Source Transformation Integrity in Legacy COBOL Systems: A Static Analysis Approach to Detecting Format-Dependent Semantic Divergence

Abstract

The compilation format flag for COBOL fixed-format source code is not stored in the source file — it lives in the build system, CI configuration, or operator invocation. When that flag changes, the positional semantics of column 7 (the indicator area) change with it: a comment under -fixed may become active code under -free, or the program may fail to compile entirely. We demonstrate this with a single unmodified file: compiled with cobc -fixed it executes and produces correct output; compiled with cobc -free (GnuCOBOL 3.1.2, same version) it produces ten compilation errors. We present cobol-shield, a static analysis toolkit that detects format boundary conditions before transformation occurs and classifies findings under a three-tier evidence framework. Validation against three open-source COBOL projects yields two confirmed findings with observable proof-of-concept outputs, a systemic defect in 25 of 29 IBM CICS modules, and a characterization of the false positive profile of each detection rule. All artifacts are publicly available at https://github.com/LuisCastellanos-dev/cobol-shield.