** Detects LLMs wired directly to OS commands or shell executions. This allows you to aggressively [block Prompt-Injection-to-RCE attacks](https://squid-protocol.github.io/gitgalaxy/cookbook/prevent-agentic-rce/) in your CI/CD pipeline.
+* **The "God-Mode" Agent:** Flags autonomous tools with raw, unfiltered database access. Blocks autonomous data corruption before it can wipe a production table.
+* **The Exfiltration Vector:** Identifies LLMs accessing network sockets and cryptographic secrets, stopping SSRF and key exfiltration vulnerabilities cold.
 
 ---
 
 ### 🤖 Side 2: The Dev Agent Firewall (`DevAgentFirewall`)
 *Protects your codebase from the autonomous AI tools you use.*
 
-Not all legacy code is safe for an AI coding assistant (like Cursor, Copilot, or Claude) to modify. This firewall evaluates the structural complexity, cognitive load, and entropy of a file to determine if an AI agent will succeed, hallucinate, or silently destroy your system logic.
+Not all legacy code is safe for an AI coding assistant (like Cursor, Copilot, or Claude) to modify. This firewall evaluates the structural complexity, cognitive load, and entropy of a file to determine if an AI agent will succeed, hallucinate, or silently destroy your system logic. By running this sensor, you can safely [sandbox autonomous agents](https://squid-protocol.github.io/gitgalaxy/cookbook/sandbox-autonomous-agents/) to only work on verified, low-complexity files.
 
 * **Context Window Shredders:** Identifies massive files with extreme algorithmic complexity. Prevents AI context collapse and logic truncation.
-* **The Hallucination Zone:** Highlights heavy metaprogramming with zero documentation. Prevents AI method hallucination and fabricated syntax.
+* **The Hallucination Zone:** Highlights heavy metaprogramming with zero documentation, preventing AI method hallucination and fabricated syntax.
 * **Silent Mutation Risk:** Flags logic with a high blast radius and zero test coverage. Blocks unverifiable AI modifications.
-* **HITL Mandate:** Detects severe technical debt. Forces a Human-In-The-Loop (HITL) code review requirement for PRs generated by AI agents.
+* **HITL Mandate:** Detects severe technical debt. Forces a strict Human-In-The-Loop (HITL) code review requirement for PRs generated by AI agents.
 
 ---
 
 ### 🚀 Quickstart: CI/CD & Pipeline Integration
 
-Currently, the AI Guardrails operate as deep-inspection middleware. Instead of running as standalone standalone commands, these sensors inject themselves into the primary `galaxyscope` analysis pipeline to evaluate project telemetry in real-time.
+Currently, the AI Guardrails operate as deep-inspection middleware. Instead of running as standalone commands, these sensors seamlessly inject themselves into the primary `galaxyscope` analysis pipeline to evaluate project telemetry in real-time.
 
 #### 1. Local CLI Execution
 Run a standard scan using the global PyPI package. The guardrails will automatically evaluate the ecosystem and report critical Agentic vulnerabilities.
@@ -75,7 +75,7 @@ jobs:
 ### 🌌 Powered by the blAST Engine (Bypassing LLMs and ASTs)
 This tool is a modular enterprise integration within the broader GitGalaxy architecture. It is driven by our custom mathematical heuristics engine, capable of mapping multi-dimensional relationships at extreme velocity without requiring rigid ASTs. Read the official documentation to see the structural methodologies powering these guardrails:
 
-* 📖 **[AI AppSec Sensor Architecture](../../../docs/wiki/02-17-ai-appsec-sensor.md)**
-* 📖 **[Dev Agent Firewall Mechanics](../../../docs/wiki/02-18-dev-agent-firewall.md)**
-* 📖 **[Logic Bomb & Injection Surface Risk Equations](../../../docs/wiki/08-20-logic-bomb-exposure.md)**
+* 📖 **[AI AppSec Sensor Architecture](https://squid-protocol.github.io/gitgalaxy/02-17-ai-appsec-sensor/)**
+* 📖 **[Dev Agent Firewall Mechanics](https://squid-protocol.github.io/gitgalaxy/02-18-dev-agent-firewall/)**
+* 📖 **[Logic Bomb & Injection Surface Risk Equations](https://squid-protocol.github.io/gitgalaxy/08-20-logic-bomb-exposure/)**
 * 🪐 **[Return to the Main GitGalaxy Hub](https://github.com/squid-protocol/gitgalaxy)**

