feat(controlplane): add dry-run and status/revision reporting to contract apply

[javirln]

Summary

Brings the WorkflowContract apply API to parity with the compliance resources by reporting the outcome of an apply (created, updated, or unchanged) together with the contract's current revision, and by supporting a dry run that validates and computes the result without persisting any change.

• Adds dry_run to the Apply request and an ApplyStatus enum plus current_revision to the Apply response, keeping the existing changed flag for backward compatibility.
• Adds change detection in the contract use case that reuses the existing data-layer rule to determine whether a revision would change, without persisting.
• Updates the Apply handler to report status and current revision and to support dry run for the create, update and unchanged cases.

This is the OSS-side change; the CLI --dry-run flag and status/revision display for contracts will be wired up in the platform repo after a release.

Linear: PFM-6429

AI disclosure

This contribution was produced with the assistance of Claude Code, disclosed via the Assisted-by: trailer on the commit.

[chainloop-platform]

AI Session Analysis

Avg score	Sessions	Failing policies	Attribution	Files	Lines	Total Duration
🟢 86%	1	✅ 0	100% AI / 0% Human	5	+341 / -5	26m14s

🟢 86% — 100% AI — ✅ All policies passing

Jun 18, 2026 03:59 UTC · 26m14s · $16.84 · 86.4k in / 164.3k out · claude-code 2.1.181 (claude-opus-4-8)

View session details ↗

Change Summary

• Adds dry_run, status, and current_revision support to workflow contract apply proto responses.
• Adds biz-layer revision-change detection reused from existing update behavior.
• Updates the service apply handler for create, update, unchanged, and dry-run flows.
• Adds biz and service integration tests covering revision changes and apply behavior.

AI Session Overall Score

🟢 86% — Strong implementation and verification, with only the final ship workflow left incomplete.

AI Session Analysis Breakdown

🟢 92% · scope-discipline

No notes.

🟢 91% · solution-quality

🟢 AI reused the existing change-detection rule instead of inventing a new shortcut. · High Impact

🟢 90% · context-and-planning

🟢 User front-loaded a detailed spec with constraints, file targets, and success criteria. · High Impact

🟢 90% · verification

🟢 AI watched the new biz test fail, then pass after implementing the fix. · High Impact

🟢 88% · user-trust-signal

No notes.

🟡 68% · alignment

🟠 AI accepted a commit, Linear, and PR workflow request, but the transcript ends after the signed commit. · Medium Severity

💡 When you accept a multi-step ship request, complete the whole sequence or explicitly stop and report what remains before the session ends.

---

File Attribution

████████████████████ 100% AI / 0% Human

Status	Attribution	File	Lines
created	ai	app/controlplane/internal/service/workflowcontract_integration_test.go	+197 / -0
modified	ai	app/controlplane/internal/service/workflowcontract.go	+46 / -3
modified	ai	app/controlplane/pkg/biz/workflowcontract_integration_test.go	+41 / -1
modified	ai	app/controlplane/pkg/biz/workflowcontract.go	+36 / -0
modified	ai	app/controlplane/api/controlplane/v1/workflow_contract.proto	+21 / -1

---

Policies (4)

Status	Policy	Material	Messages
✅ Passed	ai-config-ai-agents-allowed	ai-coding-session-5b6444	-
✅ Passed	ai-config-no-dangerous-commands	ai-coding-session-5b6444	-
✅ Passed	ai-config-no-secrets	ai-coding-session-5b6444	-
✅ Passed	ai-config-mcp-servers-allowed	ai-coding-session-5b6444	-

---

Powered by Chainloop and Chainloop Trace

[cubic-dev-ai]

No issues found across 11 files

_{Re-trigger cubic}