Repository navigation
decisions: reconcile all areas - #3765
Conversation
Add docs/decisions with an index and one page each for Artifact CAS, Attestation Process, Authentication, Service Operations, and Chainloop Trace. The pages hold 59 current decisions (ADR-001 to ADR-063, with 4 Non-Confirmed) taken from the 19 specs in docs/specs, each checked against the code, plus three open conflicts. Assisted-by: Claude Code Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev> Chainloop-Trace-Sessions: e3100522-144f-4450-91f7-eed1cd2c29d9
PR validation — ✅ 3 passing
AI Session Checks — 🟡 60% ·
|
| Avg score | Sessions | Failing policies | Attribution | Files | Lines | Total Duration |
|---|---|---|---|---|---|---|
| 🟡 60% | 1 | 100% AI / 0% Human | 7 | +840 / -1 | 70h37m58s |
🟡 60% — 100% AI — ⚠️ 1 policies failing
-
Oct 31, 2026 23:07 UTC · 70h37m58s · $71.21 · 1.7k in / 840.8k out · claude-code 2.1.316 (claude-opus-5-5)
Change Summary
-
Adds an index and five area-prefixed Current Decisions pages, and updates repository guidance to consult them.
AI Session Overall Score
-
🟡 60% — Unsupported triage claims required correction; documentation checks do not establish the changed guidance works.
AI Session Analysis Breakdown
-
🟢 90% · scope-discipline
-
🟢 Changes add the five requested area pages and index without modifying runtime code or dependencies. · High Impact
🟡 78% · user-trust-signal
-
🟡 The user questioned the selection rationale and rule adherence before approving a corrected triage. · Low Severity
🟡 73% · verification
-
🟢 The final lint run inspected all six decision documents and reported zero hard violations. · High Impact
🟠 No captured run demonstrates the new decision-reading and spec-editing guidance in use, and the active user supplied no behavioral confirmation. · Medium Severity
💡 Exercise the changed guidance on a representative task and observe decision-page discovery before accepting the behavior change.
🟡 72% · context-and-planning
-
🟢 The opening supplied a structured reconciliation workflow covering collection, approval, code checks, clarity, and publication. · High Impact
🔴 35% · alignment
-
🔴 Incomplete source reading led to an unsupported claim that every retained decision satisfied the triage rules. · High Severity
💡 Read complete decision records and record each test result before claiming the selection satisfies the rules.
🟠 The assistant presented superseded decisions as an unresolved format choice, then admitted the existing rules already settled it. · Medium Severity
💡 Distinguish genuine user choices from outcomes already determined by the governing rules before asking for approval.
abstained · solution-quality
-
🟡 solution-quality not assessed — reviewer should confirm coverage · Low Severity
-
File Attribution
████████████████████100% AI / 0% HumanStatus Attribution File Lines created ai docs/decisions/chainloop-trace.md+367 / -0 created ai docs/decisions/artifact-cas.md+117 / -0 created ai docs/decisions/authentication.md+102 / -0 created ai docs/decisions/README.md+94 / -0 created ai docs/decisions/service-operations.md+82 / -0 created ai docs/decisions/attestation-process.md+77 / -0 modified ai CLAUDE.md+1 / -1
Policies (4, 1 failing)
Status Policy Material Messages ✅ Passed ai-config-ai-agents-allowedai-coding-session-e31005- ✅ Passed ai-config-no-dangerous-commandsai-coding-session-e31005- ⚠️ Failedai-config-no-secretsai-coding-session-e31005- Secret (jwt) detected in session content [turn=2025, source=tool_result, line=1]: 124:|
⚠️ Failed |ai-config-no-secrets| [ai-coding-session-e31005](https://app.chainloop.dev/u/chainloop/projects/chainloop/v... - Secret (jwt) detected in session content [turn=413, source=tool_result, line=21]: deel_pto: "https://api.deel.com/apps/webhooks/calendars/[CHAINLOOP_TRACE_REDACTED:jwt]"
- Secret (private-key) detected in session content [turn=103, source=tool_result, line=2]: [CHAINLOOP_TRACE_REDACTED:private-key]
✅ Passed ai-config-mcp-servers-allowedai-coding-session-e31005- -
Security Checks — ✅ 5 passing
✅ secret-scan
| Status | Policy | Messages |
|---|---|---|
| ✅ Passed | secrets-detection |
- |
✅ sast-scan
| Status | Policy | Messages |
|---|---|---|
| ✅ Passed | owasp-top10-2025 |
- |
| ✅ Passed | sast |
- |
| ✅ Passed | cwe-top25 |
- |
| ✅ Passed | cwe-top26-40-cusp |
- |
Scans not applied (3)
| Scan | Reason |
|---|---|
vulnerability-scan |
no manifest/lockfile changed |
github-actions-scan |
no workflow files changed |
iac-scan |
no IaC files changed |
Security context
✅ Nothing this change touches has a recorded security-fix history.
