[waveywaves]

Summary

Implements the provider/parser slice of spec issue-3520:

• copies the hook-reported Pi JSONL through a temporary file and atomically publishes successful refreshes to Trace state;
• keeps the last usable private copy when refresh fails so pre-push can still send the best session version available;
• validates Pi JSONL v3, follows the last persisted session-tree branch, and rejects duplicate IDs, cycles, selected orphans, invalid headers, and malformed interior lines;
• retains valid native and unknown selected entries while excluding Chainloop tree markers;
• maps deterministic model, token, cost, tool, conversation, timing, warning, and raw-session evidence; and
• ignores invalid usage values without making the resulting evidence uncraftable.

This PR implements R-006, R-007, and the provider-copy portion of R-005. After maintainer review, it intentionally departs from R-005's stale-copy invalidation rule: a failed refresh now retains and uses the best previously copied session version. It intentionally does not register Pi or add extension/hooks/CLI flags; those remain a separate implementation slice.

Compatibility and safety

• Refresh errors no longer suppress an existing usable Pi copy; sessions without any usable copy still fail with sanitized, non-blocking warnings.
• Pi requires the transcript path reported by its future extension and does not guess from the working directory.
• The parser still reads Trace's private copy rather than the live Pi transcript.
• Copy and parse errors omit local transcript paths.
• No control-plane API, protobuf, evidence-schema, provider registry, or CLI changes are included.

Verification

• go test -race -shuffle=on -count=1 ./app/cli/internal/trace/pi ./app/cli/pkg/action
• make -C app/cli build
• go vet ./... from app/cli
• manual provider driver: successful refresh, failed-refresh cached fallback, and sanitized no-cache failure
• git diff --check
• local make -C app/cli lint was attempted, but golangci-lint 2.11.1's available toolchains cannot parse this repository's Go 1.27 export data; the post-push lint (cli) check is authoritative

Refs #3520

AI assistance

Vibhav's Pi assisted with implementation and review. The maintainer-fix commit carries an Assisted-by: Vibhav's Pi trailer.

[chainloop-platform]

PR validation — ✅ 3 passing

Status	Policy	Material	Messages
✅ Passed	pr-min-approvals	pr-info	-
✅ Passed	pr-description-required	pr-info	-
✅ Passed	pr-user-story-linked	pr-info	-

_{View attestation ↗}

AI Session Checks — ⏭️ bypassed by label

AI Coding Session Check Bypassed

This PR carries the skip-ai-session label, so the AI coding session check was bypassed.

Learn more about Chainloop Trace.

Security Checks — ✅ 6 passing

✅ secret-scan

Status	Policy	Messages
✅ Passed	secrets-detection	-

✅ sast-scan

Status	Policy	Messages
✅ Passed	owasp-top10-2025	-
✅ Passed	sast	-
✅ Passed	cwe-top25	-
✅ Passed	cwe-top26-40-cusp	-

✅ iac-scan

Status	Policy	Messages
✅ Passed	iac-misconfiguration	-

Scans not applied (2)

Scan	Reason
vulnerability-scan	no manifest/lockfile changed
github-actions-scan	no workflow files changed

_{View attestation ↗}

Security context

✅ Nothing this change touches has a recorded security-fix history.

_{View in Chainloop ↗ · How this works ↗}

---

Powered by Chainloop and Chainloop Trace

[cubic-dev-ai]

All reported issues were addressed across 11 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[matiasinsaurralde]

Thanks for your contribution, we're looking into expanding testing and evaluations for this feature so we'll come back to your PR soon!

[jiparis]

Hi @waveywaves I've added a couple of comments. I understand this PR implements only the 1st milestone from the spec, so I think it's soon for end to end tests (we are adding PI test driver In this PR #3668)

[jiparis]

Thanks, I'm merging this.