chainloop runs, with mocks standing in for external services. Argusic installed and launched it on a clean machine in 17 minutes, hitting 2 errors on the way, and recorded the session.

How did Argusic test chainloop?

On a fresh, disposable machine, with every command recorded and the repository pinned at commit 586d918d3e19. 2 attempts are recorded, and the full method is on the methodology page.

What did it cost to test chainloop?

The run that produced this verdict cost $0.10: real compute and model cost, not a list price per million tokens. It is recorded on that run's page.

How long does chainloop take to install?

17 minutes in the run that decided this verdict, from a clean machine to a running state. That is one measured attempt, not an average.

Does chainloop need a GPU?

Not to start. Argusic reached a running state on a machine with no GPU.

What goes wrong when installing chainloop?

2 things broke in the recorded run, and 1 were fixed without human help. Each one, and the time it cost, is listed on this page.

Where is the evidence for chainloop?

All 2 recorded runs are on this page, each linking to its full log and terminal recording, stored with a sha256 fingerprint so it cannot be quietly altered.

chainloop

Agentic SDLC infrastructure. Define guardrails. Collect signals. Enforce continuously. Signed records of what your AI coding agents and CI/CD pipelines did, checked against policies as code, with the loop closed in CI/CD. AI sessions, SBOMs, VEX, SARIF and SLSA provenance, built on Sigstore and in-toto. Apache 2.0.

Runs with mockssource: GitHub homepageGoApache-2.0commit 586d918d3e19

Go, Apache-2.0 licensed. The project labels itself: agentic sdlc, ai agents, ai governance, ai sessions, attestation, autonomous agents, coding agents and compliance.

chainloop runs, with stand-ins for the services it depends on. An Argusic agent installed it in 17 minutes and hit 2 errors on a clean machine with no GPU, and the whole session was recorded.

Chainloop CLI and both server components (controlplane, artifact-cas) compile and install. 71 of 76 test suites pass. The 5 failing suites require Docker/testcontainers which is unavailable. The installed CLI binary responds to --help and version commands.
What the agent ended up with on a clean machine, in its own words. How this is measured

Measured by Argusic on a fresh machine every time. Every number links to its evidence. Argusic Score 71 of 100 (the mean of this project's run scores).

At a glance

verdict: Runs with mocks
Argusic Score: 71 / 100
cost of the verifying run: $0.10 (measured)
recorded runs: 2
last tested: 2026-10-17
stars: 598
forks: 62
open issues: 30
watchers: 8
size: 62 MB
created: 2023-03-06
last push: 2026-10-17

Subject data from GitHub, linked at the top of this page, refreshed 2026-10-17. Test data by Argusic (CC BY 4.0); every number links to a run page with the full log, the recording, and their sha256 hashes.

What was measured

From the run that decided this verdict. Every line is a recorded value, not an estimate.

Time lost to each failure while testing chainloop, drawn from the recorded run — Every bar is a failure the agent recorded, with the time it cost. Drawn from this run, not from anywhere else.

What went wrong, in the agent's own words

The agent's own words, worst first, never rewritten into advice.

Go 1.27.1 not installed in container1 minute
5 test suites fail needing Docker: pkg/blobmanager/s3, pkg/credentials/manager, pkg/credentials/vault, app/controlplane/internal/usercontext, app/artifact-cas/internal/service1 minute

Install time: 17 minutes
Cold machine to finish: 16 minutes
Errors hit and fixed: 2 hit, 1 fixed with no human help
How the result was proved: go test for 71 package suites all passed; cli version returned 'Client Version: dev, Server Version: 1.125.0'
Model tokens used: 129,305
Exact commit tested: 586d918d3e19
Container image: sha256:cdd920bce783

What was not measured

The other half, so you can see exactly how far this evidence goes. A gap is printed as a gap and never filled in.

Peak GPU memory: this ran on a CPU machine, so there was no GPU to sample
Behaviour over a long run: each attempt uses the smallest documented settings and a fixed time budget, so this measures whether it runs, not how it holds up under load
Behaviour against real services: this run was verified against stand-in services only

The end of the recording

The last lines of the terminal session that decided this verdict, exactly as they were recorded.

5. **Ran 71 test suites**: all passing
6. **Identified 5 failing test suites** that require Docker/testcontainers (not available in this c…
tokens used
129,305
Now I have all the information needed to compile my final report. Let me put together the result.
**Summary of work done:**
1. **Install Go toolchain**: Downloaded Go 1.27.1 for Linux x86_64 since it wasn't installed in the…
2. **Built CLI binary**: `cli` binary (~182MB) installed at `~/.local/share/go/bin/cli`, responds t…
3. **Built artifact-cas binary**: `cmd` binary (~69MB) installed at `~/.local/share/go/bin/cmd`
4. **Built controlplane binary**: compiled successfully
5. **Ran 71 test suites**: all passing
6. **Identified 5 failing test suites** that require Docker/testcontainers (not available in this c…

Replay the whole session, every command from a clean machine to this point.

How it was tested

One agent, one container, no human help. It installs the project the way its own documentation says to, runs it, and fixes what breaks. Everything below is recorded as it happened: the terminal session, the log and the exact commit. The full method.

Strengths and limits

Measured facts, not opinions. How this is written.

What went well

Installed in 17 minutes.
Licensed Apache-2.0, as reported by its host.
Measured 2 times, so the result is not a one-off.

What did not, or is not known

Only reached a running state against stand-in services, so nothing here proves it works against the real ones.
Hit 2 errors during setup, 1 of which were not solved.

Also tested, in the same area

Every one of these was installed and run by Argusic on a clean machine. Nothing appears here that was not tested.

Run history

tested by	attempt	outcome	score	cost USD	when
Argusic Runner	2/3	Runs with mocks	82.00	0.10	2026-10-17 10:47 UTC
Argusic Runner	1/3	Unverified	60.00	0.10	2026-10-17 10:31 UTC

Embed the badge

Markdown for the project README. It links back here; terms on the terms page.

[![Tested by Argusic](https://argusic.com/badge/chainloop.svg)](https://argusic.com/subject/chainloop)

Questions

Does chainloop run?: chainloop runs, with mocks standing in for external services. Argusic installed and launched it on a clean machine in 17 minutes, hitting 2 errors on the way, and recorded the session.
How did Argusic test chainloop?: On a fresh, disposable machine, with every command recorded and the repository pinned at commit 586d918d3e19. 2 attempts are recorded, and the full method is on the methodology page.
What did it cost to test chainloop?: The run that produced this verdict cost $0.10: real compute and model cost, not a list price per million tokens. It is recorded on that run's page.
How long does chainloop take to install?: 17 minutes in the run that decided this verdict, from a clean machine to a running state. That is one measured attempt, not an average.
Does chainloop need a GPU?: Not to start. Argusic reached a running state on a machine with no GPU.
What goes wrong when installing chainloop?: 2 things broke in the recorded run, and 1 were fixed without human help. Each one, and the time it cost, is listed on this page.
Where is the evidence for chainloop?: All 2 recorded runs are on this page, each linking to its full log and terminal recording, stored with a sha256 fingerprint so it cannot be quietly altered.