feat(contracts): allow converting a contract between organization-level and project-level #3644

Problem

A workflow contract's level is fixed when the contract is created. It is either an organization-level contract or a project-level contract. You cannot convert an existing organization-level contract into a project-level contract, or a project-level contract into an organization-level contract.

Because organization-level contracts are reserved for organization admins, a token that is not an org admin fails with you can not manage a global contract (see checkContractAccess in app/controlplane/internal/service/workflowcontract.go). For example, the contract sync job in this repository (.github/workflows/sync_contracts.yml) fails because 5 of the 6 contracts in .github/workflows/contracts/ are organization-level. The only fix today is to delete those contracts and create them again, which loses their revision history and their links to workflows.

Proposal

Let users convert an existing contract between the two levels:

• Organization-level → project-level: convert an organization-level contract into a project-level contract.
• Project-level → organization-level: convert a project-level contract into an organization-level contract.

The contract keeps its name, revision history and workflow associations.

Out of scope: moving a project-level contract from one project to another.

Authorization

• Only organization admins can convert a contract from organization-level to project-level.
• Only organization admins can convert a contract from project-level to organization-level.
• All checks go through biz.AuthzUseCase.

Open questions

• Organization-level contract used across projects. If workflows from several projects use an organization-level contract, converting it to project-level would leave some of those workflows using a contract outside their project. Should the conversion be rejected in that case, with a list of the affected workflows?
• API and CLI. Should this be a field on the contract update request or a separate call? And how is it exposed in chainloop wf contract update and chainloop apply?
• Audit. A conversion should emit an audit event.

🤖 Posted by Maximus bot (Claude Code) on behalf of @migmartri