{gitgalaxy-2.0.7 → gitgalaxy-2.0.8}/gitgalaxy/tools/cobol_to_cobol/README.md

@@ -4,16 +4,16 @@
 [![Architecture](https://img.shields.io/badge/Architecture-Deterministic_Regex-00BFFF.svg)](#)
 [![State Manager](https://img.shields.io/badge/State-Hybrid_RAM%2FSQLite-8A2BE2.svg)](#)
 
-Welcome to the **GitGalaxy Mainframe Modernization Suite**. This is a deterministic, high-speed static analysis suite designed to safely slice, sanitize, and modernize monolithic legacy systems. 
+Welcome to the **GitGalaxy Mainframe Modernization Suite**. This is a deterministic, high-speed static analysis suite designed to safely slice, sanitize, and [map monolithic legacy systems](https://squid-protocol.github.io/gitgalaxy/cookbook/map-cobol-monoliths/). 
 
 **Mainframe Proven:** The outputs of these architectural tools natively compile against raw MVS 3.8j operating systems (1974 Hercules Mainframe), while simultaneously scaffolding modern cloud environments.
 
 ### 🔄 The Modernization Pipeline
 
-You point the Migration Controller at a massive, undocumented COBOL repository. It translates a chaotic folder of `.cbl` files into a deterministic execution pipeline:
+You point the [Legacy Refraction Controller](https://squid-protocol.github.io/gitgalaxy/05-01-legacy-refraction-controller/) at a massive, undocumented COBOL repository. It translates a chaotic folder of `.cbl` files into a deterministic execution pipeline:
 
 * **The Assessment:** Dynamically scales between high-speed RAM and SQLite3.
-* **Dead Code Extraction:** Uses structural heuristics to mathematically map and extract orphaned memory and dead code bloat. *(AST-Free)*
+* **Dead Code Extraction:** Uses structural heuristics to mathematically map and [extract orphaned memory and dead code bloat](https://squid-protocol.github.io/gitgalaxy/cookbook/identifying-dead-code-in-cobol/). *(AST-Free)*
 * **Dependency Mapping:** Maps data lineage to deflect dead dependencies.
 * **Asset Generation:** Generates pristine PostgreSQL schemas, JSON APIs, and compile-ready JCLs.
 
@@ -24,28 +24,29 @@ You point the Migration Controller at a massive, undocumented COBOL repository.
 This suite is built on a modular Hub-and-Spoke architecture. Every Python script acts as an independent CLI tool or is orchestrated centrally.
 
 #### 1. Pre-Processors & Sensors
-* **Lexical Patcher (`cobol_lexical_patcher.py`):** Safely neutralizes legacy compiler traps.
-* **System Limits Reporter (`cobol_system_limits_reporter.py`):** Flags non-deterministic routing logic and system constraint breaches.
+* **[Lexical Patcher](https://squid-protocol.github.io/gitgalaxy/05-13-lexical-patcher/) (`cobol_lexical_patcher.py`):** Safely neutralizes legacy compiler traps.
+* **[System Limits Reporter](https://squid-protocol.github.io/gitgalaxy/05-17-system-limits-reporter/) (`cobol_system_limits_reporter.py`):** Flags non-deterministic routing logic and system constraint breaches.
   <br>![System Limits Reporter](../../../docs/wiki/assets/system_limits_reporter.gif)
 
 #### 2. Extractors & Slicers
-* **Graveyard Finder (`cobol_graveyard_finder.py`):** Expands copybooks to calculate dead code bloat.
+* **[Graveyard Reaper](https://squid-protocol.github.io/gitgalaxy/05-10-graveyard-reaper/) (`cobol_graveyard_finder.py`):** Expands copybooks to calculate dead code bloat.
   <br>![Graveyard Reaper](../../../docs/wiki/assets/graveyard_reaper.gif)
-* **DAG Architect (`cobol_dag_architect.py`):** Maps data lineage to mathematically calculate zero-trust execution topology.
+* **[DAG Architect](https://squid-protocol.github.io/gitgalaxy/05-08-dag-architect/) (`cobol_dag_architect.py`):** Maps data lineage to [mathematically calculate zero-trust execution topology](https://squid-protocol.github.io/gitgalaxy/cookbook/creating-dag-from-cobol-files/).
   <br>![DAG Architect](../../../docs/wiki/assets/dag_architect.gif)
-* **Microservice Slicer (`cobol_microservice_slicer.py`):** Executes 3-pass recursive variable taint-tracking.
+* **[Microservice Slicer](https://squid-protocol.github.io/gitgalaxy/05-14-microservice-slicer/) (`cobol_microservice_slicer.py`):** Executes 3-pass recursive variable taint-tracking for safe [business logic extraction](https://squid-protocol.github.io/gitgalaxy/cookbook/cobol-microservice-slicing/).
   <br>![Microservice Slicer](../../../docs/wiki/assets/microservice_slicer.gif)
-* **ETL Unpacker (`cobol_etl_unpacker.py`):** Translates binary EBCDIC and Packed Decimal to CSVs.
+* **[ETL Unpacker](https://squid-protocol.github.io/gitgalaxy/05-09-etl-unpacker/) (`cobol_etl_unpacker.py`):** Translates binary EBCDIC and Packed Decimal to CSVs to [unpack hidden ETL flows](https://squid-protocol.github.io/gitgalaxy/cookbook/unpacking-etl-from-cbl-files/).
 
