maintainability-agent 2.6.0__tar.gz → 2.7.0__tar.gz

{maintainability_agent-2.6.0/src/maintainability_agent.egg-info → maintainability_agent-2.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: maintainability-agent
-Version: 2.6.0
+Version: 2.7.0
 Summary: Maintainability gate and AI remediation prompt generator for CI.
 Author: Marshall Guillory
 License: MIT
@@ -44,7 +44,7 @@ Dynamic: license-file
 **A deterministic, offline maintainability audit whose output is a _bounded
 work order_ for an AI coding agent** — a copy-paste prompt, per finding, that
 says *fix exactly these and refactor nothing else*. Chat-primary; CLI for CI.
-Version **2.6.0**.
+Version **2.7.0**.
 
 **Languages parsed:** Python, Java, C, C++, C#, Swift, Fortran (free-form
 *and* fixed-form), and the JS/TS family — each by a scanner written for it, and
@@ -78,9 +78,11 @@ What 1.0 guarantees:
 - **Deterministic and local.** Same tree, config, pinned analyzer versions and
   history in → same evidence, findings and score out. The analysis performs no
   network access and invokes no LLM, and **this agent does not transmit your
-  source.** Third-party analyzers it may spawn (eslint, jscpd, lizard) are
-  **not network-sandboxed** — this process does not police whether *they* phone
-  home; install them yourself for an air-gapped run.
+  source.** Every report states what it examined and produced — files,
+  declarations, findings, bounded work items — **all computed with no model
+  call**: work a metered agent never has to do. Third-party analyzers it may
+  spawn (eslint, jscpd, lizard) are **not network-sandboxed** — this process does
+  not police whether *they* phone home; install them for an air-gapped run.
 - **One uniform rubric**, readable in source, applied to every repository —
   so "better" and "worse" are not an argument. Calibrated against a
   query-selected corpus of mature open-source projects; the corpus median
@@ -183,9 +185,8 @@ policy, history consent, economics, test-suite execution, and presentation, and
 no report. A configured repository returns `choice_needed` (`run` or
 `reconfigure`), also without a report. Answering setup does not start an audit.
 `action="run"` returns the report and its bounded remediation prompt to the
-conversation. `record_history=None` follows the persisted first-run history
-consent and always appends to an existing history, while an explicit `true`
-or `false` wins.
+conversation. `record_history=None` follows the persisted first-run consent and
+always appends to an existing history; an explicit `true` or `false` wins.
 
 ```bash
 python3 -m pip install "maintainability-agent[mcp]"
@@ -193,10 +194,10 @@ maintainability-agent mcp --allow-root /absolute/path/to/repository
 ```
 
 Presentation is exactly three choices — **chat**, a **Markdown** file, or a
-single-file **HTML** report — and where to save a file is asked only after a
-file format is chosen. No report file is written without that choice. See
-[chat workflow help](docs/help/README.md) and
-[IDE and agent integration](docs/ide-agent-integration.md).
+single-file **HTML** report. Where to save is asked only after a file format is
+chosen, and no report file is written without that choice. See
+[chat workflow help](docs/help/README.md) and [IDE and agent
+integration](docs/ide-agent-integration.md).
 
 ## Automation / CI: CLI
 
@@ -290,14 +291,13 @@ SonarQube, Qlty) rather than replacing them — their SARIF folds in via
 
 ## Language support
 
-**Be clear-eyed about this: the tool does not support every language equally,
-and on an unrecognized language it will quietly under-report rather than fail.**
-Coverage comes from two layers.
+**Be clear-eyed: the tool does not support every language equally, and on an
+unrecognized language it under-reports rather than fails.** Coverage has two layers.
 
-Nine languages are parsed as of **2.4.0**: Python (1.0), Java (1.0), C (1.1),
-C++ (1.2), C# (1.3), Fortran (free-form 1.4, fixed-form 1.6), Swift (2.4), the
-JS/TS family, and HTML. Each has a scanner written for it and a documented list of what it
-misses — a language is claimed here only when both exist.
+Ten languages are parsed as of **2.7.0**: Python (1.0), Java (1.0), C (1.1),
+C++ (1.2), C# (1.3), Fortran (free-form 1.4, fixed-form 1.6), Swift (2.4),
+COBOL (2.7), the JS/TS family, and HTML. Each has a scanner written for it and a
+documented list of what it misses — a language is claimed only when both exist.
 
