Skip to content

feat(materials): add CHAINLOOP_AI_SECURITY_CONTEXT material type - #3376

Merged
matiasinsaurralde merged 4 commits into
mainfrom
feat/ai-security-context-material
Aug 26, 2026
Merged

feat(materials): add CHAINLOOP_AI_SECURITY_CONTEXT material type#3376
matiasinsaurralde merged 4 commits into
mainfrom
feat/ai-security-context-material

Conversation

@matiasinsaurralde

@matiasinsaurraldematiasinsaurralde commented Aug 26, 2026

Copy link
Copy Markdown
Contributor

Closes PFM-7010

Summary

Adds a first-party material type for the security context artifact: recurring vulnerability fingerprints mined from a repository's fix history, the attack surfaces they share, ranked risks, and byte-verifiable evidence anchors backing each claim.

The payload is validated against an embedded, versioned JSON schema. The Chainloop evidence envelope is asserted in the crafter, matching the other first-party material types whose schemas are payload-rooted.

Review in cubic

@chainloop-platform

chainloop-platformBot commented Aug 26, 2026

Copy link
Copy Markdown
Contributor

AI Session Checks — 🟡 74% · ✅ 0 failing

Avg scoreSessionsFailing policiesAttributionFilesLinesTotal Duration
🟡 74%2✅ 097% AI / 3% Human25+5286 / -7021h28m50s

🟡 60% — 96% AI — ✅ All policies passing

Aug 26, 2026 00:21 UTC · 20h45m45s · $62.15 · 692 in / 374.5k out · claude-code 2.1.245 (claude-opus-5)

View session details ↗

Change Summary

  • Adds CHAINLOOP_AI_SECURITY_CONTEXT as a new material type with enum wiring and generated API updates.
  • Introduces the embedded schema, validator/crafter wiring, payload types, annotations, and fixture/test coverage for security-context artifacts.
  • Follows with two fixture-only scrub commits that replace personal or external repo references and re-run the touched-package tests.

AI Session Overall Score

🟡 60% — Strong implementation, but repeated corrected overstatements make reviewer attention warranted.

AI Session Analysis Breakdown

🟢 93% · verification

🟢 AI ran targeted and package-level Go tests before and after the commits. · High Impact

🟢 92% · scope-discipline

🟢 Follow-up scrub commits stayed confined to the requested fixture repo fields. · Medium Impact

🟢 88% · context-and-planning

🟢 A detailed pfm7010.md plan existed before the E2E implementation phase began. · High Impact

🟢 84% · user-trust-signal

No notes.

🟡 67% · solution-quality

🟠 Final scrub rewrote only fixture repo metadata, leaving anchors and quoted spans from another project. · Medium Severity

💡 When anonymizing fixtures, regenerate or rewrite all provenance-bearing fields together.

🔴 35% · alignment

🔴 AI twice overstated facts, then corrected itself on schema-pattern guidance and late fixture-provenance constraints. · High Severity

💡 Re-check the live code path before presenting repo conventions or future constraints as settled facts.


File Attribution

███████████████████░ 96% AI / 4% Human

StatusAttributionFileLines
createdaipkg/attestation/crafter/materials/testdata/ai-security-context.json+1933 / -0
modifiedaiinternal/schemavalidators/internal_schemas/aisecuritycontext/ai-security-context-0.1.schema.json+916 / -2
modifiedaipkg/attestation/crafter/materials/chainloop_ai_security_context_test.go+436 / -6
createdaipkg/attestation/crafter/materials/aisecuritycontext/aisecuritycontext.go+280 / -0
createdaipkg/attestation/crafter/materials/testdata/ai-security-context-extra-field.json+196 / -0
createdaipkg/attestation/crafter/materials/testdata/ai-security-context-minimal.json+195 / -0
createdaiinternal/schemavalidators/testdata/ai_security_context_valid.json+191 / -0
createdaipkg/attestation/crafter/materials/testdata/ai-security-context-bare.json+191 / -0
modifiedaipkg/attestation/crafter/materials/chainloop_ai_security_context.go+178 / -9
createdaiinternal/schemavalidators/testdata/ai_security_context_missing_required.json+184 / -0
modifiedaiinternal/schemavalidators/schemavalidators_test.go+183 / -0
modifiedaiinternal/schemavalidators/schemavalidators.go+75 / -18
modifiedaiapp/controlplane/api/workflowcontract/v1/crafting_schema_validations.go+5 / -4
modifiedaiapp/controlplane/api/workflowcontract/v1/crafting_schema_test.go+4 / -4
modifiedhumanpkg/attestation/crafter/crafter_test.go+8 / -0
modifiedaiapp/cli/documentation/cli-reference.mdx+2 / -2
modifiedaiapp/controlplane/api/workflowcontract/v1/crafting_schema.proto+4 / -0
modifiedaipkg/attestation/crafter/materials/materials.go+2 / -0

