maintainability-agent 2.6.0__tar.gz → 2.8.0__tar.gz

{maintainability_agent-2.6.0/src/maintainability_agent.egg-info → maintainability_agent-2.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: maintainability-agent
-Version: 2.6.0
+Version: 2.8.0
 Summary: Maintainability gate and AI remediation prompt generator for CI.
 Author: Marshall Guillory
 License: MIT
@@ -44,7 +44,7 @@ Dynamic: license-file
 **A deterministic, offline maintainability audit whose output is a _bounded
 work order_ for an AI coding agent** — a copy-paste prompt, per finding, that
 says *fix exactly these and refactor nothing else*. Chat-primary; CLI for CI.
-Version **2.6.0**.
+Version **2.8.0**.
 
 **Languages parsed:** Python, Java, C, C++, C#, Swift, Fortran (free-form
 *and* fixed-form), and the JS/TS family — each by a scanner written for it, and
@@ -78,9 +78,11 @@ What 1.0 guarantees:
 - **Deterministic and local.** Same tree, config, pinned analyzer versions and
   history in → same evidence, findings and score out. The analysis performs no
   network access and invokes no LLM, and **this agent does not transmit your
-  source.** Third-party analyzers it may spawn (eslint, jscpd, lizard) are
-  **not network-sandboxed** — this process does not police whether *they* phone
-  home; install them yourself for an air-gapped run.
+  source.** Every report states what it examined and produced — files,
+  declarations, findings, bounded work items — **all computed with no model
+  call**: work a metered agent never has to do. Third-party analyzers it may
+  spawn (eslint, jscpd, lizard) are **not network-sandboxed** — this process does
+  not police whether *they* phone home; install them for an air-gapped run.
 - **One uniform rubric**, readable in source, applied to every repository —
   so "better" and "worse" are not an argument. Calibrated against a
   query-selected corpus of mature open-source projects; the corpus median
@@ -183,9 +185,8 @@ policy, history consent, economics, test-suite execution, and presentation, and
 no report. A configured repository returns `choice_needed` (`run` or
 `reconfigure`), also without a report. Answering setup does not start an audit.
 `action="run"` returns the report and its bounded remediation prompt to the
-conversation. `record_history=None` follows the persisted first-run history
-consent and always appends to an existing history, while an explicit `true`
-or `false` wins.
+conversation. `record_history=None` follows the persisted first-run consent and
+always appends to an existing history; an explicit `true` or `false` wins.
 
 ```bash
 python3 -m pip install "maintainability-agent[mcp]"
@@ -193,10 +194,10 @@ maintainability-agent mcp --allow-root /absolute/path/to/repository
 ```
 
 Presentation is exactly three choices — **chat**, a **Markdown** file, or a
-single-file **HTML** report — and where to save a file is asked only after a
-file format is chosen. No report file is written without that choice. See
-[chat workflow help](docs/help/README.md) and
-[IDE and agent integration](docs/ide-agent-integration.md).
+single-file **HTML** report. Where to save is asked only after a file format is
+chosen, and no report file is written without that choice. See
+[chat workflow help](docs/help/README.md) and [IDE and agent
+integration](docs/ide-agent-integration.md).
 
 ## Automation / CI: CLI
 
@@ -290,14 +291,13 @@ SonarQube, Qlty) rather than replacing them — their SARIF folds in via
 
 ## Language support
 
-**Be clear-eyed about this: the tool does not support every language equally,
-and on an unrecognized language it will quietly under-report rather than fail.**
-Coverage comes from two layers.
+**Be clear-eyed: the tool does not support every language equally, and on an
+unrecognized language it under-reports rather than fails.** Coverage has two layers.
 
-Nine languages are parsed as of **2.4.0**: Python (1.0), Java (1.0), C (1.1),
-C++ (1.2), C# (1.3), Fortran (free-form 1.4, fixed-form 1.6), Swift (2.4), the
-JS/TS family, and HTML. Each has a scanner written for it and a documented list of what it
-misses — a language is claimed here only when both exist.
+Ten languages are parsed as of **2.7.0**: Python (1.0), Java (1.0), C (1.1),
+C++ (1.2), C# (1.3), Fortran (free-form 1.4, fixed-form 1.6), Swift (2.4),
+COBOL (2.7), the JS/TS family, and HTML. Each has a scanner written for it and a
+documented list of what it misses — a language is claimed only when both exist.
 