 **Built-in scanner (always on, no dependencies)** — reads function/class
 declarations, sizes and complexity for a fixed set of languages, and **only**
@@ -311,18 +311,19 @@ these:
 | C++ (`.cpp`, `.hpp`, `.cc`, `.cxx`, `.hh`) | dedicated brace-bounded scanner — functions, class members, namespaces, templates | Bounded; bodyless declarations are not definitions |
 | C# (`.cs`) | dedicated brace-bounded scanner — methods, constructors, `class`/`interface`/`struct`/`record`/`enum` | Bounded; properties are not declarations |
 | Swift (`.swift`) | dedicated brace-bounded scanner — functions, initialisers, subscripts, `class`/`struct`/`enum`/`protocol`/`actor` | Bounded; extension members carry their type, protocol requirements and computed properties are not declarations |
+| COBOL (`.cbl`, `.cob`, `.cpy`, and `.CBL`/`.COB`/`.CPY`) | dedicated scanner — PROCEDURE DIVISION paragraphs, bounded by the start of whatever follows; fixed-form card columns read where the layout carries them | Bounded by the next header; level numbers and container programs/sections are not declarations |
 | Fortran, free-form (`.f90`, `.f95`, `.f03`, `.f08`, `.F90`, `.F95`, `.F03`, `.F08`, `.pf`) | dedicated **keyword**-bounded scanner — modules, subroutines, functions, derived types | Bounded by `end`; measured with Fortran's own branch and nesting reading |
 | Fortran, fixed-form (`.f`, `.for`, `.ftn`, `.F`, `.FOR`, `.FTN`) | the same scanner over card-column source; continuations joined, labelled `DO` loops understood | Bounded by `end` or by the loop's label |
 | JS / TS / JSX / TSX (`.js`, `.jsx`, `.mjs`, `.cjs`, `.ts`, `.tsx`) | brace/paren depth over a masked copy | Bounded by the declaration's own braces |
 | HTML (`.html`) | same brace scanner (inline `<script>`) | Bounded |
 | TypeScript (semantic) | a recorded analysis or a locally-installed `tsc`, workspace projects included | Type-level facts; `unknown` when no checker is present |
 
-Any language **not** in that table — Go, Rust, Ruby, PHP, Kotlin,
-Swift, and the rest — is **not parsed for declarations by the built-in
-scanner.** Its files still count toward repo size, but the built-ins produce no
-function-size, complexity, duplication or dead-code findings for them, and the
-estimate leans on whatever evidence *is* available (which is why the report
-discloses its evidence tier and can withhold the grade).
+Any language **not** in that table — Go, Rust, Ruby, PHP, Kotlin, and the rest —
+is **not parsed for declarations by the built-in scanner.** Its files still count
+toward repo size, but the built-ins produce no function-size, complexity,
+duplication or dead-code findings for them, and the estimate leans on whatever
+evidence *is* available (which is why the report discloses its evidence tier and
+can withhold the grade).
 
 **Which analyzer covers which language** (the opt-in pool, when installed):
 
@@ -332,13 +333,14 @@ discloses its evidence tier and can withhold the grade).
 | Java | dedicated scanner | lizard, PMD, Checkstyle, SpotBugs |
 | C / C++ / C# | dedicated scanners | lizard, multimetric |
 | **Fortran** (free- and fixed-form) | dedicated scanner | **fortitude** — 100+ rules; **lizard** — complexity, NLOC, params |
+| **COBOL** | dedicated scanner | **none** — no offline analyzer in the catalog reads it |
 | JS / TS / JSX / TSX | brace scanner | ESLint, lizard, jscpd |
 
-Fortran reached parity in 1.6.0. lizard measures it — this project's
-catalog row for lizard was stale and said otherwise, so lizard came out
-`not-applicable` on every Fortran repository and never ran — and
-fortitude adds 100+ lint rules beside it. A lint now fails the build if
-any parsed language has no analyzer that measures complexity.
+Fortran reached parity in 1.6.0: lizard had read it for years behind a
+stale catalog row, so it came out `not-applicable` and never ran. A lint fails
+the build if a parsed language has no analyzer measuring complexity — **COBOL is
+the one disclosed exemption**, because the tooling that reads it is licensed and
+host-resident, so its external tier is empty and the report says so.
 
 **External analyzer adapters (opt-in pool)** — this is how coverage extends
 beyond the built-in set. When you enable the analyzer pool, the tool shells out
@@ -350,12 +352,11 @@ selected *and* installed (acquisition is opt-in and off by default), and where
 they measured a full concept set they become the *primary* evidence, with the
 built-ins as the fallback.
 
-So: **first-class today is Python** (and TypeScript for semantics); Java, C, C++,
-C#, free-form Fortran and the JS/TS family are bounded-but-real; every other language is only as covered as
-the external analyzer you point at it — and with no analyzer, it is
-under-reported by design. The per-language accuracy, the exact parsed set, and
-the known limitations are documented in
-[docs/language-support.md](docs/language-support.md); the adapter catalog is in
+So: **first-class today is Python** (and TypeScript for semantics); every other
+parsed language is bounded-but-real; anything outside the table is only as
+covered as the analyzer you point at it, and with none it is under-reported by
+design. Per-language accuracy and limits:
+[docs/language-support.md](docs/language-support.md); the adapter catalog:
 [docs/adapters.md](docs/adapters.md).
 
