[migmartri]

The attestation status and workflow run describe outputs showed "Policy violation strategy: ADVISORY" when the organization does not enforce policies. That is confusing when individual policies or policy groups are configured as gates, because those still block the push. The row is now only shown when the strategy is ENFORCED.

AI disclosure: this change was produced with assistance from Claude Code.

Closes #3762

[chainloop-platform]

PR validation — ⚠️ 2 failing

Status	Policy	Material	Messages
⚠️ Failed	pr-min-approvals	pr-info	PR/MR #3761 has 0 approving reviews, 1 required.
✅ Passed	pr-description-required	pr-info	-
⚠️ Failed	pr-user-story-linked	pr-info	PR/MR #3761 does not reference a user story or issue in title, description, or branch 'fix(cli): hide the policy violation strategy when it is advisory'. Expected patterns: ["(?i)[A-Z]+-[0-9]+", "#[0-9]+", "(?i)gh-[0-9]+", "(?i)\\[[A-Z]+-[0-9]+\\]"]

_{View attestation ↗}

AI Session Checks — 🟡 79% · ✅ 0 failing

Avg score	Sessions	Failing policies	Attribution	Files	Lines	Total Duration
🟡 79%	1	✅ 0	99% AI / 1% Human	27	+787 / -73	3h51m0s

🟡 79% — 99% AI — ✅ All policies passing

Oct 31, 2026 17:18 UTC · 3h51m0s · $36.58 · 1.2k in / 420.5k out · claude-code 2.1.316 (claude-opus-5-5)

_{View session details ↗}

Change Summary

• Adds contract-level policy enforcement with tighten-only gate resolution.
• Updates crafter, renderer, control-plane status handling, and CLI status output.
• Adds warnings for ignored gate: false opt-outs at init and status time.
• Adds focused Go tests plus broader lint and package test runs.

AI Session Overall Score

🟡 79% — Strong implementation, but one status surface and one warning surface remain incomplete.

AI Session Analysis Breakdown

🟢 90% · scope-discipline

No notes.

🟢 88% · solution-quality

🟢 Tighten-only logic lands in shared gate-resolution helpers. · High Impact

🟢 87% · context-and-planning

🟢 A full spec existed before implementation. · High Impact

🟢 The AI asked design questions before editing. · High Impact

🟢 82% · user-trust-signal

No notes.

🟡 72% · alignment

🟠 The diff names the source in attestation status, but workflow run describe still prints only status.Strategy. · Medium Severity

💡 When a spec names multiple user-visible surfaces, check each surface before calling the requirement done.

🟠 The contract check/save warning was parked as a follow-up without a later user instruction narrowing scope. · Medium Severity

💡 If you need to defer a requested surface, ask to narrow scope instead of parking it silently.

🟡 68% · verification

🟠 Focused Go tests ran, but the captured outputs do not show the spec's two push-blocking acceptance checks by name. · Medium Severity

💡 When a spec names acceptance checks, run those checks explicitly or capture a named test result for each.

---

File Attribution

███████████████████░ 99% AI / 1% Human

Status	Attribution	File	Lines
created	ai	docs/specs/issue-3762-contract-policy-enforcement.md	+169 / -0
modified	ai	pkg/attestation/crafter/api/attestation/v1/crafting_state_test.go	+109 / -0
modified	ai	pkg/attestation/crafter/api/attestation/v1/crafting_state.go	+74 / -0
modified	ai	app/cli/cmd/attestation_status_test.go	+63 / -1
modified	ai	pkg/attestation/crafter/crafter_test.go	+59 / -0
modified	ai	app/cli/cmd/workflow_workflow_run_describe_test.go	+43 / -0
modified	ai	pkg/attestation/renderer/chainloop/v02_test.go	+39 / -0
modified	ai	app/cli/pkg/action/attestation_init_test.go	+37 / -0
modified	ai	app/controlplane/pkg/biz/workflowrun.go	+25 / -12
modified	ai	pkg/attestation/renderer/chainloop/policy_status_test.go	+36 / -0
modified	ai	app/cli/cmd/workflow_workflow_run_describe.go	+20 / -10
modified	ai	app/controlplane/api/workflowcontract/v1/crafting_schema.proto	+12 / -7
modified	ai	app/cli/pkg/action/attestation_init.go	+18 / -0
modified	ai	pkg/attestation/renderer/chainloop/policy_status.go	+16 / -0
modified	ai	pkg/policies/policy_groups_test.go	+13 / -1
modified	ai	app/cli/cmd/attestation_push.go	+2 / -11
modified	ai	app/cli/cmd/attestation_status.go	+8 / -5
modified	ai	app/cli/pkg/action/attestation_status.go	+10 / -3
modified	ai	pkg/policies/policies.go	+3 / -9
modified	ai	pkg/attestation/crafter/crafter.go	+7 / -4
modified	ai	pkg/policies/policies_test.go	+9 / -1
modified	ai	pkg/attestation/renderer/chainloop/v02.go	+5 / -4
modified	ai	pkg/policies/policy_groups.go	+5 / -3
modified	ai	app/cli/cmd/attestation_push_test.go	+3 / -1
modified	ai	pkg/attestation/crafter/api/attestation/v1/crafting_state.proto	+2 / -1

…and 2 more file(s).

---

Policies (4)

Status	Policy	Material	Messages
✅ Passed	ai-config-ai-agents-allowed	ai-coding-session-44016f	-
✅ Passed	ai-config-no-dangerous-commands	ai-coding-session-44016f	-
✅ Passed	ai-config-no-secrets	ai-coding-session-44016f	-
✅ Passed	ai-config-mcp-servers-allowed	ai-coding-session-44016f	-

Security Checks — ✅ 5 passing

✅ secret-scan

Status	Policy	Messages
✅ Passed	secrets-detection	-

✅ sast-scan

Status	Policy	Messages
✅ Passed	owasp-top10-2025	-
✅ Passed	sast	-
✅ Passed	cwe-top25	-
✅ Passed	cwe-top26-40-cusp	-

Scans not applied (3)

Scan	Reason
vulnerability-scan	no manifest/lockfile changed
github-actions-scan	no workflow files changed
iac-scan	no IaC files changed

_{View attestation ↗}

Security context

✅ Nothing this change touches has a recorded security-fix history.

_{View in Chainloop ↗ · How this works ↗}

---

Powered by Chainloop and Chainloop Trace

[cubic-dev-ai]

No issues found across 2 files

_{View guided diff | Re-trigger cubic}