Guardrail: String compareTo/equals on a layout field is a collation violation (Part of #4035)

[squid-protocol]

Part of #4035 (layer 2: the guardrail). Layer 1 landed in #5339.

What

• cobol_to_java_guardrail.py: new collation violation. .compareTo( / .compareToIgnoreCase( / .equals( / .equalsIgnoreCase( / Objects.equals( with a String field of the generated layout (or its getX()) on either side, through trim()-style pass-throughs, is rejected with the CobolCompare call to use. The baseline now records string_fields per data file (only when non-empty); a baseline without the key leaves the rule inert (no baseline version bump).
• 4 new tests in test_agent_guardrail.py: reader captures String fields (annotated field, record component, not BigDecimal/Map); each comparison form; what passes (BigDecimal compareTo, CobolCompare.eq, comment/literal, non-layout names); old baseline inert.
• README guardrail line.

Class table

member	status
compareTo / compareToIgnoreCase / equals / equalsIgnoreCase / Objects.equals, field or getter, either side	this PR
String reaching a comparison via a local/parameter	sibling gap (needs type flow)
layer 3 boundary inputs (equivalence_inputs.py)	remaining slice
level-88 predicates	later item of the issue

Evidence

All proven ports under tests/equivalence/*/port (CardDemo, CBSA, GenApp): 0 collation hits. pr_gates --fast 6/6; test_agent_guardrail + tree-wide guards pass. No detector change, so no golden bless.

Cross-repo

None.

🤖 Generated with Claude Code

[squid-protocol]

No description provided.

[squid-protocol]

No description provided.

[github-actions]

🐦‍⬛ Muninn Security Scan

✅ No security issues found.

🐦‍⬛ Powered by Muninn · Skald Lab

[squid-protocol]

PR #5414 @ 3db04d3: 2 failed check(s)

