feat(core-engine): jcl dead_code + jcl/yaml spec_exposure comment-stream rules (#2732)

[squid-protocol]

Closes #2732.

Fills the three comment-stream rule absences the epic #2560 n/a sweep flagged: jcl/dead_code, jcl/spec_exposure, yaml/spec_exposure. Both jcl absences are the #2610 leftover — jcl's comment stream was structurally empty until _strip_jcl_comments, and #2610/#2611 added the debt/ownership rules without revisiting these two.

jcl/dead_code

Turning a statement's // into //* is the universal JCL way to comment it out. The operand guard — a keyword must be followed by operand-shaped text, not prose — is load-bearing rather than decorative, and cics-genapp's CICSTS56.jcl is the proof: it carries

//* SET THE RETURN CODE TO CONTROL IF CICS SHOULD BE
//* EXECUTE DUMP UTILITY PROGRAM TO PRINT THE

as English banners a few lines above four genuinely commented-out statements:

//*        DD DSN=CSQ901.SCSQLOAD,DISP=SHR

A bare (?:EXEC|DD|JOB|SET|INCLUDE)\b counts all six. The guard keeps the four and drops the two (THE is not NAME=; EXECUTE leaves no space after EXEC).

yaml/spec_exposure — where this departs from the issue, and why

This is the substantive part of the review. The issue asked for the generic bracket-tag rule verbatim from python/go/java/js, on the reasoning that

because spec_exposure never sees the code stream, YAML's [a, b] flow-sequence syntax cannot FP against it — the usual reason to hesitate doesn't apply.

That premise is wrong. coding_analysis applies every non-underscore rule to the code stream, and comment_analysis then runs the comment-stream rules a second time over the comments — it supplements the code-stream pass, it does not replace it. Measured, with the issue's rule dropped in verbatim, on a workflow containing no comments whatsoever:

jobs:
  audit:
    steps: [...]
  build:
    needs: [audit, lint]     # ← spec_exposure = 1

YAML is the one language where a bracket holding bare unquoted words is ordinary syntax rather than a tag, so the absence was never as arbitrary as it looked. Both new spec_exposure rules are anchored to their language's comment marker instead (^[ \t]*#, ^//\*) — the same anchoring yaml's own dead_code and jcl's own ownership rule already use. Since prism strips those markers out of the code stream, the anchor makes the rules structurally comment-only, and it costs no recall: prism re-emits an end-of-line comment on its own #-led line, so trailing tags still count (pinned by a test).

Second measured fix, carried into both rules: the generic pattern's bare spec branch has no trailing boundary, so it matches "specified" and "species". That isn't hypothetical — 2 of the 3 code-stream hits across the 41,815 .yml/.yaml files in the local pool corpus were [specified\n per-machine] (meson's docs) and [species] (an elasticsearch fixture). Added \b after the alternation.

Both new patterns are ReDoS-safe by construction: each bounded run excludes the delimiter that must follow it ([^\n\[]{0,200} before a literal [, [^\]\n]{0,300} before ], the name charset before [ \t]+), so every quantifier has exactly one landing site and there is no ambiguous partition to backtrack over. Covered by assert_redos_immune payloads sized to each quantifier.

Differential Scan

28 differences in both modes, every one attributable to jcl/dead_code. Enumerated in full via the manual golden_diff route (the crucible_check.py output is capped, so scoping from it alone isn't possible):

what moved	count
Commented-out Code (Dead Logic) per file	13
derived Commented Logic Exposure per file	13
repo-level dead_code + Commented Logic Exposure average	2

13 files in cics-banking-sample-application-cbsa gain 16 occurrences (CICSTS56 → 4, the twelve CREL*/CREDB2L → 1 each). That matches an independent count taken over the 443 licensed .jcl/.prc files in the local pool, which contains the same source — a useful cross-check that the rule fires on exactly the shapes it was built from.

No coordinate churn, no other language moved, and yaml moved nothing at all — the anchored rule finds no tag anywhere in the corpus, which is precisely why the paired corpus plant is required rather than optional.

The regenerated fixtures also carry four machine-specific metadata lines per file (absolute path, remote origin URL, timestamp, scan duration); golden_diff.load_and_sanitize explicitly pops all four as machine/runner-specific noise, so they are inert.

Verification

• pytest tests/ — 7580 passed, 4 skipped, 9 xfailed, 3 xpassed
• tests/tools/audit_check.py — ruff (70-finding baseline, format clean), mypy (2-error baseline), dead-key, ast-accuracy all clear
• tests/tools/crucible_check.py — PASS in both full_precision and zero_dependency after the bless
• New coverage: 5 dead_code + 2 spec_exposure table cases for jcl, 3 for yaml; an end-to-end prism→detector test per language proving the counts arrive through the comment stream and that the JES3 //*MAIN verb stays in code; a dedicated regression pinning the flow-sequence FP the issue's proposed rule would have introduced; word-boundary and ReDoS tests

Cross-repo

Pairs with squid-protocol/keyword-rosetta#55 (draft), which plants the jcl commented-out statement and the jcl/yaml [SPEC-n] tags, and retires ledger entry comment-stream-rules-missing-jcl-yaml (still_reproduces → false).

Per keyword-rosetta docs/GATING.md's n/a semantics, filling a None rule ends the cell's incomparability whether or not the corpus has anything for it to match — so without that plant these three cells flip from documented-n/a to a manufactured measured-0 scored against the median.

Merge order: this PR first. Rosetta CI checks out engine main, so the corpus PR stays draft until this lands and re-blesses against engine main afterwards. rosetta-audit on this PR will report the three cells moving; that is the expected signal, not a failure.

🤖 Generated with Claude Code

https://claude.ai/code/session_01M8F1cmMsujEjWnnw4d1e4W

[github-actions]

🐦‍⬛ Muninn Security Scan

✅ No security issues found.

🐦‍⬛ Powered by Muninn · Skald Lab