[migmartri]

Summary

Workflows can already be bound to a platform workflow template through the workflows.workflow_template_id column, but the only writer is the in-process repository auto-setup path. The gRPC surface never saw the field, so a template-backed workflow could only be created via project onboarding.

This exposes that binding over the API:

• WorkflowServiceCreateRequest.workflow_template_id (field 8), validated as a UUID and ignored when empty.
• WorkflowItem.workflow_template_id (field 13), so the binding reads back through create, view and list without a second request.
• WorkflowService.Create parses the reference into the create options, and bizWorkflowToPb emits it.
• pkg/action carries the field on both NewWorkflowCreateOpts and WorkflowItem, so template-aware clients reuse the existing action rather than reimplementing the call.

The biz and data layers already carried and persisted the field and are unchanged.

Notes

The reference is unvalidated by design. There is no workflow_template table in the control plane and no foreign key on the column, so existence, org ownership and soft-deletion cannot be checked here. Nothing in the control plane dereferences the value; validation belongs to the platform, which resolves it through its own org-scoped queries.

Contract semantics are unchanged: a template-bound workflow created this way gets the contract the caller passed, or the default empty one, not a contract rendered from the template. Closing that gap needs a template-aware create endpoint and is deferred.

The open-source CLI command layer is untouched and exposes no --template flag, as it has no notion of templates.

AI assistance

Implemented with the assistance of Claude Code. Each commit carries an Assisted-by: Claude Code trailer.

[chainloop-platform]

AI Session Checks — 🟡 60% · ⚠️ 1 failing

Avg score	Sessions	Failing policies	Attribution	Files	Lines	Total Duration
🟡 60%	1	⚠️ 1	100% AI / 0% Human	9	+317 / -5	16m7s

🟡 60% — 100% AI — ⚠️ 1 policies failing

Aug 31, 2026 12:03 UTC · 16m7s · $11.10 · 330 in / 70.5k out · claude-code 2.1.246 (claude-opus-5)

View session details ↗

Change Summary

• Adds workflow_template_id to workflow create requests and workflow item responses.
• Wires the field through controlplane service parsing and CLI action mapping without changing OSS cmd.
• Adds targeted proto, service, action, and biz tests, plus regenerated API/frontend/jsonschema artifacts.

AI Session Overall Score

🟡 60% — Strong implementation and verification, but alignment went red on the uncreated PR.

AI Session Analysis Breakdown

🟢 92% · user-trust-signal

No notes.

🟢 90% · scope-discipline

🟢 Changes stayed in the Phase 1 OSS surfaces, and the AI checked cmd remained untouched. · High Impact

🟢 88% · verification

🟢 AI wrote tests first, fixed one failing mapper case, and re-ran the suite green. · High Impact

🟢 86% · solution-quality

No notes.

🟡 70% · context-and-planning

🟢 The user supplied a highly structured spec with goals, non-goals, phases, and tests. · High Impact

🟠 Spec 140 was detailed, but the multi-layer implementation began without a shared written plan or TODO. · Medium Severity

💡 For multi-layer changes, publish a short step plan before the first edit.

🔴 35% · alignment

🔴 Asked to create a PR, the AI only branched, committed, and pushed; no PR-creation step or successful final push is recorded. · High Severity

💡 When asked for a PR, run an actual PR creation command or state you can only push a branch.

🟠 AI first said signing was impossible in-sandbox, then reversed after reading the Docker docs and checking the forwarded SSH agent. · Medium Severity

💡 Before declaring signing impossible, check forwarded-agent docs and inspect SSH_AUTH_SOCK or ssh-add -L.

---

File Attribution

████████████████████ 100% AI / 0% Human

Status	Attribution	File	Lines
created	ai	app/cli/pkg/action/workflow_create_test.go	+103 / -0
created	ai	app/controlplane/api/controlplane/v1/workflow_test.go	+74 / -0
created	ai	app/controlplane/internal/service/workflow_test.go	+61 / -0
modified	ai	app/controlplane/pkg/biz/workflow_integration_test.go	+35 / -0
modified	ai	app/cli/pkg/action/workflow_create.go	+14 / -5
modified	ai	app/controlplane/internal/service/workflow.go	+15 / -0
modified	ai	app/controlplane/api/controlplane/v1/workflow.proto	+8 / -0
modified	ai	app/cli/pkg/action/workflow_list.go	+4 / -0
modified	ai	app/controlplane/api/controlplane/v1/response_messages.proto	+3 / -0

---

Policies (4, 1 failing)

Status	Policy	Material	Messages
✅ Passed	ai-config-ai-agents-allowed	ai-coding-session-0768ad	-
⚠️ Failed	ai-config-no-dangerous-commands	ai-coding-session-0768ad	Forbidden bash pattern /curl[^|\n]|\s(?:bash|sh)\b/ matched command: bash -l -c 'curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v2.4.0 2>&1 | tail -3' Forbidden bash pattern /curl[^|\n]|\s(?:bash|sh)\b/ matched command: bash -l -c 'curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v2.9.0 2>&1 | tail -2'
✅ Passed	ai-config-no-secrets	ai-coding-session-0768ad	-
✅ Passed	ai-config-mcp-servers-allowed	ai-coding-session-0768ad	-

---

Security Checks — ⚠️ 1 failing

✅ secret-scan

Status	Policy	Messages
✅ Passed	secrets-detection	-

✅ sast-scan

Status	Policy	Messages
✅ Passed	sast	-
✅ Passed	cwe-top25	-
✅ Passed	cwe-top26-40-cusp	-
✅ Passed	owasp-top10-2025	-

✅ iac-scan

Status	Policy	Messages
✅ Passed	iac-misconfiguration	-

PR info

Status	Policy	Messages
✅ Passed	pr-description-required	-
⚠️ Failed	pr-user-story-linked	PR/MR #3386 does not reference a user story or issue in title, description, or branch 'feat(controlplane): accept a workflow template reference on workflow create'. Expected patterns: ["(?i)[A-Z]+-[0-9]+", "#[0-9]+", "(?i)[A-Z]{2", "}-[0-9]+", "(?i)gh-[0-9]+", "(?i)\[[A-Z]+-[0-9]+\]"]

⏭️ 2 scans not applied

Scan	Reason
vulnerability-scan	no manifest/lockfile changed
github-actions-scan	no workflow files changed

View attestation ↗

---

Powered by Chainloop and Chainloop Trace

[cubic-dev-ai]

All reported issues were addressed across 17 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>