[matiasinsaurralde]

Refs PFM-8068

Summary

Adds an optional repo_commits_total integer to the scan_stats definition of the AI security-context 0.1 JSON Schema. It records the number of commits reachable from the scanned revision, the denominator a consumer needs to render scan progress as "N of M commits" or a percentage, which it cannot compute without git access to the repository.

The field is additive and optional:

• Existing artifacts that omit it still validate.
• additionalProperties: false and the scan_stats required set are unchanged.
• The schema stays at version 0.1; $id is unchanged.

The Go decoder ScanStats struct mirrors the new field. This change must be released before any producer starts emitting the field.

[chainloop-platform]

PR validation — ✅ 3 passing

Status	Policy	Material	Messages
✅ Passed	pr-min-approvals	pr-info	-
✅ Passed	pr-description-required	pr-info	-
✅ Passed	pr-user-story-linked	pr-info	-

_{View attestation ↗}

AI Session Checks — 🟢 94% · ✅ 0 failing

Avg score	Sessions	Failing policies	Attribution	Files	Lines	Total Duration
🟢 94%	1	✅ 0	100% AI / 0% Human	3	+13 / -1	6m20s

🟢 94% — 100% AI — ✅ All policies passing

Oct 29, 2026 04:05 UTC · 6m20s · $7.55 · 150 in / 54.6k out · claude-code 2.1.311 (claude-opus-4-8)

_{View session details ↗}

Change Summary

• Adds repo_commits_total to the AI security-context 0.1 schema.
• Mirrors the field in ScanStats and extends the full security-context fixture.
• Preserves strict validation boundaries and runs the requested Go test plan.

AI Session Overall Score

🟢 94% — Autonomous one-shot run; five judges green and requested tests were observed passing.

AI Session Analysis Breakdown

🟢 96% · scope-discipline

🟢 Only the three requested files were staged and committed. · High Impact

🟢 95% · alignment

🟢 The AI restated the spec as three concrete edits before changing files. · High Impact

🟢 94% · context-and-planning

No notes.

🟢 94% · verification

🟢 The AI ran both Go test commands named in the spec and observed passing output. · High Impact

🟢 93% · solution-quality

No notes.

abstained · user-trust-signal

🟡 user-trust-signal not assessed — reviewer should confirm coverage · Low Severity

---

File Attribution

████████████████████ 100% AI / 0% Human

Status	Attribution	File	Lines
modified	ai	pkg/attestation/crafter/materials/aisecuritycontext/aisecuritycontext.go	+6 / -0
modified	ai	internal/schemavalidators/internal_schemas/aisecuritycontext/ai-security-context-0.1.schema.json	+5 / -0
modified	ai	pkg/attestation/crafter/materials/testdata/ai-security-context.json	+2 / -1

---

Policies (4)

Status	Policy	Material	Messages
✅ Passed	ai-config-ai-agents-allowed	ai-coding-session-8e8e03	-
✅ Passed	ai-config-no-dangerous-commands	ai-coding-session-8e8e03	-
✅ Passed	ai-config-no-secrets	ai-coding-session-8e8e03	-
✅ Passed	ai-config-mcp-servers-allowed	ai-coding-session-8e8e03	-

Security Checks — ✅ 6 passing

✅ secret-scan

Status	Policy	Messages
✅ Passed	secrets-detection	-

✅ sast-scan

Status	Policy	Messages
✅ Passed	owasp-top10-2025	-
✅ Passed	sast	-
✅ Passed	cwe-top25	-
✅ Passed	cwe-top26-40-cusp	-

✅ iac-scan

Status	Policy	Messages
✅ Passed	iac-misconfiguration	-

Scans not applied (2)

Scan	Reason
vulnerability-scan	no manifest/lockfile changed
github-actions-scan	no workflow files changed

_{View attestation ↗}

Security context

✅ Nothing this change touches has a recorded security-fix history.

_{View in Chainloop ↗ · How this works ↗}

---

Powered by Chainloop and Chainloop Trace

[cubic-dev-ai]

No issues found across 3 files

_{View guided diff | Re-trigger cubic}