[migmartri]

The CLI now uses the single-port hostnames by default: cp.chainloop.dev:443 for the control plane and cas.chainloop.dev:443 for the Artifact CAS. Since v1.126.0, these endpoints serve gRPC and HTTP on one port (#3628).

The docs, examples and sandbox egress rules that named the old api.cp.chainloop.dev and api.cas.chainloop.dev hostnames now use the new ones. These include the CLI reference, the CLI and Dagger READMEs, the OpenAPI download examples, and the sandbox kit's NO_PROXY and egress allow list.

The new hostnames must serve native gRPC before a CLI release ships with these defaults.

Related: #3628

AI assistance: this change was prepared with Claude Code.

[chainloop-platform]

PR validation — ✅ 3 passing

Status	Policy	Material	Messages
✅ Passed	pr-min-approvals	pr-info	-
✅ Passed	pr-description-required	pr-info	-
✅ Passed	pr-user-story-linked	pr-info	-

_{View attestation ↗}

AI Session Checks — 🟡 79% · ✅ 0 failing

Avg score	Sessions	Failing policies	Attribution	Files	Lines	Total Duration
🟡 79%	1	✅ 0	100% AI / 0% Human	10	+250 / -248	23h41m13s

🟡 79% — 100% AI — ✅ All policies passing

Oct 25, 2026 14:29 UTC · 23h41m13s · $18.88 · 542 in / 188.1k out · claude-code 2.1.310 (claude-opus-5-5)

_{View session details ↗}

Change Summary

• Adds useSharedEndpoints as an opt-in chart flag that keeps legacy client selection by default.
• Switches the control plane CAS address and install-note CLI endpoints when the flag is enabled.
• Updates the chart README and parameter table for the shared-endpoint migration, and adds table-driven coverage for defaults, opt-in, and custom CAS port.

AI Session Overall Score

🟡 79% — Clean chart rewrite, but spec-level release and ingress checks remain open.

AI Session Analysis Breakdown

🟢 92% · scope-discipline

🟢 Final changes stay inside six deployment/chainloop files. · High Impact

🟢 89% · solution-quality

🟢 The opt-in flag preserves existing client selection by default. · High Impact

🟢 84% · alignment

No notes.

🟢 82% · context-and-planning

🟢 AI compared the EE chart before rewriting the OSS chart. · High Impact

🟡 70% · user-trust-signal

🟠 The user had to redirect the chart work toward the EE-consistent approach before the final rewrite. · Medium Severity

💡 When two plausible chart strategies exist, surface the fork before committing to one.

🟡 64% · verification

🟠 Chart checks ran, but the spec's release-note and nginx default-install checks still were not completed. · Medium Severity

💡 Close spec verification by either running the named acceptance checks or parking them explicitly in the PR.

---

File Attribution

████████████████████ 100% AI / 0% Human

Status	Attribution	File	Lines
modified	ai	app/cli/documentation/cli-reference.md	+228 / -228
modified	ai	devel/sandbox-kit/claude/spec.yaml	+7 / -5
modified	ai	app/cli/cmd/telemetry_flush_test.go	+3 / -3
modified	ai	app/cli/README.md	+2 / -2
modified	ai	app/cli/cmd/root.go	+2 / -2
modified	ai	app/controlplane/api/gen/openapi/openapi-extra.yaml	+2 / -2
modified	ai	app/controlplane/api/gen/openapi/openapi.yaml	+2 / -2
modified	ai	extras/dagger/README.md	+2 / -2
modified	ai	app/cli/cmd/telemetry_report_test.go	+1 / -1
modified	ai	sbxenv.yaml	+1 / -1

---

Policies (4)

Status	Policy	Material	Messages
✅ Passed	ai-config-no-dangerous-commands	ai-coding-session-d94c7f	-
✅ Passed	ai-config-mcp-servers-allowed	ai-coding-session-d94c7f	-
✅ Passed	ai-config-ai-agents-allowed	ai-coding-session-d94c7f	-
✅ Passed	ai-config-no-secrets	ai-coding-session-d94c7f	-

Security Checks — ⚠️ 1 failing

✅ secret-scan

Status	Policy	Messages
✅ Passed	secrets-detection	-

✅ sast-scan

Status	Policy	Messages
✅ Passed	owasp-top10-2025	-
✅ Passed	sast	-
✅ Passed	cwe-top25	-
✅ Passed	cwe-top26-40-cusp	-

⚠️ iac-scan — 1 failing

Status	Policy	Messages
⚠️ Failed	iac-misconfiguration	Ensure that arrays have a maximum number of items in "app/controlplane/api/gen/openapi/openapi.yaml" (error) Ensure that the global security field has rules defined in "app/controlplane/api/gen/openapi/openapi-extra.yaml" (error) Ensure that the global security field has rules defined in "app/controlplane/api/gen/openapi/openapi.yaml" (error)

Scans not applied (2)

Scan	Reason
vulnerability-scan	no manifest/lockfile changed
github-actions-scan	no workflow files changed

_{View attestation ↗}

Security context

✅ Nothing this change touches has a recorded security-fix history.

_{View in Chainloop ↗ · How this works ↗}

---

Powered by Chainloop and Chainloop Trace

[cubic-dev-ai]

All reported issues were addressed across 10 files

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Re-trigger cubic</sub>

[migmartri]

@jiparis ptal