View in Chainloop ↗ · How this works ↗
Powered by Chainloop and Chainloop Trace
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
All reported issues were addressed across 6 files
Reply with feedback, questions, or to request a fix.
View guided diff | Re-trigger cubic
Follow the new Current Decisions format: each area gets a three-letter prefix (CAS, ATT, AUT, OPS, TRC) and its own ID sequence from 001, and the pages use the new agent instructions comment. The IDs were not yet merged or cited, so they are renumbered rather than kept. Assisted-by: Claude Code Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev> Chainloop-Trace-Sessions: e3100522-144f-4450-91f7-eed1cd2c29d9
Add the conditions and limits that the code shows (defaults, opt-in settings, error paths, filters, and scope) to the entries and the Language of each area. Move ATT-002 to Current decisions, narrow the OPS-001 conflict, and add an Authentication conflict about the download login. Point CLAUDE.md agents to the decisions index. Assisted-by: Claude Code Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev> Chainloop-Trace-Sessions: e3100522-144f-4450-91f7-eed1cd2c29d9
The existence cache lifetime stays at 24 hours with no setting and no off switch. This replaces issue-3543 D-007 and the settings of R-004. Assisted-by: Claude Code Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev> Chainloop-Trace-Sessions: e3100522-144f-4450-91f7-eed1cd2c29d9
…wn counts Scope CAS-005 to the HTTP download endpoint, AUT-006 to requests that pass field validation, AUT-007 to a missing JSON/REST mapping, and the Trace to CAS relationship to pushes. Count dispatch D-001 as shown, because OPS-005 now cites it. Assisted-by: Claude Code Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev> Chainloop-Trace-Sessions: e3100522-144f-4450-91f7-eed1cd2c29d9
There was a problem hiding this comment.
All reported issues were addressed across 7 files (changes from recent commits).
Requires human review: Auto-approval blocked because this review re-detected 1 unresolved issue already reported by Cubic.
View guided diff | Re-trigger cubic
Scope OPS-003 to the shared endpoint ingress, restate the CAS legacy listener in the relationships, cite R-003 for ATT-002, and say that the TRC-001 fallback is not built. Name replaced decisions in the Trace Not shown line. Assisted-by: Claude Code Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev> Chainloop-Trace-Sessions: e3100522-144f-4450-91f7-eed1cd2c29d9
Adds
docs/decisions/, the Current Decisions pages of this repository. Each page lists the design decisions of one functional area that hold today, with stable area-prefixed IDs, their deciders, the spec they come from, and what a check of the code found. The pages keep only choices that a reader of the code would likely get wrong. Smaller decisions, decisions whose reason the code already states, and decisions that a spec replaced while it was drafted stay in their specs and are counted on each page's "Not shown" line.It also updates the Design Specs block of
CLAUDE.md, so that agents read the decisions index before they change the behavior of an area.Areas
Each area has a three-letter prefix, and its decision IDs count from 001. Area owners, please check your prefix.
CAS, owner @migmartri): CAS-001 to CAS-009. Existence cache store, location, tenant key, and fixed lifetime, credentials kept in process, and the browser download cache (Authorization header, existence check before 304). CAS-009 is recorded directly: the existence cache lifetime stays at 24 hours with no setting or off switch, which replaces issue-3543 D-007 and the settings of R-004.ATT, owner @migmartri): ATT-001 to ATT-004. Organization order with.chainloop.yml, the five commands that read it, one reader shared with Trace, and the API token check.AUT, owner @migmartri): AUT-001 to AUT-007. Handoff code exchange, S256 binding, code store with no token at rest, opt-in detection, legacy?t=handling in the CLI, uniform exchange errors, and a gRPC-only exchange endpoint.OPS, owner @migmartri): OPS-002 to OPS-005. Separate metrics and profiler ports, TLS on the shared endpoint, the HTTP port as the shared endpoint, and multiplexing in the server process. Non-Confirmed: OPS-001.TRC, owner @jiparis): TRC-001 to TRC-039. Spec capture, skills, transcript pointers, pasted images, local mode, the e2e matrix, line attribution, and the Pi and Codex providers. Non-Confirmed: TRC-019 and TRC-028.Open conflicts
/download/callback. Proposed: a spec change that records the current download flow.No conflict was on a page before this change, because the pages are new.
One point for the Trace owner: TRC-029 says that the e2e suite pins the agent versions. The suite does not install the agents. It only warns when the installed version is different, so the pin is not enforced.
Review
A check of the written text against the specs and the code added the conditions and limits of many entries: defaults, opt-in settings, error paths, filters, and scope words. Nobody has read the final text of these entries yet. Each area owner, please review the entries and the Language of your area.
Each area owner approves the area map entry and prefix, the key decision cut, and the Language section of their area.
AI disclosure: Claude Code assisted with this change. It ran the eng-adr reconcile, checked each decision and the written text against the code, and drafted the pages. A person approved the area map, the cut, the Language sections, the conflict proposals, and CAS-009.