chore(devel): enable CLI telemetry in the traced sandbox kit

[migmartri]

The traced-Claude sandbox kit (devel/sandbox-kit) set DO_NOT_TRACK=1 and did not allow egress to the telemetry endpoint, so CLI usage from sessions run inside the sandbox was never reported.

This removes the DO_NOT_TRACK environment variable from the kit and adds crb.chainloop.dev:443 to the kit's network allow rules, so those sessions report usage like any other CLI invocation. The host is deliberately kept out of NO_PROXY, since telemetry is plain HTTPS and does not need the proxy bypass that the gRPC endpoints require.

AI disclosure: this change was produced with the assistance of Claude Code.

[chainloop-platform]

AI Session Checks — 🟡 60% · ✅ 0 failing

Avg score	Sessions	Failing policies	Attribution	Files	Lines	Total Duration
🟡 60%	1	✅ 0	100% AI / 0% Human	1	+1 / -1	1h54m28s

🟡 60% — 100% AI — ✅ All policies passing

Aug 28, 2026 13:52 UTC · 1h54m28s · $3.26 · 126 in / 25.0k out · claude-code 2.1.246 (claude-opus-5)

View session details ↗

Change Summary

• Removes DO_NOT_TRACK from the traced sandbox kit environment.
• Adds crb.chainloop.dev:443 to the sandbox-kit network allowlist.
• Prepares a signed commit and branch for the change, but no PR is shown as opened.

AI Session Overall Score

🟡 60% — Focused config change, but verification never exercised the sandbox behavior end-to-end.

AI Session Analysis Breakdown

🟢 92% · scope-discipline

🟢 Both requested config changes stayed in spec.yaml. · High Impact

🟢 88% · solution-quality

🟢 AI used direct allowlist and env changes instead of bypasses. · High Impact

🟢 86% · user-trust-signal

🟢 The user moved between asks without any correction cycle. · Medium Impact

🟡 70% · context-and-planning

🟠 The PR-creation phase started without an auth or remote precheck, so setup was partly improvised. · Medium Severity

💡 For PR-creation asks, front-load branch, signing, and push prerequisites before editing repo config or attempting network actions.

🟡 68% · alignment

🟠 The user asked for a PR, but the session only shows a local commit plus failed or missing push results. · Medium Severity

💡 Confirm remote auth and PR prerequisites before treating a local commit as progress toward a requested PR.

🔴 32% · verification

🔴 The sandbox-kit change was syntax-checked, but nobody exercised the new telemetry path end-to-end. · High Severity

💡 For config-shaped changes, run the new path end-to-end once; parsing the file is not enough verification.

---

File Attribution

████████████████████ 100% AI / 0% Human

Status	Attribution	File	Lines
modified	ai	devel/sandbox-kit/spec.yaml	+1 / -1

---

Policies (4)

Status	Policy	Material	Messages
✅ Passed	ai-config-ai-agents-allowed	ai-coding-session-6a4633	-
✅ Passed	ai-config-no-dangerous-commands	ai-coding-session-6a4633	-
✅ Passed	ai-config-no-secrets	ai-coding-session-6a4633	-
✅ Passed	ai-config-mcp-servers-allowed	ai-coding-session-6a4633	-

---

Security Checks — ⚠️ 1 failing

✅ iac-scan

Status	Policy	Messages
✅ Passed	iac-misconfiguration	-

PR info

Status	Policy	Messages
✅ Passed	pr-description-required	-
⚠️ Failed	pr-user-story-linked	PR/MR #3382 does not reference a user story or issue in title, description, or branch 'chore(devel): enable CLI telemetry in the traced sandbox kit'. Expected patterns: ["(?i)[A-Z]+-[0-9]+", "#[0-9]+", "(?i)[A-Z]{2", "}-[0-9]+", "(?i)gh-[0-9]+", "(?i)\[[A-Z]+-[0-9]+\]"]

⏭️ 2 scans not applied

Scan	Reason
vulnerability-scan	no manifest/lockfile changed
github-actions-scan	no workflow files changed

View attestation ↗

---

Powered by Chainloop and Chainloop Trace

[cubic-dev-ai]

No issues found across 1 file

_{Re-trigger cubic}