[squid-protocol]

Fixes #4733

What. Evidence Refresh now sweeps the Db2 cases, so Db2-backed programs (GenApp, several CBSA) get their measured L3/L4 in the ledger and report on main.

• New db2 job in .github/workflows/evidence-refresh.yml: proof_sweep.py --det-only --db2-only (new flag; --aggregate --expect db2 too) with the same baseline ratchet, plus evidence.py refresh --stale --only-db2 (new flag) for the 4 Db2 records (cbsa-inqacc, cbsa-updacc, genapp-lgicdb01, genapp-lgupdb01). It uploads its sweep.json and the evidence records it wrote.
• refresh (needs: db2, if: !cancelled(), so it runs when db2 is skipped or failed) overlays those records (only evidence.json regular files), passes both sweeps to det_coverage_ledger.py update (when the Db2 sweep passed its ratchet), then re-renders pages and builds the report as before. It checks out the commit the Db2 job swept, so the ledger fingerprints match the measured tree. Auto-merge only if db2 succeeded or was skipped; a failed db2 fails the run and leaves the bot PR for a person.
• Unchanged: concurrency (cancel-in-progress false, ci: evidence-refresh finishes a running refresh instead of cancelling it on every push (#4703) #4720), the PAT/auto-merge steps (ci: evidence report refreshed by bot on main, advisory in PRs, release-gated (#4703) #4705), the non-Db2 sweep and records (--skip-db2), pinned action SHAs, permissions: contents: read (write only on refresh). actionlint and zizmor: no findings.

Cadence. db2 runs on the nightly schedule and on dispatch with db2 = true (now the default), not on every push. Measured locally (12 cores, fresh pinned container, 4 pool databases, --jobs 4): sweep of 30 Db2 cases 13.4 min, 4 record re-proofs 1.9 min, so ~15 min plus image pull (4.5 GB) and Db2 start on top; I estimate 30-45 min on a 4 vCPU hosted runner (timeout 150). A push-triggered refresh skips db2, keeps the last Db2 ledger entries and records, and the report shows them as stale rather than zero (#4730, merged). Every push would add that time ahead of the ~1 h refresh on merge-heavy days.

Runner capacity. ubuntu-latest (public repo: 4 vCPU, 16 GB, root docker) can run the container: --privileged is allowed, and Db2 used ~2 GB with 4 databases active. No Db2 CI existed before (det-sweep.yml deliberately uses --skip-db2). Not proven on a hosted runner until the first nightly/dispatch run.

Pin. equivalence_db2.IMAGE = icr.io/db2_community/db2@sha256:2de8151713c261843868c5c3411b57be6ae79d99d70a5b3022337836776bfda6 (what :latest resolved to on 2026-10-08, built 2026-07-13: the image every local Db2 proof used). Recorded in oracle_assumptions.md; a Db2 case's proof report records it under oracle.db2; tests/cobol_mainframe/test_db2_image_pin.py fails on a tag or a digest missing from the doc; a container left from another image is refused. The harness fingerprint covers equivalence_db2.py, so this change stales every evidence record (scheduled, not blocking); the next bot run re-proves them.

Harness fix found on the way. On a fresh container (the CI case) several sweep processes raced: the first sweep run against a new container lost 14 of 30 cases with KeyError: 'Database code set'. _ensure_container now serialises the start behind a lock and waits for GGDB to exist before any process goes on.

Evidence. Fresh container from the pinned digest, proof_sweep.py --det-only --db2-only --jobs 4: det: 30/30 proven, sweep: as expected. evidence.py refresh --stale --only-db2: 4/4 proven. Ledger update from the sweep works. pr_gates --fast 5/5, --ratchets 7/7.

Verify after merge. Dispatch Evidence Refresh on main (db2 = true) or wait for the nightly: the db2 job summary shows the sweep and records time; the bot PR should include det_sweep_coverage.json entries for the genapp-/cbsa- cases and the Db2 evidence records, and GenApp should show its L3/L4. (A dispatch on this branch would check out main and use the bot PAT, so it is not a safe pre-merge test.)

🤖 Generated with Claude Code

https://claude.ai/code/session_01MQNoe4wPJgr7dbUvs3DG6D

[github-actions]

🐦‍⬛ Muninn Security Scan

✅ No security issues found.

🐦‍⬛ Powered by Muninn · Skald Lab