feat(materials): add OVERSECURED_JSON material type

[migmartri]

Closes#3369

Adds a first-class material type for Oversecured mobile (Android/iOS) scan reports. Until now the only way to attest one was the generic EVIDENCE kind with a hand-written wrapper, which pushed the wrapping onto every caller and skipped validation at craft time. Oversecured has no SARIF output, so the report cannot be routed through the existing SARIF kind either.

The accepted input is the whole-scan JSON export (oversecured report <scanId> --app <appId> --format json). The crafter validates the export envelope — a scan id, an app platform, and a findings array that may be empty or null for a clean scan — and then uploads the report unchanged. Validation stops at the envelope: the findings carry decompiled sources and DAST heap snapshots that make up nearly all of a multi-MB export, and nothing in them identifies the tool better than the header does.

The kind is deliberately kept out of auto-detection, so it must be referenced with an explicit --kind OVERSECURED_JSON or from a workflow contract. The vendor does not publish the export envelope, so pinning it into the detection order would bet every other JSON kind on a shape inferred from a sample. The exclusions in that list are now consolidated into one comment block and pinned by a test.

The material carries the chainloop.material.tool.name annotation only. The export omits the per-finding hasSast/hasDast flags that exist on the API's findings-list and single-finding responses, and states nothing about which engines ran, so no chainloop.material.scan.types value can be derived from it honestly; there is no scanner version in the envelope either (header.scan.version is the app version).

Evaluating these reports with the sast policy family needs a matching rego execution path, which lives in the policies repository and is not part of this change. Worth noting for whoever writes it: the export has no sink, so a finding's location has to come from code[] and its is_matched lines, and false positives are marked rather than filtered out.

AI assistance

This change was produced with AI assistance (Claude Code). Every commit carries an Assisted-by: Claude Code trailer.

🤖 Posted by Maximus bot (Claude Code) on behalf of @migmartri

[chainloop-platform]

AI Session Checks — 🟢 88% · ✅ 0 failing

Avg score	Sessions	Failing policies	Attribution	Files	Lines	Total Duration
🟢 88%	1	✅ 0	100% AI / 0% Human	15	+974 / -10	43m57s

🟢 88% — 100% AI — ✅ All policies passing

Aug 26, 2026 10:44 UTC · 43m57s · $36.62 · 740 in / 259.2k out · claude-code 2.1.246 (claude-opus-5)

View session details ↗

Change Summary

• Adds OVERSECURED_JSON support with a new crafter and registration in the material flow.
• Extends workflow-contract schema outputs, generated API artifacts, and an exclusion test for auto-detection.
• Adds Oversecured fixtures and focused tests, including real-export verification and simplify-driven follow-up cleanup.

AI Session Overall Score

🟢 88% — Well-planned, well-verified work; only the requested PR opening is missing.

AI Session Analysis Breakdown

🟢 94% · user-trust-signal

No notes.

🟢 93% · scope-discipline

No notes.

🟢 92% · context-and-planning

🟢 AI wrote a scoped spec and revised it against the sample export before coding. · High Impact

🟢 91% · solution-quality

🟢 Review feedback removed the byte-copying findings decode instead of shipping it. · High Impact

🟢 91% · verification

🟢 AI ran focused tests, real-export checks, and final build/tests after rebase. · High Impact

🟡 72% · alignment

🟠 User asked for PR creation, but the session stops after commit and rebase with no PR step. · Medium Severity

💡 When shipping steps are requested together, restate the checklist and close every item before stopping.

---

File Attribution

████████████████████ 100% AI / 0% Human

Status	Attribution	File	Lines
created	ai	pkg/attestation/crafter/materials/testdata/oversecured.json	+384 / -0
created	ai	pkg/attestation/crafter/materials/oversecured_test.go	+205 / -0
created	ai	pkg/attestation/crafter/materials/oversecured.go	+156 / -0
modified	ai	app/controlplane/api/workflowcontract/v1/crafting_schema_test.go	+35 / -0
created	ai	pkg/attestation/crafter/materials/testdata/oversecured-clean.json	+33 / -0
created	ai	pkg/attestation/crafter/materials/testdata/oversecured-null-vulnerabilities.json	+29 / -0
created	ai	pkg/attestation/crafter/materials/testdata/oversecured-findings-list.json	+25 / -0
created	ai	pkg/attestation/crafter/materials/testdata/oversecured-no-vulnerabilities.json	+24 / -0
modified	ai	app/controlplane/api/workflowcontract/v1/crafting_schema_validations.go	+14 / -8
created	ai	pkg/attestation/crafter/materials/testdata/oversecured-vulnerabilities-not-array.json	+22 / -0
created	ai	pkg/attestation/crafter/materials/testdata/oversecured-unfamiliar-platform.json	+21 / -0
created	ai	pkg/attestation/crafter/materials/testdata/oversecured-no-platform.json	+19 / -0
modified	ai	app/cli/documentation/cli-reference.mdx	+2 / -2
modified	ai	app/controlplane/api/workflowcontract/v1/crafting_schema.proto	+3 / -0
modified	ai	pkg/attestation/crafter/materials/materials.go	+2 / -0

---

Policies (4)

Status	Policy	Material	Messages
✅ Passed	ai-config-ai-agents-allowed	ai-coding-session-35d950	-
✅ Passed	ai-config-no-dangerous-commands	ai-coding-session-35d950	-
✅ Passed	ai-config-no-secrets	ai-coding-session-35d950	-
✅ Passed	ai-config-mcp-servers-allowed	ai-coding-session-35d950	-

---

Security Checks — ✅ 6 passing

✅ iac-scan

Status	Policy	Messages
✅ Passed	iac-misconfiguration	-
✅ Passed	iac-misconfiguration	-

PR info

Status	Policy	Messages
✅ Passed	pr-description-required	-
✅ Passed	pr-description-required	-
✅ Passed	pr-user-story-linked	-
✅ Passed	pr-user-story-linked	-

⏭️ 2 scans not applied

Scan	Reason
vulnerability-scan	no manifest/lockfile changed
github-actions-scan	no workflow files changed

View attestation ↗

---

Powered by Chainloop and Chainloop Trace

[cubic-dev-ai]

No issues found across 29 files

_{Re-trigger cubic}