Skip to content

equivalence: a port's proof runs the programs its task LINKs to as Java - #4207

Merged
squid-protocol merged 6 commits into
mainfrom
fix/model-proof-linked-programs
Oct 3, 2026
Merged

squid-protocol merged 6 commits into
mainfrom
fix/model-proof-linked-programs

Conversation

@squid-protocol

Copy link
Copy Markdown
Owner

Fixes #4188.

The problem. A case's "programs" (the programs its task LINKs to) ran on the Java side as generated stubs when a port was proven, so whatever they wrote never appeared there. CBSA INQACC and XFRFUN (which LINK ABNDPROC) and GenApp LGUPDB01 (which LINKs LGUPVS01) could not prove, however right the port was.

The fix. prepare_project resolves each LINKed program for a port's proof, in this order:

  1. the port's own service, if it carries one;
  2. the program's committed model port (the case that proves it);
  3. its deterministic translation from this checkout.

The CICS report names each program's origin (report.json → linked_programs). Det-port runs (det_port.py) already translated the extras and are unchanged.

Re-proving the loop's stored attempts, unedited (--faults all):

Program Attempts proven Coverage LINKed program's Java
CBSA INQACC 2, 3, 4 (attempt 1 not proven) 14 scenarios, 22/25 paragraphs, 13/25 branches ABNDPROC: det port
GenApp LGUPDB01 1, 2, 3, 4 5 scenarios, 8/9 paragraphs, 17/38 branches LGUPVS01: det port
CBSA XFRFUN none (1–3; attempt 4 produced no port) — ABNDPROC: det port

XFRFUN's remaining difference is in the model's port, not the harness: on the two null-date scenarios its ABND-CODE is RUF3 where the COBOL writes RUF2.

The proven INQACC and LGUPDB01 ports are in a separate PR, [needs Joe's review].

Model sweep: running (the first run was cut off by a background time limit on a heavily loaded machine). The result will be posted here.

Tests: test_linked_programs.py (committed-model-port origin, port-carried origin); ruff_audit --ci clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_01RZE6us7fUL6Hynk59rWLvZ

squid-protocol and others added 2 commits October 3, 2026 00:15
…va (#4188)

A case's "programs" (the programs its task LINKs to) ran on the Java side as
their generated stubs when a port was proven, so anything they write never
appeared there: CBSA INQACC and XFRFUN (-> ABNDPROC) and GenApp LGUPDB01
(-> LGUPVS01) could not prove however right the port was.

prepare_project now resolves each LINKed program for a port's proof: the port's
own service if it carries one, else the program's committed model port (the
case proving it), else its deterministic translation from this checkout; the
CICS report names each origin (report.json linked_programs).

Re-proving the loop's stored attempts, unedited (--faults all):
  INQACC   attempts 2-4 proven (14 scenarios); attempt 1 not proven
  LGUPDB01 attempts 1-4 proven (5 scenarios)
  XFRFUN   attempts 1-3 not proven: ABND-CODE RUF3 vs the COBOL's RUF2 on
           the two null-date scenarios -- a difference in the model's port

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RZE6us7fUL6Hynk59rWLvZ
@github-actions

github-actions Bot commented Oct 3, 2026

Copy link
Copy Markdown
Contributor

🐦‍⬛ Muninn Security Scan

✅ No security issues found.

🐦‍⬛ Powered by Muninn · Skald Lab

squid-protocol and others added 4 commits October 3, 2026 06:02
…ven once LINKed programs run (#4188) (#4208)

The porting loop's stored attempts (claude-sonnet-5-5, no tools, ticket prompt
only), byte-identical to its records, each with provenance.json. The loop
called them not proven because a port's proof ran the LINKed program (ABNDPROC,
LGUPVS01) as its stub; with #4188 they prove unedited:
  cbsa-inqacc     attempt 2: 14 scenarios, 22/25 paragraphs, 13/25 branches
  genapp-lgupdb01 attempt 1: 5 scenarios, 8/9 paragraphs, 17/38 branches


Claude-Session: https://claude.ai/code/session_01RZE6us7fUL6Hynk59rWLvZ

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…t and the LINKed-program origins

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RZE6us7fUL6Hynk59rWLvZ
…ram has the DetSql seam (#4173 x #4188)

A model port reaches Db2 its own way. Once #4188 runs a task's LINKed programs from their det ports,
DetSql is on the classpath and the plan installed, but a fault on the model-ported program's own
statement never fires: 'faults fired differ: cobol [..], java []'. The seam is now decided per statement
owner (sql_seam_programs): a fault whose program's Java does not use DetSql makes the task not judged,
with the no-hook reason; a fault on a det-ported LINKed program's statement is injected and judged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RZE6us7fUL6Hynk59rWLvZ
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RZE6us7fUL6Hynk59rWLvZ
def test_sql_seam_is_decided_per_statement_owner(tmp_path):
"""#4173 x #4188: a model-ported main program has no seam even when a det-ported program it LINKs to puts
DetSql on the classpath; a fault on the det program's own statement can be injected and judged."""
import equivalence_cics as ec


def test_a_det_main_program_has_the_seam(tmp_path):
import equivalence_cics as ec
@squid-protocol
squid-protocol merged commit 646369c into main Oct 3, 2026
30 checks passed
@squid-protocol
squid-protocol deleted the fix/model-proof-linked-programs branch October 3, 2026 10:24
@squid-protocol

Copy link
Copy Markdown
Owner Author

Verification after the SQL-fault integration fix (868f2df... / 368096a, 879368a), merged here as 646369c.

Root cause. #4200 decided the SQL fault seam once per task: it checked whether DetSql was on the classpath. Once #4188 runs a task's LINKed programs from their det ports, DetSql is always on the classpath, so the plan was installed. But a fault on the model-ported program's own statement can never fire there, which gave "faults fired differ: cobol [..], java []".

Fix. The seam is now decided per statement owner (sql_seam_programs / sql_unjudged):

  • a fault whose program's Java doesn't use DetSql makes the task "not judged", with the no-hook reason;
  • a fault on a det-ported LINKed program's own statement is still injected and judged.

Both directions are unit-tested.

Sweeps on the branch head:

🤖 Generated with Claude Code

https://claude.ai/code/session_01RZE6us7fUL6Hynk59rWLvZ

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

equivalence: model-port proofs don't run a case's LINKed programs (INQACC, XFRFUN, LGUPDB01 unprovable)

2 participants