Repository navigation
fix(cli): tell the two trace init project dead ends apart (PFM-7409) - #3466
Merged
migmartri merged 1 commit intoSep 22, 2026
Conversation
A caller that can neither create a project nor write to one got a single message blaming the projects it can see for not accepting a workflow. In an organization the caller has no project membership in there are no such projects, so the message described neither what happened nor what to ask an administrator for. Split it into the missing-membership case and the read-only-projects case, and drop the workflow wording, which named an internal permission rather than anything asked for at that point in the wizard. Assisted-by: Claude Code Signed-off-by: Jose I. Paris <jiparis@chainloop.dev> Chainloop-Trace-Sessions: 09fcf4a8-b750-4b57-9048-a9fdb2c3d546
Contributor
AI Session Checks — 🟡 60% ·
|
| Avg score | Sessions | Failing policies | Attribution | Files | Lines | Total Duration |
|---|---|---|---|---|---|---|
| 🟡 60% | 1 | 100% AI / 0% Human | 2 | +22 / -5 | 3m59s |
🟡 60% — 100% AI — ⚠️ 1 policies failing
-
Sep 22, 2026 15:50 UTC · 3m59s · $2.81 · 78 in / 12.0k out · claude-code 2.1.278 (claude-opus-5)
Change Summary
-
- Updates
resolveInteractiveProjectto distinguish no-membership from read-only-project dead ends. - Replaces the old “accepts a new workflow” wording with clearer administrator guidance.
- Expands
TestResolveInteractiveProjectwith one case for each dead end and re-runs the package tests.
- Updates
AI Session Overall Score
-
🟡 60% — Good fix and verification, but the final PR-creation ask was left unfinished.
AI Session Analysis Breakdown
-
🟢 94% · scope-discipline
-
🟢 Code changes stayed inside
trace_init_identity.goand its adjacent test. · High Impact
🟢 93% · verification
-
🟢 New tests were added, failed first, then passed after the fix. · High Impact
🟢 91% · solution-quality
-
No notes.
🟢 86% · context-and-planning
-
No notes.
🟢 84% · user-trust-signal
-
🟢 The user moved directly to “create a PR,” signaling acceptance of the fix. · Medium Impact
🔴 35% · alignment
-
🔴 The final user ask was to create a PR, but the session stopped at branch creation and commit. · High Severity
💡 When asked for a PR, stop only after push plus
gh pr create, or state the blocker explicitly.
-
File Attribution
████████████████████100% AI / 0% HumanStatus Attribution File Lines modified ai app/cli/cmd/trace_init_identity_test.go+14 / -3 modified ai app/cli/cmd/trace_init_identity.go+8 / -2
Policies (4, 1 failing)
Status Policy Material Messages ✅ Passed ai-config-ai-agents-allowedai-coding-session-09fcf4- ✅ Passed ai-config-no-dangerous-commandsai-coding-session-09fcf4- ⚠️ Failedai-config-no-secretsai-coding-session-09fcf4Secret (jwt) detected in session content [turn=45, source=tool_result, line=1]: [REDACTED:jwt] ✅ Passed ai-config-mcp-servers-allowedai-coding-session-09fcf4- -
Security Checks — ✅ 8 passing
✅ secret-scan
| Status | Policy | Messages |
|---|---|---|
| ✅ Passed | secrets-detection |
- |
✅ sast-scan
| Status | Policy | Messages |
|---|---|---|
| ✅ Passed | owasp-top10-2025 |
- |
| ✅ Passed | sast |
- |
| ✅ Passed | cwe-top25 |
- |
| ✅ Passed | cwe-top26-40-cusp |
- |
PR info
| Status | Policy | Messages |
|---|---|---|
| ✅ Passed | pr-min-approvals |
- |
| ✅ Passed | pr-description-required |
- |
| ✅ Passed | pr-user-story-linked |
- |
⏭️ 3 scans not applied
| Scan | Reason |
|---|---|
vulnerability-scan |
no manifest/lockfile changed |
github-actions-scan |
no workflow files changed |
iac-scan |
no IaC files changed |
View attestation ↗
View attestation ↗
Powered by Chainloop and Chainloop Trace
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
migmartri
approved these changes
Sep 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the misleading error
chainloop trace initshows when the caller can neither create a project nor add a workflow to an existing one.The single message blamed the projects the caller can see for not accepting a workflow, which describes nothing when the caller sees no project at all — the case reported in PFM-7409, an organization the caller has no project membership in.
It is now split into the two distinct dead ends:
you do not belong to any project in this organization, and cannot create a new one; ask an administrator to add you to oneyou can only view the projects in this organization, and cannot create a new one; ask an administrator for write access to oneThe workflow wording is gone from both, since it named an internal permission rather than anything the user asked for at that point in the wizard.
AI assistance: this change was produced with Claude Code; the commit carries an
Assisted-by: Claude Codetrailer.🤖 Generated with Claude Code