 **Built-in scanner (always on, no dependencies)** — reads function/class
 declarations, sizes and complexity for a fixed set of languages, and **only**
@@ -311,18 +311,19 @@ these:
 | C++ (`.cpp`, `.hpp`, `.cc`, `.cxx`, `.hh`) | dedicated brace-bounded scanner — functions, class members, namespaces, templates | Bounded; bodyless declarations are not definitions |
 | C# (`.cs`) | dedicated brace-bounded scanner — methods, constructors, `class`/`interface`/`struct`/`record`/`enum` | Bounded; properties are not declarations |
 | Swift (`.swift`) | dedicated brace-bounded scanner — functions, initialisers, subscripts, `class`/`struct`/`enum`/`protocol`/`actor` | Bounded; extension members carry their type, protocol requirements and computed properties are not declarations |
+| COBOL (`.cbl`, `.cob`, `.cpy`, and `.CBL`/`.COB`/`.CPY`) | dedicated scanner — PROCEDURE DIVISION paragraphs, bounded by the start of whatever follows; fixed-form card columns read where the layout carries them | Bounded by the next header; level numbers and container programs/sections are not declarations |
 | Fortran, free-form (`.f90`, `.f95`, `.f03`, `.f08`, `.F90`, `.F95`, `.F03`, `.F08`, `.pf`) | dedicated **keyword**-bounded scanner — modules, subroutines, functions, derived types | Bounded by `end`; measured with Fortran's own branch and nesting reading |
 | Fortran, fixed-form (`.f`, `.for`, `.ftn`, `.F`, `.FOR`, `.FTN`) | the same scanner over card-column source; continuations joined, labelled `DO` loops understood | Bounded by `end` or by the loop's label |
 | JS / TS / JSX / TSX (`.js`, `.jsx`, `.mjs`, `.cjs`, `.ts`, `.tsx`) | brace/paren depth over a masked copy | Bounded by the declaration's own braces |
 | HTML (`.html`) | same brace scanner (inline `<script>`) | Bounded |
 | TypeScript (semantic) | a recorded analysis or a locally-installed `tsc`, workspace projects included | Type-level facts; `unknown` when no checker is present |
 
-Any language **not** in that table — Go, Rust, Ruby, PHP, Kotlin,
-Swift, and the rest — is **not parsed for declarations by the built-in
-scanner.** Its files still count toward repo size, but the built-ins produce no
-function-size, complexity, duplication or dead-code findings for them, and the
-estimate leans on whatever evidence *is* available (which is why the report
-discloses its evidence tier and can withhold the grade).
+Any language **not** in that table — Go, Rust, Ruby, PHP, Kotlin, and the rest —
+is **not parsed for declarations by the built-in scanner.** Its files still count
+toward repo size, but the built-ins produce no function-size, complexity,
+duplication or dead-code findings for them, and the estimate leans on whatever
+evidence *is* available (which is why the report discloses its evidence tier and
+can withhold the grade).
 
 **Which analyzer covers which language** (the opt-in pool, when installed):
 
@@ -332,13 +333,14 @@ discloses its evidence tier and can withhold the grade).
 | Java | dedicated scanner | lizard, PMD, Checkstyle, SpotBugs |
 | C / C++ / C# | dedicated scanners | lizard, multimetric |
 | **Fortran** (free- and fixed-form) | dedicated scanner | **fortitude** — 100+ rules; **lizard** — complexity, NLOC, params |
+| **COBOL** | dedicated scanner | **none** — no offline analyzer in the catalog reads it |
 | JS / TS / JSX / TSX | brace scanner | ESLint, lizard, jscpd |
 
-Fortran reached parity in 1.6.0. lizard measures it — this project's
-catalog row for lizard was stale and said otherwise, so lizard came out
-`not-applicable` on every Fortran repository and never ran — and
-fortitude adds 100+ lint rules beside it. A lint now fails the build if
-any parsed language has no analyzer that measures complexity.
+Fortran reached parity in 1.6.0: lizard had read it for years behind a
+stale catalog row, so it came out `not-applicable` and never ran. A lint fails
+the build if a parsed language has no analyzer measuring complexity — **COBOL is
+the one disclosed exemption**, because the tooling that reads it is licensed and
+host-resident, so its external tier is empty and the report says so.
 
 **External analyzer adapters (opt-in pool)** — this is how coverage extends
 beyond the built-in set. When you enable the analyzer pool, the tool shells out
@@ -350,12 +352,11 @@ selected *and* installed (acquisition is opt-in and off by default), and where
 they measured a full concept set they become the *primary* evidence, with the
 built-ins as the fallback.
 
-So: **first-class today is Python** (and TypeScript for semantics); Java, C, C++,
-C#, free-form Fortran and the JS/TS family are bounded-but-real; every other language is only as covered as
-the external analyzer you point at it — and with no analyzer, it is
-under-reported by design. The per-language accuracy, the exact parsed set, and
-the known limitations are documented in
-[docs/language-support.md](docs/language-support.md); the adapter catalog is in
+So: **first-class today is Python** (and TypeScript for semantics); every other
+parsed language is bounded-but-real; anything outside the table is only as
+covered as the analyzer you point at it, and with none it is under-reported by
+design. Per-language accuracy and limits:
+[docs/language-support.md](docs/language-support.md); the adapter catalog:
 [docs/adapters.md](docs/adapters.md).
 