 #### 3. Cloud & Mainframe Forges
-* **Compiler Forge (`cobol_compiler_forge.py`):** Flattens copybooks and generates era-aware build JCLs.
+* **[Compiler Forge](https://squid-protocol.github.io/gitgalaxy/05-07-mainframe-compiler-forge/) (`cobol_compiler_forge.py`):** Flattens copybooks and generates era-aware build JCLs.
   <br>![Compiler Forge](../../../docs/wiki/assets/compiler_forge.gif)
-* **Cloud Schema Forge (`cobol_schema_forge.py`):** Translates `PIC` clauses to strict PostgreSQL DDLs.
+* **[Cloud Schema Forge](https://squid-protocol.github.io/gitgalaxy/05-15-cloud-schema-forge/) (`cobol_schema_forge.py`):** Translates `PIC` clauses to [strict PostgreSQL DDL schemas](https://squid-protocol.github.io/gitgalaxy/cookbook/creating-schema-from-cobol-files/).
   <br>![Cloud Schema Forge](../../../docs/wiki/assets/cloud_schema_forge.gif)
-* **Zero-Trust JCL Forge (`cobol_jcl_forge.py`):** Extracts `SELECT` mappings to auto-generate strict, least-privilege JCL emulators.
-
+* **[Zero-Trust JCL Forge](https://squid-protocol.github.io/gitgalaxy/05-12-zero-trust-jcl-forge/) (`cobol_jcl_forge.py`):** Extracts `SELECT` mappings to [auto-generate strict, least-privilege JCL emulators](https://squid-protocol.github.io/gitgalaxy/cookbook/creating-jcl-from-cobol-files/).
+  <br>![Zero-Trust JCL Forge](../../../docs/wiki/assets/jcl_forge_demo.gif)
+  
 #### 4. The AI Remediation Boundary
-* **Anomaly Task Forge (`cobol_agent_task_forge.py`):** Isolates structural anomalies into bounded JSON job tickets for LLM remediation.
+* **[Anomaly Task Forge](https://squid-protocol.github.io/gitgalaxy/05-16-anomaly-agent-task-forge/) (`cobol_agent_task_forge.py`):** Isolates structural anomalies into bounded JSON job tickets for LLM remediation.
 
 ---
 
@@ -165,7 +166,7 @@ The controller generates a timestamped `_gitgalaxy_clean` directory containing:
 ### 🌌 Powered by the blAST Engine (Bypassing LLMs and ASTs)
 This tool is a modular enterprise integration within the broader GitGalaxy architecture. It is driven by our custom mathematical heuristics engine, capable of mapping multi-dimensional relationships at extreme velocity without requiring rigid ASTs. Read the official documentation to explore the architecture of the modernization controllers:
 
-* 📖 **[The Legacy Modernization Controller](../../../docs/wiki/05-01-legacy-refraction-controller.md)**
-* 📖 **[Dead Code Extraction Mathematics](../../../docs/wiki/05-10-graveyard-reaper.md)**
-* 📖 **[Zero-Trust JCL Forge Mechanics](../../../docs/wiki/05-12-zero-trust-jcl-forge.md)**
+* 📖 **[The Legacy Refraction Controller](https://squid-protocol.github.io/gitgalaxy/05-01-legacy-refraction-controller/)**
+* 📖 **[Dead Code Extraction Mathematics](https://squid-protocol.github.io/gitgalaxy/05-10-graveyard-reaper/)**
+* 📖 **[Zero-Trust JCL Forge Mechanics](https://squid-protocol.github.io/gitgalaxy/05-12-zero-trust-jcl-forge/)**
 * 🪐 **[Return to the Main GitGalaxy Hub](https://github.com/squid-protocol/gitgalaxy)**