 ## What it produces
@@ -423,10 +424,9 @@ defaults. The grade is gated (A+ needs every dimension clean; a
 repo with production code and zero test files cannot earn an A-grade) and banded
 from the evidence floor, so withholding evidence never buys a better letter.
 Every threshold gate — file, function, duplication — is opted **on** for this
-repo's own CI, against thresholds stricter than the shipped defaults, so
-drifting below the bar fails the build rather than the README. (CI note:
-`actions/checkout` defaults to `fetch-depth: 1`, which hides history and costs
-roughly a grade — use `fetch-depth: 0`.)
+repo's own CI, so drifting below the bar fails the build rather than the README.
+(CI note: `actions/checkout` defaults to `fetch-depth: 1`, which hides history
+and costs roughly a grade — use `fetch-depth: 0`.)
 
 ## Platform support
 
@@ -517,14 +517,14 @@ gate, and the self-audit — is in
 
 ## Support this work
 
-This is a single-maintainer, MIT-licensed project — free to use, and built on
-a lot of unpaid hours. If it saves you or your team time, please consider
+This is a single-maintainer, MIT-licensed project — free to use, and built on a
+lot of unpaid hours. If it saves you or your team time, please consider
 sponsoring its continued development:
 
 **❤️ [Sponsor on GitHub](https://github.com/sponsors/marshallguillory86)**
 
-Sponsorship is entirely optional and never gates a feature, a fix, or support —
-the whole tool stays free and open. It just helps keep the work going.
+Sponsorship is optional and never gates a feature, a fix, or support — the whole
+tool stays free and open. It just helps keep the work going.
 
 ## Acknowledgements
 

{maintainability_agent-2.6.0 → maintainability_agent-2.7.0}/README.md

@@ -5,7 +5,7 @@
 **A deterministic, offline maintainability audit whose output is a _bounded
 work order_ for an AI coding agent** — a copy-paste prompt, per finding, that
 says *fix exactly these and refactor nothing else*. Chat-primary; CLI for CI.
-Version **2.6.0**.
+Version **2.7.0**.
 
 **Languages parsed:** Python, Java, C, C++, C#, Swift, Fortran (free-form
 *and* fixed-form), and the JS/TS family — each by a scanner written for it, and
@@ -39,9 +39,11 @@ What 1.0 guarantees:
 - **Deterministic and local.** Same tree, config, pinned analyzer versions and
   history in → same evidence, findings and score out. The analysis performs no
   network access and invokes no LLM, and **this agent does not transmit your
-  source.** Third-party analyzers it may spawn (eslint, jscpd, lizard) are
-  **not network-sandboxed** — this process does not police whether *they* phone
-  home; install them yourself for an air-gapped run.
+  source.** Every report states what it examined and produced — files,
+  declarations, findings, bounded work items — **all computed with no model
+  call**: work a metered agent never has to do. Third-party analyzers it may
+  spawn (eslint, jscpd, lizard) are **not network-sandboxed** — this process does
+  not police whether *they* phone home; install them for an air-gapped run.
 - **One uniform rubric**, readable in source, applied to every repository —
   so "better" and "worse" are not an argument. Calibrated against a
   query-selected corpus of mature open-source projects; the corpus median
@@ -144,9 +146,8 @@ policy, history consent, economics, test-suite execution, and presentation, and
 no report. A configured repository returns `choice_needed` (`run` or
 `reconfigure`), also without a report. Answering setup does not start an audit.
 `action="run"` returns the report and its bounded remediation prompt to the
-conversation. `record_history=None` follows the persisted first-run history
-consent and always appends to an existing history, while an explicit `true`
-or `false` wins.
+conversation. `record_history=None` follows the persisted first-run consent and
+always appends to an existing history; an explicit `true` or `false` wins.
 
 ```bash
 python3 -m pip install "maintainability-agent[mcp]"
@@ -154,10 +155,10 @@ maintainability-agent mcp --allow-root /absolute/path/to/repository
 ```
 
 Presentation is exactly three choices — **chat**, a **Markdown** file, or a
-single-file **HTML** report — and where to save a file is asked only after a
-file format is chosen. No report file is written without that choice. See
-[chat workflow help](docs/help/README.md) and
-[IDE and agent integration](docs/ide-agent-integration.md).
+single-file **HTML** report. Where to save is asked only after a file format is
+chosen, and no report file is written without that choice. See
+[chat workflow help](docs/help/README.md) and [IDE and agent
+integration](docs/ide-agent-integration.md).
 
 ## Automation / CI: CLI
 
@@ -251,14 +252,13 @@ SonarQube, Qlty) rather than replacing them — their SARIF folds in via
 
 ## Language support
 
-**Be clear-eyed about this: the tool does not support every language equally,
-and on an unrecognized language it will quietly under-report rather than fail.**
-Coverage comes from two layers.
+**Be clear-eyed: the tool does not support every language equally, and on an
+unrecognized language it under-reports rather than fails.** Coverage has two layers.
 
