cobolwork 0.9.0

Summary

cobolwork 0.9.0 is the release candidate. The build gate gains its errors and truncation sets, an in-stream finding is labelled by running its job, the flow walk reaches every source of the largest repositories it had cut short, and IBM's own published listings witness the parser's layouts.

• build reports a file, Db2 or CICS status the program sets and never tests, and input a STRING, a MOVE, an arithmetic statement or a selector drops without an abend: three status rules and eighteen truncation rules, each warning until its rate is recorded.
• A jcl-instream finding is labelled by running its job through the finding's step, with the in-stream data as marker records and the repository's data sets as z/OS records; a run that cannot reach the step says why.
• The flow walk examines only a call's own return edge from a subprogram many places call, and its bounds rise to 79 million edges a walk and 2.1 billion in all: ACAS walks every source and reports 185 findings for 120.
• Twenty-four Enterprise COBOL Data Division Maps published beside their sources agree with the parser on every one of 8,595 sizes and offsets, once a pointer holds 4 bytes under the IBM standard; 322 IBM-compiled units and ironwork accept and refuse alike.

Limit: Negatives from coverage and two-model labels ship unmeasured, as decision D-11 allows, and move to 1.1. The twenty-one new rules warn until their firing rates are recorded. Unieuro's flow walk still stops at the total bound.

What 0.9.0 adds over 0.8.0

Install: npm install -g @portll/cobolwork or pip install cobolwork; either gives the command cobolwork. The PyPI package runs the same files with the Node.js on your PATH, which must be Node 22 or later.

The build gate

• The errors set reports a status-setting statement where a route from it reaches a read of what it wrote, or the next statement on the same file, Db2 or CICS, without a test of the status (build-gate.md section 11a). A file statement with an AT END, INVALID KEY or EXCEPTION phrase handles its own status, a CLOSE sets none that is reported, and a cursor's OPEN or FETCH is reported only where no later statement of the cursor tests the status. A program whose order is unread is left unjudged.
• The truncation set reports a STRING or UNSTRING with no ON OVERFLOW that can overflow, a MOVE or unguarded arithmetic into fewer integer digits, and a selector with no WHEN OTHER, each as a sink with rows for the command line, a job, a terminal, the web and file records. A STRING whose sending items fit the receiver is no sink.
• A fix to a command sink is credited where the fixed command reads the input from an environment variable the program sets by name, every read a quoted argument of a program that does not run its arguments, and the whole field passed a class test (G1.10).

Labels from runs

• bench/label-job.mjs runs a finding's job under ironwork job from a copy of the JCL in which the finding's in-stream data is marker records, ending before the next step. Data sets hold z/OS records copied from the repository's file of that name where its length is a whole number of records, a generation data group gets its base and generations, and an indexed or relative file gets an empty cluster. A job that cannot be prepared or stops short of the step is labelled by its program alone and says why in jobNotRun. Job labels record taint at the finding's operation under --trace-input.
• A program's run writes each DD at its FD's fixed record length, names a long ASSIGN both ways, and gives an indexed file ordered keys only where it is the finding's source. Confirmed CABS labels rose from 9 to 22.
• A program with a level-66 entry inside its record is run under --compliance extended, and its labels record that stratum; a Language Environment condition in a CICS task is read as transaction abend 4038.

The flow engine

• A node with eight or more return edges holds them by call site, and a state with a call context examines only its own call's return: the walk reaches the same states in the same order and examines fewer edges. ACAS's flow set takes 264 s against 410 s with the same report.
• The walk bounds are 79 million edges for one walk and 2.1 billion in all, what ACAS needs with a margin, where 5 million and 500 million cut 82 of its walks. Only repositories that reached the old bounds change, each gaining findings and losing no route.
• A field's lower-bound facts are kept by bound as well as in order: a program that increments a counter in thousands of places, NIST's DB105A among them, analyses in three quarters of the time with identical findings.

IBM's output as a witness

• diag/mine-ibm-output.mjs inventories the Enterprise COBOL listings and job logs public repositories hold: compiler levels, listing sections, options in effect, and each compile-time and run-time message id, keeping what the system wrote apart from what a file quotes.
• diag/ibm-listing.mjs reads a listing's source with COPY expansions marked, its Data Division Map and its diagnostics, through form feeds, the ^L a capture tool writes for one, and a copybook the listing lacks. diag/grade-against-ibm.mjs pairs the map's items with the parser's by depth and name: 8,595 of 8,595 sizes and offsets agree over 24 maps from IBM's z/OS samples and bec-denmark/becut. diag/refusals-against-ibm.mjs sends each listing's source through ironwork check: over 322 units, 312 both accept and 10 both refuse, none the other way.
• A POINTER holds 4 bytes under the IBM standard, as Enterprise COBOL lays it out under LP(32); GnuCOBOL and Micro Focus keep 8. Before the change 17 sizes and 98 offsets disagreed, every one a pointer.

Memory

• The command line states the machine's free memory as 1024 MB unless the operator has stated it, since the guard's free term counts free pages only on this machine.