{gitgalaxy-2.0.7 → gitgalaxy-2.0.8}/gitgalaxy/tools/cobol_to_cobol/cobol_jcl_auditor.py

@@ -1,10 +1,13 @@
 #!/usr/bin/env python3
 # ==============================================================================
-# GitGalaxy Spoke: Zero-Trust Meta Auditor (v4 - API Module)
+# GitGalaxy Spoke: Zero-Trust Meta Auditor (v5 - CLI Enabled)
 # Purpose: Compares forged JCLs against original IBM legacy JCLs to calculate
 #          exact code bloat reduction and over-permissioned I/O shedding.
 # ==============================================================================
+import argparse
+import json
 import re
+import sys
 from pathlib import Path
 
 SYSTEM_DDS = {"STEPLIB", "SYSOUT", "SYSPRINT", "SYSUDUMP", "SYSIN", "CEEDUMP", "DFHCSD", "IGZDDOP"}
@@ -39,7 +42,7 @@ def parse_jcl_intent(filepath: Path) -> dict:
     return metrics
 
 def audit_zero_trust_jcls(forged_dir: Path, original_dir: Path) -> dict:
-    """API endpoint for the Refractor Controller to fetch bloat metrics."""
+    """Core logic to fetch bloat metrics."""
     legacy_jcls = list(original_dir.rglob("*.[jJ][cC][lL]")) + list(original_dir.rglob("*.txt"))
     legacy_map = {}
     
@@ -48,7 +51,7 @@ def audit_zero_trust_jcls(forged_dir: Path, original_dir: Path) -> dict:
         if forged_dir in lj.parents: continue
         metrics = parse_jcl_intent(lj)
         for pgm in metrics["exec_pgms"]:
-            # If multiple legacy JCLs call the same program, keep the biggest one (worst offender)
+            # If multiple legacy JCLs call the same program, keep the biggest one
             if pgm not in legacy_map or metrics.get("lines_of_code", 0) > legacy_map[pgm].get("lines_of_code", 0):
                 legacy_map[pgm] = {"file": lj, "metrics": metrics}
 
@@ -90,4 +93,57 @@ def audit_zero_trust_jcls(forged_dir: Path, original_dir: Path) -> dict:
     else:
         report["bloat_reduction_pct"] = 0.0
 
-    return report
+    return report
+
+def main():
+    parser = argparse.ArgumentParser(description="GitGalaxy Zero-Trust Meta Auditor (v5)")
+    parser.add_argument("forged", help="Directory containing the forged GitGalaxy JCLs")
+    parser.add_argument("legacy", help="Directory containing the original legacy IBM JCLs")
+    parser.add_argument("--json", action="store_true", help="Output raw JSON instead of a formatted terminal report")
+    
+    args = parser.parse_args()
+    forged_path = Path(args.forged).resolve()
+    legacy_path = Path(args.legacy).resolve()
+
+    if not forged_path.exists() or not legacy_path.exists():
+        print("\n[!] ERROR: One or both directories do not exist.")
+        sys.exit(1)
+
+    # Run the audit
+    report = audit_zero_trust_jcls(forged_path, legacy_path)
+
+    # Output routing
+    if args.json:
+        print(json.dumps(report, indent=2))
+        sys.exit(0)
+
+    # CLI Terminal Vibe
+    print("\n==============================================================")
+    print(" 🛡️  GitGalaxy Spoke: Zero-Trust Meta Auditor (v5)")
+    print("==============================================================")
+    print(f" [*] Forged Dir  : {forged_path.name}")
+    print(f" [*] Legacy Root : {legacy_path.name}")
+    print("--------------------------------------------------------------")
+    
+    if report["audited"] == 0:
+        print(" [!] No matching execution intents found between the directories.")
+        print("     Ensure your forged JCLs share PROGRAM-IDs with the legacy corpus.")
+    else:
+        print(" PROGRAM BREAKDOWN:")
+        for pgm, data in report["program_breakdown"].items():
+            loc = str(data['loc_saved']).rjust(4)
+            io = str(data['io_blocked']).rjust(2)
+            print(f"  [+] {pgm.ljust(10)} | LOC Saved: {loc} | I/O Blocked: {io} | Ref: {data['legacy_file']}")
+
+        print("--------------------------------------------------------------")
+        print(" 📊 FINAL AUDIT METRICS:")
+        print(f"  > Programs Audited       : {report['audited']}")
+        print(f"  > Original Legacy LOC    : {report['original_loc']}")
+        print(f"  > GitGalaxy Forged LOC   : {report['forged_loc']}")
+        print(f"  > Bloat Reduction        : {report['bloat_reduction_pct']}%")
+        print(f"  > Over-Permissioned I/O  : {report['excess_dds_blocked']} Boundaries Shed")
+
+    print("==============================================================\n")
+
+if __name__ == "__main__":
+    main()