-Nine languages are parsed as of **2.4.0**: Python (1.0), Java (1.0), C (1.1),
-C++ (1.2), C# (1.3), Fortran (free-form 1.4, fixed-form 1.6), Swift (2.4), the
-JS/TS family, and HTML. Each has a scanner written for it and a documented list of what it
-misses — a language is claimed here only when both exist.
+Ten languages are parsed as of **2.7.0**: Python (1.0), Java (1.0), C (1.1),
+C++ (1.2), C# (1.3), Fortran (free-form 1.4, fixed-form 1.6), Swift (2.4),
+COBOL (2.7), the JS/TS family, and HTML. Each has a scanner written for it and a
+documented list of what it misses — a language is claimed only when both exist.
 
 **Built-in scanner (always on, no dependencies)** — reads function/class
 declarations, sizes and complexity for a fixed set of languages, and **only**
@@ -272,18 +272,19 @@ these:
 | C++ (`.cpp`, `.hpp`, `.cc`, `.cxx`, `.hh`) | dedicated brace-bounded scanner — functions, class members, namespaces, templates | Bounded; bodyless declarations are not definitions |
 | C# (`.cs`) | dedicated brace-bounded scanner — methods, constructors, `class`/`interface`/`struct`/`record`/`enum` | Bounded; properties are not declarations |
 | Swift (`.swift`) | dedicated brace-bounded scanner — functions, initialisers, subscripts, `class`/`struct`/`enum`/`protocol`/`actor` | Bounded; extension members carry their type, protocol requirements and computed properties are not declarations |
+| COBOL (`.cbl`, `.cob`, `.cpy`, and `.CBL`/`.COB`/`.CPY`) | dedicated scanner — PROCEDURE DIVISION paragraphs, bounded by the start of whatever follows; fixed-form card columns read where the layout carries them | Bounded by the next header; level numbers and container programs/sections are not declarations |
 | Fortran, free-form (`.f90`, `.f95`, `.f03`, `.f08`, `.F90`, `.F95`, `.F03`, `.F08`, `.pf`) | dedicated **keyword**-bounded scanner — modules, subroutines, functions, derived types | Bounded by `end`; measured with Fortran's own branch and nesting reading |
 | Fortran, fixed-form (`.f`, `.for`, `.ftn`, `.F`, `.FOR`, `.FTN`) | the same scanner over card-column source; continuations joined, labelled `DO` loops understood | Bounded by `end` or by the loop's label |
 | JS / TS / JSX / TSX (`.js`, `.jsx`, `.mjs`, `.cjs`, `.ts`, `.tsx`) | brace/paren depth over a masked copy | Bounded by the declaration's own braces |
 | HTML (`.html`) | same brace scanner (inline `<script>`) | Bounded |
 | TypeScript (semantic) | a recorded analysis or a locally-installed `tsc`, workspace projects included | Type-level facts; `unknown` when no checker is present |
 
-Any language **not** in that table — Go, Rust, Ruby, PHP, Kotlin,
-Swift, and the rest — is **not parsed for declarations by the built-in
-scanner.** Its files still count toward repo size, but the built-ins produce no
-function-size, complexity, duplication or dead-code findings for them, and the
-estimate leans on whatever evidence *is* available (which is why the report
-discloses its evidence tier and can withhold the grade).
+Any language **not** in that table — Go, Rust, Ruby, PHP, Kotlin, and the rest —
+is **not parsed for declarations by the built-in scanner.** Its files still count
+toward repo size, but the built-ins produce no function-size, complexity,
+duplication or dead-code findings for them, and the estimate leans on whatever
+evidence *is* available (which is why the report discloses its evidence tier and
+can withhold the grade).
 
 **Which analyzer covers which language** (the opt-in pool, when installed):
 
@@ -293,13 +294,14 @@ discloses its evidence tier and can withhold the grade).
 | Java | dedicated scanner | lizard, PMD, Checkstyle, SpotBugs |
 | C / C++ / C# | dedicated scanners | lizard, multimetric |
 | **Fortran** (free- and fixed-form) | dedicated scanner | **fortitude** — 100+ rules; **lizard** — complexity, NLOC, params |
+| **COBOL** | dedicated scanner | **none** — no offline analyzer in the catalog reads it |
 | JS / TS / JSX / TSX | brace scanner | ESLint, lizard, jscpd |
 
-Fortran reached parity in 1.6.0. lizard measures it — this project's
-catalog row for lizard was stale and said otherwise, so lizard came out
-`not-applicable` on every Fortran repository and never ran — and
-fortitude adds 100+ lint rules beside it. A lint now fails the build if
-any parsed language has no analyzer that measures complexity.
+Fortran reached parity in 1.6.0: lizard had read it for years behind a
+stale catalog row, so it came out `not-applicable` and never ran. A lint fails
+the build if a parsed language has no analyzer measuring complexity — **COBOL is
+the one disclosed exemption**, because the tooling that reads it is licensed and
+host-resident, so its external tier is empty and the report says so.
 
