fix(supply-chain): restore simple dependency-path cycle semantics

[cursor]

Summary

Do not merge #867 at a88b213. That head reapplied a shared (package_key, matched_count) cache, deleted the cycle regressions, and added an undocumented CVE-2026-16633 Trivy ignore.

This branch keeps the protected-develop simple-path walk and adds the contract that Bolt keeps deleting:

• root → alpha@1 → beta → alpha@1 cannot reuse alpha@1 to satisfy a second alpha before charlie
• distinct keys alpha@1 then alpha@2 may still satisfy repeated alpha positions
• the function docstring and docs/security/dependency-policy.md make the simple-path authority explicit (Cormen et al., 2022, Appendix B.4)
• cycle regressions live in both test_supply_chain_dependency_path_cycles.py and test_supply_chain_policy.py so deleting one file still fails CI
• .jules/bolt.md records the shared-state cache as a rejected change
• no .trivyignore entry for CVE-2026-16633; that finding stays with canonical fix(security): establish canonical npm, PDF.js, Nanoid, and Undici baseline #783

Verification

• Reproduced the cycle false positive on test(supply-chain): preserve simple dependency-path cycle semantics #867 a88b213 (True vs required False)
• python3 -m pytest services/analysis-engine/tests/test_supply_chain_dependency_path_cycles.py services/analysis-engine/tests/test_supply_chain_policy.py -k 'named_dependency_path or dependency_path_does_not or dependency_path_can_match' — 4 passed
• ./scripts/harness/quickcheck.sh (CI on this PR)

Security Notes

Attack surface

Cargo owner-chain matching in scripts/checks/verify_supply_chain.py and Trivy exception policy in .trivyignore.

Trust boundary

Supply-chain checks decide whether a lockfile owner chain is accepted. A false positive can mark a cyclic or reused package key as a valid named path. An undocumented Trivy ignore can hide a real pdfjs-dist finding.

Mitigations

• Path-local frozenset of package keys; a key may appear at most once on a candidate walk
• No shared (package_key, matched_count) cache
• No new Trivy ignore
• Policy text forbids reintroducing the cache to save frozenset copies

Test points

• Cyclic graph root → alpha@1 → beta → alpha@1 → charlie must return False for ("alpha", "alpha", "charlie")
• Distinct keys alpha@1 then alpha@2 must return True for the same name tuple
• Both the dedicated cycle module and test_supply_chain_policy.py encode those cases

Dependency and Supply Chain

• No new direct dependency was added
• If a new dependency was added, this PR explains why it is needed
• runtime / dev / build / test classification is recorded
• alternatives were considered
• maintainer trust and update health were checked
• license fit was checked
• known security issues were checked
• transitive footprint impact was considered
• SBOM or supplemental inventory impact was recorded

i18n impact

• No user-visible string changed
• Korean and English locale impact was updated

Reviewer checklist

• Gitflow target branch is develop
• protected-branch rules were not weakened
• required checks are expected to stay green

References

Cormen, T. H., Leiserson, C. E., Rivest, R. L., & Stein, C. (2022). Introduction to algorithms (4th ed.). MIT Press.

  

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[seonghobae]

Superseded by canonical existing owner #867 after exact-head reconciliation. #867 now has exact head dbcbe6d9f27020cdb3070b4dbfb1f905522c26c4 with this PR head f4a60530064321ebd04ed0c86f2d9dda7d6caefa as an explicit merge parent. compare(f4a6053…, dbcbe6d…) is ahead with zero file differences, so this PR's additional test_supply_chain_policy.py cycle/distinct-key regressions and the .jules/bolt.md rejected-optimization note are preserved byte-for-byte in #867 along with the safe simple-path implementation and absence of the unauthorized Trivy ignore. Closing the duplicate avoids competing owners for the same supply-chain boundary; #867 still requires fresh exact-head checks/reviews before any merge classification.

[cursor]

Closed duplicate; tree is preserved on #867

Exact-head f4a60530064321ebd04ed0c86f2d9dda7d6caefa keeps the protected-develop simple-path walk:

• cargo_lock_has_named_dependency_path uses a path-local frozenset of package keys
• there is no shared (package_key, matched_count) cache
• .trivyignore has no CVE-2026-16633 entry
• cycle root → alpha@1 → beta → alpha@1 → charlie returns False for ("alpha", "alpha", "charlie")
• distinct keys alpha@1 then alpha@2 still return True

git diff f4a60530 dbcbe6d is empty. This PR was closed after #867 absorbed this head as a merge parent, so the two-module cycle regressions and the .jules/bolt.md rejected-cache note already live on #867.

Next action: do not reopen #872. Continue merge work on #867 at dbcbe6d9f27020cdb3070b4dbfb1f905522c26c4 after that head's required checks are terminal-success. Inherited pdfjs-dist / CVE-2026-16633 stays with canonical #783.

  

_{Sent by Cursor Automation: Fix Issues}