feat(policies): remove STATUS phase and make status action read-only

Remove the STATUS phase from the AttestationPhase enum, simplifying
the attestation lifecycle to INIT and PUSH. Policy evaluation is moved
out of the status action into the init action explicitly, following
the same pattern push already uses. The status command becomes a pure
read-only observer that displays existing evaluations from crafting state.

Signed-off-by: Miguel Martinez <miguel@chainloop.dev>

Author: migmartri

app/cli/cmd/attestation_init.go

@@ -21,7 +21,6 @@ import (
 
 	"github.com/chainloop-dev/chainloop/app/cli/cmd/output"
 	"github.com/chainloop-dev/chainloop/app/cli/pkg/action"
-	"github.com/chainloop-dev/chainloop/pkg/policies"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
 )
@@ -128,7 +127,7 @@ func newAttestationInitCmd() *cobra.Command {
 				return newGracefulError(err)
 			}
 
-			res, err := statusAction.Run(cmd.Context(), attestationID, action.WithStatusEvalPhase(policies.EvalPhaseInit))
+			res, err := statusAction.Run(cmd.Context(), attestationID)
 			if err != nil {
 				return newGracefulError(err)
 			}

app/cli/pkg/action/attestation_init.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2024-2025 The Chainloop Authors.
+// Copyright 2024-2026 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -27,6 +27,7 @@ import (
 	"github.com/chainloop-dev/chainloop/app/controlplane/pkg/unmarshal"
 	"github.com/chainloop-dev/chainloop/pkg/attestation/crafter"
 	clientAPI "github.com/chainloop-dev/chainloop/pkg/attestation/crafter/api/attestation/v1"
+	"github.com/chainloop-dev/chainloop/pkg/attestation/renderer"
 	"github.com/chainloop-dev/chainloop/pkg/casclient"
 	"github.com/chainloop-dev/chainloop/pkg/policies"
 	"github.com/rs/zerolog"
@@ -305,6 +306,22 @@ func (action *AttestationInit) Run(ctx context.Context, opts *AttestationInitRun
 		// Don't fail the init - this is best-effort
 	}
 
+	// Evaluate attestation-level policies at init phase
+	attClient := pb.NewAttestationServiceClient(action.CPConnection)
+	r, err := renderer.NewAttestationRenderer(action.c.CraftingState, attClient, "", "", nil, renderer.WithLogger(action.Logger))
+	if err != nil {
+		return "", fmt.Errorf("creating attestation renderer: %w", err)
+	}
+
+	statement, err := r.RenderStatement(ctx)
+	if err != nil {
+		return "", fmt.Errorf("rendering statement: %w", err)
+	}
+
+	if err := action.c.EvaluateAttestationPolicies(ctx, attestationID, statement, policies.EvalPhaseInit); err != nil {
+		return "", fmt.Errorf("evaluating attestation policies: %w", err)
+	}
+
 	return attestationID, nil
 }
 

app/cli/pkg/action/attestation_push.go

@@ -102,8 +102,7 @@ func (action *AttestationPush) Run(ctx context.Context, attestationID string, ru
 		return nil, fmt.Errorf("creating status action: %w", err)
 	}
 
-	// we do not want to evaluate policies here since we do it manually later on
-	attestationStatus, err := statusAction.Run(ctx, attestationID, WithSkipPolicyEvaluation())
+	attestationStatus, err := statusAction.Run(ctx, attestationID)
 	if err != nil {
 		return nil, fmt.Errorf("creating running status action: %w", err)
 	}

app/cli/pkg/action/attestation_status.go

@@ -20,13 +20,10 @@ import (
 	"fmt"
 	"time"
 
-	pb "github.com/chainloop-dev/chainloop/app/controlplane/api/controlplane/v1"
 	pbc "github.com/chainloop-dev/chainloop/app/controlplane/api/workflowcontract/v1"
 	"github.com/chainloop-dev/chainloop/pkg/attestation/crafter"
 	v1 "github.com/chainloop-dev/chainloop/pkg/attestation/crafter/api/attestation/v1"
-	"github.com/chainloop-dev/chainloop/pkg/attestation/renderer"
 	"github.com/chainloop-dev/chainloop/pkg/attestation/renderer/chainloop"
-	"github.com/chainloop-dev/chainloop/pkg/policies"
 )
 
 type AttestationStatusOpts struct {
@@ -40,10 +37,7 @@ type AttestationStatus struct {
 	*ActionsOpts
 	c *crafter.Crafter
 	// Do not show information about the project version release status
-	isPushed  bool
-	evalPhase policies.EvalPhase
-	// skipEvaluation disables policy evaluation entirely; only existing evaluations from state are shown
-	skipEvaluation bool
+	isPushed bool
 }
 
 type AttestationStatusResult struct {
@@ -93,30 +87,10 @@ func NewAttestationStatus(cfg *AttestationStatusOpts) (*AttestationStatus, error
 		ActionsOpts: cfg.ActionsOpts,
 		c:           c,
 		isPushed:    cfg.isPushed,
-		evalPhase:   policies.EvalPhaseStatus,
 	}, nil
 }
 