 **External analyzer adapters (opt-in pool)** — this is how coverage extends
 beyond the built-in set. When you enable the analyzer pool, the tool shells out
@@ -311,12 +313,11 @@ selected *and* installed (acquisition is opt-in and off by default), and where
 they measured a full concept set they become the *primary* evidence, with the
 built-ins as the fallback.
 
-So: **first-class today is Python** (and TypeScript for semantics); Java, C, C++,
-C#, free-form Fortran and the JS/TS family are bounded-but-real; every other language is only as covered as
-the external analyzer you point at it — and with no analyzer, it is
-under-reported by design. The per-language accuracy, the exact parsed set, and
-the known limitations are documented in
-[docs/language-support.md](docs/language-support.md); the adapter catalog is in
+So: **first-class today is Python** (and TypeScript for semantics); every other
+parsed language is bounded-but-real; anything outside the table is only as
+covered as the analyzer you point at it, and with none it is under-reported by
+design. Per-language accuracy and limits:
+[docs/language-support.md](docs/language-support.md); the adapter catalog:
 [docs/adapters.md](docs/adapters.md).
 
 ## What it produces
@@ -384,10 +385,9 @@ defaults. The grade is gated (A+ needs every dimension clean; a
 repo with production code and zero test files cannot earn an A-grade) and banded
 from the evidence floor, so withholding evidence never buys a better letter.
 Every threshold gate — file, function, duplication — is opted **on** for this
-repo's own CI, against thresholds stricter than the shipped defaults, so
-drifting below the bar fails the build rather than the README. (CI note:
-`actions/checkout` defaults to `fetch-depth: 1`, which hides history and costs
-roughly a grade — use `fetch-depth: 0`.)
+repo's own CI, so drifting below the bar fails the build rather than the README.
+(CI note: `actions/checkout` defaults to `fetch-depth: 1`, which hides history
+and costs roughly a grade — use `fetch-depth: 0`.)
 
 ## Platform support
 
@@ -478,14 +478,14 @@ gate, and the self-audit — is in
 
 ## Support this work
 
-This is a single-maintainer, MIT-licensed project — free to use, and built on
-a lot of unpaid hours. If it saves you or your team time, please consider
+This is a single-maintainer, MIT-licensed project — free to use, and built on a
+lot of unpaid hours. If it saves you or your team time, please consider
 sponsoring its continued development:
 
 **❤️ [Sponsor on GitHub](https://github.com/sponsors/marshallguillory86)**
 
-Sponsorship is entirely optional and never gates a feature, a fix, or support —
-the whole tool stays free and open. It just helps keep the work going.
+Sponsorship is optional and never gates a feature, a fix, or support — the whole
+tool stays free and open. It just helps keep the work going.
 
 ## Acknowledgements
 

{maintainability_agent-2.6.0 → maintainability_agent-2.7.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "maintainability-agent"
-version = "2.6.0"
+version = "2.7.0"
 description = "Maintainability gate and AI remediation prompt generator for CI."
 readme = "README.md"
 # 3.11, not 3.10. `_discovery`, `_pillars` and `_runner` all import

{maintainability_agent-2.6.0 → maintainability_agent-2.7.0/src/maintainability_agent.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: maintainability-agent
-Version: 2.6.0
+Version: 2.7.0
 Summary: Maintainability gate and AI remediation prompt generator for CI.
 Author: Marshall Guillory
 License: MIT
@@ -44,7 +44,7 @@ Dynamic: license-file
 **A deterministic, offline maintainability audit whose output is a _bounded
 work order_ for an AI coding agent** — a copy-paste prompt, per finding, that
 says *fix exactly these and refactor nothing else*. Chat-primary; CLI for CI.
-Version **2.6.0**.
+Version **2.7.0**.
 
 **Languages parsed:** Python, Java, C, C++, C#, Swift, Fortran (free-form
 *and* fixed-form), and the JS/TS family — each by a scanner written for it, and
@@ -78,9 +78,11 @@ What 1.0 guarantees:
 - **Deterministic and local.** Same tree, config, pinned analyzer versions and
   history in → same evidence, findings and score out. The analysis performs no
   network access and invokes no LLM, and **this agent does not transmit your
-  source.** Third-party analyzers it may spawn (eslint, jscpd, lizard) are
-  **not network-sandboxed** — this process does not police whether *they* phone
-  home; install them yourself for an air-gapped run.
+  source.** Every report states what it examined and produced — files,
+  declarations, findings, bounded work items — **all computed with no model
+  call**: work a metered agent never has to do. Third-party analyzers it may
+  spawn (eslint, jscpd, lizard) are **not network-sandboxed** — this process does
+  not police whether *they* phone home; install them for an air-gapped run.
 - **One uniform rubric**, readable in source, applied to every repository —
   so "better" and "worse" are not an argument. Calibrated against a
   query-selected corpus of mature open-source projects; the corpus median
@@ -183,9 +185,8 @@ policy, history consent, economics, test-suite execution, and presentation, and
 no report. A configured repository returns `choice_needed` (`run` or
 `reconfigure`), also without a report. Answering setup does not start an audit.
 `action="run"` returns the report and its bounded remediation prompt to the
-conversation. `record_history=None` follows the persisted first-run history
-consent and always appends to an existing history, while an explicit `true`
-or `false` wins.
+conversation. `record_history=None` follows the persisted first-run consent and
+always appends to an existing history; an explicit `true` or `false` wins.
 
 ```bash
 python3 -m pip install "maintainability-agent[mcp]"
@@ -193,10 +194,10 @@ maintainability-agent mcp --allow-root /absolute/path/to/repository
 ```
 
