fix(policy,reason): fail closed on ambiguous ODRL constraints and hostile RIF/XML input

[jeswr]

Requested by Jesse · project thread

Summary

Input-robustness fixes for sparq-policy and sparq-reason. Each one now fails closed on malformed or hostile input.

sparq-policy (parse.rs)

• sparq-policy: RawConstraint picks an ARBITRARY leftOperand/operator when a constraint node carries several #3832: RawConstraint::absorb used first-binding-wins for odrl:leftOperand/odrl:operator, so the result depended on result ordering. A node with several distinct values is now refused (Err). Degrading it to the unsatisfiable guard would disable a prohibition, so this follows the sq-srjuc refusal precedent. Repeated identical bindings, one row per rightOperand object, still fold as before.
• sparq-policy: a NESTED-list member of an odrl:rightOperand collection is silently unmatchable, widening the negative set operators #3982: fold_rights now refuses a nested-list member of a rightOperand collection, including an empty nested ( ), the same way fold_list_operands does. Before, the member was unmatchable, so under isNoneOf the authored exclusion was silently dropped (isNoneOf ( ( <a> ) <b> ) granted a). The doc comment that called this "fail-closed" has been corrected.

sparq-reason

• sq-hhfh0: rif-xml: recursion-depth guard for nested And/Or/Exists to prevent stack overflow on adversarial XML #3359 (rif_xml.rs): element nesting is capped at MAX_XML_DEPTH = 256 in parse_xml_tree. That bounds every downstream recursion (parse_condition, expand_body, renaming, recursive Drop). Before, 100k nested <Or>/<Exists> aborted the process with a stack overflow (confirmed red). A body just under the cap still imports on the default debug test-thread stack.
• sq-h7cfm: rif-xml: validate xmlns namespace on Document root element (fail-closed on non-RIF XML) #3360 (rif_xml.rs): the root element must be in the RIF namespace, either as the default xmlns or as a prefixed rif:Document. A missing or foreign namespace gives MalformedXml.
• sparq-reason time:inSeconds accepts impossible calendar dates (2026-02-29), diverging from sparq-policy parse_instant #3804 (n3/mod.rs): time:inSeconds/time:dayOfWeek now bind nothing for an impossible calendar date (2026-02-29, 1900-02-29, month 13, day 0) instead of rolling it over. This matches sparq_policy::parse_instant. Real leap days (2024-02-29, 2000-02-29) still bind.

Skills updated: skills/usage-control-policy/SKILL.md and skills/inference/SKILL.md now list the new refusals.

Closes #3359
Closes #3360
Closes #3804
Closes #3832
Closes #3982

Base gate (always required)

• cargo build --workspace succeeds. (Left to CI; only crate-scoped builds were run here.)
• cargo clippy --workspace --exclude sparq-py --all-targets -- -D warnings is clean. (Left to CI. Crate-scoped cargo clippy -p sparq-reason -p sparq-policy --all-targets --all-features -- -D warnings is clean.)
• The code this PR touches is formatted (matching the surrounding committed style).
• cargo test passes for every crate this PR touches (-p sparq-policy, -p sparq-reason default + --all-features, and -p sparq-conformance --all-features --test rif_wg_core_suite).

Targeted re-evaluation (check the rows that apply to your change)

• Reasoner: only the RIF/XML importer front-end and one time: builtin changed; the rule engine is untouched. The crate's tests and the W3C RIF-WG core suite runner were re-run. The LUBM tier was not.

Ratchets and conventions

• I did not lower any conformance / perf / coverage ratchet.
• No hard-coded performance numbers added to markdown.
• Follow-up / discovered work is captured as beads, not as TODO/FIXME markers.
• If this change makes a doc statement false, I updated that doc in the same change.

Security

• This change does not introduce a security regression. It closes a DoS (stack-overflow abort) in the RIF/XML importer and two order-dependent or fail-open shapes in the ODRL reference evaluator.

Performance check (local, before vs after main)

Non-canonical, shared-box measurements: 4 cores, other jobs running, release profile. Each binary was built from origin/main and from this branch in separate target dirs. The runs alternate main/PR to cancel drift. Noise band is the p10–p90 spread of the per-run times, relative to the median.

