test: Add RVM compiler testing to ACI tests (microsoft#509)

code fixes:
  - compiler: add `is_var_bound_in_current_scope` and use it in destructuring so
    only the innermost scope blocks rebinding while still catching duplicates
    within that block.
  - rvm: treat `not` over undefined operands as a successful negation to match
    interpreter semantics.

tests/aci:
   migrate YAML cases to `data.policy.rule` queries with `{x: …}`
  bindings, expand the harness to run interpreter plus RVM (with optional
  skipping), align results to the binding format, add readable timing output,
  and support a `--filter` flag for targeting cases.

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>

Author: anakrish

src/languages/rego/compiler/core.rs

@@ -140,6 +140,14 @@ impl<'a> Compiler<'a> {
         }
     }
 
+    /// Returns true when a variable is already bound in the innermost scope
+    pub fn is_var_bound_in_current_scope(&self, var_name: &str) -> bool {
+        self.scopes
+            .last()
+            .map(|scope| scope.bound_vars.contains_key(var_name))
+            .unwrap_or(false)
+    }
+
     /// Look up a variable in all scopes starting from innermost (like interpreter's lookup_local_var)
     pub fn lookup_local_var(&self, var_name: &str) -> Option<Register> {
         self.scopes

src/languages/rego/compiler/destructuring.rs

@@ -289,7 +289,7 @@ impl<'a> Compiler<'a> {
             return Ok(());
         }
 
-        if self.lookup_local_var(var_name).is_some() {
+        if self.is_var_bound_in_current_scope(var_name) {
             bail!("Variable '{var_name}' already defined in current scope");
         }
 

src/rvm/vm/dispatch.rs

@@ -299,7 +299,10 @@ impl RegoVM {
                 let operand_value = &self.registers[operand as usize];
 
                 if operand_value == &Value::Undefined {
-                    self.registers[dest as usize] = Value::Undefined;
+                    // In Rego, `not expr` succeeds when `expr` has no results.
+                    // When the operand evaluates to undefined we should treat it as
+                    // a successful negation instead of propagating undefined.
+                    self.registers[dest as usize] = Value::Bool(true);
                     return Ok(InstructionOutcome::Continue);
                 }
 

tests/aci/aci.yaml

@@ -11,7 +11,7 @@ cases:
     target: /run/layers/p0-layer0
   data:
     metadata: {}
-  query: data.policy.mount_device=x
+  query: data.policy.mount_device
   want_result: 
   - x:
       allowed: true
@@ -44,7 +44,7 @@ cases:
         "/run/layers/p0-layer3": 41d64cdeb347bf236b4c13b7403b633ff11f1cf94dbc7cf881a44d6da88c5156
         "/run/layers/p0-layer4": 4dedae42847c704da891a28c25d32201a1ae440bce2aecccfa8e6f03b97a6a6c
         "/run/layers/p0-layer5": fe84c9d5bfddd07a2624d00333cf13c1a9c941f3a261f13ead44fc6a93bc0e7a
-  query: data.policy.mount_overlay=x
+  query: data.policy.mount_overlay
   want_result:
   - x:
       allowed: true
@@ -68,7 +68,7 @@ cases:
     target: /mnt/layer6
   data:
     metadata: {}
-  query: data.policy.scratch_mount=x
+  query: data.policy.scratch_mount
   want_result:
   - x:
       allowed: true
@@ -201,7 +201,7 @@ cases:
       scratch_mounts:
         "/mnt/layer6":
           encrypted: true
-  query: data.policy.create_container=x
+  query: data.policy.create_container
   want_result:
   - x:
       allow_stdio_access: false
@@ -257,7 +257,7 @@ cases:
       started:
         container0:
         - {"privileged": false}
-  query: data.policy.shutdown_container=x
+  query: data.policy.shutdown_container
   want_result:
   - x:
       allowed: true
@@ -286,7 +286,7 @@ cases:
       scratch_mounts:
         "/mnt/layer6":
           encrypted: true
-  query: data.policy.scratch_unmount=x
+  query: data.policy.scratch_unmount
   want_result:
   - x:
       allowed: true
@@ -313,7 +313,7 @@ cases:
       overlayTargets:
         "/run/gcs/c/container0/rootfs": true
       scratch_mounts: []
-  query: data.policy.unmount_overlay=x
+  query: data.policy.unmount_overlay
   want_result:
   - x:
       allowed: true
@@ -332,7 +332,7 @@ cases:
     metadata:
       devices:
         "/run/layers/p0-layer0": 1b80f120dbd88e4355d6241b519c3e25290215c469516b49dece9cf07175a766
-  query: data.policy.unmount_device=x
+  query: data.policy.unmount_device
   want_result:
   - x:
       allowed: true
@@ -378,7 +378,7 @@ cases:
     namespace: fragment
   data:
     metadata: {}
-  query: data.policy.load_fragment=x
+  query: data.policy.load_fragment
   want_result:
   - x: 
       add_module: false