 Presentation is exactly three choices — **chat**, a **Markdown** file, or a
-single-file **HTML** report — and where to save a file is asked only after a
-file format is chosen. No report file is written without that choice. See
-[chat workflow help](docs/help/README.md) and
-[IDE and agent integration](docs/ide-agent-integration.md).
+single-file **HTML** report. Where to save is asked only after a file format is
+chosen, and no report file is written without that choice. See
+[chat workflow help](docs/help/README.md) and [IDE and agent
+integration](docs/ide-agent-integration.md).
 
 ## Automation / CI: CLI
 
@@ -290,14 +291,13 @@ SonarQube, Qlty) rather than replacing them — their SARIF folds in via
 
 ## Language support
 
-**Be clear-eyed about this: the tool does not support every language equally,
-and on an unrecognized language it will quietly under-report rather than fail.**
-Coverage comes from two layers.
+**Be clear-eyed: the tool does not support every language equally, and on an
+unrecognized language it under-reports rather than fails.** Coverage has two layers.
 
-Nine languages are parsed as of **2.4.0**: Python (1.0), Java (1.0), C (1.1),
-C++ (1.2), C# (1.3), Fortran (free-form 1.4, fixed-form 1.6), Swift (2.4), the
-JS/TS family, and HTML. Each has a scanner written for it and a documented list of what it
-misses — a language is claimed here only when both exist.
+Ten languages are parsed as of **2.7.0**: Python (1.0), Java (1.0), C (1.1),
+C++ (1.2), C# (1.3), Fortran (free-form 1.4, fixed-form 1.6), Swift (2.4),
+COBOL (2.7), the JS/TS family, and HTML. Each has a scanner written for it and a
+documented list of what it misses — a language is claimed only when both exist.
 
 **Built-in scanner (always on, no dependencies)** — reads function/class
 declarations, sizes and complexity for a fixed set of languages, and **only**
@@ -311,18 +311,19 @@ these:
 | C++ (`.cpp`, `.hpp`, `.cc`, `.cxx`, `.hh`) | dedicated brace-bounded scanner — functions, class members, namespaces, templates | Bounded; bodyless declarations are not definitions |
 | C# (`.cs`) | dedicated brace-bounded scanner — methods, constructors, `class`/`interface`/`struct`/`record`/`enum` | Bounded; properties are not declarations |
 | Swift (`.swift`) | dedicated brace-bounded scanner — functions, initialisers, subscripts, `class`/`struct`/`enum`/`protocol`/`actor` | Bounded; extension members carry their type, protocol requirements and computed properties are not declarations |
+| COBOL (`.cbl`, `.cob`, `.cpy`, and `.CBL`/`.COB`/`.CPY`) | dedicated scanner — PROCEDURE DIVISION paragraphs, bounded by the start of whatever follows; fixed-form card columns read where the layout carries them | Bounded by the next header; level numbers and container programs/sections are not declarations |
 | Fortran, free-form (`.f90`, `.f95`, `.f03`, `.f08`, `.F90`, `.F95`, `.F03`, `.F08`, `.pf`) | dedicated **keyword**-bounded scanner — modules, subroutines, functions, derived types | Bounded by `end`; measured with Fortran's own branch and nesting reading |
 | Fortran, fixed-form (`.f`, `.for`, `.ftn`, `.F`, `.FOR`, `.FTN`) | the same scanner over card-column source; continuations joined, labelled `DO` loops understood | Bounded by `end` or by the loop's label |
 | JS / TS / JSX / TSX (`.js`, `.jsx`, `.mjs`, `.cjs`, `.ts`, `.tsx`) | brace/paren depth over a masked copy | Bounded by the declaration's own braces |
 | HTML (`.html`) | same brace scanner (inline `<script>`) | Bounded |
 | TypeScript (semantic) | a recorded analysis or a locally-installed `tsc`, workspace projects included | Type-level facts; `unknown` when no checker is present |
 
-Any language **not** in that table — Go, Rust, Ruby, PHP, Kotlin,
-Swift, and the rest — is **not parsed for declarations by the built-in
-scanner.** Its files still count toward repo size, but the built-ins produce no
-function-size, complexity, duplication or dead-code findings for them, and the
-estimate leans on whatever evidence *is* available (which is why the report
-discloses its evidence tier and can withhold the grade).
+Any language **not** in that table — Go, Rust, Ruby, PHP, Kotlin, and the rest —
+is **not parsed for declarations by the built-in scanner.** Its files still count
+toward repo size, but the built-ins produce no function-size, complexity,
+duplication or dead-code findings for them, and the estimate leans on whatever
+evidence *is* available (which is why the report discloses its evidence tier and
+can withhold the grade).
 