-func WithStatusEvalPhase(phase policies.EvalPhase) func(*AttestationStatus) {
-	return func(opts *AttestationStatus) {
-		opts.evalPhase = phase
-	}
-}
-
-// WithSkipPolicyEvaluation disables policy evaluation; only existing evaluations from crafting state are displayed.
-func WithSkipPolicyEvaluation() func(*AttestationStatus) {
-	return func(opts *AttestationStatus) {
-		opts.skipEvaluation = true
-	}
-}
-
-type AttestationStatusOpt func(*AttestationStatus)
-
-func (action *AttestationStatus) Run(ctx context.Context, attestationID string, opts ...AttestationStatusOpt) (*AttestationStatusResult, error) {
-	for _, opt := range opts {
-		opt(action)
-	}
-
+func (action *AttestationStatus) Run(ctx context.Context, attestationID string) (*AttestationStatusResult, error) {
 	c := action.c
 
 	if initialized, err := c.AlreadyInitialized(ctx, attestationID); err != nil {
@@ -152,25 +126,7 @@ func (action *AttestationStatus) Run(ctx context.Context, attestationID string,
 		TimestampAuthority:          att.GetSigningOptions().GetTimestampAuthorityUrl(),
 	}
 
-	if !action.skipEvaluation {
-		// Render the statement and evaluate attestation-level policies using the configured phase
-		attClient := pb.NewAttestationServiceClient(action.CPConnection)
-		r, err := renderer.NewAttestationRenderer(c.CraftingState, attClient, "", "", nil, renderer.WithLogger(action.Logger))
-		if err != nil {
-			return nil, fmt.Errorf("creating attestation renderer: %w", err)
-		}
-
-		statement, err := r.RenderStatement(ctx)
-		if err != nil {
-			return nil, fmt.Errorf("rendering statement: %w", err)
-		}
-
-		if err := c.EvaluateAttestationPolicies(ctx, attestationID, statement, action.evalPhase); err != nil {
-			return nil, fmt.Errorf("evaluating attestation policies: %w", err)
-		}
-	}
-
-	// Always read policy evaluations from crafting state regardless of evaluation
+	// Read policy evaluations from crafting state (evaluation happens in init/push, not here)
 	res.PolicyEvaluations, res.HasPolicyViolations = getPolicyEvaluations(c)
 
 	if v := workflowMeta.GetVersion(); v != nil {

app/controlplane/api/gen/frontend/workflowcontract/v1/crafting_schema.ts

@@ -311,7 +311,6 @@ message PolicySpec {
 enum AttestationPhase {
   ATTESTATION_PHASE_UNSPECIFIED = 0;
   INIT = 1;
-  STATUS = 2;
   PUSH = 3;
 }
 
@@ -350,7 +349,7 @@ message PolicySpecV2 {
   }];
 
   // Controls at which attestation phases this policy is evaluated.
-  // Empty means evaluate at all phases (INIT, STATUS, and PUSH) for backwards compatibility.
+  // Empty means evaluate at all phases (INIT and PUSH) for backwards compatibility.
   // Only applicable when kind is ATTESTATION.
   repeated AttestationPhase attestation_phases = 5;
 }

app/controlplane/api/gen/jsonschema/workflowcontract.v1.PolicySpecV2.jsonschema.json

@@ -69,7 +69,6 @@ type EvalPhase int
 const (
 	EvalPhaseUnspecified EvalPhase = iota
 	EvalPhaseInit
-	EvalPhaseStatus
 	EvalPhasePush
 )
 
@@ -198,8 +197,6 @@ func shouldEvaluateAtPhase(phases []v1.AttestationPhase, phase EvalPhase) bool {
 	switch phase {
 	case EvalPhaseInit:
 		target = v1.AttestationPhase_INIT
-	case EvalPhaseStatus:
-		target = v1.AttestationPhase_STATUS
 	case EvalPhasePush:
 		target = v1.AttestationPhase_PUSH
 	default: