feat(cli): auto-collect AI agent configuration during attestation init

Add a Collector interface to the crafter package that enables pluggable
auto-discovery of evidence during attestation init. Refactor existing
PR metadata collection into PRMetadataCollector and introduce a new
AIAgentConfigCollector that discovers Claude agent config files
(CLAUDE.md, .claude/*, .mcp.json) and attaches them as EVIDENCE material.

Ref: PFM-4919
Signed-off-by: Jose Ignacio Paris <jiparis@chainloop.dev>
Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>

Author: jiparis

app/cli/pkg/action/attestation_init.go

@@ -300,11 +300,12 @@ func (action *AttestationInit) Run(ctx context.Context, opts *AttestationInitRun
 		return "", err
 	}
 
-	// Auto-collect PR/MR metadata if in PR/MR context
-	if err := action.c.AutoCollectPRMetadata(ctx, attestationID, discoveredRunner, casBackend); err != nil {
-		action.Logger.Warn().Err(err).Msg("failed to auto-collect PR/MR metadata")
-		// Don't fail the init - this is best-effort
-	}
+	// Register and run auto-discovery collectors
+	action.c.RegisterCollectors(
+		crafter.NewPRMetadataCollector(discoveredRunner),
+		crafter.NewAIAgentConfigCollector(),
+	)
+	action.c.RunCollectors(ctx, attestationID, casBackend)
 
 	// Evaluate attestation-level policies at init phase
 	attClient := pb.NewAttestationServiceClient(action.CPConnection)

internal/aiagentconfig/aiagentconfig.go

@@ -0,0 +1,74 @@
+//
+// Copyright 2026 The Chainloop Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package aiagentconfig
+
+const (
+	// EvidenceID is the identifier for the AI agent config evidence
+	EvidenceID = "CHAINLOOP_AI_AGENT_CONFIG"
+	// EvidenceSchemaURL is the URL to the JSON schema for AI agent config
+	EvidenceSchemaURL = "https://schemas.chainloop.dev/aiagentconfig/1.0/ai-agent-config.schema.json"
+)
+
+// Agent identifies the AI agent provider
+type Agent struct {
+	Name    string `json:"name"`
+	Version string `json:"version,omitempty"`
+}
+
+// GitContext holds optional git information at capture time
+type GitContext struct {
+	Repository string `json:"repository,omitempty"`
+	Branch     string `json:"branch,omitempty"`
+	CommitSHA  string `json:"commit_sha,omitempty"`
+}
+
+// ConfigFile represents a single discovered configuration file
+type ConfigFile struct {
+	Path          string `json:"path"`
+	SHA256        string `json:"sha256"`
+	Size          int64  `json:"size"`
+	Base64Content string `json:"base64_content"`
+}
+
+// Data is the payload inside the evidence envelope
+type Data struct {
+	SchemaVersion string       `json:"schema_version"`
+	Agent         Agent        `json:"agent"`
+	ConfigHash    string       `json:"config_hash"`
+	CapturedAt    string       `json:"captured_at"`
+	GitContext    *GitContext  `json:"git_context,omitempty"`
+	ConfigFiles   []ConfigFile `json:"config_files"`
+	// Future fields for richer analysis
+	Permissions any `json:"permissions,omitempty"`
+	MCPServers  any `json:"mcp_servers,omitempty"`
+	Subagents   any `json:"subagents,omitempty"`
+}
+
+// Evidence is the full envelope matching the custom evidence format
+type Evidence struct {
+	ID     string `json:"chainloop.material.evidence.id"`
+	Schema string `json:"schema"`
+	Data   Data   `json:"data"`
+}
+
+// NewEvidence creates a new Evidence instance with the standard envelope
+func NewEvidence(data Data) *Evidence {
+	return &Evidence{
+		ID:     EvidenceID,
+		Schema: EvidenceSchemaURL,
+		Data:   data,
+	}
+}