Policies (4)

StatusPolicyMaterialMessages
✅ Passedai-config-ai-agents-allowedai-coding-session-df945b-
✅ Passedai-config-no-dangerous-commandsai-coding-session-df945b-
✅ Passedai-config-no-secretsai-coding-session-df945b-
✅ Passedai-config-mcp-servers-allowedai-coding-session-df945b-

🟢 88% — 100% AI — ✅ All policies passing

Aug 26, 2026 21:49 UTC · 43m5s · $16.63 · 328 in / 138.2k out · claude-code 2.1.245 (claude-opus-5)

View session details ↗

Change Summary

  • Moves shared_surface.class to a $refed l0_class_path definition derived from the L0 enum.
  • Adds guard tests that rebuild the regex from the enum and exercise valid and invalid class values.
  • Verifies the guard catches enum-only drift, then runs targeted package tests, lint, and broader build/test commands.

AI Session Overall Score

🟢 88% — Focused root-cause fix with strong validation; one repo-wide test claim was overstated.

AI Session Analysis Breakdown

🟢 96% · scope-discipline

No notes.

🟢 95% · solution-quality

🟢 The fix centralizes taxonomy ownership instead of weakening validation. · High Impact

🟢 94% · verification

🟢 AI wrote failing guard tests first, then re-ran them after the fix. · High Impact

🟢 88% · context-and-planning

🟢 The opening task provided file, failure mode, constraints, and success criteria. · High Impact

🟡 72% · alignment

🟠 Final summary overstated repo-wide validation; the recorded command stopped at an unrelated build error. · Medium Severity

💡 Before claiming repo-wide validation, quote the exact command that finished successfully; do not summarize a command path that aborted.

abstained · user-trust-signal

🟡 No user follow-up after the opening ask, so the reviewer gets no reaction arc. · Low Severity

Missing criteria: user-trust-signal


File Attribution

████████████████████ 100% AI / 0% Human

StatusAttributionFileLines
modifiedaiinternal/schemavalidators/schemavalidators_test.go+142 / -0
modifiedaipkg/attestation/crafter/materials/chainloop_ai_security_context_test.go+119 / -6
modifiedaipkg/attestation/crafter/materials/chainloop_ai_security_context.go+27 / -9
modifiedaiinternal/schemavalidators/internal_schemas/aisecuritycontext/ai-security-context-0.1.schema.json+6 / -2
modifiedaipkg/attestation/crafter/crafter_test.go+8 / -0
modifiedaiapp/controlplane/api/workflowcontract/v1/crafting_schema_validations.go+1 / -4
modifiedaiapp/controlplane/api/workflowcontract/v1/crafting_schema_test.go+0 / -4

Policies (4)

StatusPolicyMaterialMessages
✅ Passedai-config-ai-agents-allowedai-coding-session-3f3650-
✅ Passedai-config-no-dangerous-commandsai-coding-session-3f3650-
✅ Passedai-config-no-secretsai-coding-session-3f3650-
✅ Passedai-config-mcp-servers-allowedai-coding-session-3f3650-

Security Checks — ✅ 3 passing

iac-scan

StatusPolicyMessages
✅ Passediac-misconfiguration-

PR info

StatusPolicyMessages
✅ Passedpr-description-required-
✅ Passedpr-user-story-linked-

⏭️ 2 scans not applied

ScanReason
vulnerability-scanno manifest/lockfile changed
github-actions-scanno workflow files changed

View attestation ↗


Powered by Chainloop and Chainloop Trace

@cubic-dev-aicubic-dev-aiBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 31 files

Not reviewed (too large): pkg/attestation/crafter/materials/testdata/ai-security-context.json (~1,933 lines) - if these are generated or fixture files, add them to ignored paths to exclude them from future reviews.

Tip: cubic can generate docs of your entire codebase and keep them up to date. Try it here.

