test(supply-chain): preserve simple dependency-path cycle semantics

.jules/bolt.md

@@ -61,3 +61,6 @@
 ## 2026-07-13 - Array.from mapping optimization
 **Learning:** Using `Array.from({ length: N }).map(...)` creates an intermediate array of `undefined` values which requires memory allocation and garbage collection, adding O(N) unnecessary overhead in frequently re-rendered UI components.
 **Action:** Use `Array.from({ length: N }, (_, index) => ...)` to map elements directly during array creation, avoiding intermediate allocations.
+## 2026-08-16 - Graph traversal memory optimization is unsafe
+**Learning:** Replacing path-local `frozenset` cycle prevention in `cargo_lock_has_named_dependency_path` with a shared `(package_key, matched_count)` cache changes simple-path semantics. On `root → alpha@1 → beta → alpha@1 → charlie`, the same key can satisfy two `alpha` positions and falsely accept `("alpha", "alpha", "charlie")`.
+**Action:** Keep a path-local `frozenset` of package keys. Do not reintroduce a global state cache. Distinct keys that share a name (`alpha@1` then `alpha@2`) remain valid matches. Keep the cycle regressions.

docs/security/dependency-policy.md

@@ -90,6 +90,19 @@ Every bootstrap, PR, or release report that claims this baseline is enforced mus
 - any failed command or GitHub API call when enforcement could not be completed
 - any remaining manual review item that still needs repository-admin action
 
+## Named dependency-path authority
+
+`scripts/checks/verify_supply_chain.py` treats a Cargo owner chain as a
+*simple path*: a package key may appear at most once on a candidate walk
+(Cormen et al., 2022, Appendix B.4). A shared
+`(package_key, matched_count)` cache is not an equivalent optimization.
+On a cycle such as `root → alpha@1 → beta → alpha@1 → charlie`, that cache
+can reuse `alpha@1` to satisfy a second `alpha` position and falsely accept
+the chain. Distinct keys that share a name (`alpha@1` then `alpha@2`) remain
+valid. Do not reintroduce a global state cache to save `frozenset` copies.
+Keep cycle and distinct-key regressions in
+`services/analysis-engine/tests/test_supply_chain_dependency_path_cycles.py`.
+
 ## Vulnerability exception handling
 
 Exceptions are allowed only when no patched version exists and the advisory is non-exploitable for this repository context.
@@ -138,3 +151,7 @@ Mark work as `BLOCKED` only when platform execution is impossible because GitHub
 ## Fast reference
 
 `모든 보호 브랜치 변경은 dependency review, 보안 점검, SBOM 생성·검증을 통과해야 하며, release 산출물은 GitHub에서 추적 가능한 SBOM과 함께 배포되고, 이 공급망 통제는 에이전트가 임의로 해제하지 않는다.`
+
+## References
+
+Cormen, T. H., Leiserson, C. E., Rivest, R. L., & Stein, C. (2022). *Introduction to algorithms* (4th ed.). MIT Press.

services/analysis-engine/tests/test_supply_chain_dependency_path_cycles.py

@@ -0,0 +1,64 @@
+"""Regression tests for Cargo dependency-path cycle handling."""
+
+from conftest import load_module
+
+
+def test_dependency_path_does_not_reuse_a_package_key_through_a_cycle() -> None:
+    """Ensure a cycle cannot make one package instance satisfy two path positions."""
+    supply_chain = load_module(
+        "scripts/checks/verify_supply_chain.py",
+        "verify_supply_chain_dependency_path_cycle_regression",
+    )
+    package_dependencies = {
+        "root 1.0.0": ["alpha 1.0.0"],
+        "alpha 1.0.0": ["beta 1.0.0", "charlie 1.0.0"],
+        "beta 1.0.0": ["alpha 1.0.0"],
+        "charlie 1.0.0": [],
+    }
+
+    assert not supply_chain.cargo_lock_has_named_dependency_path(
+        package_dependencies,
+        "root 1.0.0",
+        ("alpha", "alpha", "charlie"),
+    )
+
+
+def test_dependency_path_still_matches_direct_path_on_cyclic_graph() -> None:
+    """Cycle prevention must not reject a valid simple path that avoids reuse."""
+    supply_chain = load_module(
+        "scripts/checks/verify_supply_chain.py",
+        "verify_supply_chain_dependency_path_cycle_direct_regression",
+    )
+    package_dependencies = {
+        "root 1.0.0": ["alpha 1.0.0"],
+        "alpha 1.0.0": ["beta 1.0.0", "charlie 1.0.0"],
+        "beta 1.0.0": ["alpha 1.0.0"],
+        "charlie 1.0.0": [],
+    }
+
+    assert supply_chain.cargo_lock_has_named_dependency_path(
+        package_dependencies,
+        "root 1.0.0",
+        ("alpha", "charlie"),
+    )
+
+
+def test_dependency_path_can_match_same_name_on_distinct_package_keys() -> None:
+    """Ensure distinct package instances may legitimately satisfy repeated names."""
+    supply_chain = load_module(
+        "scripts/checks/verify_supply_chain.py",
+        "verify_supply_chain_dependency_path_distinct_instances",
+    )
+    package_dependencies = {
+        "root 1.0.0": ["alpha 1.0.0"],
+        "alpha 1.0.0": ["beta 1.0.0"],
+        "beta 1.0.0": ["alpha 2.0.0"],
+        "alpha 2.0.0": ["charlie 1.0.0"],
+        "charlie 1.0.0": [],
+    }
+
+    assert supply_chain.cargo_lock_has_named_dependency_path(
+        package_dependencies,
+        "root 1.0.0",
+        ("alpha", "alpha", "charlie"),
+    )

services/analysis-engine/tests/test_supply_chain_dependency_path_depth.py

@@ -0,0 +1,29 @@
+"""Depth-safety regressions for Cargo dependency owner-chain traversal."""
+
+from __future__ import annotations
+
+import sys
+
+from conftest import load_module
+
+
+def test_dependency_path_handles_graph_deeper_than_python_recursion_limit() -> None:
+    """A valid long Cargo graph must not fail because Python recursion is bounded."""
+    supply_chain = load_module(
+        "scripts/checks/verify_supply_chain.py",
+        "verify_supply_chain_dependency_path_depth",
+    )
+    edge_count = sys.getrecursionlimit() + 50
+    package_dependencies = {
+        f"node-{index} 1.0.0": [f"node-{index + 1} 1.0.0"] for index in range(edge_count)
+    }
+    package_dependencies[f"node-{edge_count} 1.0.0"] = []
+
+    assert (
+        supply_chain.cargo_lock_has_named_dependency_path(
+            package_dependencies,
+            "node-0 1.0.0",
+            ("missing-owner",),
+        )
+        is False
+    )