feat(trace): local storage mode for AI coding sessions

[matiasinsaurralde]

Refs PFM-7675

Summary

Chainloop Trace records an AI coding session and attests it to a control plane on git push. This adds a local storage mode: a repository records its sessions and stores the assembled evidence set on disk, with no control plane, login, or network.

The mode is a committed repository policy in .chainloop.yml:

• traceStorage - CONTROL_PLANE (default) or LOCAL
• tracePath - optional location for stored sessions (defaults under the per-clone trace state)
• traceRequired - replaces the deprecated requireTrace

chainloop trace init --local sets a repository up with no control plane (R-008). In local mode the pre-push hook runs the same push-time assembly and writes each material under its content digest, with a per-session manifest that declares the output unsigned and not an attestation (R-002, R-003, R-006, R-009). trace run honors the mode as well. Secret redaction stays on by default, with a CHAINLOOP_TRACE_NO_REDACT opt-out for a trusted local store (R-004). No control-plane connection is opened in local mode (R-005), and stored sessions are preserved across a trace uninstall.

Implements the design in docs/specs/issue-3582-trace-evidence-export.md.

Refs #3582

[chainloop-platform]

AI Session Checks — 🟢 92% · ✅ 0 failing

Avg score	Sessions	Failing policies	Attribution	Files	Lines	Total Duration
🟢 92%	1	✅ 0	100% AI / 0% Human	23	+1710 / -297	1h55m43s

🟢 92% — 100% AI — ✅ All policies passing

Oct 14, 2026 02:52 UTC · 1h55m43s · $117.49 · 1.2k in / 764.5k out · claude-code 2.1.296 (claude-opus-4-8)

_{View session details ↗}

Change Summary

• Adds traceStorage: LOCAL config, storage-path resolution, and local session persistence under .git/chainloop-trace/local-sessions.
• Updates trace init, pre-push hooks, and trace run to support offline local mode and preserve stored sessions.
• Adds focused config, action, state, and CLI tests plus docs for the new local-mode flow.

AI Session Overall Score

🟢 92% — Well-scoped, well-planned implementation with strong automated and end-to-end verification.

AI Session Analysis Breakdown

🟢 95% · context-and-planning

🟢 AI wrote a multi-milestone plan before substantive edits began. · High Impact

🟢 94% · scope-discipline

🟢 AI staged only app/cli/ feature files and left unrelated working-tree changes untouched. · High Impact

🟢 94% · verification

🟢 AI ran repeated go test suites and manual offline checks before committing. · High Impact

🟢 93% · user-trust-signal

No notes.

🟢 92% · alignment

No notes.

🟢 88% · solution-quality

No notes.

---

File Attribution

████████████████████ 100% AI / 0% Human

Status	Attribution	File	Lines
created	ai	app/cli/pkg/action/trace_local_store.go	+370 / -0
modified	ai	app/cli/pkg/action/trace_hook_handler.go	+156 / -89
created	ai	app/cli/pkg/action/trace_local_store_test.go	+206 / -0
modified	ai	app/cli/cmd/root.go	+100 / -85
modified	ai	app/cli/cmd/trace_init.go	+153 / -21
created	ai	app/cli/internal/trace/config/storage_test.go	+145 / -0
created	ai	app/cli/cmd/trace_init_local_test.go	+134 / -0
modified	ai	app/cli/internal/trace/config/config.go	+97 / -0
modified	ai	app/cli/pkg/action/trace_run.go	+70 / -20
modified	ai	app/cli/cmd/trace_run.go	+58 / -27
modified	ai	app/cli/internal/trace/state/state.go	+46 / -2
modified	ai	app/cli/documentation/cli-reference.md	+28 / -15
modified	ai	app/cli/pkg/action/trace_agent_hook.go	+31 / -7
modified	ai	app/cli/internal/trace/state/state_test.go	+35 / -0
modified	ai	app/cli/cmd/trace_hook.go	+24 / -1
modified	ai	app/cli/pkg/action/trace_spec_materials_test.go	+12 / -12
modified	ai	app/cli/pkg/action/trace_spec_materials.go	+15 / -4
modified	ai	app/cli/internal/repositoryconfig/config.go	+16 / -1
modified	ai	app/cli/pkg/action/trace_skills_test.go	+6 / -6
modified	ai	app/cli/internal/trace/README.md	+3 / -2
modified	ai	app/cli/pkg/action/trace_pasted_images_test.go	+2 / -2
modified	ai	app/cli/pkg/action/trace_spec_pointers_test.go	+2 / -2
modified	ai	app/cli/pkg/action/trace_skills_scenario_test.go	+1 / -1

---

Policies (4)

Status	Policy	Material	Messages
✅ Passed	ai-config-ai-agents-allowed	ai-coding-session-7492b7	-
✅ Passed	ai-config-no-dangerous-commands	ai-coding-session-7492b7	-
✅ Passed	ai-config-no-secrets	ai-coding-session-7492b7	-
✅ Passed	ai-config-mcp-servers-allowed	ai-coding-session-7492b7	-

---

Powered by Chainloop and Chainloop Trace