== ground-truth part 1/2 (failure) -- real
https://github.com/squid-protocol/gitgalaxy/actions/runs/39102121586/job/117600839677
repro: python -m pytest -q tests/cobol_mainframe/test_refraction_snapshot.py::test_excerpt_snapshot[cics-async-api-credit-card-application-example] tests/cobol_mainframe/test_refraction_snapshot.py::test_excerpt_snapshot[cics-banking-sample-application-cbsa] tests/cobol_mainframe/test_refraction_snapshot.py::test_excerpt_snapshot[cics-genapp] tests/cobol_mainframe/test_refraction_snapshot.py::test_full_corpus_snapshot[cics-banking-sample-application-cbsa] tests/cobol_mainframe/test_refraction_snapshot.py::test_full_corpus_snapshot[dbb-mortgage-application] tests/cobol_mainframe/test_refraction_snapshot.py::test_full_corpus_snapshot[zecs]
failing tests: tests/cobol_mainframe/test_refraction_snapshot.py::test_excerpt_snapshot[cics-async-api-credit-card-application-example] tests/cobol_mainframe/test_refraction_snapshot.py::test_excerpt_snapshot[cics-banking-sample-application-cbsa] tests/cobol_mainframe/test_refraction_snapshot.py::test_excerpt_snapshot[cics-genapp] tests/cobol_mainframe/test_refraction_snapshot.py::test_full_corpus_snapshot[cics-banking-sample-application-cbsa] tests/cobol_mainframe/test_refraction_snapshot.py::test_full_corpus_snapshot[dbb-mortgage-application] tests/cobol_mainframe/test_refraction_snapshot.py::test_full_corpus_snapshot[zecs]
errors:
fail-on-cache-miss: false
E AssertionError: 1 generated file(s) differ from cics-async-api-credit-card-application-example's snapshot; bless with refraction_snapshot.py update
tests/cobol_mainframe/test_refraction_snapshot.py:26: AssertionError
E AssertionError: 1 generated file(s) differ from cics-banking-sample-application-cbsa's snapshot; bless with refraction_snapshot.py update
E AssertionError: 1 generated file(s) differ from cics-genapp's snapshot; bless with refraction_snapshot.py update
E AssertionError: 1 generated file(s) differ from cics-banking-sample-application-cbsa's snapshot; bless with refraction_snapshot.py update --corpus cics-banking-sample-application-cbsa
E AssertionError: 1 generated file(s) differ from zecs's snapshot; bless with refraction_snapshot.py update --corpus zecs
E AssertionError: 1 generated file(s) differ from dbb-mortgage-application's snapshot; bless with refraction_snapshot.py update --corpus dbb-mortgage-application
FAILED tests/cobol_mainframe/test_refraction_snapshot.py::test_excerpt_snapshot[cics-async-api-credit-card-application-example] - AssertionError: 1 generated file(s) differ from cics-async-api-credit-card-application-example's snapshot; ble
FAILED tests/cobol_mainframe/test_refraction_snapshot.py::test_excerpt_snapshot[cics-banking-sample-application-cbsa] - AssertionError: 1 generated file(s) differ from cics-banking-sample-application-cbsa's snapshot; bless with refraction_ FAILED tests/cobol_mainframe/test_refraction_snapshot.py::test_excerpt_snapshot[cics-genapp] - AssertionError: 1 generated file(s) differ from cics-genapp's snapshot; bless with refraction_snapshot.py updateFAILED tests/cobol_mainframe/test_refraction_snapshot.py::test_full_corpus_snapshot[cics-banking-sample-application-cbsa] - AssertionError: 1 generated file(s) differ from cics-banking-sample-application-cbsa's snapshot; bless withrefract
FAILED tests/cobol_mainframe/test_refraction_snapshot.py::test_full_corpus_snapshot[zecs] - AssertionError: 1 generated file(s) differ from zecs's snapshot; bless with refraction_snapshot.py update --corpus zecs
FAILED tests/cobol_mainframe/test_refraction_snapshot.py::test_full_corpus_snapshot[dbb-mortgage-application] - AssertionError: 1 generated file(s) differ from dbb-mortgage-application's snapshot; bless with `refraction_snapshot.py update -
##[error]Process completed with exit code 1.
log tail:
archive: true
env:
GITGALAXY_LICENSE_KEY: COMMUNITY_FREE_TIER
GITGALAXY_MAINFRAME_CORPORA: /home/runner/work/gitgalaxy/gitgalaxy/.mainframe_corpora
PYTHONUTF8: 1
pythonLocation: /opt/hostedtoolcache/Python/3.12.15/x64
PKG_CONFIG_PATH: /opt/hostedtoolcache/Python/3.12.15/x64/lib/pkgconfig
Python_ROOT_DIR: /opt/hostedtoolcache/Python/3.12.15/x64
Python2_ROOT_DIR: /opt/hostedtoolcache/Python/3.12.15/x64
Python3_ROOT_DIR: /opt/hostedtoolcache/Python/3.12.15/x64
LD_LIBRARY_PATH: /opt/hostedtoolcache/Python/3.12.15/x64/lib
##[endgroup]
With the provided path, there will be 1 file uploaded
Artifact name is valid!
Root directory input is valid!
Uploading artifact: test-times-ground-truth-part-1.zip
Beginning upload of artifact content to blob storage
Uploaded bytes 85372
Finished uploading artifact content to blob storage!
SHA256 digest of uploaded artifact is 1b06829127874980ff99e7a47776c14652d1b896038993c5d98aeb9274e770ac
Finalizing artifact upload
Artifact test-times-ground-truth-part-1 successfully finalized. Artifact ID 12126928942
Artifact test-times-ground-truth-part-1 has been successfully uploaded! Final size is 85372 bytes. Artifact ID is 12126928942
Artifact download URL: https://github.com/squid-protocol/gitgalaxy/actions/runs/39102121586/artifacts/12126928942
Post job cleanup.
[command]/usr/bin/git version
git version 2.55.0
Temporarily overriding HOME='/home/runner/work/_temp/fff28e32-8f9d-44bb-8e4a-8df009843f3d' before making global git config changes
Adding repository directory to the temporary git global config as a safe directory
[command]/usr/bin/git config --global --add safe.directory /home/runner/work/gitgalaxy/gitgalaxy/gitgalaxy
Removing SSH command configuration
[command]/usr/bin/git config --local --name-only --get-regexp core.sshCommand
[command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'core.sshCommand' && git config --local --unset-all 'core.sshCommand' || :"
Removing HTTP extra header
[command]/usr/bin/git config --local --name-only --get-regexp http.https://github.com/.extraheader
[command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'http.https://github.com/.extraheader' && git config --local --unset-all 'http.https://github.com/.extraheader' || :"
Removing includeIf entries pointing to credentials config files
[command]/usr/bin/git config --local --name-only --get-regexp ^includeIf.gitdir:
[command]/usr/bin/git submodule foreach --recursive git config --local --show-origin --name-only --get-regexp remote.origin.url
Cleaning up orphan processes