 **Which analyzer covers which language** (the opt-in pool, when installed):
 
@@ -332,13 +333,14 @@ discloses its evidence tier and can withhold the grade).
 | Java | dedicated scanner | lizard, PMD, Checkstyle, SpotBugs |
 | C / C++ / C# | dedicated scanners | lizard, multimetric |
 | **Fortran** (free- and fixed-form) | dedicated scanner | **fortitude** — 100+ rules; **lizard** — complexity, NLOC, params |
+| **COBOL** | dedicated scanner | **none** — no offline analyzer in the catalog reads it |
 | JS / TS / JSX / TSX | brace scanner | ESLint, lizard, jscpd |
 
-Fortran reached parity in 1.6.0. lizard measures it — this project's
-catalog row for lizard was stale and said otherwise, so lizard came out
-`not-applicable` on every Fortran repository and never ran — and
-fortitude adds 100+ lint rules beside it. A lint now fails the build if
-any parsed language has no analyzer that measures complexity.
+Fortran reached parity in 1.6.0: lizard had read it for years behind a
+stale catalog row, so it came out `not-applicable` and never ran. A lint fails
+the build if a parsed language has no analyzer measuring complexity — **COBOL is
+the one disclosed exemption**, because the tooling that reads it is licensed and
+host-resident, so its external tier is empty and the report says so.
 
 **External analyzer adapters (opt-in pool)** — this is how coverage extends
 beyond the built-in set. When you enable the analyzer pool, the tool shells out
@@ -350,12 +352,11 @@ selected *and* installed (acquisition is opt-in and off by default), and where
 they measured a full concept set they become the *primary* evidence, with the
 built-ins as the fallback.
 
-So: **first-class today is Python** (and TypeScript for semantics); Java, C, C++,
-C#, free-form Fortran and the JS/TS family are bounded-but-real; every other language is only as covered as
-the external analyzer you point at it — and with no analyzer, it is
-under-reported by design. The per-language accuracy, the exact parsed set, and
-the known limitations are documented in
-[docs/language-support.md](docs/language-support.md); the adapter catalog is in
+So: **first-class today is Python** (and TypeScript for semantics); every other
+parsed language is bounded-but-real; anything outside the table is only as
+covered as the analyzer you point at it, and with none it is under-reported by
+design. Per-language accuracy and limits:
+[docs/language-support.md](docs/language-support.md); the adapter catalog:
 [docs/adapters.md](docs/adapters.md).
 
 ## What it produces
@@ -423,10 +424,9 @@ defaults. The grade is gated (A+ needs every dimension clean; a
 repo with production code and zero test files cannot earn an A-grade) and banded
 from the evidence floor, so withholding evidence never buys a better letter.
 Every threshold gate — file, function, duplication — is opted **on** for this
-repo's own CI, against thresholds stricter than the shipped defaults, so
-drifting below the bar fails the build rather than the README. (CI note:
-`actions/checkout` defaults to `fetch-depth: 1`, which hides history and costs
-roughly a grade — use `fetch-depth: 0`.)
+repo's own CI, so drifting below the bar fails the build rather than the README.
+(CI note: `actions/checkout` defaults to `fetch-depth: 1`, which hides history
+and costs roughly a grade — use `fetch-depth: 0`.)
 
 ## Platform support
 
@@ -517,14 +517,14 @@ gate, and the self-audit — is in
 
 ## Support this work
 
-This is a single-maintainer, MIT-licensed project — free to use, and built on
-a lot of unpaid hours. If it saves you or your team time, please consider
+This is a single-maintainer, MIT-licensed project — free to use, and built on a
+lot of unpaid hours. If it saves you or your team time, please consider
 sponsoring its continued development:
 
 **❤️ [Sponsor on GitHub](https://github.com/sponsors/marshallguillory86)**
 
-Sponsorship is entirely optional and never gates a feature, a fix, or support —
-the whole tool stays free and open. It just helps keep the work going.
+Sponsorship is optional and never gates a feature, a fix, or support — the whole
+tool stays free and open. It just helps keep the work going.
 