Re-trigger cubic

Adds a first-party material type for the security context artifact: recurring
vulnerability fingerprints mined from a repository's fix history, the attack
surfaces they share, ranked risks, and byte-verifiable evidence anchors backing
each claim.
The payload is validated against an embedded, versioned JSON schema. The
Chainloop evidence envelope is asserted in the crafter, matching the other
first-party material types whose schemas are payload-rooted.
The kind is excluded from auto-detection: the artifact is generic JSON inside an
envelope and would shadow other JSON kinds, so it must be referenced with an
explicit --kind CHAINLOOP_AI_SECURITY_CONTEXT or from a workflow contract.
The crafter surfaces the scanned head SHA, the producing tool version, the
fingerprint count, and whether the scan funnel reconciles as material
annotations, so a policy can gate on them without downloading the payload.
Signed-off-by: Matías Insaurralde <matias@chainloop.dev>
Chainloop-Trace-Sessions: df945bde-e982-472c-bb81-50055df403bb
@matiasinsaurralde
matiasinsaurraldeforce-pushed the feat/ai-security-context-material branch from 3116486 to 1a6a0a8CompareAugust 26, 2026 21:10

@cubic-dev-aicubic-dev-aiBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All reported issues were addressed across 31 files (changes from recent commits).

Not reviewed (too large): pkg/attestation/crafter/materials/testdata/ai-security-context.json (~1,933 lines) - if these are generated or fixture files, add them to ignored paths to exclude them from future reviews.

Reply with feedback, questions, or to request a fix.

Re-trigger cubic

migmartri
migmartri previously approved these changes Aug 26, 2026
…curity context schema
The closed L0 class taxonomy was spelled out twice in the AI security context
schema: once as the l0_class enum and once inline in shared_surface.class's
pattern. Extending it meant editing both, and updating only one let the two
diverge, so the same class would be rejected on a shared surface while an
individual fingerprint carrying it passed.
Hoist the pattern into a l0_class_path definition that shared_surface.class
references, and mark it as derived from the l0_class enum. The wire format is
unchanged: shared surfaces still carry slash-joined class tokens, so the pattern
stays the way membership is checked, since draft-07 cannot interpolate an enum
into a pattern.
Guard the derivation with tests that rebuild the pattern from the enum and drive
every taxonomy member through both the single-token and slash-joined positions,
so a taxonomy edit that touches only one copy fails instead of silently widening
or narrowing validation.
Chainloop-Trace-Sessions: 3f365023-61a3-4af3-bbe9-03688f152834, df945bde-e982-472c-bb81-50055df403bb
Signed-off-by: Matías Insaurralde <matias@chainloop.dev>
Comment threadpkg/attestation/crafter/materials/chainloop_ai_security_context.go Outdated
Comment threadapp/controlplane/api/workflowcontract/v1/crafting_schema_validations.go Outdated

@cubic-dev-aicubic-dev-aiBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All reported issues were addressed across 2 files (changes from recent commits).

Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic

…hared tool annotations
The crafter announced the producing scanner under a key private to this material
kind, which left it invisible to generic policies and to tooling that reads tool
identity the same way for every kind. It also surfaced only the version, so an
attested material carried a bare version string naming no tool at all, even
though the payload already required the tool name.
Emit both through the shared vocabulary instead: chainloop.material.tools, plus
the legacy name and version keys, matching what the CycloneDX and SPDX crafters
already do. The annotations that are genuinely specific to a security context —
head SHA, fingerprint count and whether the scan funnel reconciles — stay as they
were.
Chainloop-Trace-Sessions: 3f365023-61a3-4af3-bbe9-03688f152834, df945bde-e982-472c-bb81-50055df403bb
Signed-off-by: Matías Insaurralde <matias@chainloop.dev>
The kind was held out of the auto-detection order on the grounds that its
evidence id is only reachable after a full parse. Detection already crafts each
kind in turn and parses the file completely, so that constraint does not exist,
and the crafter matches on the exact evidence id and schema URL before it accepts
anything — a stricter fingerprint than the two sibling AI kinds already in the
list, neither of which inspects the envelope at all.
The exclusion did not make a contract-free `attestation add` ask for an explicit
--kind either. Nothing ahead of it matched, so the file fell through to the
ARTIFACT catch-all and was recorded as a generic artifact, losing both the schema
validation and the annotations the kind exists to publish.
Add it alongside the other CHAINLOOP_AI_* entries and replace the exclusion
assertion with a positive detection test.
Chainloop-Trace-Sessions: 3f365023-61a3-4af3-bbe9-03688f152834, cc2bbc73-4145-4e0a-a516-ebbe5d42ca81, df945bde-e982-472c-bb81-50055df403bb
Signed-off-by: Matías Insaurralde <matias@chainloop.dev>
@matiasinsaurralde
matiasinsaurralde merged commit 37a179f into mainAug 26, 2026
5 checks passed
@matiasinsaurralde
matiasinsaurralde deleted the feat/ai-security-context-material branch August 26, 2026 22:37
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

@matiasinsaurralde@migmartri