 ## What it produces
@@ -382,8 +383,8 @@ Based on ISO/IEC 25010 maintainability — modularity, reusability,
 analyzability, modifiability, testability. Scores are **rates calibrated
 against real code**, not counts: every pressure is normalized against the
 median a pinned 112-repo corpus of mature projects actually carries —
-spanning every language the scanner parses (django, angular, spring-framework,
-ghidra, LAPACK, …). How that corpus was selected, what each language actually
+eight of the ten parsed languages (django, angular, spring-framework,
+ghidra, LAPACK, …); Swift and COBOL are parsed but unanchored. How that corpus was selected, what each language actually
 reads, and what the numbers do *not* establish:
 [the calibration study](docs/calibration-2.0-study.md), so `2.5x` means
 "two and a half times what well-maintained real code shows." The corpus median
@@ -423,10 +424,9 @@ defaults. The grade is gated (A+ needs every dimension clean; a
 repo with production code and zero test files cannot earn an A-grade) and banded
 from the evidence floor, so withholding evidence never buys a better letter.
 Every threshold gate — file, function, duplication — is opted **on** for this
-repo's own CI, against thresholds stricter than the shipped defaults, so
-drifting below the bar fails the build rather than the README. (CI note:
-`actions/checkout` defaults to `fetch-depth: 1`, which hides history and costs
-roughly a grade — use `fetch-depth: 0`.)
+repo's own CI, so drifting below the bar fails the build rather than the README.
+(CI note: `actions/checkout` defaults to `fetch-depth: 1`, which hides history
+and costs roughly a grade — use `fetch-depth: 0`.)
 
 ## Platform support
 
@@ -517,14 +517,14 @@ gate, and the self-audit — is in
 
 ## Support this work
 
-This is a single-maintainer, MIT-licensed project — free to use, and built on
-a lot of unpaid hours. If it saves you or your team time, please consider
+This is a single-maintainer, MIT-licensed project — free to use, and built on a
+lot of unpaid hours. If it saves you or your team time, please consider
 sponsoring its continued development:
 
 **❤️ [Sponsor on GitHub](https://github.com/sponsors/marshallguillory86)**
 
-Sponsorship is entirely optional and never gates a feature, a fix, or support —
-the whole tool stays free and open. It just helps keep the work going.
+Sponsorship is optional and never gates a feature, a fix, or support — the whole
+tool stays free and open. It just helps keep the work going.
 
 ## Acknowledgements
 

{maintainability_agent-2.6.0 → maintainability_agent-2.8.0}/README.md

@@ -5,7 +5,7 @@
 **A deterministic, offline maintainability audit whose output is a _bounded
 work order_ for an AI coding agent** — a copy-paste prompt, per finding, that
 says *fix exactly these and refactor nothing else*. Chat-primary; CLI for CI.
-Version **2.6.0**.
+Version **2.8.0**.
 
 **Languages parsed:** Python, Java, C, C++, C#, Swift, Fortran (free-form
 *and* fixed-form), and the JS/TS family — each by a scanner written for it, and
@@ -39,9 +39,11 @@ What 1.0 guarantees:
 - **Deterministic and local.** Same tree, config, pinned analyzer versions and
   history in → same evidence, findings and score out. The analysis performs no
   network access and invokes no LLM, and **this agent does not transmit your
-  source.** Third-party analyzers it may spawn (eslint, jscpd, lizard) are
-  **not network-sandboxed** — this process does not police whether *they* phone
-  home; install them yourself for an air-gapped run.
+  source.** Every report states what it examined and produced — files,
+  declarations, findings, bounded work items — **all computed with no model
+  call**: work a metered agent never has to do. Third-party analyzers it may
+  spawn (eslint, jscpd, lizard) are **not network-sandboxed** — this process does
+  not police whether *they* phone home; install them for an air-gapped run.
 - **One uniform rubric**, readable in source, applied to every repository —
   so "better" and "worse" are not an argument. Calibrated against a
   query-selected corpus of mature open-source projects; the corpus median
@@ -144,9 +146,8 @@ policy, history consent, economics, test-suite execution, and presentation, and
 no report. A configured repository returns `choice_needed` (`run` or
 `reconfigure`), also without a report. Answering setup does not start an audit.
 `action="run"` returns the report and its bounded remediation prompt to the
-conversation. `record_history=None` follows the persisted first-run history
-consent and always appends to an existing history, while an explicit `true`
-or `false` wins.
+conversation. `record_history=None` follows the persisted first-run consent and
+always appends to an existing history; an explicit `true` or `false` wins.
 
 ```bash
 python3 -m pip install "maintainability-agent[mcp]"
@@ -154,10 +155,10 @@ maintainability-agent mcp --allow-root /absolute/path/to/repository
 ```
 
 Presentation is exactly three choices — **chat**, a **Markdown** file, or a
-single-file **HTML** report — and where to save a file is asked only after a
-file format is chosen. No report file is written without that choice. See
-[chat workflow help](docs/help/README.md) and
-[IDE and agent integration](docs/ide-agent-integration.md).
+single-file **HTML** report. Where to save is asked only after a file format is
+chosen, and no report file is written without that choice. See
+[chat workflow help](docs/help/README.md) and [IDE and agent
+integration](docs/ide-agent-integration.md).
 
