Skip to content

fix(trace): record HTML spec materials as HTML - #3709

Merged
jiparis merged 5 commits into
chainloop-dev:mainfrom
jiparis:pfm-7998-record-html-spec-materials
Oct 23, 2026
Merged

jiparis merged 5 commits into
chainloop-dev:mainfrom
jiparis:pfm-7998-record-html-spec-materials

Conversation

@jiparis

@jiparis jiparis commented Oct 23, 2026 •

Copy link
Copy Markdown
Member

Some AI coding sessions capture spec or attachment sources that are full HTML pages. Trace stored them under the file name the agent chose, usually .md, with the frontmatter header above the doctype. A reader then showed the HTML source as text, not as a page.

Now a captured text spec source whose body opens with a doctype or an html root element is stored as an .html file that holds only the page. The header values (kind, URI, role, title, description) stay in the material annotations and in the spec entry of the session, as before. Redaction runs on the whole file first, so the stored page is redacted. Markdown that only contains HTML tags, such as a README banner, and image or binary sources are unchanged. The Trace README feature table has a new row for this.

Tested with new table-driven unit tests for the HTML detection and for the staged file name and content of the spec material.

This change was made with AI assistance (Claude Code).

Closes #3707

🤖 Opened by the eng-autopilot skill (Claude Code) for @jiparis

View guided diff

A spec or attachment capture whose body is an HTML page (it opens with a
doctype or an html root element) is now stored as an .html file that
holds only the page. Before, it kept the name the agent chose, usually
.md, and the frontmatter header above the doctype, so readers showed
the HTML source as text. The header values stay in the annotations and
in the spec entry. Markdown that only contains HTML tags is unchanged.

Closes chainloop-dev#3707

Assisted-by: Claude Code
Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>

Chainloop-Trace-Sessions: a52240a5-d7d2-4dc2-8c65-a64c9d84eec8
@jiparis
jiparis requested a review from a team October 23, 2026 10:36
@chainloop-platform

chainloop-platform Bot commented Oct 23, 2026 •

Copy link
Copy Markdown
Contributor

PR validation — ✅ 3 passing

Status Policy Material Messages
✅ Passed pr-min-approvals pr-info -
✅ Passed pr-description-required pr-info -
✅ Passed pr-user-story-linked pr-info -

View attestation ↗

AI Session Checks — ⚠️ 1 session(s) missing

Missing AI Coding Sessions

We detected commits in this PR that were AI-assisted, but the matching Chainloop Trace session(s) could not be found in Chainloop.

Please make sure the AI coding session evidence has been sent by the Chainloop CLI, or add the skip-ai-session label to this PR to bypass this check.

Learn more about Chainloop Trace.

Security Checks — ✅ 5 passing

✅ secret-scan

Status Policy Messages
✅ Passed secrets-detection -

✅ sast-scan

Status Policy Messages
✅ Passed owasp-top10-2025 -
✅ Passed sast -
✅ Passed cwe-top25 -
✅ Passed cwe-top26-40-cusp -
Scans not applied (3)
Scan Reason
vulnerability-scan no manifest/lockfile changed
github-actions-scan no workflow files changed
iac-scan no IaC files changed

View attestation ↗

Security context

✅ Nothing this change touches has a recorded security-fix history.

View in Chainloop ↗ · How this works ↗


Powered by Chainloop and Chainloop Trace

@cubic-dev-ai cubic-dev-ai Bot left a comment •

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All reported issues were addressed across 5 files

Reply with feedback, questions, or to request a fix.

View guided diff | Re-trigger cubic

Comment thread app/cli/internal/trace/README.md Outdated
Register the HTML spec sources feature in the end-to-end suite. A new
scenario seeds an HTML design document, and the check verifies that its
spec material holds only the page, with the doctype first.

Assisted-by: Claude Code
Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>

Chainloop-Trace-Sessions: a52240a5-d7d2-4dc2-8c65-a64c9d84eec8
@jiparis
jiparis marked this pull request as ready for review October 23, 2026 10:59
The end-to-end suite passed the HTML spec sources check 3/3 with
Claude Code 2.1.309 and haiku.

Assisted-by: Claude Code
Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>

Chainloop-Trace-Sessions: a52240a5-d7d2-4dc2-8c65-a64c9d84eec8
The end-to-end suite passed the HTML spec sources check 3/3 with
OpenCode 2 and openrouter/anthropic/claude-haiku-5.5.

Assisted-by: Claude Code
Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>

Chainloop-Trace-Sessions: a52240a5-d7d2-4dc2-8c65-a64c9d84eec8
The end-to-end suite passed the HTML spec sources check 3/3 with
Cursor and the auto model.

Assisted-by: Claude Code
Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>

Chainloop-Trace-Sessions: a52240a5-d7d2-4dc2-8c65-a64c9d84eec8
@jiparis

jiparis commented Oct 23, 2026

Copy link
Copy Markdown
Member Author

The HTML spec sources cell for Codex stays Unknown in this PR. We will update it once this PR is merged.

A local Codex run on macOS did not test this branch: Codex runs shell commands in a login shell (zsh -lc), and path_helper puts an installed chainloop CLI ahead of the binary under test, so the pre-push hook used the released CLI.

Claude Code, Cursor, and OpenCode 2 passed the check 3/3.

🤖 Opened by the eng-autopilot skill (Claude Code) for @jiparis

@jiparis
jiparis merged commit 72bc01d into chainloop-dev:main Oct 23, 2026
16 of 17 checks passed
@jiparis
jiparis deleted the pfm-7998-record-html-spec-materials branch October 23, 2026 11:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Record HTML spec materials as HTML in the trace attestation

2 participants