fix(supply-chain): restore simple-path authority and lock policy text

.jules/bolt.md

@@ -61,3 +61,6 @@
 ## 2026-07-13 - Array.from mapping optimization
 **Learning:** Using `Array.from({ length: N }).map(...)` creates an intermediate array of `undefined` values which requires memory allocation and garbage collection, adding O(N) unnecessary overhead in frequently re-rendered UI components.
 **Action:** Use `Array.from({ length: N }, (_, index) => ...)` to map elements directly during array creation, avoiding intermediate allocations.
+## 2026-08-16 - Graph traversal memory optimization is unsafe
+**Learning:** Replacing path-local `frozenset` cycle prevention in `cargo_lock_has_named_dependency_path` with a shared `(package_key, matched_count)` cache changes simple-path semantics. On `root → alpha@1 → beta → alpha@1 → charlie`, the same key can satisfy two `alpha` positions and falsely accept `("alpha", "alpha", "charlie")`.
+**Action:** Keep a path-local `frozenset` of package keys. Do not reintroduce a global state cache. Distinct keys that share a name (`alpha@1` then `alpha@2`) remain valid matches. Keep the cycle regressions.

docs/security/dependency-policy.md

@@ -90,6 +90,19 @@ Every bootstrap, PR, or release report that claims this baseline is enforced mus
 - any failed command or GitHub API call when enforcement could not be completed
 - any remaining manual review item that still needs repository-admin action
 
+## Named dependency-path authority
+
+`scripts/checks/verify_supply_chain.py` treats a Cargo owner chain as a
+*simple path*: a package key may appear at most once on a candidate walk
+(Cormen et al., 2022, Appendix B.4). A shared
+`(package_key, matched_count)` cache is not an equivalent optimization.
+On a cycle such as `root → alpha@1 → beta → alpha@1 → charlie`, that cache
+can reuse `alpha@1` to satisfy a second `alpha` position and falsely accept
+the chain. Distinct keys that share a name (`alpha@1` then `alpha@2`) remain
+valid. Do not reintroduce a global state cache to save `frozenset` copies.
+Keep cycle and distinct-key regressions in
+`services/analysis-engine/tests/test_supply_chain_dependency_path_cycles.py`.
+
 ## Vulnerability exception handling
 
 Exceptions are allowed only when no patched version exists and the advisory is non-exploitable for this repository context.
@@ -138,3 +151,7 @@ Mark work as `BLOCKED` only when platform execution is impossible because GitHub
 ## Fast reference
 
 `모든 보호 브랜치 변경은 dependency review, 보안 점검, SBOM 생성·검증을 통과해야 하며, release 산출물은 GitHub에서 추적 가능한 SBOM과 함께 배포되고, 이 공급망 통제는 에이전트가 임의로 해제하지 않는다.`
+
+## References
+
+Cormen, T. H., Leiserson, C. E., Rivest, R. L., & Stein, C. (2022). *Introduction to algorithms* (4th ed.). MIT Press.

scripts/checks/verify_supply_chain.py

@@ -1988,7 +1988,13 @@ def cargo_lock_has_named_dependency_path(
     root_package: str,
     package_names: tuple[str, ...],
 ) -> bool:
-    """Return whether a dependency path contains package names in order."""
+    """Return whether a simple dependency path contains package names in order.
+
+    A package key may appear at most once on a candidate path. Shared
+    ``(package_key, matched_count)`` caches are unsafe: a cycle can revisit
+    the same key with a later match count and falsely satisfy a repeated
+    name. Distinct keys that share a package name remain valid matches.
+    """
     pending: list[tuple[str, int, frozenset[str]]] = [(root_package, 0, frozenset())]
     while pending:
         current, matched_count, seen = pending.pop()