 ## Automation / CI: CLI
 
@@ -251,14 +252,13 @@ SonarQube, Qlty) rather than replacing them — their SARIF folds in via
 
 ## Language support
 
-**Be clear-eyed about this: the tool does not support every language equally,
-and on an unrecognized language it will quietly under-report rather than fail.**
-Coverage comes from two layers.
+**Be clear-eyed: the tool does not support every language equally, and on an
+unrecognized language it under-reports rather than fails.** Coverage has two layers.
 
-Nine languages are parsed as of **2.4.0**: Python (1.0), Java (1.0), C (1.1),
-C++ (1.2), C# (1.3), Fortran (free-form 1.4, fixed-form 1.6), Swift (2.4), the
-JS/TS family, and HTML. Each has a scanner written for it and a documented list of what it
-misses — a language is claimed here only when both exist.
+Ten languages are parsed as of **2.7.0**: Python (1.0), Java (1.0), C (1.1),
+C++ (1.2), C# (1.3), Fortran (free-form 1.4, fixed-form 1.6), Swift (2.4),
+COBOL (2.7), the JS/TS family, and HTML. Each has a scanner written for it and a
+documented list of what it misses — a language is claimed only when both exist.
 
 **Built-in scanner (always on, no dependencies)** — reads function/class
 declarations, sizes and complexity for a fixed set of languages, and **only**
@@ -272,18 +272,19 @@ these:
 | C++ (`.cpp`, `.hpp`, `.cc`, `.cxx`, `.hh`) | dedicated brace-bounded scanner — functions, class members, namespaces, templates | Bounded; bodyless declarations are not definitions |
 | C# (`.cs`) | dedicated brace-bounded scanner — methods, constructors, `class`/`interface`/`struct`/`record`/`enum` | Bounded; properties are not declarations |
 | Swift (`.swift`) | dedicated brace-bounded scanner — functions, initialisers, subscripts, `class`/`struct`/`enum`/`protocol`/`actor` | Bounded; extension members carry their type, protocol requirements and computed properties are not declarations |
+| COBOL (`.cbl`, `.cob`, `.cpy`, and `.CBL`/`.COB`/`.CPY`) | dedicated scanner — PROCEDURE DIVISION paragraphs, bounded by the start of whatever follows; fixed-form card columns read where the layout carries them | Bounded by the next header; level numbers and container programs/sections are not declarations |
 | Fortran, free-form (`.f90`, `.f95`, `.f03`, `.f08`, `.F90`, `.F95`, `.F03`, `.F08`, `.pf`) | dedicated **keyword**-bounded scanner — modules, subroutines, functions, derived types | Bounded by `end`; measured with Fortran's own branch and nesting reading |
 | Fortran, fixed-form (`.f`, `.for`, `.ftn`, `.F`, `.FOR`, `.FTN`) | the same scanner over card-column source; continuations joined, labelled `DO` loops understood | Bounded by `end` or by the loop's label |
 | JS / TS / JSX / TSX (`.js`, `.jsx`, `.mjs`, `.cjs`, `.ts`, `.tsx`) | brace/paren depth over a masked copy | Bounded by the declaration's own braces |
 | HTML (`.html`) | same brace scanner (inline `<script>`) | Bounded |
 | TypeScript (semantic) | a recorded analysis or a locally-installed `tsc`, workspace projects included | Type-level facts; `unknown` when no checker is present |
 
-Any language **not** in that table — Go, Rust, Ruby, PHP, Kotlin,
-Swift, and the rest — is **not parsed for declarations by the built-in
-scanner.** Its files still count toward repo size, but the built-ins produce no
-function-size, complexity, duplication or dead-code findings for them, and the
-estimate leans on whatever evidence *is* available (which is why the report
-discloses its evidence tier and can withhold the grade).
+Any language **not** in that table — Go, Rust, Ruby, PHP, Kotlin, and the rest —
+is **not parsed for declarations by the built-in scanner.** Its files still count
+toward repo size, but the built-ins produce no function-size, complexity,
+duplication or dead-code findings for them, and the estimate leans on whatever
+evidence *is* available (which is why the report discloses its evidence tier and
+can withhold the grade).
 