== ground-truth part 2/2 (failure) -- real
https://github.com/squid-protocol/gitgalaxy/actions/runs/39102121586/job/117600839674
repro: python -m pytest -q tests/cobol_mainframe/test_refraction_snapshot.py::test_excerpt_snapshot[aws-mainframe-modernization-carddemo] tests/cobol_mainframe/test_refraction_snapshot.py::test_excerpt_snapshot[dbb-mortgage-application] tests/cobol_mainframe/test_refraction_snapshot.py::test_excerpt_snapshot[dsf] tests/cobol_mainframe/test_refraction_snapshot.py::test_excerpt_snapshot[zecs] tests/cobol_mainframe/test_refraction_snapshot.py::test_excerpt_snapshot[zopeneditor-sample] tests/cobol_mainframe/test_refraction_snapshot.py::test_full_corpus_snapshot[aws-mainframe-modernization-carddemo] tests/cobol_mainframe/test_refraction_snapshot.py::test_full_corpus_snapshot[cics-async-api-credit-card-application-example] tests/cobol_mainframe/test_refraction_snapshot.py::test_full_corpus_snapshot[cics-genapp] tests/cobol_mainframe/test_refraction_snapshot.py::test_full_corpus_snapshot[dsf] tests/cobol_mainframe/test_refraction_snapshot.py::test_full_corpus_snapshot[zopeneditor-sample]
failing tests: tests/cobol_mainframe/test_refraction_snapshot.py::test_excerpt_snapshot[aws-mainframe-modernization-carddemo] tests/cobol_mainframe/test_refraction_snapshot.py::test_excerpt_snapshot[dbb-mortgage-application] tests/cobol_mainframe/test_refraction_snapshot.py::test_excerpt_snapshot[dsf] tests/cobol_mainframe/test_refraction_snapshot.py::test_excerpt_snapshot[zecs] tests/cobol_mainframe/test_refraction_snapshot.py::test_excerpt_snapshot[zopeneditor-sample] tests/cobol_mainframe/test_refraction_snapshot.py::test_full_corpus_snapshot[aws-mainframe-modernization-carddemo] tests/cobol_mainframe/test_refraction_snapshot.py::test_full_corpus_snapshot[cics-async-api-credit-card-application-example] tests/cobol_mainframe/test_refraction_snapshot.py::test_full_corpus_snapshot[cics-genapp] tests/cobol_mainframe/test_refraction_snapshot.py::test_full_corpus_snapshot[dsf] tests/cobol_mainframe/test_refraction_snapshot.py::test_full_corpus_snapshot[zopeneditor-sample]
errors:
fail-on-cache-miss: false
E AssertionError: 1 generated file(s) differ from aws-mainframe-modernization-carddemo's snapshot; bless with refraction_snapshot.py update
tests/cobol_mainframe/test_refraction_snapshot.py:26: AssertionError
E AssertionError: 1 generated file(s) differ from dbb-mortgage-application's snapshot; bless with refraction_snapshot.py update
E AssertionError: 1 generated file(s) differ from dsf's snapshot; bless with refraction_snapshot.py update
E AssertionError: 1 generated file(s) differ from zecs's snapshot; bless with refraction_snapshot.py update
E AssertionError: 1 generated file(s) differ from zopeneditor-sample's snapshot; bless with refraction_snapshot.py update
E AssertionError: 1 generated file(s) differ from zopeneditor-sample's snapshot; bless with refraction_snapshot.py update --corpus zopeneditor-sample
E AssertionError: 1 generated file(s) differ from aws-mainframe-modernization-carddemo's snapshot; bless with refraction_snapshot.py update --corpus aws-mainframe-modernization-carddemo
E AssertionError: 1 generated file(s) differ from cics-genapp's snapshot; bless with refraction_snapshot.py update --corpus cics-genapp
E AssertionError: 1 generated file(s) differ from dsf's snapshot; bless with refraction_snapshot.py update --corpus dsf
E AssertionError: 1 generated file(s) differ from cics-async-api-credit-card-application-example's snapshot; bless with refraction_snapshot.py update --corpus cics-async-api-credit-card-application-example
FAILED tests/cobol_mainframe/test_refraction_snapshot.py::test_excerpt_snapshot[aws-mainframe-modernization-carddemo] - AssertionError: 1 generated file(s) differ from aws-mainframe-modernization-carddemo's snapshot; bless with refraction_ FAILED tests/cobol_mainframe/test_refraction_snapshot.py::test_excerpt_snapshot[dbb-mortgage-application] - AssertionError: 1 generated file(s) differ from dbb-mortgage-application's snapshot; bless with refraction_snapshot.py updateFAILED tests/cobol_mainframe/test_refraction_snapshot.py::test_excerpt_snapshot[dsf] - AssertionError: 1 generated file(s) differ from dsf's snapshot; bless withrefraction_snapshot.py