fix(rvm): assert every-quantifier results so failing cases don't pass (microsoft#765)

The RVM was silently succeeding on `every` quantifiers (and loops nested
inside an `every` body) that should have failed. In each case the loop
computed a pass/fail into a register that the surrounding query then
ignored, so the RVM disagreed with the interpreter.

Four related fixes:

- compile_every_quantifier: guard the loop result so a failing `every`
  body makes the rule undefined instead of always succeeding.

- resolve_iteration_state: `every` over a non-iterable scalar (number,
  string, bool, null, undefined) is now undefined, not vacuously true.
  Only genuinely empty collections stay true; any/forEach are untouched.

- a `some ... in` inside an `every` body now guards its loop result, so
  a `some` that matches nothing fails the current iteration. Top-level
  rule bodies still rely on context yields and are unaffected.

- a hoisted index iteration (`some i` / `arr[i]`) inside an `every` body
  gets the same guard.

Also drop `every` from OPA_TODO_FOLDERS so the interpreter-vs-RVM
differential suite covers it, add an OPA_UNSKIP_FOLDERS env override for
auditing other still-skipped folders, and add regression cases for every
variant above.

Author: anakrish

src/languages/rego/compiler/loops.rs

@@ -13,7 +13,7 @@ use crate::ast::{self, ExprRef, LiteralStmt, Query};
 use crate::compiler::destructuring_planner::plans::BindingPlan;
 use crate::compiler::hoist::{HoistedLoop, LoopType};
 use crate::lexer::Span;
-use crate::rvm::instructions::{LoopMode, LoopStartParams};
+use crate::rvm::instructions::{GuardMode, LoopMode, LoopStartParams};
 use crate::rvm::Instruction;
 use crate::Value;
 use alloc::format;
@@ -197,6 +197,19 @@ impl<'a> Compiler<'a> {
             *end = loop_end;
         }
 
+        // The loop writes its overall pass/fail into `result_reg`
+        // (`success_count == total_iterations` for `Every`). The enclosing query
+        // must fail (evaluate to undefined) when the quantifier does not hold, so
+        // guard on `result_reg` here. Without this the `every` result is computed
+        // but discarded, leaving the surrounding rule to always succeed.
+        self.emit_instruction(
+            Instruction::Guard {
+                register: result_reg,
+                mode: GuardMode::Condition,
+            },
+            span,
+        );
+
         Ok(())
     }
 
@@ -312,6 +325,25 @@ impl<'a> Compiler<'a> {
             *end = loop_end;
         }
 
+        // A hoisted index-iteration loop inside an `every` body acts as a
+        // condition on the current iteration: if the indexed reference matches
+        // nothing the iteration must fail. The `every` body emits no context
+        // yield, so the loop result register is otherwise discarded (same
+        // situation as `some ... in`). Guard on it so a non-matching indexed
+        // reference fails the enclosing `every` iteration.
+        if matches!(
+            self.context_stack.last().map(|c| &c.context_type),
+            Some(ContextType::Every)
+        ) {
+            self.emit_instruction(
+                Instruction::Guard {
+                    register: result_reg,
+                    mode: GuardMode::Condition,
+                },
+                collection.span(),
+            );
+        }
+
         Ok(())
     }
 

src/languages/rego/compiler/queries.rs

@@ -70,12 +70,31 @@ impl<'a> Compiler<'a> {
                     ..
                 } = &stmt.literal
                 {
-                    self.compile_some_in_loop_with_remaining_statements(
+                    let some_result_reg = self.compile_some_in_loop_with_remaining_statements(
                         key,
                         value,
                         collection,
                         &stmts[idx..],
                     )?;
+                    // Inside an `every` body a `some ... in` acts as a condition
+                    // on the current iteration: if it matches nothing the
+                    // iteration must fail. Unlike a top-level rule body (where
+                    // per-iteration context yields produce the results), the
+                    // `every` body has no yield, so the loop result register is
+                    // otherwise discarded. Guard on it so a `some` that matches
+                    // nothing fails the enclosing `every` iteration.
+                    if matches!(
+                        self.context_stack.last().map(|c| &c.context_type),
+                        Some(ContextType::Every)
+                    ) {
+                        self.emit_instruction(
+                            Instruction::Guard {
+                                register: some_result_reg,
+                                mode: GuardMode::Condition,
+                            },
+                            &stmt.span,
+                        );
+                    }
                     return Ok(());
                 }
             }

src/rvm/vm/loops.rs

@@ -495,8 +495,15 @@ impl RegoVM {
                     // over a virtual null element.
                     Ok(Some(IterationState::Single { consumed: false }))
                 } else {
-                    // Standard Rego or count/forEach: non-collection → immediate result.
-                    let result = non_collection_result(mode);
+                    // Standard Rego: iterating a non-collection scalar (number,
+                    // string, bool, null, undefined) yields no iterations. For
+                    // `every` this makes the quantifier undefined (it fails) — it
+                    // is NOT vacuously true, which only applies to a genuinely
+                    // empty collection. `any`/`forEach` remain false.
+                    let result = match *mode {
+                        LoopMode::Every => Value::Undefined,
+                        LoopMode::Any | LoopMode::ForEach => Value::Bool(false),
+                    };
                     self.set_register(params.result_reg, result)?;
                     self.pc = usize::from(params.loop_end).saturating_sub(1);
                     Ok(None)

tests/opa.rs

@@ -26,7 +26,6 @@ const OPA_TODO_FOLDERS: &[&str] = &[
     "baseandvirtualdocs",
     "dataderef",
     "defaultkeyword",
-    "every",
     "fix1863",
     "functions",
     "partialdocconstants",
@@ -102,6 +101,20 @@ fn log_rvm_skip(case_note: &str, folder_name: Option<&str>) {
     }
 }
 
+/// Allows temporarily enabling RVM verification for folders otherwise listed in
+/// `OPA_TODO_FOLDERS`, without editing the source. Set `OPA_UNSKIP_FOLDERS` to a
+/// comma-separated list of folder names (e.g. `every,functions`) or `all`.
+/// Intended for auditing latent RVM bugs in currently-skipped constructs.
+fn folder_rvm_unskipped(folder: &str) -> bool {
+    match std::env::var("OPA_UNSKIP_FOLDERS") {
+        Ok(list) => {
+            let list = list.trim();
+            list.eq_ignore_ascii_case("all") || list.split(',').any(|f| f.trim() == folder)
+        }
+        Err(_) => false,
+    }
+}
+
 fn setup_engine_for_case(case: &TestCase, is_rego_v0_test: bool) -> Result<EngineSetup> {
     let mut engine = Engine::new();
 
@@ -388,7 +401,7 @@ fn run_opa_tests(opa_tests_dir: String, folders: &[String]) -> Result<()> {
         let folder_name = folder_name_from_path(path_dir);
         let skip_rvm_for_folder = folder_name
             .as_deref()
-            .map(|folder| OPA_TODO_FOLDERS.contains(&folder))
+            .map(|folder| OPA_TODO_FOLDERS.contains(&folder) && !folder_rvm_unskipped(folder))
             .unwrap_or(false);
 
         if path.is_dir() {