 **Which analyzer covers which language** (the opt-in pool, when installed):
 
@@ -293,13 +294,14 @@ discloses its evidence tier and can withhold the grade).
 | Java | dedicated scanner | lizard, PMD, Checkstyle, SpotBugs |
 | C / C++ / C# | dedicated scanners | lizard, multimetric |
 | **Fortran** (free- and fixed-form) | dedicated scanner | **fortitude** — 100+ rules; **lizard** — complexity, NLOC, params |
+| **COBOL** | dedicated scanner | **none** — no offline analyzer in the catalog reads it |
 | JS / TS / JSX / TSX | brace scanner | ESLint, lizard, jscpd |
 
-Fortran reached parity in 1.6.0. lizard measures it — this project's
-catalog row for lizard was stale and said otherwise, so lizard came out
-`not-applicable` on every Fortran repository and never ran — and
-fortitude adds 100+ lint rules beside it. A lint now fails the build if
-any parsed language has no analyzer that measures complexity.
+Fortran reached parity in 1.6.0: lizard had read it for years behind a
+stale catalog row, so it came out `not-applicable` and never ran. A lint fails
+the build if a parsed language has no analyzer measuring complexity — **COBOL is
+the one disclosed exemption**, because the tooling that reads it is licensed and
+host-resident, so its external tier is empty and the report says so.
 
 **External analyzer adapters (opt-in pool)** — this is how coverage extends
 beyond the built-in set. When you enable the analyzer pool, the tool shells out
@@ -311,12 +313,11 @@ selected *and* installed (acquisition is opt-in and off by default), and where
 they measured a full concept set they become the *primary* evidence, with the
 built-ins as the fallback.
 
-So: **first-class today is Python** (and TypeScript for semantics); Java, C, C++,
-C#, free-form Fortran and the JS/TS family are bounded-but-real; every other language is only as covered as
-the external analyzer you point at it — and with no analyzer, it is
-under-reported by design. The per-language accuracy, the exact parsed set, and
-the known limitations are documented in
-[docs/language-support.md](docs/language-support.md); the adapter catalog is in
+So: **first-class today is Python** (and TypeScript for semantics); every other
+parsed language is bounded-but-real; anything outside the table is only as
+covered as the analyzer you point at it, and with none it is under-reported by
+design. Per-language accuracy and limits:
+[docs/language-support.md](docs/language-support.md); the adapter catalog:
 [docs/adapters.md](docs/adapters.md).
 
 ## What it produces
@@ -343,8 +344,8 @@ Based on ISO/IEC 25010 maintainability — modularity, reusability,
 analyzability, modifiability, testability. Scores are **rates calibrated
 against real code**, not counts: every pressure is normalized against the
 median a pinned 112-repo corpus of mature projects actually carries —
-spanning every language the scanner parses (django, angular, spring-framework,
-ghidra, LAPACK, …). How that corpus was selected, what each language actually
+eight of the ten parsed languages (django, angular, spring-framework,
+ghidra, LAPACK, …); Swift and COBOL are parsed but unanchored. How that corpus was selected, what each language actually
 reads, and what the numbers do *not* establish:
 [the calibration study](docs/calibration-2.0-study.md), so `2.5x` means
 "two and a half times what well-maintained real code shows." The corpus median
@@ -384,10 +385,9 @@ defaults. The grade is gated (A+ needs every dimension clean; a
 repo with production code and zero test files cannot earn an A-grade) and banded
 from the evidence floor, so withholding evidence never buys a better letter.
 Every threshold gate — file, function, duplication — is opted **on** for this
-repo's own CI, against thresholds stricter than the shipped defaults, so
-drifting below the bar fails the build rather than the README. (CI note:
-`actions/checkout` defaults to `fetch-depth: 1`, which hides history and costs
-roughly a grade — use `fetch-depth: 0`.)
+repo's own CI, so drifting below the bar fails the build rather than the README.
+(CI note: `actions/checkout` defaults to `fetch-depth: 1`, which hides history
+and costs roughly a grade — use `fetch-depth: 0`.)
 
 ## Platform support
 
@@ -478,14 +478,14 @@ gate, and the self-audit — is in
 
 ## Support this work
 
-This is a single-maintainer, MIT-licensed project — free to use, and built on
-a lot of unpaid hours. If it saves you or your team time, please consider
+This is a single-maintainer, MIT-licensed project — free to use, and built on a
+lot of unpaid hours. If it saves you or your team time, please consider
 sponsoring its continued development:
 
 **❤️ [Sponsor on GitHub](https://github.com/sponsors/marshallguillory86)**
 
-Sponsorship is entirely optional and never gates a feature, a fix, or support —
-the whole tool stays free and open. It just helps keep the work going.
+Sponsorship is optional and never gates a feature, a fix, or support — the whole
+tool stays free and open. It just helps keep the work going.
 