services/analysis-engine/tests/test_supply_chain_dependency_path_cycles.py

@@ -0,0 +1,44 @@
+"""Regression tests for Cargo dependency-path cycle handling."""
+
+from conftest import load_module
+
+
+def test_dependency_path_does_not_reuse_a_package_key_through_a_cycle() -> None:
+    """Ensure a cycle cannot make one package instance satisfy two path positions."""
+    supply_chain = load_module(
+        "scripts/checks/verify_supply_chain.py",
+        "verify_supply_chain_dependency_path_cycle_regression",
+    )
+    package_dependencies = {
+        "root 1.0.0": ["alpha 1.0.0"],
+        "alpha 1.0.0": ["beta 1.0.0", "charlie 1.0.0"],
+        "beta 1.0.0": ["alpha 1.0.0"],
+        "charlie 1.0.0": [],
+    }
+
+    assert not supply_chain.cargo_lock_has_named_dependency_path(
+        package_dependencies,
+        "root 1.0.0",
+        ("alpha", "alpha", "charlie"),
+    )
+
+
+def test_dependency_path_can_match_same_name_on_distinct_package_keys() -> None:
+    """Ensure distinct package instances may legitimately satisfy repeated names."""
+    supply_chain = load_module(
+        "scripts/checks/verify_supply_chain.py",
+        "verify_supply_chain_dependency_path_distinct_instances",
+    )
+    package_dependencies = {
+        "root 1.0.0": ["alpha 1.0.0"],
+        "alpha 1.0.0": ["beta 1.0.0"],
+        "beta 1.0.0": ["alpha 2.0.0"],
+        "alpha 2.0.0": ["charlie 1.0.0"],
+        "charlie 1.0.0": [],
+    }
+
+    assert supply_chain.cargo_lock_has_named_dependency_path(
+        package_dependencies,
+        "root 1.0.0",
+        ("alpha", "alpha", "charlie"),
+    )

services/analysis-engine/tests/test_supply_chain_policy.py

@@ -5108,3 +5108,66 @@ def test_opencode_strix_lookup_reports_missing_actions_read_scope() -> None:
     assert_local_review_workflows_removed()
     assert "Strix evidence lookup" in policy
     assert "Actions read access" in policy
+
+
+def test_named_dependency_path_does_not_reuse_a_package_key_through_a_cycle() -> None:
+    """Ensure a cycle cannot make one package instance satisfy two path positions."""
+    supply_chain = load_module(
+        "scripts/checks/verify_supply_chain.py",
+        "verify_supply_chain_policy_dependency_path_cycle",
+    )
+    package_dependencies = {
+        "root 1.0.0": ["alpha 1.0.0"],
+        "alpha 1.0.0": ["beta 1.0.0", "charlie 1.0.0"],
+        "beta 1.0.0": ["alpha 1.0.0"],
+        "charlie 1.0.0": [],
+    }
+
+    assert not supply_chain.cargo_lock_has_named_dependency_path(
+        package_dependencies,
+        "root 1.0.0",
+        ("alpha", "alpha", "charlie"),
+    )
+
+
+def test_named_dependency_path_can_match_same_name_on_distinct_package_keys() -> None:
+    """Ensure distinct package instances may legitimately satisfy repeated names."""
+    supply_chain = load_module(
+        "scripts/checks/verify_supply_chain.py",
+        "verify_supply_chain_policy_dependency_path_distinct",
+    )
+    package_dependencies = {
+        "root 1.0.0": ["alpha 1.0.0"],
+        "alpha 1.0.0": ["beta 1.0.0"],
+        "beta 1.0.0": ["alpha 2.0.0"],
+        "alpha 2.0.0": ["charlie 1.0.0"],
+        "charlie 1.0.0": [],
+    }
+
+    assert supply_chain.cargo_lock_has_named_dependency_path(
+        package_dependencies,
+        "root 1.0.0",
+        ("alpha", "alpha", "charlie"),
+    )
+
+
+def test_dependency_policy_documents_named_dependency_path_simple_path_authority() -> None:
+    """Keep the simple-path rule, cycle counter-example, and APA citation in policy."""
+    repo_root = Path(__file__).resolve().parents[3]
+    dependency_policy = (repo_root / "docs" / "security" / "dependency-policy.md").read_text(
+        encoding="utf-8"
+    )
+
+    assert "## Named dependency-path authority" in dependency_policy
+    assert "*simple path*" in dependency_policy
+    assert "Cormen et al., 2022, Appendix B.4" in dependency_policy
+    assert "`(package_key, matched_count)` cache is not an equivalent optimization" in (
+        dependency_policy
+    )
+    assert "root → alpha@1 → beta → alpha@1 → charlie" in dependency_policy
+    assert "test_supply_chain_dependency_path_cycles.py" in dependency_policy
+    assert "## References" in dependency_policy
+    assert (
+        "Cormen, T. H., Leiserson, C. E., Rivest, R. L., & Stein, C. (2022). "
+        "*Introduction to algorithms* (4th ed.). MIT Press."
+    ) in dependency_policy