updateFAILED tests/cobol_mainframe/test_refraction_snapshot.py::test_excerpt_snapshot[zecs] - AssertionError: 1 generated file(s) differ from zecs's snapshot; bless withrefraction_snapshot.py updateFAILED tests/cobol_mainframe/test_refraction_snapshot.py::test_excerpt_snapshot[zopeneditor-sample] - AssertionError: 1 generated file(s) differ from zopeneditor-sample's snapshot; bless withrefraction_snapshot.py updateFAILED tests/cobol_mainframe/test_refraction_snapshot.py::test_full_corpus_snapshot[zopeneditor-sample] - AssertionError: 1 generated file(s) differ from zopeneditor-sample's snapshot; bless withrefraction_snapshot.py update --corpus zope
FAILED tests/cobol_mainframe/test_refraction_snapshot.py::test_full_corpus_snapshot[aws-mainframe-modernization-carddemo] - AssertionError: 1 generated file(s) differ from aws-mainframe-modernization-carddemo's snapshot; bless with refract FAILED tests/cobol_mainframe/test_refraction_snapshot.py::test_full_corpus_snapshot[cics-genapp] - AssertionError: 1 generated file(s) differ from cics-genapp's snapshot; bless with refraction_snapshot.py update --corpus cics-genappFAILED tests/cobol_mainframe/test_refraction_snapshot.py::test_full_corpus_snapshot[dsf] - AssertionError: 1 generated file(s) differ from dsf's snapshot; bless withrefraction_snapshot.py update --corpus dsf`
FAILED tests/cobol_mainframe/test_refraction_snapshot.py::test_full_corpus_snapshot[cics-async-api-credit-card-application-example] - AssertionError: 1 generated file(s) differ from cics-async-api-credit-card-application-example's snapshot;
##[error]Process completed with exit code 1.
log tail:
archive: true
env:
GITGALAXY_LICENSE_KEY: COMMUNITY_FREE_TIER
GITGALAXY_MAINFRAME_CORPORA: /home/runner/work/gitgalaxy/gitgalaxy/.mainframe_corpora
PYTHONUTF8: 1
pythonLocation: /opt/hostedtoolcache/Python/3.12.15/x64
PKG_CONFIG_PATH: /opt/hostedtoolcache/Python/3.12.15/x64/lib/pkgconfig
Python_ROOT_DIR: /opt/hostedtoolcache/Python/3.12.15/x64
Python2_ROOT_DIR: /opt/hostedtoolcache/Python/3.12.15/x64
Python3_ROOT_DIR: /opt/hostedtoolcache/Python/3.12.15/x64
LD_LIBRARY_PATH: /opt/hostedtoolcache/Python/3.12.15/x64/lib
##[endgroup]
With the provided path, there will be 1 file uploaded
Artifact name is valid!
Root directory input is valid!
Uploading artifact: test-times-ground-truth-part-2.zip
Beginning upload of artifact content to blob storage
Uploaded bytes 84597
Finished uploading artifact content to blob storage!
SHA256 digest of uploaded artifact is df3a4e5a1866fe1e0485b5fc4324363f905cb1ccb430a15c96713b986e4c5fe8
Finalizing artifact upload
Artifact test-times-ground-truth-part-2 successfully finalized. Artifact ID 12127062195
Artifact test-times-ground-truth-part-2 has been successfully uploaded! Final size is 84597 bytes. Artifact ID is 12127062195
Artifact download URL: https://github.com/squid-protocol/gitgalaxy/actions/runs/39102121586/artifacts/12127062195
Post job cleanup.
[command]/usr/bin/git version
git version 2.55.0
Temporarily overriding HOME='/home/runner/work/_temp/0eed4efd-d8c2-418f-b9b6-58ba9e5dae30' before making global git config changes
Adding repository directory to the temporary git global config as a safe directory
[command]/usr/bin/git config --global --add safe.directory /home/runner/work/gitgalaxy/gitgalaxy/gitgalaxy
Removing SSH command configuration
[command]/usr/bin/git config --local --name-only --get-regexp core.sshCommand
[command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'core.sshCommand' && git config --local --unset-all 'core.sshCommand' || :"
Removing HTTP extra header
[command]/usr/bin/git config --local --name-only --get-regexp http.https://github.com/.extraheader
[command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'http.https://github.com/.extraheader' && git config --local --unset-all 'http.https://github.com/.extraheader' || :"
Removing includeIf entries pointing to credentials config files
[command]/usr/bin/git config --local --name-only --get-regexp ^includeIf.gitdir:
[command]/usr/bin/git submodule foreach --recursive git config --local --show-origin --name-only --get-regexp remote.origin.url
Cleaning up orphan processes

[squid-protocol]

No description provided.

[squid-protocol]

No description provided.