 ## Acknowledgements
 

{maintainability_agent-2.6.0 → maintainability_agent-2.8.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "maintainability-agent"
-version = "2.6.0"
+version = "2.8.0"
 description = "Maintainability gate and AI remediation prompt generator for CI."
 readme = "README.md"
 # 3.11, not 3.10. `_discovery`, `_pillars` and `_runner` all import

{maintainability_agent-2.6.0 → maintainability_agent-2.8.0/src/maintainability_agent.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: maintainability-agent
-Version: 2.6.0
+Version: 2.8.0
 Summary: Maintainability gate and AI remediation prompt generator for CI.
 Author: Marshall Guillory
 License: MIT
@@ -44,7 +44,7 @@ Dynamic: license-file
 **A deterministic, offline maintainability audit whose output is a _bounded
 work order_ for an AI coding agent** — a copy-paste prompt, per finding, that
 says *fix exactly these and refactor nothing else*. Chat-primary; CLI for CI.
-Version **2.6.0**.
+Version **2.8.0**.
 
 **Languages parsed:** Python, Java, C, C++, C#, Swift, Fortran (free-form
 *and* fixed-form), and the JS/TS family — each by a scanner written for it, and
@@ -78,9 +78,11 @@ What 1.0 guarantees:
 - **Deterministic and local.** Same tree, config, pinned analyzer versions and
   history in → same evidence, findings and score out. The analysis performs no
   network access and invokes no LLM, and **this agent does not transmit your
-  source.** Third-party analyzers it may spawn (eslint, jscpd, lizard) are
-  **not network-sandboxed** — this process does not police whether *they* phone
-  home; install them yourself for an air-gapped run.
+  source.** Every report states what it examined and produced — files,
+  declarations, findings, bounded work items — **all computed with no model
+  call**: work a metered agent never has to do. Third-party analyzers it may
+  spawn (eslint, jscpd, lizard) are **not network-sandboxed** — this process does
+  not police whether *they* phone home; install them for an air-gapped run.
 - **One uniform rubric**, readable in source, applied to every repository —
   so "better" and "worse" are not an argument. Calibrated against a
   query-selected corpus of mature open-source projects; the corpus median
@@ -183,9 +185,8 @@ policy, history consent, economics, test-suite execution, and presentation, and
 no report. A configured repository returns `choice_needed` (`run` or
 `reconfigure`), also without a report. Answering setup does not start an audit.
 `action="run"` returns the report and its bounded remediation prompt to the
-conversation. `record_history=None` follows the persisted first-run history
-consent and always appends to an existing history, while an explicit `true`
-or `false` wins.
+conversation. `record_history=None` follows the persisted first-run consent and
+always appends to an existing history; an explicit `true` or `false` wins.
 
 ```bash
 python3 -m pip install "maintainability-agent[mcp]"
@@ -193,10 +194,10 @@ maintainability-agent mcp --allow-root /absolute/path/to/repository
 ```
 
 Presentation is exactly three choices — **chat**, a **Markdown** file, or a
-single-file **HTML** report — and where to save a file is asked only after a
-file format is chosen. No report file is written without that choice. See
-[chat workflow help](docs/help/README.md) and
-[IDE and agent integration](docs/ide-agent-integration.md).
+single-file **HTML** report. Where to save is asked only after a file format is
+chosen, and no report file is written without that choice. See
+[chat workflow help](docs/help/README.md) and [IDE and agent
+integration](docs/ide-agent-integration.md).
 
 ## Automation / CI: CLI
 
@@ -290,14 +291,13 @@ SonarQube, Qlty) rather than replacing them — their SARIF folds in via
 
 ## Language support
 
-**Be clear-eyed about this: the tool does not support every language equally,
-and on an unrecognized language it will quietly under-report rather than fail.**
-Coverage comes from two layers.
+**Be clear-eyed: the tool does not support every language equally, and on an
+unrecognized language it under-reports rather than fails.** Coverage has two layers.
 
-Nine languages are parsed as of **2.4.0**: Python (1.0), Java (1.0), C (1.1),
-C++ (1.2), C# (1.3), Fortran (free-form 1.4, fixed-form 1.6), Swift (2.4), the
-JS/TS family, and HTML. Each has a scanner written for it and a documented list of what it
-misses — a language is claimed here only when both exist.
+Ten languages are parsed as of **2.7.0**: Python (1.0), Java (1.0), C (1.1),
+C++ (1.2), C# (1.3), Fortran (free-form 1.4, fixed-form 1.6), Swift (2.4),
+COBOL (2.7), the JS/TS family, and HTML. Each has a scanner written for it and a
+documented list of what it misses — a language is claimed only when both exist.
 