 ## Acknowledgements
 

{maintainability_agent-2.6.0 → maintainability_agent-2.7.0}/src/maintainability_agent.egg-info/SOURCES.txt

@@ -59,6 +59,7 @@ src/maintainability_audit/_pillars.py
 src/maintainability_audit/_practice.py
 src/maintainability_audit/_pressures.py
 src/maintainability_audit/_ranges_c.py
+src/maintainability_audit/_ranges_cobol.py
 src/maintainability_audit/_ranges_core.py
 src/maintainability_audit/_ranges_cpp.py
 src/maintainability_audit/_ranges_csharp.py
@@ -173,6 +174,7 @@ tests/test_ci_installs_the_analyzer_pool.py
 tests/test_claimed_languages.py
 tests/test_cli.py
 tests/test_clone_group_class.py
+tests/test_cobol_declarations.py
 tests/test_cognitive_complexity.py
 tests/test_cohort_statistics.py
 tests/test_concealment_properties.py

{maintainability_agent-2.6.0 → maintainability_agent-2.7.0}/src/maintainability_audit/__init__.py

@@ -1,3 +1,3 @@
 """Maintainability Audit CI."""
 
-__version__ = "2.6.0"
+__version__ = "2.7.0"

{maintainability_agent-2.6.0 → maintainability_agent-2.7.0}/src/maintainability_audit/_cognitive.py

@@ -35,6 +35,12 @@ import re
 
 from ._masking import mask_fortran_lines, mask_lines
 
+# Both live in `parsing`, and `_ranges_core` reaches nothing here, so this
+# is a sibling import rather than a cycle. COBOL's mask is not in
+# `_masking` with the others because it needs the whole file to know which
+# division a line is in — see `_ranges_cobol.mask_cobol_lines`.
+from ._ranges_cobol import mask_cobol_lines
+
 # Constructs that both cost a point and deepen the nesting for whatever
 # they contain.
 _NESTING_NODES = (ast.If, ast.For, ast.AsyncFor, ast.While, ast.ExceptHandler, ast.IfExp)
@@ -175,6 +181,57 @@ def fortran_cognitive(lines: list[str]) -> int:
     return score
 
 
+_CB_CLOSES_RE = re.compile(r"\bEND-(?:IF|EVALUATE|PERFORM|SEARCH|READ|STRING)\b", re.I)
+_CB_OPENS_RE = re.compile(
+    r"\bIF\b|\bEVALUATE\b|\bPERFORM\b(?=[^.]*\b(?:UNTIL|VARYING|TIMES)\b)|\bSEARCH\b",
+    re.I,
+)
+_CB_ELSE_RE = re.compile(r"^\s*ELSE\b|\bWHEN\b", re.I)  # noqa: S5850 - alternation is intended
+_CB_BOOLEAN_RE = re.compile(r"\b(?:AND|OR)\b", re.I)
+_CB_CONTROL_RE = re.compile(r"\b(?:IF|EVALUATE|UNTIL|VARYING|TIMES|SEARCH)\b", re.I)
+
+
+def cobol_cognitive(lines: list[str]) -> int:
+    """Cognitive complexity for a COBOL paragraph.
+
+    Nesting is read from the constructs themselves, as in Fortran, since
+    COBOL has no braces either. What COBOL adds is a second way to close
+    every open scope at once: **a period ends the sentence and with it
+    every construct the sentence opened.** Classic COBOL leans on that
+    entirely — `IF X DISPLAY Y.` opens and closes an `IF` with no
+    `END-IF` anywhere — and a reader that only counted `END-` terminators
+    would let depth climb monotonically through a paragraph and charge
+    the last statement for every branch above it.
+
+    The `PERFORM` lookahead is the other judgment. `PERFORM SOME-PARA` is
+    a call and opens nothing; `PERFORM UNTIL DONE` is a loop and does.
+    Counting every `PERFORM` as nesting would make an ordinary
+    call-per-line paragraph read as deeply nested.
+    """
+    masked = mask_cobol_lines(lines)
+    score = 0
+    depth = 0
+    for line in masked:
+        statement = line.rstrip()
+        if not statement.strip():
+            continue
+        if _CB_CLOSES_RE.search(statement):
+            depth = max(0, depth - len(_CB_CLOSES_RE.findall(statement)))
+        body = _CB_CLOSES_RE.sub(" ", statement)
+        if _CB_ELSE_RE.search(body):
+            score += 1
+            score += len(_CB_BOOLEAN_RE.findall(body))
+        else:
+            for _ in _CB_CONTROL_RE.finditer(body):
+                score += 1 + depth
+            score += len(_CB_BOOLEAN_RE.findall(body))
+        depth += len(_CB_OPENS_RE.findall(body))
+        if statement.rstrip().endswith("."):
+            # The sentence ended, and with it every scope it opened.
+            depth = 0
+    return score
+
+
 def brace_cognitive(lines: list[str], control: re.Pattern[str] | None = None) -> int:
     """Approximate cognitive complexity for a C-family declaration body.