gitgalaxy-2.0.8/gitgalaxy/tools/cobol_to_cobol/cobol_jcl_forge.py

@@ -0,0 +1,185 @@
+#!/usr/bin/env python3
+# ==============================================================================
+# GitGalaxy Spoke: Zero-Trust JCL Forge (v5 - Hygienic Defaults)
+# ==============================================================================
+import argparse
+import sys
+import re
+from pathlib import Path
+from datetime import datetime
+
+def analyze_cobol_intent(filepath: Path) -> dict:
+    intent = {
+        "program_id": "UNKNOWN", 
+        "files_requested": [], 
+        "is_cics": False, 
+        "is_db2": False,
+        "cics_calls": 0,
+        "sql_calls": 0
+    }
+    
+    try:
+        raw_content = filepath.read_text(encoding='utf-8', errors='ignore')
+        
+        # 1. THE FLATTENER: Strip punch-card formatting
+        clean_lines = []
+        for line in raw_content.splitlines():
+            if len(line) > 6 and line[6] in ('*', '/'): 
+                continue
+            clean_lines.append(line[7:] if len(line) > 7 else line)
+            
+        monolith_code = " ".join(clean_lines)
+
+        # 2. EXTRACT PROGRAM-ID (With fallback to file name)
+        prog_id_match = re.search(r'PROGRAM-ID\.\s+[\'"]?([A-Z0-9\-]+)[\'"]?', monolith_code, re.IGNORECASE)
+        if prog_id_match: 
+            intent["program_id"] = prog_id_match.group(1).strip()
+        else:
+            intent["program_id"] = filepath.stem.upper()
+
+        # 3. BATCH I/O: Extract all File Assignments
+        file_assign_pattern = re.compile(r'SELECT\s+([A-Z0-9\-]+)\s+ASSIGN\s+(?:TO\s+)?([A-Z0-9\-]+)[^.]*\.', re.IGNORECASE)
+        for match in file_assign_pattern.finditer(monolith_code):
+            internal_name = match.group(1).strip()
+            raw_dd = match.group(2).strip()
+            clean_dd = re.sub(r'^(?:UT|UR)-S-', '', raw_dd)
+            intent["files_requested"].append({"internal": internal_name, "dd_name": clean_dd})
+
+        # 4. TRANSACTIONAL I/O: Detect EXEC CICS blocks
+        cics_matches = re.findall(r'EXEC\s+CICS.*?END-EXEC\.', monolith_code, re.IGNORECASE)
+        if cics_matches:
+            intent["is_cics"] = True
+            intent["cics_calls"] = len(cics_matches)
+
+        # 5. DATABASE I/O: Detect EXEC SQL blocks
+        sql_matches = re.findall(r'EXEC\s+SQL.*?END-EXEC\.', monolith_code, re.IGNORECASE)
+        if sql_matches:
+            intent["is_db2"] = True
+            intent["sql_calls"] = len(sql_matches)
+            
+    except Exception as e: 
+        print(f"  [!] Intent Forge Error on {filepath.name}: {e}")
+        
+    return intent
+
+def generate_zero_trust_jcl(intent: dict, job_name: str, account_code: str, lineage: dict = None, corporate_header: str = "") -> str:
+    if lineage is None: lineage = {"inputs": set(), "outputs": set()}
+    prog_name = intent["program_id"]
+    jcl = []
+    
+    jcl.append(f"//{job_name} JOB ({account_code}),'GITGALAXY FORGE',")
+    jcl.append(f"//             CLASS=A,MSGCLASS=A,MSGLEVEL=(1,1),")    
+    jcl.append(f"//             USER=HERC01,PASSWORD=CUL8TR,")
+    jcl.append(f"//             TIME=10,REGION=4M")
+    jcl.append(f"//* ==========================================================")
+    jcl.append(f"//* AUTOGENERATED BY GITGALAXY ZERO-TRUST FORGE")
+    
+    arch_flags = []
+    if intent["is_cics"]: arch_flags.append("CICS")
+    if intent["is_db2"]: arch_flags.append("DB2")
+    if arch_flags:
+        jcl.append(f"//* ARCHITECTURE REQUIRES: {' + '.join(arch_flags)}")
+        
+    jcl.append(f"//* ==========================================================")
+    jcl.append(f"//STEP01   EXEC PGM={prog_name}")
+    jcl.append(f"//STEPLIB  DD DSN=HERC01.LOADLIB,DISP=SHR")
+    jcl.append(f"//SYSOUT   DD SYSOUT=*")
+    jcl.append(f"//SYSPRINT DD SYSOUT=*")
+    jcl.append(f"//SYSUDUMP DD SYSOUT=*")
+    
+    if intent["files_requested"]:
+        jcl.append(f"//* --- EXTRACTED FILE INTENT BOUNDARIES ---")
+        for file in intent["files_requested"]:
+            raw_dd = file["dd_name"]
+            dd = re.sub(r'[^A-Z0-9]', '', raw_dd.upper())
