fix(supply-chain): restore simple-path cycle regressions after Bolt rewrite by cursor[bot] · Pull Request #886 · ContextualWisdomLab/bandscope

cursor · 2026-08-16T16:30:10Z

Closed as proven duplicate of canonical #867

Exact duplicate/supersession evidence was revalidated immediately before closure:

test(supply-chain): preserve simple dependency-path cycle semantics #867 had drifted to bcf22eea40d2a5a1563e738ad7a508bbd3dae565, deleting the locked cycle/distinct-key regressions and replacing the validated path-local simple-path walk.
This PR's exact head f270d3dfece13ab6d54c260b8b094e9a7335a548 is a direct fast-forward descendant of that drifted test(supply-chain): preserve simple dependency-path cycle semantics #867 head: compare(bcf22eea…, f270d3df…) reports ahead_by=1, behind_by=0.
That single repair commit restores the path-local frozenset simple-path implementation, both cycle/distinct-key regression authorities, and the dependency-policy contract.
The canonical test(supply-chain): preserve simple dependency-path cycle semantics #867 branch bolt-optimize-supply-chain-check-10739114227262951755 was then fast-forwarded without force to this exact f270d3df… commit and refetched successfully.
Therefore this PR has no remaining unique semantic or file delta that is not now owned by test(supply-chain): preserve simple dependency-path cycle semantics #867.

No merge evidence from this PR is transferred. #867 must obtain fresh exact-head CI/security/SBOM/coverage/review evidence on f270d3df…; inherited #783 and central dependency gates remain unchanged.

Bolt reapplied a shared (package_key, matched_count) cache on top of the already-restored simple-path walk. That cache lets one package key satisfy two owner-chain positions through a cycle. Restore path-local frozenset prevention, keep the cycle and distinct-key regressions in two test modules, drop the unauthorized pdfjs-dist Trivy ignore, and record the unsafe optimization as a rejected change. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>

…rift

…ewrite Head bcf22ee replaced the validated frozenset walk with recursive DFS and deleted the cycle/distinct-key tests plus the simple-path policy citation. Restore the locked iterative walk, both regression modules, and the Cormen et al. (2022) owner-chain authority so the next rewrite cannot drop the lock. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>

cursor · 2026-08-16T16:31:31Z

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

cursor

Stale comment

Prefer #887 over this restore

This head f270d3df correctly restores the dbcbe6d9 frozenset walk, cycle/distinct-key tests, and Cormen et al. (2022) citation. Keep it closed or unmerged once #887 lands.

#887 593b6fe6 is the same restore plus test_dependency_policy_documents_named_dependency_path_simple_path_authority, which fails on the Bolt policy file and would have blocked the bcf22eea deletion. Do not open a fourth restore PR. Do not merge #867 at bcf22eea.

View PR

_{Sent by Cursor Automation: Fix Issues}

seonghobae

Independent review of f270d3df vs develop acdbea63, with the full cargo_lock_has_named_dependency_path body (not just the docstring hunk) and a file-level compare to draft #887 593b6fe6.

CodeRabbit CLI is not installed in this environment (coderabbit: command not found); this assessment is from the required walk/diff/pytest checks.

Strengths

The walk at scripts/checks/verify_supply_chain.py:1998-2012 is an iterative path-local frozenset stack (pending.pop(), next_seen = seen | {current}). It is not recursive DFS and it does not use a shared (package_key, matched_count) cache. Develop already had this body; this PR only documents the simple-path rule.
Cycle fixture root → alpha@1 → beta → alpha@1 with query ("alpha", "alpha", "charlie") is False. Distinct keys alpha@1 then alpha@2 are True. Direct ("alpha", "charlie") on the cyclic graph is True (reproduced in the PR worktree; the last one is not locked).
The four pytest cases are real load_module calls of the matcher, not mocks. All four passed.
Policy text cites Cormen et al. (2022, Appendix B.4) in APA 7th, and .jules/bolt.md rejects the shared-cache rewrite. No .trivyignore / pdfjs-dist / CVE-2026-16633 change.

Issues

Critical

None.

Important

Missing required lock for direct ("alpha", "charlie") on the cyclic graph — services/analysis-engine/tests/test_supply_chain_dependency_path_cycles.py:19-23 and the twin at test_supply_chain_policy.py:5126-5130 only lock the False cycle case. A rewrite that refuses every remaining-name walk once a back-edge exists would still pass both locked tests and break owner-chain matching. The PR description says this case was reproduced; it is not a regression test.
This head is not the best landing vehicle. #886 and #867 now share SHA f270d3df. Draft #887 593b6fe6 is the same restore plus test_dependency_policy_documents_named_dependency_path_simple_path_authority, which is RED on develop's policy file and GREEN on this policy text. That is the lock that would have caught the Bolt deletion of the citation/section. After reading both diffs, prefer #887; do not treat it as better on the walk (the walk files are identical).

Minor

Cycle and distinct-key cases are duplicated across test_supply_chain_dependency_path_cycles.py and test_supply_chain_policy.py with no extra assertion in the policy module.
.jules/bolt.md:64 appends the new learning without a blank line after the previous entry.

Recommendations

Land #887 (mark ready). Close #886 and #867 as the same-SHA restore without the policy-text lock. Do not open a fourth restore PR. Do not merge #867 at any older DFS head.
On the landing head, add assert cargo_lock_has_named_dependency_path(..., ("alpha", "charlie")) on the existing cycle fixture.
Keep inherited pdfjs-dist / CVE-2026-16633 on #783.