Workload	main (median ms)	PR (median ms)	Δ median (Δ best)	Noise band
sparq-policy parse_policy_str, 400 ODRL policies (isAnyOf list, isNoneOf multi-object, dateTime, prohibition); 20 runs × median of 7	189.8	189.6	−0.1% (−1.0%)	±15%
sparq-policy evaluate, the 400 policies × 34 requests × 5 rounds	52.7	50.9	−3.4% (−5.4%)	±11–15%
sparq-reason rif_xml::import, 2,000-rule RIF-Core document (1.6 MB, nested And/Frame bodies); 20 runs × median of 9	27.6	27.6	+0.1% (+1.2%)	±65% (tail outliers; p10 ±2%)
sparq-reason N3 time:inSeconds / time:dayOfWeek over 3,000 dateTimes (reason_n3_terms); 20 runs × median of 7	36.1	35.8	−0.8% (−3.0%)	±30%

Verdict: no regression beyond noise. The conflict flags in absorb and the nested-list check in fold_rights run once per constraint at parse time. The RIF depth and namespace checks add one length compare per element plus a root-only attribute scan.

🤖 Generated with Claude Code

https://claude.ai/code/session_01ScyGGohDhirnbLbrUSnA5n

---

Generated by Claude Code

[jeswr]

🔎 Codex reviewer — gpt-6.1-sol

Automated review by the Codex reviewer (OpenAI gpt-6.1-sol via Codex CLI) of head 640530fcb53d. Scope: correctness, security, soundness and design; style nits omitted. A new head gets a fresh review.

Findings

1. [medium] Namespace validation can be bypassed below the root — crates/sparq-reason/src/rif_xml.rs:462
   Adding xmlns="urn:foreign" to <payload> in an otherwise accepted document passes the new root check. Descendants still lose their namespaces through local_name(), so foreign Group, Frame and other elements are interpreted as RIF rules and can produce conclusions. The RIF-Core schema requires these elements to be namespace-qualified.

   Resolve and validate each element’s namespace, including inherited declarations and prefix rebinding, before interpreting its local name.

2. [medium] Invalid date fields become defaults before validation — crates/sparq-reason/src/n3/mod.rs:3285
   The new calendar check validates values produced by parse().ok().unwrap_or(1). Consequently, "2026-02-29Z"^^xsd:date becomes February 1 and still binds both time builtins. An overflowing day in "2026-02-9223372036854775808T00:00:00Z"^^xsd:dateTime follows the same path. Impossible dates therefore still generate inferred facts.

   Default only genuinely absent components; reject parsing failures in supplied fields. Separate date timezone suffixes before parsing and validating the calendar components.

Verdict: Address these validation bypasses before merging.

[jeswr]

🔎 Codex reviewer — gpt-6.1-sol

Automated review by the Codex reviewer (OpenAI gpt-6.1-sol via Codex CLI) of head 14036cd9482a. Scope: correctness, security, soundness and design; style nits omitted. A new head gets a fresh review.

Findings

1. [low] Valid escaped RIF namespaces are rejected — crates/sparq-reason/src/rif_xml.rs:415
   Quick-xml returns namespace bytes without expanding character references, so the raw comparison rejects valid input such as <Document xmlns="http://www.w3.org/2007/rif&#35;"><payload><Group/></payload></Document>. This previously imported successfully and denotes the RIF namespace under XML namespace normalization rules.

   Normalize and unescape the resolved namespace value before comparing it, and add regression tests for escaped default and prefixed declarations.

Verdict: Fix the namespace normalization regression before merging as is.

[jeswr]

🔎 Codex reviewer — gpt-6.1-sol

Automated review by the Codex reviewer (OpenAI gpt-6.1-sol via Codex CLI) of head 06a4fd028380. Scope: correctness, security, soundness and design; style nits omitted. A new head gets a fresh review.

Findings

No correctness, security, soundness or design problems found.

Verdict: The PR appears safe to merge as is.

[jeswr]

Local ci-fast gate (GitHub Actions outage; Jesse approved local-gate merges). PR head 06a4fd02 merged with main bb7c6044:

• clippy -D warnings (core crates, all targets): pass
• nextest (core crates, ci profile): pass
• doctests (core crates): pass
• W3C SPARQL conformance 1229/1229 (ratchet 1229): pass

Squash-merging under the local-gate rule.

---

Generated by Claude Code