Repository navigation
Conversation
Add a design spec that compares the options to serve gRPC, gRPC-Web and HTTP from one port per service (control plane and Artifact CAS), and picks a connection-level split on the current gRPC port, with the legacy HTTP port behind a config flag for a deprecation period. Refs #3628 Assisted-by: Claude Code Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev> Chainloop-Trace-Sessions: 2d702692-c199-4c83-b691-9bb2db0657ac
AI Session Checks — 🟢 90% ·
|
| Avg score | Sessions | Failing policies | Attribution | Files | Lines | Total Duration |
|---|---|---|---|---|---|---|
| 🟢 90% | 1 | 100% AI / 0% Human | 1 | +273 / -34 | 50m26s |
🟢 90% — 100% AI — ⚠️ 1 policies failing
-
Oct 15, 2026 17:16 UTC · 50m26s · $11.34 · 376 in / 130.2k out · claude-code 2.1.300 (claude-opus-5-5)
Change Summary
-
- Drafts and revises
docs/specs/issue-3628-single-endpoint.mdfor the single-port gRPC/HTTP design. - Adds parity requirements, current-format decision records, and classifier/proxy limits from review.
- Opens draft PR
chainloop#3629and files follow-up issuePFM-7832about deprecatedgrpc-web.
- Drafts and revises
AI Session Overall Score
-
🟢 90% — Spec-only autonomous run stayed aligned and tightly scoped; code-level judges abstained.
AI Session Analysis Breakdown
-
🟢 94% · context-and-planning
-
🟢 Opening instructions and skill guidance gave the session strong setup. · High Impact
🟢 92% · scope-discipline
-
🟢 Recorded diff stats kept the PR focused on one spec file. · High Impact
🟢 90% · alignment
-
No notes.
🟢 85% · user-trust-signal
-
🟢 The user kept routing follow-up work back to the same session. · Medium Impact
abstained · solution-quality
-
🟠 Solution quality was not assessed because the session shipped design text, not implementation code. · Medium Severity
💡 When a session is spec-only, separate later implementation work into its own PR so code-quality review stays crisp.
abstained · verification
-
🟠 Verification was not assessed because the PR is spec-only and changes no runtime behavior. · Medium Severity
💡 For spec-only PRs, keep the diff clearly non-runtime so reviewers can safely treat verification as N/A.
-
File Attribution
████████████████████100% AI / 0% HumanStatus Attribution File Lines modified ai docs/specs/issue-3628-single-endpoint.md+273 / -34
Policies (4, 1 failing)
Status Policy Material Messages ✅ Passed ai-config-ai-agents-allowedai-coding-session-2d7026- ✅ Passed ai-config-no-dangerous-commandsai-coding-session-2d7026- ⚠️ Failedai-config-no-secretsai-coding-session-2d7026- Secret (private-key) detected in session content [turn=747, source=tool_result, line=6]: |
⚠️ Failed |ai-config-no-secrets| [ai-coding-session-2d7026](https://app.chainloop.dev/u/chainloop/projects/chainloop/versi... - Secret (private-key) detected in session content [turn=76, source=tool_result, line=24]: 231: [CHAINLOOP_TRACE_REDACTED:private-key]
✅ Passed ai-config-mcp-servers-allowedai-coding-session-2d7026- -
Powered by Chainloop and Chainloop Trace
Refs #3628 Assisted-by: Claude Code Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>
|
@cubic please review |
Use one Decision Record entry per decision, give each Non-Goal its reason, order requirements by importance, and align the parity requirements with the current release instead of the legacy port. Refs #3628 Assisted-by: Claude Code Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>
@migmartri I have started the AI code review. It will take a few minutes to complete. |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
All reported issues were addressed
Heads up: you’ve reached your flex budget. Increase your flex budget or wait for usage to reset.
View guided diff | Re-trigger cubic
Match every gRPC content type, record that a connection that starts with gRPC carries only gRPC, list the supported proxy setups, and ask reviewers about proxies that share one upstream connection. Refs #3628 Assisted-by: Claude Code Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>
1 participant
Summary
The control plane and the Artifact CAS will each serve gRPC, gRPC-Web, and HTTP on one port. Today each service has a gRPC port and an HTTP port. An installation thus needs two Services, two ingresses, two hostnames, and two TLS settings per service.
The spec compares three options: a split by connection, a per-request router to the HTTP adapter of the gRPC server, and a move to Connect. It picks the split by connection on the current gRPC port. Each new connection goes to the gRPC server that runs today, or to the HTTP server that runs today. The middleware, the authentication, and the native gRPC transport for large CAS streams do not change. The old HTTP port stays on by default for a deprecation period, behind a config flag. The Helm chart moves to one Service and one hostname per service, with a path split on the same host for nginx.
Open questions for reviewers
The Decision Record (D-001 to D-010) holds the other choices. Please challenge any of them in review.
We would like two reviewers to approve this spec before it merges.
Refs #3628
🤖 Posted by Maximus bot (Claude Code) on behalf of @migmartri using the eng-autopilot skill