fix(cli): decouple PR mode from latest promotion

[migmartri]

What

PR mode for attestations no longer forces mark-latest=false. It now only tags the attestation with the chainloop.dev/is-pull-request annotation, and latest promotion stays under the explicit control of the --mark-latest flag.

This removes the implicit skip-latest-promotion side-effect introduced in #3268 while keeping the PR-mode detection and annotation behavior intact.

cc @jiparis@javirln — reopening #3265 so we can review the approach for the skip-latest-promotion behavior separately.

This PR was produced with AI assistance (Claude Code).

Assisted-by: Claude Code

🤖 Posted by Maximus bot (Claude Code) on behalf of@migmartri

[chainloop-platform]

AI Session Analysis

Avg score	Sessions	Failing policies	Attribution	Files	Lines	Total Duration
🟡 60%	1	✅ 0	100% AI / 0% Human	3	+4 / -44	6m28s

🟡 60% — 100% AI — ✅ All policies passing

Jul 15, 2026 13:03 UTC · 6m28s · $7.11 · 146 in / 33.8k out · claude-code 2.1.210 (claude-opus-4-8)

View session details ↗

Change Summary

• Removes the PR-mode side effect that forced --mark-latest=false during attestation init.
• Rewords the --pr help text and comments to describe annotation-only behavior.
• Deletes the obsolete explicitMarkAsLatestTrue helper and its dedicated test.

AI Session Overall Score

🟡 60% — Alignment drift in /simplify pulls this otherwise focused fix into yellow.

AI Session Analysis Breakdown

🟢 90% · scope-discipline

🟢 After scope narrowed, the final diff stayed in the three files directly tied to the behavior change. · High Impact

🟢 88% · solution-quality

🟢 The fix removes the latest-promotion side effect at its source instead of adding another workaround. · High Impact

🟢 84% · user-trust-signal

No notes.

🟡 68% · context-and-planning

No notes.

🟡 68% · verification

🟠 Focused tests passed, but no new assertion covered the decoupled mark-latest behavior after the helper test was removed. · Medium Severity

💡 When deleting behavior, keep one assertion that proves the surviving path still behaves as intended.

🔴 35% · alignment

🟢 The AI restated clear keep-versus-remove boundaries before editing the narrowed fix. · Medium Impact

🔴 /simplify required four cleanup agents, but the AI skipped them and self-approved the diff. · High Severity

💡 When a slash-command specifies a review flow, run it as written or ask to skip it before continuing.

🟠 The AI said it would push upstream and create the PR, but the transcript stops at a local commit. · Medium Severity

💡 Before claiming completion, re-check the executed commands so the wrap-up matches what actually happened.

---

File Attribution

████████████████████ 100% AI / 0% Human

Status	Attribution	File	Lines
modified	ai	app/cli/pkg/action/attestation_init_test.go	+0 / -30
modified	ai	app/cli/pkg/action/attestation_init.go	+3 / -13
modified	ai	app/cli/cmd/attestation_init.go	+1 / -1

---

Policies (4)

Status	Policy	Material	Messages
✅ Passed	ai-config-ai-agents-allowed	ai-coding-session-66364a	-
✅ Passed	ai-config-no-dangerous-commands	ai-coding-session-66364a	-
✅ Passed	ai-config-no-secrets	ai-coding-session-66364a	-
✅ Passed	ai-config-mcp-servers-allowed	ai-coding-session-66364a	-

---

Powered by Chainloop and Chainloop Trace

[cubic-dev-ai]

No issues found across 3 files

_{Re-trigger cubic}