feat: add CHECKMARX_JSON material type

[javirln]

Adds support for ingesting Checkmarx One native JSON reports (the ast-cli ScanResultsCollection produced by cx ... --report-format json) as a new CHECKMARX_JSON material type.

Unlike the existing SARIF ingestion path, the native format preserves fields SARIF drops — the triage state, similarityId, Checkmarx query metadata, and CVSS/CWE details — which lets policies act on already-triaged findings. A single report can bundle multiple engines (SAST, SCA, KICS, containers, secrets), distinguished per result by type.

The crafter validates the report structure (top-level scanID and a results key, plus a type and data payload on each result) to reject look-alike JSON, accepts clean scans where results is empty or null, and records the report verbatim for policy evaluation. The kind is omitted from auto-detection and must be referenced with an explicit --kind CHECKMARX_JSON.

Assisted-by: Claude Code

[chainloop-platform]

AI Session Analysis

Avg score	Sessions	Failing policies	Attribution	Files	Lines	Total Duration
🟢 86%	1	✅ 0	48% AI / 52% Human	9	+603 / -2	46m6s

🟢 86% — 48% AI — ✅ All policies passing

Jul 15, 2026 09:24 UTC · 46m6s · $27.80 · 527 in / 228.9k out · claude-code 2.1.210 (claude-opus-4-8)

View session details ↗

Change Summary

• Adds a new CHECKMARX_JSON material type and wires it into crafting dispatch and schema generation.
• Adds a dedicated crafter, real Checkmarx-based fixtures, and tests for mixed-engine and empty-report cases.
• Rebases the feature onto main, renumbers the enum, and trims internal design-doc commits from the final branch.

AI Session Overall Score

🟢 86% — Strong implementation and verification; session stopped before the requested PR-open step.

AI Session Analysis Breakdown

🟢 93% · solution-quality

🟢 AI found the valid results:null case and fixed the parser at the right layer. · High Impact

🟢 92% · context-and-planning

No notes.

🟢 91% · scope-discipline

🟢 AI dropped the two internal spec commits so the final branch stayed feature-focused. · High Impact

🟢 90% · verification

🟢 AI reran targeted tests, full package tests, build, lint, and formatting after risky changes. · High Impact

🟢 88% · user-trust-signal

No notes.

🟡 65% · alignment

🟠 User asked to open a PR, but the session stops after rebasing and re-signing the feature commit. · Medium Severity

💡 When a request includes ship steps, either run them or explicitly say why you stopped.

---

File Attribution

█████████░░░░░░░░░░░ 48% AI / 52% Human

Status	Attribution	File	Lines
created	human	pkg/attestation/crafter/materials/testdata/checkmarx.json	+299 / -0
created	ai	pkg/attestation/crafter/materials/checkmarx_test.go	+154 / -0
created	ai	pkg/attestation/crafter/materials/checkmarx.go	+129 / -0
created	human	pkg/attestation/crafter/materials/testdata/checkmarx-clean.json	+5 / -0
created	human	pkg/attestation/crafter/materials/testdata/checkmarx-null-results.json	+5 / -0
modified	human	app/cli/documentation/cli-reference.mdx	+2 / -2
modified	ai	app/controlplane/api/workflowcontract/v1/crafting_schema_validations.go	+4 / -0
modified	ai	app/controlplane/api/workflowcontract/v1/crafting_schema.proto	+3 / -0
modified	ai	pkg/attestation/crafter/materials/materials.go	+2 / -0

---

Policies (4)

Status	Policy	Material	Messages
✅ Passed	ai-config-ai-agents-allowed	ai-coding-session-239907	-
✅ Passed	ai-config-no-dangerous-commands	ai-coding-session-239907	-
✅ Passed	ai-config-no-secrets	ai-coding-session-239907	-
✅ Passed	ai-config-mcp-servers-allowed	ai-coding-session-239907	-

---

Powered by Chainloop and Chainloop Trace

[cubic-dev-ai]

No issues found across 23 files

_{Re-trigger cubic}

[migmartri]

Thanks