spec: issue-3543 Existence cache in the Artifact CAS

[migmartri]

Adds Spec issue-3543: an existence cache in the Artifact CAS.

When an upload starts for evidence that is already in storage, the Artifact CAS reads the backend credentials from the secrets manager and builds a new storage client. Then it asks the backend if the blob exists. Nothing is cached today. This spec adds a cache of positive existence results, with a namespace for each organization and backend, and a short-lived in-memory cache of storage clients. Repeated uploads of the same evidence, from chainloop attestation add or from the trace push, then complete with no call to the secrets manager or the storage backend. The cache uses NATS KV when the CAS has a NATS connection, and an in-memory LRU cache otherwise. The CLI and the API do not change.

Open questions for reviewers: none at drafting time. Decisions D-001 to D-009 record the choices and the rejected options. Please challenge any of them.

Refs #3543

This spec was written with AI assistance (Claude Code).

[chainloop-platform]

PR validation — ⚠️ 1 failing

Status	Policy	Material	Messages
⚠️ Failed	pr-min-approvals	pr-info	PR/MR #3544 has 0 approving reviews, 1 required.
✅ Passed	pr-description-required	pr-info	-
✅ Passed	pr-user-story-linked	pr-info	-

_{View attestation ↗}

AI Session Checks — 🟢 92% · ✅ 0 failing

Avg score	Sessions	Failing policies	Attribution	Files	Lines	Total Duration
🟢 92%	1	✅ 0	100% AI / 0% Human	2	+131 / -2	24h31m0s

🟢 92% — 100% AI — ✅ All policies passing

Oct 7, 2026 09:36 UTC · 24h31m0s · $8.27 · 304 in / 58.0k out · claude-code 2.1.292 (claude-opus-5-5)

_{View session details ↗}

Change Summary

• Drafts docs/specs/003-cas-existence-cache.md for CAS existence-result caching.
• Proposes org/backend-scoped cache keys, tenant namespace, and short-lived in-memory client reuse.
• Records decisions on 24h TTL, uncached Describe, and NATS KV vs in-memory fallback.
• Creates parent GitHub issue #3543 and prepares a spec-only PR branch.

AI Session Overall Score

🟢 92% — Focused spec-writing session; quality and verification abstained because no code changed.

AI Session Analysis Breakdown

🟢 94% · context-and-planning

🟢 AI researched current behavior and asked structured tradeoff questions before drafting. · High Impact

🟢 92% · alignment

🟢 AI applied the tenant-namespace follow-up directly to named spec sections. · High Impact

🟢 91% · user-trust-signal

🟢 The session ended with 'create a pr,' signaling acceptance of the spec. · High Impact

🟢 90% · scope-discipline

No notes.

abstained · solution-quality

No notes.

abstained · verification

🟡 Solution-quality and verification abstained because the session only drafted a spec file. · Low Severity

Missing criteria: solution-quality, verification

---

File Attribution

████████████████████ 100% AI / 0% Human

Status	Attribution	File	Lines
created	ai	docs/specs/003-cas-existence-cache.md	+129 / -0
modified	ai	docs/specs/issue-3543-cas-existence-cache.md	+2 / -2

---

Policies (4)

Status	Policy	Material	Messages
✅ Passed	ai-config-ai-agents-allowed	ai-coding-session-ab0219	-
✅ Passed	ai-config-no-dangerous-commands	ai-coding-session-ab0219	-
✅ Passed	ai-config-no-secrets	ai-coding-session-ab0219	-
✅ Passed	ai-config-mcp-servers-allowed	ai-coding-session-ab0219	-

Security Checks — ✅ 5 passing

✅ secret-scan

Status	Policy	Messages
✅ Passed	secrets-detection	-

✅ sast-scan

Status	Policy	Messages
✅ Passed	owasp-top10-2025	-
✅ Passed	sast	-
✅ Passed	cwe-top25	-
✅ Passed	cwe-top26-40-cusp	-

Scans not applied (3)

Scan	Reason
vulnerability-scan	no manifest/lockfile changed
github-actions-scan	no workflow files changed
iac-scan	no IaC files changed

_{View attestation ↗}

Security context

✅ Nothing this change touches has a recorded security-fix history.

_{View in Chainloop ↗ · How this works ↗}

---

Powered by Chainloop and Chainloop Trace

[migmartri]

Heads up: the spec naming convention changed. Specs are now named after their parent GitHub issue instead of a sequential number, because parallel spec PRs kept taking the same number.

Please rename this spec before merging:

• File: docs/specs/issue-3543-cas-existence-cache.md
• Heading: # Spec issue-3543: Existence cache in the Artifact CAS
• PR title: spec: issue-3543 Existence cache in the Artifact CAS

Existing specs on main are being renamed in #3545.

🤖 Posted by Maximus bot (Claude Code) on behalf of @migmartri

[migmartri]

Renamed: the file is now docs/specs/issue-3543-cas-existence-cache.md, the heading is # Spec issue-3543: ..., and the PR title is updated (db18793).