feat(supply-chain): exact-version license evidence and assessments

[balcsida]

Summary

Milestone 2. Depends on #107.

• SPDX expression parser (internal/supplychain/spdxexpr) – bounded grammar (size/token/depth limits) over the embedded SPDX License List 3.27.0; preserves AND/OR/grouping/+/WITH/LicenseRef/DocumentRef and written order; NOASSERTION, NONE, UNLICENSED, unknown identifiers, and free text stay explicit statuses and are never mapped to a license. Fuzzed (normalized round-trip).
• Resolvers (npm, NuGet, Maven) – only through routes from GRAPHNEST_SUPPLY_CHAIN_REGISTRY_* (secret-file credentials, optional CA, opt-in private hosts, namespace restriction). Fetcher pins origin + base path (redirects elsewhere rejected), blocks private/link-local/metadata addresses by default, bounds decompressed bodies, rejects hostile path segments, attaches credentials only to the route's origin. No route ⇒ no outbound license traffic; a private route never falls back to a public registry.
  • npm: exact version document only (never dist-tags); SEE LICENSE IN, legacy objects/arrays, UNLICENSED recorded as what they are.
  • NuGet: exact nuspec; expression vs file vs legacy licenseUrl preserved; the nupkg is never downloaded.
  • Maven: exact POM; bounded parent/property resolution with cycle detection; unresolved inheritance stays unknown; only unambiguous names normalized; repository declarations never followed.
• Evidence & assessments – immutable evidence rows (raw value, parse status, resolver/list versions, content hash, outcome; identical re-fetches are new observations flagged duplicate; outages keep earlier resolved evidence with its age; negatives expire after 24h); deterministic per-occurrence assessment with conflict detection; enrichment worker queued at publication; GET .../component?element= evidence detail reachable only through an authorized occurrence.
• UI – assessed-license column (never inferred from the declared value) and an evidence panel. Migration 034. Helm route values + Secret mounts; docs.

Verification

Resolver tests against fake TLS registries (exact-version mismatch, private/public same-name isolation, omitted origin, parent cycles, invalid expressions, outage, cross-origin/base-path redirects, oversized and gzip-bomb bodies, private-address denial, untrusted certificate, hostile names, credentials never in evidence, no traffic without routes). Assessment truth table. Store integration tests (immutability, route scoping, TTL, leases). End-to-end integration through PostgreSQL and REST.

Implications

• Migration: 034 additive.
• Security/egress: see above; documented in the threat model and operations guide.

---

Part of the Dependencies & Licenses stack (native GitHub stack #114, ten layers, main ← #104 ← #105 ← #106 ← #107 ← #108 ← #109 ← #110 ← #111 ← #112 ← #113). Design: ADR-0017; living plan with the full validation table: docs/execplans/supply-chain.md. All commits are SSH-signed. Nothing here calls a live GitHub Enterprise Server or a live package registry; GitHub and registry behavior is exercised against fixtures and fake servers only.

_{Stack created with GitHub Stacks CLI}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.