[migmartri]

Adds buf.build:443 to the Docker Sandboxes kit egress allowlist so protobuf code generation works inside the sandbox. The Buf Schema Registry is dialed by make api / buf generate to resolve both the buf.yaml module dependencies and the remote plugins declared in the buf.gen.yaml files.

AI disclosure: this change was produced with the assistance of Claude Code.

🤖 Generated with Claude Code

[chainloop-platform]

AI Session Checks — 🟡 60% · ✅ 0 failing

Avg score	Sessions	Failing policies	Attribution	Files	Lines	Total Duration
🟡 60%	1	✅ 0	100% AI / 0% Human	1	+3 / -0	4m17s

🟡 60% — 100% AI — ✅ All policies passing

Aug 31, 2026 12:12 UTC · 4m17s · $0.97 · 28 in / 2.9k out · claude-code 2.1.251 (claude-opus-5)

View session details ↗

Change Summary

• Adds buf.build:443 to the sandbox-kit network allowlist.
• Documents that the host is needed for make api and buf generate.
• Creates a signed one-file commit for the sandbox rule update.

AI Session Overall Score

🟡 60% — Focused change, but the config edit shipped without any observed validation.

AI Session Analysis Breakdown

🟢 94% · scope-discipline

🟢 Only devel/sandbox-kit/spec.yaml was modified and committed. · High Impact

🟢 92% · alignment

🟢 AI named the exact file and reason for the allowlist entry. · High Impact

🟢 90% · solution-quality

No notes.

🟢 88% · user-trust-signal

🟢 The next user message was a new task, not a correction. · Medium Impact

🟢 86% · context-and-planning

No notes.

🔴 28% · verification

🔴 No in-session test, runtime exercise, or user confirmation showed the new egress rule working. · High Severity

💡 For config changes, exercise the new path once and show the outcome.

---

File Attribution

████████████████████ 100% AI / 0% Human

Status	Attribution	File	Lines
modified	ai	devel/sandbox-kit/spec.yaml	+3 / -0

---

Policies (4)

Status	Policy	Material	Messages
✅ Passed	ai-config-ai-agents-allowed	ai-coding-session-c38cbc	-
✅ Passed	ai-config-no-dangerous-commands	ai-coding-session-c38cbc	-
✅ Passed	ai-config-no-secrets	ai-coding-session-c38cbc	-
✅ Passed	ai-config-mcp-servers-allowed	ai-coding-session-c38cbc	-

---

Security Checks — ⚠️ 1 failing

✅ secret-scan

Status	Policy	Messages
✅ Passed	secrets-detection	-

✅ sast-scan

Status	Policy	Messages
✅ Passed	owasp-top10-2025	-
✅ Passed	sast	-
✅ Passed	cwe-top25	-
✅ Passed	cwe-top26-40-cusp	-

✅ iac-scan

Status	Policy	Messages
✅ Passed	iac-misconfiguration	-

PR info

Status	Policy	Messages
✅ Passed	pr-description-required	-
⚠️ Failed	pr-user-story-linked	PR/MR #3385 does not reference a user story or issue in title, description, or branch 'feat(devel): allow buf.build egress in the sandbox kit'. Expected patterns: ["(?i)[A-Z]+-[0-9]+", "#[0-9]+", "(?i)[A-Z]{2", "}-[0-9]+", "(?i)gh-[0-9]+", "(?i)\[[A-Z]+-[0-9]+\]"]

⏭️ 2 scans not applied

Scan	Reason
vulnerability-scan	no manifest/lockfile changed
github-actions-scan	no workflow files changed

View attestation ↗

---

Powered by Chainloop and Chainloop Trace

[cubic-dev-ai]

No issues found across 1 file

_{Re-trigger cubic}

[matiasinsaurralde]

LGTM