feat(schemavalidators): add optional provenance.trace_discover to AI security context schema

Merged
MI
13h ago
+170-0

Adds an optional provenance.trace_discover object to the AI security context schema (ai-security-context-0.1).

The producer of a security context looks up, in the Chainloop graph, the AI coding sessions behind fingerprint commits that declare none in a Chainloop-Trace-Sessions trailer. Today the artifact cannot record how that lookup went, so a context whose lookups were all refused looks the same as one for a repository with no AI sessions. Because provenance sets additionalProperties: false, the schema has to allow the field before a producer can write it.

The new object holds:

  • status: ran, disabled, or cli_not_found.
  • commits, matched, not_found, denied, failed: non-negative integer counters. They are required when status is ran and forbidden otherwise (draft-07 if/then/else).

The field is optional, so artifacts without it stay valid and schema_version is unchanged. Validator tests cover the valid and invalid shapes.

This change was produced with AI assistance (Claude Code).

🤖 Posted by Maximus bot (Claude Code) on behalf of @migmartri using the eng-autopilot skill