+            if len(dd) > 8: dd = dd[-8:]
+            
+            if raw_dd in lineage.get('outputs', set()): disp = "(NEW,CATLG,DELETE)"
+            elif raw_dd in lineage.get('inputs', set()): disp = "SHR"
+            else: disp = "SHR"
+            
+            jcl.append(f"//{dd.ljust(8)} DD DSN=HERC01.DATA.{dd},")
+            if "NEW" in disp:
+                jcl.append(f"//             DISP={disp},")
+                jcl.append(f"//             UNIT=SYSDA,")
+                jcl.append(f"//             SPACE=(CYL,(5,1),RLSE),")
+                jcl.append(f"//             DCB=(LRECL=80,RECFM=FB,BLKSIZE=800)")
+            else:
+                jcl.append(f"//             DISP={disp}")
+                if "SHR" in disp and raw_dd not in lineage.get('inputs', set()):
+                    jcl.append(f"//* WARNING: NO EXPLICIT OPEN INTENT FOR {dd}")
+    jcl.append("//")
+    return "\n".join(jcl)
+
+def main():
+    parser = argparse.ArgumentParser(description="GitGalaxy Zero-Trust JCL Forge (v5)")
+    parser.add_argument("target", help="Target directory or specific COBOL file")
+    parser.add_argument("--job", default="GITGJOB", help="Job name for the generated JCL")
+    parser.add_argument("--acct", default="12345", help="Account code for the generated JCL")
+    parser.add_argument("--out", type=str, help="Output directory (default: hygienic timestamped folder)")
+    args = parser.parse_args()
+
+    target_path = Path(args.target).resolve()
+    
+    if target_path.is_dir():
+        extensions = ("*.cbl", "*.CBL", "*.cob", "*.COB", "*.ccp", "*.CCP")
+        cobol_files = []
+        for ext in extensions:
+            cobol_files.extend(target_path.rglob(ext))
+    else:
+        cobol_files = [target_path]
+
+    if not cobol_files:
+        print(f"\n[!] ERROR: No COBOL source files found in: {target_path}")
+        sys.exit(1)
+
+    # --- THE HYGIENIC DEFAULT LOGIC ---
+    if args.out:
+        out_dir = Path(args.out).resolve()
+    else:
+        timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")
+        if target_path.is_dir():
+            # e.g., cics-genapp -> cics-genapp_forged_20260425_161559
+            out_dir = target_path.parent / f"{target_path.name}_forged_{timestamp}"
+        else:
+            out_dir = target_path.parent / f"forged_jcls_{timestamp}"
+
+    # Create the directory
+    out_dir.mkdir(parents=True, exist_ok=True)
+
+    print("\n==============================================================")
+    print(" 🚀 GitGalaxy Spoke: Zero-Trust JCL Forge (v5)")
+    print("==============================================================")
+    print(f" [*] Target Path : {target_path}")
+    print(f" [*] Output Dir  : {out_dir}")
+    print(f" [*] Files Found : {len(cobol_files)}")
+    print("--------------------------------------------------------------")
+
+    success_count = 0
+    for file_path in cobol_files:
+        intent = analyze_cobol_intent(file_path)
+        jcl_output = generate_zero_trust_jcl(intent, args.job[:8].upper(), args.acct)
+        
+        # Output strictly locked to the designated hygienic folder
+        out_path = out_dir / f"{intent['program_id']}.jcl"
+        out_path.write_text(jcl_output, encoding='utf-8')
+        
+        io_parts = []
+        if len(intent['files_requested']) > 0: 
+            io_parts.append(f"{len(intent['files_requested'])} Batch I/O")
+        if intent['cics_calls'] > 0: 
+            io_parts.append(f"{intent['cics_calls']} CICS")
+        if intent['sql_calls'] > 0: 
+            io_parts.append(f"{intent['sql_calls']} SQL")
+            
+        io_str = f"({', '.join(io_parts)})" if io_parts else "(No I/O)"
+        
+        print(f"  [+] Forged: {file_path.name.ljust(15)} -> {out_path.name.ljust(15)} {io_str}")
+        success_count += 1
+
+    print("--------------------------------------------------------------")
+    print(f" [✓] Done! Successfully forged {success_count} JCL(s).")
+    print("==============================================================\n")
+
+if __name__ == "__main__": 
+    main()