 **Built-in scanner (always on, no dependencies)** — reads function/class
 declarations, sizes and complexity for a fixed set of languages, and **only**
@@ -311,18 +311,19 @@ these:
 | C++ (`.cpp`, `.hpp`, `.cc`, `.cxx`, `.hh`) | dedicated brace-bounded scanner — functions, class members, namespaces, templates | Bounded; bodyless declarations are not definitions |
 | C# (`.cs`) | dedicated brace-bounded scanner — methods, constructors, `class`/`interface`/`struct`/`record`/`enum` | Bounded; properties are not declarations |
 | Swift (`.swift`) | dedicated brace-bounded scanner — functions, initialisers, subscripts, `class`/`struct`/`enum`/`protocol`/`actor` | Bounded; extension members carry their type, protocol requirements and computed properties are not declarations |
+| COBOL (`.cbl`, `.cob`, `.cpy`, and `.CBL`/`.COB`/`.CPY`) | dedicated scanner — PROCEDURE DIVISION paragraphs, bounded by the start of whatever follows; fixed-form card columns read where the layout carries them | Bounded by the next header; level numbers and container programs/sections are not declarations |
 | Fortran, free-form (`.f90`, `.f95`, `.f03`, `.f08`, `.F90`, `.F95`, `.F03`, `.F08`, `.pf`) | dedicated **keyword**-bounded scanner — modules, subroutines, functions, derived types | Bounded by `end`; measured with Fortran's own branch and nesting reading |
 | Fortran, fixed-form (`.f`, `.for`, `.ftn`, `.F`, `.FOR`, `.FTN`) | the same scanner over card-column source; continuations joined, labelled `DO` loops understood | Bounded by `end` or by the loop's label |
 | JS / TS / JSX / TSX (`.js`, `.jsx`, `.mjs`, `.cjs`, `.ts`, `.tsx`) | brace/paren depth over a masked copy | Bounded by the declaration's own braces |
 | HTML (`.html`) | same brace scanner (inline `<script>`) | Bounded |
 | TypeScript (semantic) | a recorded analysis or a locally-installed `tsc`, workspace projects included | Type-level facts; `unknown` when no checker is present |
 
-Any language **not** in that table — Go, Rust, Ruby, PHP, Kotlin,
-Swift, and the rest — is **not parsed for declarations by the built-in
-scanner.** Its files still count toward repo size, but the built-ins produce no
-function-size, complexity, duplication or dead-code findings for them, and the
-estimate leans on whatever evidence *is* available (which is why the report
-discloses its evidence tier and can withhold the grade).
+Any language **not** in that table — Go, Rust, Ruby, PHP, Kotlin, and the rest —
+is **not parsed for declarations by the built-in scanner.** Its files still count
+toward repo size, but the built-ins produce no function-size, complexity,
+duplication or dead-code findings for them, and the estimate leans on whatever
+evidence *is* available (which is why the report discloses its evidence tier and
+can withhold the grade).
 
 **Which analyzer covers which language** (the opt-in pool, when installed):
 
@@ -332,13 +333,14 @@ discloses its evidence tier and can withhold the grade).
 | Java | dedicated scanner | lizard, PMD, Checkstyle, SpotBugs |
 | C / C++ / C# | dedicated scanners | lizard, multimetric |
 | **Fortran** (free- and fixed-form) | dedicated scanner | **fortitude** — 100+ rules; **lizard** — complexity, NLOC, params |
+| **COBOL** | dedicated scanner | **none** — no offline analyzer in the catalog reads it |
 | JS / TS / JSX / TSX | brace scanner | ESLint, lizard, jscpd |
 
-Fortran reached parity in 1.6.0. lizard measures it — this project's
-catalog row for lizard was stale and said otherwise, so lizard came out
-`not-applicable` on every Fortran repository and never ran — and
-fortitude adds 100+ lint rules beside it. A lint now fails the build if
-any parsed language has no analyzer that measures complexity.
+Fortran reached parity in 1.6.0: lizard had read it for years behind a
+stale catalog row, so it came out `not-applicable` and never ran. A lint fails
+the build if a parsed language has no analyzer measuring complexity — **COBOL is
+the one disclosed exemption**, because the tooling that reads it is licensed and
+host-resident, so its external tier is empty and the report says so.
 
 **External analyzer adapters (opt-in pool)** — this is how coverage extends
 beyond the built-in set. When you enable the analyzer pool, the tool shells out
@@ -350,12 +352,11 @@ selected *and* installed (acquisition is opt-in and off by default), and where
 they measured a full concept set they become the *primary* evidence, with the
 built-ins as the fallback.
 
-So: **first-class today is Python** (and TypeScript for semantics); Java, C, C++,
-C#, free-form Fortran and the JS/TS family are bounded-but-real; every other language is only as covered as
-the external analyzer you point at it — and with no analyzer, it is
-under-reported by design. The per-language accuracy, the exact parsed set, and
-the known limitations are documented in
-[docs/language-support.md](docs/language-support.md); the adapter catalog is in
+So: **first-class today is Python** (and TypeScript for semantics); every other
+parsed language is bounded-but-real; anything outside the table is only as
+covered as the analyzer you point at it, and with none it is under-reported by
+design. Per-language accuracy and limits:
+[docs/language-support.md](docs/language-support.md); the adapter catalog:
 [docs/adapters.md](docs/adapters.md).
 
