feat: org setting to block attestations on released versions

Add an opt-in organization-level setting,
block_attestations_on_released_versions, that rejects new attestations
targeting project versions that are already released (prerelease == false).
Default is false, preserving current behavior.

Enforcement happens at two points: at attestation init, transactionally
with a row lock when resolving the project version, providing fail-fast
feedback before any work is done; and at push in SaveAttestation, which
acts as the authoritative gate closing the window where a version could be
released between init and push. Both return a dedicated typed error mapped
to a FailedPrecondition gRPC code so the CLI surfaces a clear message.

The setting is exposed through the organization settings API and the
chainloop organization update CLI command.

Assisted-by: Claude Code
Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>

Chainloop-Trace-Sessions: 146f4ecb-bdc9-4562-8b1b-2481ea10d7bf

Author: migmartri

app/cli/cmd/organization_update.go

@@ -25,13 +25,14 @@ import (
 
 func newOrganizationUpdateCmd() *cobra.Command {
 	var (
-		orgName                         string
-		blockOnPolicyViolation          bool
-		policiesAllowedHostnames        []string
-		preventImplicitWorkflowCreation bool
-		restrictContractCreation        bool
-		apiTokenMaxDaysInactive         string
-		enableAIAgentCollector          bool
+		orgName                             string
+		blockOnPolicyViolation              bool
+		policiesAllowedHostnames            []string
+		preventImplicitWorkflowCreation     bool
+		restrictContractCreation            bool
+		apiTokenMaxDaysInactive             string
+		enableAIAgentCollector              bool
+		blockAttestationsOnReleasedVersions bool
 	)
 
 	cmd := &cobra.Command{
@@ -59,6 +60,10 @@ func newOrganizationUpdateCmd() *cobra.Command {
 				opts.EnableAIAgentCollector = &enableAIAgentCollector
 			}
 
+			if cmd.Flags().Changed("block-attestations-on-released-versions") {
+				opts.BlockAttestationsOnReleasedVersions = &blockAttestationsOnReleasedVersions
+			}
+
 			if cmd.Flags().Changed("api-token-max-days-inactive") {
 				days, err := strconv.Atoi(apiTokenMaxDaysInactive)
 				if err != nil {
@@ -90,5 +95,6 @@ func newOrganizationUpdateCmd() *cobra.Command {
 	cmd.Flags().BoolVar(&restrictContractCreation, "restrict-contract-creation", false, "restrict contract creation (org-level and project-level) to only organization admins (owner/admin roles)")
 	cmd.Flags().StringVar(&apiTokenMaxDaysInactive, "api-token-max-days-inactive", "", "maximum days of inactivity before API tokens are auto-revoked (e.g. '90', '0' to disable)")
 	cmd.Flags().BoolVar(&enableAIAgentCollector, "enable-ai-agent-collector", false, "enable automatic AI agent config collection during attestation init")
+	cmd.Flags().BoolVar(&blockAttestationsOnReleasedVersions, "block-attestations-on-released-versions", false, "reject new attestations pushed to project versions that are already released")
 	return cmd
 }

app/cli/documentation/cli-reference.mdx

@@ -2908,14 +2908,15 @@ chainloop organization update [flags]
 Options
 
 ```
---api-token-max-days-inactive string   maximum days of inactivity before API tokens are auto-revoked (e.g. '90', '0' to disable)
---block                                set the default policy violation blocking strategy
---enable-ai-agent-collector            enable automatic AI agent config collection during attestation init
--h, --help                                 help for update
---name string                          organization name
---policies-allowed-hostnames strings   set the allowed hostnames for the policy engine
---prevent-implicit-workflow-creation   prevent workflows and projects from being created implicitly during attestation init
---restrict-contract-creation           restrict contract creation (org-level and project-level) to only organization admins (owner/admin roles)
+--api-token-max-days-inactive string        maximum days of inactivity before API tokens are auto-revoked (e.g. '90', '0' to disable)
+--block                                     set the default policy violation blocking strategy
+--block-attestations-on-released-versions   reject new attestations pushed to project versions that are already released
+--enable-ai-agent-collector                 enable automatic AI agent config collection during attestation init
+-h, --help                                      help for update
+--name string                               organization name
+--policies-allowed-hostnames strings        set the allowed hostnames for the policy engine
+--prevent-implicit-workflow-creation        prevent workflows and projects from being created implicitly during attestation init
+--restrict-contract-creation                restrict contract creation (org-level and project-level) to only organization admins (owner/admin roles)
 ```
 