{gitgalaxy-2.0.7 → gitgalaxy-2.0.8}/gitgalaxy/tools/cobol_to_java/README.md

@@ -4,15 +4,15 @@
 [![Architecture](https://img.shields.io/badge/Architecture-Spring_Boot_3.2-00BFFF.svg)](#)
 [![Automation](https://img.shields.io/badge/Automation-100%25_Compilable_Shells-8A2BE2.svg)](#)
 
-Most legacy modernization efforts fail because they feed raw, monolithic COBOL directly into an LLM. This leads to hallucinations, memory leaks, and broken architectures. 
+Most legacy modernization efforts fail because they feed raw, monolithic COBOL directly into an LLM. As seen across the [DevSecOps Competitive Landscape](https://squid-protocol.github.io/gitgalaxy/04-00-security_landscape/), relying purely on AI or generic ASTs leads to hallucinations, memory leaks, and broken architectures. 
 
-GitGalaxy flips the paradigm. We use deterministic mathematical parsing to build a structurally perfect, 100% compiling Java Spring Boot architecture *first*, and only use AI for the final isolated logic. 
+GitGalaxy flips the paradigm. We use the deterministic, mathematical [blAST Engine](https://squid-protocol.github.io/gitgalaxy/01-03-the-blast-paradigm/) to build a structurally perfect, 100% compiling Java Spring Boot architecture *first*, and only use AI for the final isolated logic. 
 
 This pipeline has been stress-tested across a randomized corpus of 27 distinct legacy COBOL repositories (including complex IBM CICS applications), generating structurally sound, Maven-compilable Spring Boot systems without human intervention.
 
 ### 🧪 The Ultimate CI/CD Stress Test
 
-To prove the viability of this deterministic approach, the Java Forge was subjected to an automated batch test across 27 diverse repositories. 
+To prove the viability of this deterministic approach, the Java Forge was subjected to an [Automated Batch Test](https://squid-protocol.github.io/gitgalaxy/05-06-batch-test-harness/) across 27 diverse repositories. 
 
 <br>![Java Forge & Batch Test](../../../docs/wiki/assets/java_forge_and_batch_test.gif)
 
@@ -33,40 +33,40 @@ We do not claim to magically translate entire enterprise systems with zero human
 
 * **What We Automate:** Exact memory mapping, JPA entities, REST controllers, and complete Maven build systems.
 * **What We Delegate:** Highly specific, isolated internal business logic.
-* **How We Scale:** We generate strict JSON job tickets containing isolated logic slices.
+* **How We Scale:** We generate [strict JSON Autonomous Agent Tickets](https://squid-protocol.github.io/gitgalaxy/05-05-autonomous-agent-tickets/) containing isolated logic slices.
 * **Zero Hallucinations:** AI agents are restricted to filling in the pre-wired methods, preventing architectural hallucinations.
 
 ---
 
 ### 🏗️ How It Works: Deterministic Scaffolding
 
-The `cobol_to_java_controller.py` ingests the JSON Intermediate Representation (IR) generated by the Mainframe Modernization Suite. It then orchestrates a suite of specialized architectural forges.
+The `cobol_to_java_controller.py` ingests the JSON Intermediate Representation (IR) generated by the Mainframe Modernization Suite. It then orchestrates a suite of specialized architectural forges to seamlessly [Scaffold Java Spring Boot](https://squid-protocol.github.io/gitgalaxy/cookbook/scaffold-spring-boot/).
 
