spec: generated CicsSpec.java + ggcics_spec.h, drift test (#4270, spec PR 4)

[squid-protocol]

Part of #4270.

Spec PR 4 (docs/language_status/cics_command_spec.md section 7; decisions 9.2): the runtimes' RESP and default-abend tables are generated from gitgalaxy/standards/cics and committed, and a drift test fails when one is stale. The runtimes' behaviour stays hand-written; only the tables moved. Crucible logs are never derived from the spec (section 6 untouched).

What changed

• python -m gitgalaxy.standards.cics regen rewrites the committed files; regen --check exits 1 when one is stale; regen --out DIR renders elsewhere. The renderers are section lists (JAVA_SECTIONS / C_SECTIONS in cli.py): a later table is one more section.
• gitgalaxy/tools/cobol_to_java/CicsSpec.java (package <pkg>.cics): name / condition / resp / abcodeFor. It sits beside the transaction forge, not in cobolrt, because the forge emits CicsTask into <pkg>.cics even for a forge-only project with no cobolrt; CicsForge.runtime_sources() emits it beside CicsTask, and pyproject ships it. CicsTask.respName / abcodeFor and DetCics.condition / resp delegate to it.
• tests/equivalence/cics/ggcics_spec.h: DFHRESP_<condition> (all 104) and condition_abcode. ggcics.c includes it, drops its own condition_abcode, and defines its short condition names from it (NOTFND = DFHRESP_NOTFND, ..., ERRCOND = DFHRESP_ERROR): no RESP number is typed in the stub. (Bare names in the header would collide with stdio's EOF.) The ggcics.c edit is limited to the include and the enum / table lines.
• Drift checks: the cics-spec ratchet (first in pr_gates.py --ratchets: regen --check) and tests/core_engine/test_cics_spec.py (not stale; the runtimes keep no hand-copied case arms; the stub's enums are all DFHRESP_*).
• Deleted the three PR 4 transitional equality tests (test_cics_spec_equality.py: the DetCics, CicsTask and ggcics switch / enum checks). Tests that compile CicsTask by hand now add CicsSpec.
• SPEC_PRS_DONE["4"], cics_spec_status.md re-rendered (json format unchanged), spec doc status paragraph.

Narrow readings

• Only the RESP and abend tables are generated. Section 3 also lists "refusal constants" for CicsSpec.java / ggcics_spec.h, but the runtime refusal texts are PR 5's ("refusals of unstated facts share their text"), as are the stated facts. cics_crucible.CONDITION_ABCODE ("PR 4/5" in the equality test) is the runner's table, not a runtime's, so it stays for PR 5 with its equality test.
• EIB facts (det: state EIBTASKN on both harness sides (#4270) #4616, eib.py EIB_FACTS): not generated here. They are stated facts (PR 5's fact wiring); generating a table nobody reads yet would be a field with no consumer. They slot in as one more section (_java_facts / _c_facts) in PR 5.
• One intended difference: a RESP name / number the old partial switches lacked now resolves (DetCics.resp("FILENOTFOUND") is 12, CicsTask.respName(12) is FILENOTFOUND) instead of throwing / giving RESP<n>. No proven path reaches those arms (verdicts below are identical).

No-behaviour-change evidence (rebased on origin/main c0bb2f28f)

• det_port.py check against origin/main: 45 CICS ports change, all only in cobolrt/cics/DetCics.java (the same 60-line delegation); 14 unchanged; no port's own code (service/) changed.
• proof_sweep.py --det-only --skip-db2, base (origin/main) vs branch: 40 cases each, 37 proven, verdicts, coverage lines and translated counts identical (only seconds differ); "sweep: as expected" on both.
• The 18 changed ports the sweep skips (Db2: carddemo-cotrtlic/cotrtupc, cbsa-*, genapp-db, mortgage-cmort) re-proven on the branch (proof_sweep.py --det-only --cases ...): 18/18 PROVED, "sweep: as expected" against det_sweep_baseline.json (no base run for these: Db2 has one lock).
• cics_crucible.py --sides cobol-stub --offline: 86 pass / 0 fail / 0 unsupported before and after; tests/cics_crucible/baseline.json untouched.

Gates

• pr_gates.py --ratchets: 7/7 PASS (cics-spec, ports, port-surface, estate, fact-crosscheck, completeness, ground-truth).
• pr_gates.py --fast: PASS (lint, audits, secrets, xray, gauntlet). An earlier full local run passed golden before a mypy-only fix (cli.py variable reuse); per the owner's rule the full suite is CI's.
• Targeted pytest: test_cics_spec, test_cics_spec_equality, test_cics_spec_status, tests/cics_crucible/, test_det_translate, test_facade_layout_4449, test_equivalence_cics, test_equivalence_faults: all pass.

Spec PR 5 starting point

Fact wiring: generate the stated facts (command facts + eib.EIB_FACTS: setter names, GGCICS_* env vars, region defaults) and the shared runtime refusal texts as new sections; cics_crucible.py takes REGION_* and CONDITION_ABCODE from the spec; delete the remaining equality tests (runtime refusal texts, stated facts, CONDITION_ABCODE).

🤖 Generated with Claude Code

[github-actions]

🐦‍⬛ Muninn Security Scan

✅ No security issues found.

🐦‍⬛ Powered by Muninn · Skald Lab