[migmartri]

Adds two optional fields to the attestation auth information so that a reader can identify the credential without a control plane lookup:

• name: the API token name, read from the token_name claim. Set only for AUTH_TYPE_API_TOKEN.
• subject: the OIDC subject, read from the sub claim. Set only for AUTH_TYPE_FEDERATED (for example repo:org/repo:ref:refs/heads/main on GitHub Actions).

The CLI token parser extracts both values, attestation init stores them in the crafting state, and the Chainloop predicate renders them with omitempty. Old attestations, user tokens, and tokens without these claims are unchanged.

Closes #3757

This PR was produced with AI assistance (Claude Code).

🤖 Generated with Claude Code

[chainloop-platform]

PR validation — ✅ 3 passing

Status	Policy	Material	Messages
✅ Passed	pr-min-approvals	pr-info	-
✅ Passed	pr-description-required	pr-info	-
✅ Passed	pr-user-story-linked	pr-info	-

_{View attestation ↗}

AI Session Checks — 🟢 84% · ⚠️ 1 failing

Avg score	Sessions	Failing policies	Attribution	Files	Lines	Total Duration
🟢 84%	1	⚠️ 1	83% AI / 17% Human	6	+102 / -10	2m38s

🟢 84% — 83% AI — ⚠️ 1 policies failing

Oct 30, 2026 17:37 UTC · 2m38s · $2.46 · 96 in / 24.3k out · claude-code 2.1.314 (claude-opus-5-5)

_{View session details ↗}

Change Summary

• Adds name and subject to attestation auth metadata in the proto, CLI parsing, and predicate rendering.
• Updates token parsing and attestation init to populate API token names and federated subjects from JWT claims.
• Adds parser and renderer tests for the new auth fields, plus regenerated protobuf and control-plane bindings.

AI Session Overall Score

🟢 84% — Well-scoped autonomous run, with meaningful tests but one concrete spec example left unproven.

AI Session Analysis Breakdown

🟢 90% · scope-discipline

No notes.

🟢 88% · context-and-planning

🟢 A detailed captured ticket supplied scope, constraints, examples, and compatibility upfront. · High Impact

🟢 88% · solution-quality

🟢 The fix used dedicated fields from existing claims instead of overloading auth state. · High Impact

🟡 76% · verification

🟢 The AI added failing token tests first, then reran them to a passing result. · High Impact

🟠 The GitLab federated predicate example was not shown in an observed renderer or end-to-end test. · Medium Severity

💡 When the spec lists multiple concrete examples, execute one test per example instead of assuming adjacent coverage.

abstained · alignment

🟡 alignment not assessed — reviewer should confirm coverage · Low Severity

abstained · user-trust-signal

🟡 user-trust-signal not assessed — reviewer should confirm coverage · Low Severity

---

File Attribution

████████████████░░░░ 83% AI / 17% Human

Status	Attribution	File	Lines
modified	ai	pkg/attestation/renderer/chainloop/chainloop_test.go	+43 / -0
modified	ai	app/cli/internal/token/token_test.go	+31 / -4
modified	ai	app/cli/internal/token/token.go	+12 / -0
modified	ai	pkg/attestation/renderer/chainloop/chainloop.go	+8 / -4
modified	ai	app/cli/pkg/action/attestation_init.go	+4 / -2
modified	ai	pkg/attestation/crafter/api/attestation/v1/crafting_state.proto	+4 / -0

---

Policies (4, 1 failing)

Status	Policy	Material	Messages
✅ Passed	ai-config-ai-agents-allowed	ai-coding-session-e555a7	-
✅ Passed	ai-config-no-dangerous-commands	ai-coding-session-e555a7	-
⚠️ Failed	ai-config-no-secrets	ai-coding-session-e555a7	Secret (jwt) detected in session content [turn=77, source=tool_result, line=46]: token: "[CHAINLOOP_TRACE_REDACTED:jwt]", Secret (jwt) detected in session content [turn=77, source=tool_result, line=54]: token: "[CHAINLOOP_TRACE_REDACTED:jwt]", Secret (jwt) detected in session content [turn=77, source=tool_result, line=63]: token: "[CHAINLOOP_TRACE_REDACTED:jwt]", Secret (jwt) detected in session content [turn=77, source=tool_result, line=71]: token: "[CHAINLOOP_TRACE_REDACTED:jwt]", Secret (jwt) detected in session content [turn=77, source=tool_result, line=79]: token: "[CHAINLOOP_TRACE_REDACTED:jwt]", Secret (jwt) detected in session content [turn=77, source=tool_result, line=83]: token: "[CHAINLOOP_TRACE_REDACTED:jwt]", Secret (jwt) detected in session content [turn=77, source=tool_result, line=91]: token: "[CHAINLOOP_TRACE_REDACTED:jwt]",
✅ Passed	ai-config-mcp-servers-allowed	ai-coding-session-e555a7	-

Security Checks — ✅ 6 passing

✅ secret-scan

Status	Policy	Messages
✅ Passed	secrets-detection	-

✅ sast-scan

Status	Policy	Messages
✅ Passed	owasp-top10-2025	-
✅ Passed	sast	-
✅ Passed	cwe-top25	-
✅ Passed	cwe-top26-40-cusp	-

✅ iac-scan

Status	Policy	Messages
✅ Passed	iac-misconfiguration	-

Scans not applied (2)

Scan	Reason
vulnerability-scan	no manifest/lockfile changed
github-actions-scan	no workflow files changed

_{View attestation ↗}

Security context

✅ Nothing this change touches has a recorded security-fix history.

_{View in Chainloop ↗ · How this works ↗}

---

Powered by Chainloop and Chainloop Trace

[cubic-dev-ai]

No issues found across 10 files

_{View guided diff | Re-trigger cubic}