internal/aiagentconfig/builder.go

@@ -0,0 +1,83 @@
+//
+// Copyright 2026 The Chainloop Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package aiagentconfig
+
+import (
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/hex"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+	"time"
+)
+
+// BuildEvidence reads discovered files and constructs the evidence payload.
+// rootDir is the base directory, filePaths are relative to rootDir.
+// gitCtx may be nil if not in a git repository.
+func BuildEvidence(rootDir string, filePaths []string, gitCtx *GitContext) (*Evidence, error) {
+	configFiles := make([]ConfigFile, 0, len(filePaths))
+	hashes := make([]string, 0, len(filePaths))
+
+	for _, relPath := range filePaths {
+		absPath := filepath.Join(rootDir, relPath)
+
+		content, err := os.ReadFile(absPath)
+		if err != nil {
+			return nil, fmt.Errorf("reading %s: %w", relPath, err)
+		}
+
+		info, err := os.Stat(absPath)
+		if err != nil {
+			return nil, fmt.Errorf("stat %s: %w", relPath, err)
+		}
+
+		hash := sha256.Sum256(content)
+		hexHash := hex.EncodeToString(hash[:])
+		hashes = append(hashes, hexHash)
+
+		configFiles = append(configFiles, ConfigFile{
+			Path:          relPath,
+			SHA256:        hexHash,
+			Size:          info.Size(),
+			Base64Content: base64.StdEncoding.EncodeToString(content),
+		})
+	}
+
+	data := Data{
+		SchemaVersion: "v1alpha",
+		Agent:         Agent{Name: "claude"},
+		ConfigHash:    computeCombinedHash(hashes),
+		CapturedAt:    time.Now().UTC().Format(time.RFC3339),
+		GitContext:    gitCtx,
+		ConfigFiles:   configFiles,
+	}
+
+	return NewEvidence(data), nil
+}
+
+// computeCombinedHash sorts individual hashes, concatenates them, and hashes the result.
+func computeCombinedHash(hashes []string) string {
+	sorted := make([]string, len(hashes))
+	copy(sorted, hashes)
+	sort.Strings(sorted)
+
+	combined := sha256.Sum256([]byte(strings.Join(sorted, "")))
+
+	return hex.EncodeToString(combined[:])
+}

