fix(controlplane): exempt batch-local policy refs in contract apply

Contract apply resolved every policy and policy-group reference against the
persisted registry, so a dry-run apply failed when a contract referenced a
policy or policy group created in the same batch that was not yet persisted.

Add batch_policy_names and batch_policy_group_names to the apply request and
treat references to those names as known instead of resolving them, while
still validating remote references in both dry-run and real applies.

Assisted-by: Claude Code
Signed-off-by: Javier Rodriguez <javier@chainloop.dev>

Chainloop-Trace-Sessions: f56037fd-1000-4118-9de7-d532c82f30a2

Author: javirln

app/controlplane/api/controlplane/v1/workflow_contract.pb.go

@@ -121,6 +121,12 @@ message WorkflowContractServiceApplyRequest {
   bytes raw_schema = 1;
   // When true, validate and compute the result without persisting any change
   bool dry_run = 2;
+  // Names of policies created/updated in the same batch apply. References to these are
+  // treated as known instead of being resolved against the registry (they may not be
+  // persisted yet, e.g. during dry-run). Remote references are still validated.
+  repeated string batch_policy_names = 3;
+  // Same as batch_policy_names, for policy groups created/updated in the same batch.
+  repeated string batch_policy_group_names = 4;
 }
 
 message WorkflowContractServiceApplyResponse {

app/controlplane/api/controlplane/v1/workflow_contract.proto

@@ -785,7 +785,7 @@ func (s *AttestationService) FindOrCreateWorkflow(ctx context.Context, req *cpAP
 
 	// contract validation
 	if req.GetContractBytes() != nil {
-		if err = s.workflowContractUseCase.ValidateContractPolicies(ctx, req.GetContractBytes(), token); err != nil {
+		if err = s.workflowContractUseCase.ValidateContractPolicies(ctx, req.GetContractBytes(), token, nil, nil); err != nil {
 			return nil, handleUseCaseErr(err, s.log)
 		}
 	}

app/controlplane/api/gen/frontend/controlplane/v1/workflow_contract.ts

@@ -146,7 +146,7 @@ func (s *WorkflowContractService) Create(ctx context.Context, req *pb.WorkflowCo
 	}
 
 	if len(req.RawContract) != 0 {
-		if err = s.contractUseCase.ValidateContractPolicies(ctx, req.RawContract, token); err != nil {
+		if err = s.contractUseCase.ValidateContractPolicies(ctx, req.RawContract, token, nil, nil); err != nil {
 			return nil, handleUseCaseErr(err, s.log)
 		}
 	}
@@ -212,7 +212,7 @@ func (s *WorkflowContractService) Update(ctx context.Context, req *pb.WorkflowCo
 
 	// Validate the contract policies if the raw contract is provided
 	if len(req.RawContract) != 0 {
-		if err = s.contractUseCase.ValidateContractPolicies(ctx, req.RawContract, token); err != nil {
+		if err = s.contractUseCase.ValidateContractPolicies(ctx, req.RawContract, token, nil, nil); err != nil {
 			return nil, handleUseCaseErr(err, s.log)
 		}
 	}
@@ -253,7 +253,7 @@ func (s *WorkflowContractService) Apply(ctx context.Context, req *pb.WorkflowCon
 		return nil, err
 	}
 
-	if err = s.contractUseCase.ValidateContractPolicies(ctx, req.RawSchema, token); err != nil {
+	if err = s.contractUseCase.ValidateContractPolicies(ctx, req.RawSchema, token, req.GetBatchPolicyNames(), req.GetBatchPolicyGroupNames()); err != nil {
 		return nil, handleUseCaseErr(err, s.log)
 	}
 

app/controlplane/api/gen/jsonschema/controlplane.v1.WorkflowContractServiceApplyRequest.jsonschema.json

@@ -138,6 +138,106 @@ spec:
 	}
 }
 
+// contractWithPolicyRef builds a v2 contract that references a policy via a provider scheme.
+func contractWithPolicyRef(name, policyRef string) string {
+	return `
+apiVersion: chainloop.dev/v1
+kind: Contract
+metadata:
+  name: ` + name + `
+spec:
+  materials:
+    - type: ARTIFACT
+      name: my-artifact
+  policies:
+    attestation:
+      - ref: ` + policyRef + `
+`
+}
+
+// contractWithPolicyGroupRef builds a v2 contract that references a policy group via a provider scheme.
+func contractWithPolicyGroupRef(name, groupRef string) string {
+	return `
+apiVersion: chainloop.dev/v1
+kind: Contract
+metadata:
+  name: ` + name + `
+spec:
+  materials:
+    - type: ARTIFACT
+      name: my-artifact
+  policyGroups:
+    - ref: ` + groupRef + `
+`
+}
+
+// TestApplyBatchExemption verifies that references to resources declared as part of the same
+// batch apply are treated as known (not resolved against the registry), while references to
+// resources not in the batch are still validated - in dry-run as well as on a real apply.
+// No policy provider is configured in this harness, so any non-exempt provider-scheme reference
+// fails resolution, which is exactly what proves remote references are still validated.
+func (s *workflowContractApplyIntegrationTestSuite) TestApplyBatchExemption() {
+	testCases := []struct {
+		name                  string
+		rawSchema             string
+		batchPolicyNames      []string
+		batchPolicyGroupNames []string
+		dryRun                bool
+		wantErr               bool
+	}{
+		{
+			name:             "batch-local policy exempted in dry-run",
+			rawSchema:        contractWithPolicyRef("svc-apply-batch-pol-dry", "chainloop://batch-pol"),
+			batchPolicyNames: []string{"batch-pol"},
+			dryRun:           true,
+		},
+		{
+			name:             "batch-local policy exempted on real apply",
+			rawSchema:        contractWithPolicyRef("svc-apply-batch-pol-real", "chainloop://batch-pol"),
+			batchPolicyNames: []string{"batch-pol"},
+			dryRun:           false,
+		},
+		{
+			name:                  "batch-local policy group exempted in dry-run",
+			rawSchema:             contractWithPolicyGroupRef("svc-apply-batch-grp-dry", "chainloop://batch-grp"),
+			batchPolicyGroupNames: []string{"batch-grp"},
+			dryRun:                true,
+		},
+		{
+			name:      "non-batch policy still validated in dry-run",
+			rawSchema: contractWithPolicyRef("svc-apply-remote-pol-dry", "chainloop://not-in-batch"),
+			dryRun:    true,
+			wantErr:   true,
+		},
+		{
+			name:      "non-batch policy group still validated in dry-run",
+			rawSchema: contractWithPolicyGroupRef("svc-apply-remote-grp-dry", "chainloop://not-in-batch-grp"),
+			dryRun:    true,
+			wantErr:   true,
+		},
+	}
+
+	for _, tc := range testCases {
+		s.Run(tc.name, func() {
+			resp, err := s.svc.Apply(s.ctx, &pb.WorkflowContractServiceApplyRequest{
+				RawSchema:             []byte(tc.rawSchema),
+				DryRun:                tc.dryRun,
+				BatchPolicyNames:      tc.batchPolicyNames,
+				BatchPolicyGroupNames: tc.batchPolicyGroupNames,
+			})
+
+			if tc.wantErr {
+				s.Require().Error(err)
+				return
+			}
+
+			s.Require().NoError(err)
+			s.Equal(pb.WorkflowContractServiceApplyResponse_APPLY_STATUS_CREATED, resp.GetStatus())
+			s.True(resp.GetChanged())
+		})
+	}
+}
+
 func TestWorkflowContractApply(t *testing.T) {
 	suite.Run(t, new(workflowContractApplyIntegrationTestSuite))
 }