feat(supply-chain): policies and review workflow

[balcsida]

Summary

Milestone 5. Depends on #110. Three record kinds stay separate and are never edited, only superseded.

• Policy engine (internal/supplychain/policy) – walks the SPDX expression tree: AND takes the worst operand, OR the best (acceptable branches are reported; choosing one is a separate recorded decision), WITH pairs are their own terms and are never approved by their base license, unknown identifiers/references follow the policy's unknown handling and never become approved. Rules are validated against the pinned list and may not list a term in two classes. The shipped policy is a clearly labelled example fixture; unknown_handling must be review_required or prohibited.
• Review service – queue of authorized occurrences whose verdict is not approved or whose decision went stale (expired exception / changed evidence, with the reason); human conclusions stored as immutable human evidence that override automated evidence without erasing it (disagreement stays visible); approve / reject / exception decisions recording policy version + verdict, reviewer, reason, usage context, expiry (≤ 1 year); optimistic concurrency – conclusions and decisions must echo the current assessment fingerprint (409 stale_basis); background re-evaluation retains historical results; repository-scoped review grants (admin-only; reviewers still need read access and cannot grant themselves); append-only audit trail (DB trigger).
• Routes under /v1/supply-chain/review/* and /v1/supply-chain/policies, designed in OpenAPI. Migration 036.

Verification

Policy truth table (leaves, AND, OR with branch reporting, WITH, or-later handling, grouping differences, unknown handling never approves, rule validation). Integration test against PostgreSQL: install/activate example, invalid rules and unknown_handling=approved refused, evaluation counts and idempotency, queue scoping per principal, full permission matrix, stale-basis conflicts, exception expiry (queue + history), re-evaluation after a conclusion (prohibited → approved, history retained), human evidence coexisting with registry evidence, superseded decisions, append-only events.

Implications

• Migration: 036 additive (policies, conclusions, policy results, decisions, review grants, review events with an append-only trigger).
• Security: policy administration is admin-only; review capability is repository-scoped and separate from read access. No legal-obligation advice and no release-blocking gates.

---

Part of the Dependencies & Licenses stack (native GitHub stack #114, ten layers, main ← #104 ← #105 ← #106 ← #107 ← #108 ← #109 ← #110 ← #111 ← #112 ← #113). Design: ADR-0017; living plan with the full validation table: docs/execplans/supply-chain.md. All commits are SSH-signed. Nothing here calls a live GitHub Enterprise Server or a live package registry; GitHub and registry behavior is exercised against fixtures and fake servers only.

_{Stack created with GitHub Stacks CLI}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.