feat(schemavalidators): add optional provenance.trace_discover to AI security context schema

[migmartri]

Adds an optional provenance.trace_discover object to the AI security context schema (ai-security-context-0.1).

The producer of a security context looks up, in the Chainloop graph, the AI coding sessions behind fingerprint commits that declare none in a Chainloop-Trace-Sessions trailer. Today the artifact cannot record how that lookup went, so a context whose lookups were all refused looks the same as one for a repository with no AI sessions. Because provenance sets additionalProperties: false, the schema has to allow the field before a producer can write it.

The new object holds:

• status: ran, disabled, or cli_not_found.
• commits, matched, not_found, denied, failed: non-negative integer counters. They are required when status is ran and forbidden otherwise (draft-07 if/then/else).

The field is optional, so artifacts without it stay valid and schema_version is unchanged. Validator tests cover the valid and invalid shapes.

This change was produced with AI assistance (Claude Code).

🤖 Posted by Maximus bot (Claude Code) on behalf of @migmartri using the eng-autopilot skill

[chainloop-platform]

PR validation — ✅ 3 passing

Status	Policy	Material	Messages
✅ Passed	pr-min-approvals	pr-info	-
✅ Passed	pr-description-required	pr-info	-
✅ Passed	pr-user-story-linked	pr-info	-

_{View attestation ↗}

AI Session Checks — 🟢 91% · ✅ 0 failing

Avg score	Sessions	Failing policies	Attribution	Files	Lines	Total Duration
🟢 91%	1	✅ 0	100% AI / 0% Human	2	+191 / -21	23m6s

🟢 91% — 100% AI — ✅ All policies passing

Oct 16, 2026 10:23 UTC · 23m6s · $6.23 · 224 in / 83.0k out · claude-code 2.1.301 (claude-opus-5-5)

_{View session details ↗}

Change Summary

• Adds an optional provenance.trace_discover object to the AI security context schema.
• Enforces status-dependent counter rules for ran, disabled, and cli_not_found.
• Adds a 15-case validator test for the new field and later refactors that test for lint compliance.

AI Session Overall Score

🟢 91% — Autonomous autopilot run; strong alignment and verification, with no user-trust signal by design.

AI Session Analysis Breakdown

🟢 93% · scope-discipline

🟢 The staged change stayed inside the schema file and its test file. · High Impact

🟢 92% · alignment

No notes.

🟢 91% · verification

🟢 A new 15-case trace_discover test failed first and then passed after the schema fix. · High Impact

🟢 90% · context-and-planning

🟢 The opening brief tightly scoped the exact files, constraints, and workflow requirements. · High Impact

🟢 90% · solution-quality

No notes.

abstained · user-trust-signal

🟡 User trust was not assessed because the session was autopilot instructions plus peer messages, not a human reaction arc. · Low Severity

Missing criteria: user-trust-signal

---

File Attribution

████████████████████ 100% AI / 0% Human

Status	Attribution	File	Lines
modified	ai	internal/schemavalidators/schemavalidators_test.go	+96 / -21
modified	ai	internal/schemavalidators/internal_schemas/aisecuritycontext/ai-security-context-0.1.schema.json	+95 / -0

---

Policies (4)

Status	Policy	Material	Messages
✅ Passed	ai-config-ai-agents-allowed	ai-coding-session-b06814	-
✅ Passed	ai-config-no-dangerous-commands	ai-coding-session-b06814	-
✅ Passed	ai-config-no-secrets	ai-coding-session-b06814	-
✅ Passed	ai-config-mcp-servers-allowed	ai-coding-session-b06814	-

Security Checks — ✅ 6 passing

✅ secret-scan

Status	Policy	Messages
✅ Passed	secrets-detection	-

✅ sast-scan

Status	Policy	Messages
✅ Passed	owasp-top10-2025	-
✅ Passed	sast	-
✅ Passed	cwe-top25	-
✅ Passed	cwe-top26-40-cusp	-

✅ iac-scan

Status	Policy	Messages
✅ Passed	iac-misconfiguration	-

Scans not applied (2)

Scan	Reason
vulnerability-scan	no manifest/lockfile changed
github-actions-scan	no workflow files changed

_{View attestation ↗}

Security context

✅ Nothing this change touches has a recorded security-fix history.

_{View in Chainloop ↗ · How this works ↗}

---

Powered by Chainloop and Chainloop Trace

[cubic-dev-ai]

No issues found across 2 files

<sub>Heads up: you’ve reached your flex budget. Increase your flex budget or wait for usage to reset.

View guided diff | Re-trigger cubic</sub>