-#### 1. Entity & Memory Mapping Forge
-Translates legacy schema boundaries into strict Spring Boot `@Entity` classes.
+#### 1. [Entity & Memory Mapping Forge](https://squid-protocol.github.io/gitgalaxy/05-03-entity-and-memory-mapping/)
+Translates legacy schema boundaries into strict Spring Boot `@Entity` classes. Read the [Entity Forge Cookbook Recipe](https://squid-protocol.github.io/gitgalaxy/cookbook/cobol-to-java-spring-boot-entity-forge/).
 * **Precision Mapping:** Translates complex `PIC` clauses to `BigDecimal`.
 * **Array Resolution:** Resolves `OCCURS` arrays into `List` collections.
 * **Memory Overlays:** Maps `REDEFINES` memory overlays as transient aliases.
 
-#### 2. The API Contract & Service Forge
-Translates the DAG lineage intent into modern REST Controllers and auto-wires the `@Service` layer.
+#### 2. [The API Contract & Service Forge](https://squid-protocol.github.io/gitgalaxy/05-04-api-and-service-contracts/)
+Translates the DAG lineage intent into modern REST Controllers and auto-wires the `@Service` layer. View the [REST API](https://squid-protocol.github.io/gitgalaxy/cookbook/cobol-to-java-REST-API-generation/) and [Service Forge](https://squid-protocol.github.io/gitgalaxy/cookbook/cobol-to-java-spring-boot-service-forge/) recipes.
 * **Paradigm Detection:** Detects batch vs. transactional data paradigms.
 * **Controller Generation:** Builds specific REST controller endpoints.
 * **Mock Service Shield:** Generates mock services for missing external dependencies.
 
-#### 3. EBCDIC Decoder Forge
+#### 3. [EBCDIC Decoder Forge (Data Serialization)](https://squid-protocol.github.io/gitgalaxy/cookbook/cobol-to-java-mainframe-data-serialization-forge/)
 Automatically generates the utility classes necessary to read raw mainframe byte streams. 
 * **Legacy Unpacking:** Safely unpacks Packed Decimal (`COMP-3`) data.
 * **Boundary Validation:** Validates hex-boundaries to prevent runtime crashes.
 * **Format Translation:** Decodes raw EBCDIC strings to standard UTF-8.
 
-#### 4. The Build System Forge
+#### 4. [The Build System Forge](https://squid-protocol.github.io/gitgalaxy/cookbook/cobol-to-java-automated-spring-boot-build-system/)
 Generates the configuration files required for instant compilation.
 * **Dependency Management:** Generates production-ready Maven `pom.xml`.
 * **Environment Config:** Configures Spring Boot `application.yml`.
 * **Instant Verification:** Ensures instant out-of-the-box compilation.
 
-#### 5. The AI Boundary (Agent Task Forge)
+#### 5. [The AI Boundary (Anomaly Agent Task Forge)](https://squid-protocol.github.io/gitgalaxy/05-16-anomaly-agent-task-forge/)
 Packages the remaining logic into strict JSON tickets for LLMs or human engineers.
 * **Logic Extraction:** Extracts isolated business rules from the monolith.
 * **Ticket Generation:** Packages strict JSON tickets with required inputs/outputs.
@@ -101,7 +101,7 @@ Don't just take our word for it. We have published the raw, unedited artifacts g
 ### 🌌 Powered by the blAST Engine (Bypassing LLMs and ASTs)
 This tool is a modular enterprise integration within the broader GitGalaxy architecture. It is driven by our custom mathematical heuristics engine, capable of mapping multi-dimensional relationships at extreme velocity. Dive into the official wiki to understand the exact translation mechanics and memory-mapping heuristics:
 
-* 📖 **[Spring Boot Scaffolding Logic](../../../docs/wiki/05-02-spring-boot-scaffolding.md)**
-* 📖 **[Entity & Memory Mapping Rules](../../../docs/wiki/05-03-entity-and-memory-mapping.md)**
-* 📖 **[API & Service Contract Generation](../../../docs/wiki/05-04-api-and-service-contracts.md)**
+* 📖 **[Spring Boot Scaffolding Logic](https://squid-protocol.github.io/gitgalaxy/05-02-spring-boot-scaffolding/)**
+* 📖 **[Entity & Memory Mapping Rules](https://squid-protocol.github.io/gitgalaxy/05-03-entity-and-memory-mapping/)**
+* 📖 **[API & Service Contract Generation](https://squid-protocol.github.io/gitgalaxy/05-04-api-and-service-contracts/)**
 * 🪐 **[Return to the Main GitGalaxy Hub](https://github.com/squid-protocol/gitgalaxy)**