internal/aiagentconfig/builder_test.go

@@ -0,0 +1,117 @@
+//
+// Copyright 2026 The Chainloop Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package aiagentconfig
+
+import (
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/hex"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestBuildEvidence(t *testing.T) {
+	rootDir := t.TempDir()
+
+	// Create test files
+	file1Content := []byte("# Project Rules\nAlways use Go.")
+	file2Content := []byte(`{"allow": ["read"]}`)
+
+	require.NoError(t, os.WriteFile(filepath.Join(rootDir, "CLAUDE.md"), file1Content, 0o600))
+	require.NoError(t, os.MkdirAll(filepath.Join(rootDir, ".claude"), 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(rootDir, ".claude", "settings.json"), file2Content, 0o600))
+
+	gitCtx := &GitContext{
+		Repository: "https://github.com/org/repo",
+		CommitSHA:  "abc123",
+	}
+
+	evidence, err := BuildEvidence(rootDir, []string{"CLAUDE.md", ".claude/settings.json"}, gitCtx)
+	require.NoError(t, err)
+
+	// Verify envelope
+	assert.Equal(t, EvidenceID, evidence.ID)
+	assert.Equal(t, EvidenceSchemaURL, evidence.Schema)
+
+	// Verify data
+	assert.Equal(t, "v1alpha", evidence.Data.SchemaVersion)
+	assert.Equal(t, "claude", evidence.Data.Agent.Name)
+	assert.NotEmpty(t, evidence.Data.CapturedAt)
+	assert.NotEmpty(t, evidence.Data.ConfigHash)
+
+	// Verify git context
+	require.NotNil(t, evidence.Data.GitContext)
+	assert.Equal(t, "https://github.com/org/repo", evidence.Data.GitContext.Repository)
+	assert.Equal(t, "abc123", evidence.Data.GitContext.CommitSHA)
+
+	// Verify config files
+	require.Len(t, evidence.Data.ConfigFiles, 2)
+
+	cf1 := evidence.Data.ConfigFiles[0]
+	assert.Equal(t, "CLAUDE.md", cf1.Path)
+	assert.Equal(t, int64(len(file1Content)), cf1.Size)
+	hash1 := sha256.Sum256(file1Content)
+	assert.Equal(t, hex.EncodeToString(hash1[:]), cf1.SHA256)
+	assert.Equal(t, base64.StdEncoding.EncodeToString(file1Content), cf1.Base64Content)
+
+	cf2 := evidence.Data.ConfigFiles[1]
+	assert.Equal(t, ".claude/settings.json", cf2.Path)
+	hash2 := sha256.Sum256(file2Content)
+	assert.Equal(t, hex.EncodeToString(hash2[:]), cf2.SHA256)
+
+	// Verify config hash is deterministic
+	hashes := []string{hex.EncodeToString(hash1[:]), hex.EncodeToString(hash2[:])}
+	sort.Strings(hashes)
+	combined := sha256.Sum256([]byte(strings.Join(hashes, "")))
+	assert.Equal(t, hex.EncodeToString(combined[:]), evidence.Data.ConfigHash)
+}
+
+func TestBuildEvidenceWithoutGitContext(t *testing.T) {
+	rootDir := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(rootDir, "CLAUDE.md"), []byte("content"), 0o600))
+
+	evidence, err := BuildEvidence(rootDir, []string{"CLAUDE.md"}, nil)
+	require.NoError(t, err)
+
+	assert.Nil(t, evidence.Data.GitContext)
+	assert.Len(t, evidence.Data.ConfigFiles, 1)
+}
+
+func TestBuildEvidenceJSONFormat(t *testing.T) {
+	rootDir := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(rootDir, "CLAUDE.md"), []byte("content"), 0o600))
+
+	evidence, err := BuildEvidence(rootDir, []string{"CLAUDE.md"}, nil)
+	require.NoError(t, err)
+
+	// Verify it marshals to valid JSON with the correct envelope field
+	jsonData, err := json.Marshal(evidence)
+	require.NoError(t, err)
+
+	var raw map[string]any
+	require.NoError(t, json.Unmarshal(jsonData, &raw))
+
+	assert.Equal(t, EvidenceID, raw["chainloop.material.evidence.id"])
+	assert.Equal(t, EvidenceSchemaURL, raw["schema"])
+	assert.NotNil(t, raw["data"])
+}

internal/aiagentconfig/discover.go

@@ -0,0 +1,66 @@
+//
+// Copyright 2026 The Chainloop Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package aiagentconfig
+
+import (
+	"path/filepath"
+	"sort"
+)
+
+// claudePatterns are glob patterns for Claude agent configuration files,
+// evaluated relative to a root directory.
+var claudePatterns = []string{
+	"CLAUDE.md",
+	".claude/CLAUDE.md",
+	".claude/settings.json",
+	".mcp.json",
+	".claude/rules/*.md",
+	".claude/agents/*.md",
+	".claude/commands/*.md",
+	".claude/skills/*/SKILL.md",
+}
+
+// Discover searches rootDir for AI agent configuration files.
+// It only looks in rootDir and its subdirectories, never in parent directories.
+// Returns deduplicated relative paths sorted alphabetically.
+func Discover(rootDir string) ([]string, error) {
+	seen := make(map[string]struct{})
+	var results []string
+
+	for _, pattern := range claudePatterns {
+		absPattern := filepath.Join(rootDir, pattern)
+		matches, err := filepath.Glob(absPattern)
+		if err != nil {
+			return nil, err
+		}
+
+		for _, match := range matches {
+			rel, err := filepath.Rel(rootDir, match)
+			if err != nil {
+				return nil, err
+			}
+
+			if _, ok := seen[rel]; !ok {
+				seen[rel] = struct{}{}
+				results = append(results, rel)
+			}
+		}
+	}
+
+	sort.Strings(results)
+
+	return results, nil
+}