 ## What it produces
@@ -382,8 +383,8 @@ Based on ISO/IEC 25010 maintainability — modularity, reusability,
 analyzability, modifiability, testability. Scores are **rates calibrated
 against real code**, not counts: every pressure is normalized against the
 median a pinned 112-repo corpus of mature projects actually carries —
-spanning every language the scanner parses (django, angular, spring-framework,
-ghidra, LAPACK, …). How that corpus was selected, what each language actually
+eight of the ten parsed languages (django, angular, spring-framework,
+ghidra, LAPACK, …); Swift and COBOL are parsed but unanchored. How that corpus was selected, what each language actually
 reads, and what the numbers do *not* establish:
 [the calibration study](docs/calibration-2.0-study.md), so `2.5x` means
 "two and a half times what well-maintained real code shows." The corpus median
@@ -423,10 +424,9 @@ defaults. The grade is gated (A+ needs every dimension clean; a
 repo with production code and zero test files cannot earn an A-grade) and banded
 from the evidence floor, so withholding evidence never buys a better letter.
 Every threshold gate — file, function, duplication — is opted **on** for this
-repo's own CI, against thresholds stricter than the shipped defaults, so
-drifting below the bar fails the build rather than the README. (CI note:
-`actions/checkout` defaults to `fetch-depth: 1`, which hides history and costs
-roughly a grade — use `fetch-depth: 0`.)
+repo's own CI, so drifting below the bar fails the build rather than the README.
+(CI note: `actions/checkout` defaults to `fetch-depth: 1`, which hides history
+and costs roughly a grade — use `fetch-depth: 0`.)
 
 ## Platform support
 
@@ -517,14 +517,14 @@ gate, and the self-audit — is in
 
 ## Support this work
 
-This is a single-maintainer, MIT-licensed project — free to use, and built on
-a lot of unpaid hours. If it saves you or your team time, please consider
+This is a single-maintainer, MIT-licensed project — free to use, and built on a
+lot of unpaid hours. If it saves you or your team time, please consider
 sponsoring its continued development:
 
 **❤️ [Sponsor on GitHub](https://github.com/sponsors/marshallguillory86)**
 
-Sponsorship is entirely optional and never gates a feature, a fix, or support —
-the whole tool stays free and open. It just helps keep the work going.
+Sponsorship is optional and never gates a feature, a fix, or support — the whole
+tool stays free and open. It just helps keep the work going.
 
 ## Acknowledgements
 

{maintainability_agent-2.6.0 → maintainability_agent-2.8.0}/src/maintainability_agent.egg-info/SOURCES.txt

@@ -11,6 +11,7 @@ src/maintainability_audit/__init__.py
 src/maintainability_audit/__main__.py
 src/maintainability_audit/_adapters.py
 src/maintainability_audit/_analysis.py
+src/maintainability_audit/_anchor.py
 src/maintainability_audit/_arguments.py
 src/maintainability_audit/_aspects.py
 src/maintainability_audit/_attestation.py
@@ -59,6 +60,7 @@ src/maintainability_audit/_pillars.py
 src/maintainability_audit/_practice.py
 src/maintainability_audit/_pressures.py
 src/maintainability_audit/_ranges_c.py
+src/maintainability_audit/_ranges_cobol.py
 src/maintainability_audit/_ranges_core.py
 src/maintainability_audit/_ranges_cpp.py
 src/maintainability_audit/_ranges_csharp.py
@@ -142,6 +144,7 @@ tests/test_analyzer_provenance_exclusions.py
 tests/test_analyzer_scoring_path.py
 tests/test_analyzer_spread_range.py
 tests/test_analyzer_xml_bounds.py
+tests/test_anchor_disclosure.py
 tests/test_annotations_match_behaviour.py
 tests/test_anticipated_refusals.py
 tests/test_architecture.py
@@ -173,6 +176,7 @@ tests/test_ci_installs_the_analyzer_pool.py
 tests/test_claimed_languages.py
 tests/test_cli.py
 tests/test_clone_group_class.py
+tests/test_cobol_declarations.py
 tests/test_cognitive_complexity.py
 tests/test_cohort_statistics.py
 tests/test_concealment_properties.py
@@ -281,6 +285,7 @@ tests/test_runner.py
 tests/test_sarif.py
 tests/test_scan_history.py
 tests/test_scan_scope.py
+tests/test_scanner_unsafe_direction.py
 tests/test_scanning.py
 tests/test_schema_fidelity.py
 tests/test_scope_conformance.py
@@ -300,6 +305,7 @@ tests/test_tdd_structure.py
 tests/test_test_commands.py
 tests/test_test_execution_class.py
 tests/test_three_presentations.py
+tests/test_tree_chosen_spawn.py
 tests/test_trends.py
 tests/test_type_fields_not_functions_class.py
 tests/test_uat_falsifiers.py

{maintainability_agent-2.6.0 → maintainability_agent-2.8.0}/src/maintainability_audit/__init__.py

@@ -1,3 +1,3 @@
 """Maintainability Audit CI."""
 
-__version__ = "2.6.0"
+__version__ = "2.8.0"