fix(cli): stop printing repository config lookup debug line

[migmartri]

Attestation commands (init, add, push, status, reset) printed DBG failed to load repository organization error=".chainloop.yml not found" on every run in a repository without a .chainloop.yml, even without --debug. The attestation command resolved the repository organization before the root command set the log level, so the debug line went through a logger with no level set.

Changes:

• The attestation PersistentPreRunE sets the log level before it resolves the organization, so anything logged there honors --debug.
• A missing .chainloop.yml is the normal case and is no longer logged at any level.
• A .chainloop.yml that exists but cannot be loaded (for example, invalid YAML) is now logged as a warning.

The issue proposed calling the organization lookup after the root PersistentPreRunE. That order would break organization resolution from .chainloop.yml: the root hook reads the resolved organization to build the control plane connection (and to decide whether to fetch and save a default organization). So the call order is kept and only the log level is set earlier.

Tested with a new table-driven test that runs the attestation PersistentPreRunE with an unleveled logger, as seeded by main.go: no output for a missing file (with and without --debug), a warning for an invalid file, and the expected log level afterwards. Both guards were mutation-checked. Existing organization resolution tests pass unchanged.

AI disclosure: this change was produced with Claude Code.

Fixes #3592

🤖 Posted by Maximus bot (Claude Code) on behalf of @migmartri using the eng-autopilot skill

[chainloop-platform]

PR validation — ✅ 3 passing

Status	Policy	Material	Messages
✅ Passed	pr-min-approvals	pr-info	-
✅ Passed	pr-description-required	pr-info	-
✅ Passed	pr-user-story-linked	pr-info	-

_{View attestation ↗}

AI Session Checks — 🟡 81% · ✅ 0 failing

Avg score	Sessions	Failing policies	Attribution	Files	Lines	Total Duration
🟡 81%	1	✅ 0	100% AI / 0% Human	3	+71 / -5	20m52s

🟡 81% — 100% AI — ✅ All policies passing

Oct 9, 2026 15:58 UTC · 20m52s · $5.75 · 228 in / 45.4k out · claude-code 2.1.295 (claude-opus-5-5)

_{View session details ↗}

Change Summary

• Updates attestation CLI logging so a missing .chainloop.yml stays silent and invalid config warns.
• Extends CLI tests around repository-config lookup logging and logger initialization.
• Applies the same missing-file quieting to attestation init after PR review.

AI Session Overall Score

🟡 81% — Strong session, but an initial overclaim and missing user confirmation merit review.

AI Session Analysis Breakdown

🟢 92% · scope-discipline

No notes.

🟢 90% · context-and-planning

🟢 The opening brief provided file targets, acceptance criteria, and workflow constraints. · High Impact

🟢 89% · solution-quality

🟢 AI fixed the root cause without bypassing checks or weakening tests. · High Impact

🟢 88% · user-trust-signal

No notes.

🟡 74% · verification

🟢 The follow-up patch finished with go test . and lint both clean. · High Impact

🟠 Automated tests passed, but no user confirmed the final behavior after the review-driven follow-up. · Medium Severity

💡 After a follow-up patch, capture a concrete confirmation before declaring the session finished.

🟡 64% · alignment

🟠 The AI chose a different mechanism than requested and initially overclaimed that all attestation commands were fixed. · Medium Severity

💡 When you reject a prescribed implementation, confirm the alternative and re-check every acceptance path before opening the PR.

---

File Attribution

████████████████████ 100% AI / 0% Human

Status	Attribution	File	Lines
modified	ai	app/cli/cmd/attestation_test.go	+55 / -1
modified	ai	app/cli/cmd/attestation.go	+12 / -2
modified	ai	app/cli/cmd/attestation_init.go	+4 / -2

---

Policies (4)

Status	Policy	Material	Messages
✅ Passed	ai-config-ai-agents-allowed	ai-coding-session-256841	-
✅ Passed	ai-config-no-dangerous-commands	ai-coding-session-256841	-
✅ Passed	ai-config-no-secrets	ai-coding-session-256841	-
✅ Passed	ai-config-mcp-servers-allowed	ai-coding-session-256841	-

Security Checks — ✅ 5 passing

✅ secret-scan

Status	Policy	Messages
✅ Passed	secrets-detection	-

✅ sast-scan

Status	Policy	Messages
✅ Passed	owasp-top10-2025	-
✅ Passed	sast	-
✅ Passed	cwe-top25	-
✅ Passed	cwe-top26-40-cusp	-

Scans not applied (3)

Scan	Reason
vulnerability-scan	no manifest/lockfile changed
github-actions-scan	no workflow files changed
iac-scan	no IaC files changed

_{View attestation ↗}

Security context

✅ Nothing this change touches has a recorded security-fix history.

_{View in Chainloop ↗ · How this works ↗}

---

Powered by Chainloop and Chainloop Trace

[cubic-dev-ai]

No issues found across 2 files

_{View guided diff | Re-trigger cubic}

[matiasinsaurralde]

LGTM