fix(cli): use a valid trigger when trace push resets the attestation

[jiparis]

When the trace push hook adds no AI coding session evidence, it resets the attestation. The reset call used the trigger value `trace-push`. The reset action accepts only `AttestationResetTriggerFailed` and `AttestationResetTriggerCancelled`, so the reset was not valid. The hook now uses `AttestationResetTriggerCancelled`.

AI disclosure: this change was made with help from Claude Code.

[chainloop-platform]

AI Session Checks — 🟡 60% · ✅ 0 failing

Avg score	Sessions	Failing policies	Attribution	Files	Lines	Total Duration
🟡 60%	1	✅ 0	100% AI / 0% Human	1	+1 / -1	5m56s

🟡 60% — 100% AI — ✅ All policies passing

Sep 25, 2026 09:08 UTC · 5m56s · $0.89 · 34 in / 4.0k out · claude-code 2.1.282 (claude-opus-5-5)

View session details ↗

Change Summary

• Replaces the invalid "trace-push" reset trigger with AttestationResetTriggerCancelled in trace_hook_handler.go.
• Runs package tests and lint, with tests passing and lint failures attributed to pre-existing issues.
• Prepares a signed branch and commit for the fix.

AI Session Overall Score

🟡 60% — Solid fix, but the requested PR creation never happened.

AI Session Analysis Breakdown

🟢 95% · scope-discipline

No notes.

🟢 92% · solution-quality

🟢 The AI replaced the invalid literal with the canonical reset trigger constant. · High Impact

🟢 92% · user-trust-signal

No notes.

🟢 90% · context-and-planning

🟢 The opening prompt named the exact bug and the required constant to use. · High Impact

🟡 62% · verification

🟢 Package tests ran and passed before the user asked to ship. · Medium Impact

🟠 The changed reset path relied on existing package tests, with no dedicated regression test added. · Medium Severity

💡 For a branch-specific bugfix, add one focused regression test before shipping.

🔴 35% · alignment

🔴 The user asked for a PR, but the session stops at branch, commit, and push preparation. · High Severity

💡 When the user asks for PR creation, include the actual PR step or say what blocked it.

---

File Attribution

████████████████████ 100% AI / 0% Human

Status	Attribution	File	Lines
modified	ai	app/cli/pkg/action/trace_hook_handler.go	+1 / -1

---

Policies (4)

Status	Policy	Material	Messages
✅ Passed	ai-config-ai-agents-allowed	ai-coding-session-67bf28	-
✅ Passed	ai-config-no-dangerous-commands	ai-coding-session-67bf28	-
✅ Passed	ai-config-no-secrets	ai-coding-session-67bf28	-
✅ Passed	ai-config-mcp-servers-allowed	ai-coding-session-67bf28	-

---

Security Checks — ✅ 5 passing

✅ secret-scan

Status	Policy	Messages
✅ Passed	secrets-detection	-

✅ sast-scan

Status	Policy	Messages
✅ Passed	owasp-top10-2025	-
✅ Passed	sast	-
✅ Passed	cwe-top25	-
✅ Passed	cwe-top26-40-cusp	-

✅ security-context — no advisories

Nothing this change touches has a recorded security-fix history.

View security context ↗ · Security context documentation ↗

⏭️ 3 scans not applied

Scan	Reason
vulnerability-scan	no manifest/lockfile changed
github-actions-scan	no workflow files changed
iac-scan	no IaC files changed

View attestation ↗

---

PR validation — ⚠️ 1 failing

Status	Policy	Material	Messages
✅ Passed	pr-min-approvals	pr-info	-
✅ Passed	pr-description-required	pr-info	-
⚠️ Failed	pr-user-story-linked	pr-info	PR/MR #3472 does not reference a user story or issue in title, description, or branch 'fix(cli): use a valid trigger when trace push resets the attestation'. Expected patterns: ["(?i)[A-Z]+-[0-9]+", "#[0-9]+", "(?i)[A-Z]{2", "}-[0-9]+", "(?i)gh-[0-9]+", "(?i)\[[A-Z]+-[0-9]+\]"]

View attestation ↗

---

Powered by Chainloop and Chainloop Trace

[cubic-dev-ai]

No issues found across 1 file

_{Re-trigger cubic}