decisions: refresh all areas

MI
20h ago
+770-0

Adds the first Current Decisions pages in docs/decisions/: the decisions and the words of each functional area that hold today, derived from the specs in docs/specs/, the issue states, and the code.

Areas

  • Trace (owner jiparis): 13 specs. 54 key decisions, 8 superseded entries (the issue-3582 export decisions are not built and are listed as superseded), 7 open conflicts.
  • Attestation CLI (owner migmartri): issue-3063. The issue is open, but its decisions are in the code. 1 open conflict.
  • Artifact CAS (owner migmartri): issue-3543, issue-3549. 2 open conflicts.
  • Service endpoints (owner migmartri): both issue-3628 specs. The issue is open, but most decisions are in the code (#3647, #3663, #3675). 3 open conflicts.
  • Authentication (owner migmartri): issue-3626. 1 open conflict.
  • Repository-wide: one reader of .chainloop.yml for attestation and trace (issue-3063 D-007).

Open conflicts

  • Trace: pasted images are saved by the CLI (issue-3569 D-001). Only the agent wording differs: issue-3569 D-004 keeps the agent instruction to capture them (for role and title), and the code follows issue-3515 D-009 (the agent does not).
  • Trace: issue #3515 is open, but its decisions are already in the code.
  • Trace: generated-line counts are already in the evidence (#3680). issue-3639 D-011 left them to a later spec.
  • Trace: issue-3639 D-003 (joined-line fingerprints in commit records) and D-012 (commit record retention) drift from the code.
  • Trace: issue-3639-line-ranges D-005: the schema and the writer shipped in the same release.
  • Trace: the end-to-end suite has no nightly CI job, no Slack report, and does not install the pinned harness versions (issue-3635).
  • Artifact CAS: the 24-hour existence cache lifetime is not configurable (issue-3543 D-007). The client cache reloads on any error, not only on an authentication error (D-009).
  • Authentication: the browser download login now uses the handoff code (issue-3626 D-008).
  • Service endpoints: the CAS follows issue-3628-single-endpoint D-020 (shared endpoint, #3663), against issue-3628-controlplane-http-dispatch D-003 (separate endpoints). D-003 is not marked as replaced.
  • Service endpoints: D-020 removes the separate-connection contract of D-014 for the CAS, but D-014 is not struck.
  • Service endpoints: issue #3628 is open. Left: the deprecation dates and steps (D-007, D-003), the end of the two-Service chart layout (D-004), the move of the control plane's CAS connection to the single port (D-012), and proxy tests in CI (D-015).
  • Artifact CAS: the existence cache has no off switch (issue-3543 R-004).
  • Attestation CLI: issue #3063 is open, but all checked decisions are built. The code adds one step to the organization order (local attestation state before the saved default).

Review

Each area owner approves the map entry, the key decision cut, and the Language of their area. This is the first Current Decisions PR of the repository, so please also check the owner of each area.

AI assistance: this PR was produced with Claude Code.