 Options inherited from parent commands

app/cli/pkg/action/membership_list.go

@@ -29,14 +29,15 @@ type MembershipList struct {
 }
 
 type OrgItem struct {
-	ID                              string     `json:"id"`
-	Name                            string     `json:"name"`
-	CreatedAt                       *time.Time `json:"createdAt"`
-	PolicyViolationBlockingStrategy string     `json:"policyViolationBlockingStrategy"`
-	PolicyAllowedHostnames          []string   `json:"policyAllowedHostnames,omitempty"`
-	PreventImplicitWorkflowCreation bool       `json:"preventImplicitWorkflowCreation"`
-	APITokenMaxDaysInactive         *string    `json:"apiTokenMaxDaysInactive,omitempty"`
-	EnableAIAgentCollector          bool       `json:"enableAiAgentCollector"`
+	ID                                  string     `json:"id"`
+	Name                                string     `json:"name"`
+	CreatedAt                           *time.Time `json:"createdAt"`
+	PolicyViolationBlockingStrategy     string     `json:"policyViolationBlockingStrategy"`
+	PolicyAllowedHostnames              []string   `json:"policyAllowedHostnames,omitempty"`
+	PreventImplicitWorkflowCreation     bool       `json:"preventImplicitWorkflowCreation"`
+	APITokenMaxDaysInactive             *string    `json:"apiTokenMaxDaysInactive,omitempty"`
+	EnableAIAgentCollector              bool       `json:"enableAiAgentCollector"`
+	BlockAttestationsOnReleasedVersions bool       `json:"blockAttestationsOnReleasedVersions"`
 }
 
 type MembershipItem struct {
@@ -134,12 +135,13 @@ func (action *MembershipList) ListMembers(ctx context.Context, page int, pageSiz
 
 func pbOrgItemToAction(in *pb.OrgItem) *OrgItem {
 	i := &OrgItem{
-		ID:                              in.Id,
-		Name:                            in.Name,
-		CreatedAt:                       toTimePtr(in.CreatedAt.AsTime()),
-		PolicyAllowedHostnames:          in.PolicyAllowedHostnames,
-		PreventImplicitWorkflowCreation: in.PreventImplicitWorkflowCreation,
-		EnableAIAgentCollector:          in.EnableAiAgentCollector,
+		ID:                                  in.Id,
+		Name:                                in.Name,
+		CreatedAt:                           toTimePtr(in.CreatedAt.AsTime()),
+		PolicyAllowedHostnames:              in.PolicyAllowedHostnames,
+		PreventImplicitWorkflowCreation:     in.PreventImplicitWorkflowCreation,
+		EnableAIAgentCollector:              in.EnableAiAgentCollector,
+		BlockAttestationsOnReleasedVersions: in.BlockAttestationsOnReleasedVersions,
 	}
 
 	if in.DefaultPolicyViolationStrategy == pb.OrgItem_POLICY_VIOLATION_BLOCKING_STRATEGY_BLOCK {

app/cli/pkg/action/org_update.go

@@ -40,6 +40,8 @@ type NewOrgUpdateOpts struct {
 	APITokenMaxDaysInactive *int
 	// EnableAIAgentCollector enables automatic AI agent config collection during attestation init
 	EnableAIAgentCollector *bool
+	// BlockAttestationsOnReleasedVersions rejects new attestations pushed to project versions that are already released
+	BlockAttestationsOnReleasedVersions *bool
 }
 
 func (action *OrgUpdate) Run(ctx context.Context, name string, opts *NewOrgUpdateOpts) (*OrgItem, error) {
@@ -51,6 +53,7 @@ func (action *OrgUpdate) Run(ctx context.Context, name string, opts *NewOrgUpdat
 		PreventImplicitWorkflowCreation:     opts.PreventImplicitWorkflowCreation,
 		RestrictContractCreationToOrgAdmins: opts.RestrictContractCreation,
 		EnableAiAgentCollector:              opts.EnableAIAgentCollector,
+		BlockAttestationsOnReleasedVersions: opts.BlockAttestationsOnReleasedVersions,
 	}
 
 	if opts.PoliciesAllowedHostnames != nil {

app/controlplane/api/controlplane/v1/organization.pb.go

@@ -105,6 +105,9 @@ message OrganizationServiceUpdateRequest {
 
   // Enable automatic AI agent config collection during attestation init
   optional bool enable_ai_agent_collector = 8;
+
+  // Reject new attestations pushed to project versions that are already released (prerelease == false)
+  optional bool block_attestations_on_released_versions = 9;
 }
 
 message OrganizationServiceUpdateResponse {

app/controlplane/api/controlplane/v1/organization.proto

@@ -391,6 +391,8 @@ message OrgItem {
   optional int32 api_token_max_days_inactive = 9;
   // Whether AI agent config collection is automatically enabled during attestation init
   bool enable_ai_agent_collector = 10;
+  // Whether new attestations are rejected on project versions that are already released (prerelease == false)
+  bool block_attestations_on_released_versions = 11;
 
   enum PolicyViolationBlockingStrategy {
     POLICY_VIOLATION_BLOCKING_STRATEGY_UNSPECIFIED = 0;