Assessment

Ready to merge? With fixes. The restore is behaviorally correct, but do not merge #886 over #887, and do not treat the lock set as complete until the direct cyclic-graph case is a real test.

seonghobae · 2026-08-16T16:37:02Z

+        package_dependencies,
+        "root 1.0.0",
+        ("alpha", "alpha", "charlie"),
+    )


This locks the False cycle case only. The required counterpart is still missing: on this same fixture, ("alpha", "charlie") must stay True (direct remaining-name match must not die just because beta points back at alpha@1). I reproduced True on this head; please add that assert here (and in the policy-module twin) on the landing vehicle. A walk that skips every other edge after seeing a back-edge would still pass this test and break owner-chain matching.

cursor

Prefer #887; do not merge this restore over the policy-text lock

Exact head f270d3df restores the dbcbe6d9 authority: iterative path-local frozenset in cargo_lock_has_named_dependency_path, cycle/distinct-key regressions in both test modules, Cormen et al. (2022, Appendix B.4) APA citation, and the rejected shared-cache note in .jules/bolt.md. The walk is not recursive DFS and does not use a shared (package_key, matched_count) cache. Reproduced on this head: cycle False, distinct keys True, direct ("alpha", "charlie") True. No .trivyignore / pdfjs-dist / CVE-2026-16633 change.

#867 now points at the same SHA. Draft #887 593b6fe6 is that restore plus test_dependency_policy_documents_named_dependency_path_simple_path_authority, which fails on the Bolt-deleted policy file and would have blocked the bcf22eea citation deletion. Land #887. Keep this PR and #867 unmerged once #887 is ready. Do not open another restore PR. Do not merge any older DFS head.

Both this head and #887 still omit a locked assert for direct ("alpha", "charlie") on the cyclic fixture. Add that on the landing head so a rewrite that refuses every remaining-name walk after a back-edge cannot stay green.

This run cannot approve or merge. Independent review remains with seonghobae. Inherited JS vulns stay on #783. Next buyer-visible gap is issue #770; do not fold it here.

_{Sent by Cursor Automation: Fix Issues}

cursor · 2026-08-16T16:39:51Z

+    assert not supply_chain.cargo_lock_has_named_dependency_path(
+        package_dependencies,
+        "root 1.0.0",
+        ("alpha", "alpha", "charlie"),
+    )


This locks the False cycle case only. On the same fixture, also assert cargo_lock_has_named_dependency_path(..., ("alpha", "charlie")) is True. A rewrite that treats any back-edge as "no remaining-name match" would still pass this test and break a real owner-chain. Add that assert on the #887 landing head, not in a fourth restore PR.

seonghobae and others added 14 commits August 16, 2026 14:07

perf: optimize supply chain check graph traversal memory usage

5b71eb0

test(supply-chain): preserve simple dependency path semantics

3f94b21

fix(supply-chain): preserve simple path cycle semantics

28c61cd

perf: optimize supply chain check graph traversal memory usage

913e7c7

⚡ Bolt: [성능 개선] 의존성 그래프 탐색 메모리 최적화

fca0bb7

test(supply-chain): reproduce cyclic owner-chain false positive

b6690c6

fix(supply-chain): restore simple dependency-path semantics

bbf46a3

docs(supply-chain): preserve simple-path authority

3ac96dd

⚡ Bolt: [성능 개선] 의존성 그래프 탐색 메모리 최적화

a88b213

revert(supply-chain): restore validated simple-path semantics after d…

4881dba

…rift

merge(supply-chain): consolidate cycle regression authority into #867

dbcbe6d

⚡ Bolt: [성능 개선] 의존성 그래프 탐색 메모리 최적화 내 사이클 버그 수정

bcf22ee

cursor Bot requested a review from seonghobae August 16, 2026 16:30

cursor Bot mentioned this pull request Aug 16, 2026

test(supply-chain): preserve simple dependency-path cycle semantics #867

Open

7 tasks

seonghobae marked this pull request as ready for review August 16, 2026 16:31

cursor Bot mentioned this pull request Aug 16, 2026

fix(supply-chain): restore simple-path authority and lock policy text #887

Closed

cursor Bot commented Aug 16, 2026

View reviewed changes

seonghobae closed this Aug 16, 2026

seonghobae reviewed Aug 16, 2026

View reviewed changes

cursor Bot commented Aug 16, 2026

View reviewed changes

Navigation Menu

Uh oh!

fix(supply-chain): restore simple-path cycle regressions after Bolt rewrite - #886

fix(supply-chain): restore simple-path cycle regressions after Bolt rewrite#886
cursor[bot] wants to merge 14 commits into
developfrom
cursor/bc-ebb283b7-1211-4109-ba04-b28c47d94938-16d5

cursor Bot commented Aug 16, 2026 •

edited by seonghobae

Loading

Uh oh!

cursor Bot commented Aug 16, 2026

Uh oh!

cursor Bot left a comment •

edited

Loading

Uh oh!

seonghobae left a comment

Uh oh!

seonghobae Aug 16, 2026

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot Aug 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

cursor Bot commented Aug 16, 2026 • edited by seonghobae Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Closed as proven duplicate of canonical #867

Uh oh!

cursor Bot commented Aug 16, 2026

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Prefer #887 over this restore

Uh oh!

seonghobae left a comment

Choose a reason for hiding this comment

Strengths

Issues

Critical

Important

Minor

Recommendations

Assessment

Uh oh!

seonghobae Aug 16, 2026

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Prefer #887; do not merge this restore over the policy-text lock

Uh oh!

cursor Bot Aug 16, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

cursor Bot commented Aug 16, 2026 •

edited by seonghobae

Loading

cursor Bot left a comment •

edited

Loading