fix(controlplane): tighten batch-local policy ref exemption

Address review feedback on contract apply batch exemption:

- Only honor the client-supplied batch name lists on a dry-run. A real apply
  persists batch resources before the contract, so it must always validate
  fully and never trust the client lists to skip validation.
- Only exempt bare references (no provider/org). References that explicitly
  target a remote provider or org are always validated, so a bare-name
  collision with a batch-local resource can no longer bypass validation.

Assisted-by: Claude Code
Signed-off-by: Javier Rodriguez <javier@chainloop.dev>

Chainloop-Trace-Sessions: f56037fd-1000-4118-9de7-d532c82f30a2

Author: javirln

app/controlplane/internal/service/workflowcontract.go

@@ -253,7 +253,16 @@ func (s *WorkflowContractService) Apply(ctx context.Context, req *pb.WorkflowCon
 		return nil, err
 	}
 
-	if err = s.contractUseCase.ValidateContractPolicies(ctx, req.RawSchema, token, req.GetBatchPolicyNames(), req.GetBatchPolicyGroupNames()); err != nil {
+	// Batch-local references are only exempted from registry resolution on a dry-run, where
+	// the resources may not be persisted yet. A real apply persists batch resources before the
+	// contract, so it must always validate fully and never trust the client-supplied batch lists.
+	var batchPolicyNames, batchPolicyGroupNames []string
+	if dryRun {
+		batchPolicyNames = req.GetBatchPolicyNames()
+		batchPolicyGroupNames = req.GetBatchPolicyGroupNames()
+	}
+
+	if err = s.contractUseCase.ValidateContractPolicies(ctx, req.RawSchema, token, batchPolicyNames, batchPolicyGroupNames); err != nil {
 		return nil, handleUseCaseErr(err, s.log)
 	}
 

app/controlplane/internal/service/workflowcontract_integration_test.go

@@ -171,11 +171,11 @@ spec:
 `
 }
 
-// TestApplyBatchExemption verifies that references to resources declared as part of the same
-// batch apply are treated as known (not resolved against the registry), while references to
-// resources not in the batch are still validated - in dry-run as well as on a real apply.
-// No policy provider is configured in this harness, so any non-exempt provider-scheme reference
-// fails resolution, which is exactly what proves remote references are still validated.
+// TestApplyBatchExemption verifies that, on a dry-run, bare references to resources declared as
+// part of the same batch apply are treated as known (not resolved against the registry), while
+// remote references, explicitly scoped references, and any reference on a real apply are still
+// validated. No policy provider is configured in this harness, so any non-exempt provider-scheme
+// reference fails resolution, which is exactly what proves those references are still validated.
 func (s *workflowContractApplyIntegrationTestSuite) TestApplyBatchExemption() {
 	testCases := []struct {
 		name                  string
@@ -192,16 +192,28 @@ func (s *workflowContractApplyIntegrationTestSuite) TestApplyBatchExemption() {
 			dryRun:           true,
 		},
 		{
-			name:             "batch-local policy exempted on real apply",
+			name:                  "batch-local policy group exempted in dry-run",
+			rawSchema:             contractWithPolicyGroupRef("svc-apply-batch-grp-dry", "chainloop://batch-grp"),
+			batchPolicyGroupNames: []string{"batch-grp"},
+			dryRun:                true,
+		},
+		{
+			// A real apply persists batch resources before the contract, so it must validate
+			// fully and never trust the client-supplied batch list.
+			name:             "batch list not trusted on real apply",
 			rawSchema:        contractWithPolicyRef("svc-apply-batch-pol-real", "chainloop://batch-pol"),
 			batchPolicyNames: []string{"batch-pol"},
 			dryRun:           false,
+			wantErr:          true,
 		},
 		{
-			name:                  "batch-local policy group exempted in dry-run",
-			rawSchema:             contractWithPolicyGroupRef("svc-apply-batch-grp-dry", "chainloop://batch-grp"),
-			batchPolicyGroupNames: []string{"batch-grp"},
-			dryRun:                true,
+			// An org-scoped reference is unambiguously remote and must not be exempted by a
+			// bare-name collision with a batch-local policy.
+			name:             "org-scoped ref not exempted by name collision",
+			rawSchema:        contractWithPolicyRef("svc-apply-scoped-pol-dry", "chainloop://acme/batch-pol"),
+			batchPolicyNames: []string{"batch-pol"},
+			dryRun:           true,
+			wantErr:          true,
 		},
 		{
 			name:      "non-batch policy still validated in dry-run",

app/controlplane/pkg/biz/workflowcontract.go

@@ -588,8 +588,10 @@ func (uc *WorkflowContractUseCase) findAndValidatePolicy(ctx context.Context, at
 	if loader.IsProviderScheme(att.GetRef()) {
 		pr := loader.ProviderParts(att.GetRef())
 		// Policies created/updated in the same batch apply may not be persisted yet, so
-		// treat references to them as known instead of resolving against the registry.
-		if slices.Contains(batchPolicyNames, pr.Name) {
+		// treat references to them as known instead of resolving against the registry. Only
+		// bare references (no provider/org) can name a batch-local policy; references that
+		// explicitly target a remote provider or org are always validated.
+		if pr.Provider == "" && pr.OrgName == "" && slices.Contains(batchPolicyNames, pr.Name) {
 			return nil, nil
 		}
 		// Validate attachment
@@ -629,8 +631,10 @@ func (uc *WorkflowContractUseCase) findAndValidatePolicyGroup(ctx context.Contex
 	// [chainloop://][provider/]name
 	pr := loader.ProviderParts(att.GetRef())
 	// Policy groups created/updated in the same batch apply may not be persisted yet, so
-	// treat references to them as known instead of resolving against the registry.
-	if slices.Contains(batchPolicyGroupNames, pr.Name) {
+	// treat references to them as known instead of resolving against the registry. Only bare
+	// references (no provider/org) can name a batch-local group; references that explicitly
+	// target a remote provider or org are always validated.
+	if pr.Provider == "" && pr.OrgName == "" && slices.Contains(batchPolicyGroupNames, pr.Name) {
 		return nil, nil
 	}
 	remoteGroup, err := uc.GetPolicyGroup(ctx, pr.Provider, pr.Name, pr.OrgName, "", token)