[jiparis]

Implements milestone 2 of spec issue-3639 "Line ranges that point into the pushed code" (docs/specs/issue-3639-line-ranges.md), R-001 to R-005.

The line ranges of each file in the session evidence are now positions in the file at the pushed commit. Each range says if its lines are AI or human. The ranges cover the lines of the session that are still in the pushed code, so they agree with the net AI and human counts. Lines that another session of the same commit wrote get no range. A commit that joined the session adds human ranges only for the lines of its replacing hunks. A file that the pushed commit no longer holds has no ranges. A file with no blame keeps the AI ranges at edit time, with no attribution, as before. When a later commit replaces lines of a session, the session is sent again with ranges in the newer pushed commit.

The Trace README gets a "Line ranges" row, and the e2e suite gets a check for it.

Depends on #3664. Do not merge until a release includes #3664 (D-005). This PR holds the commit of #3664 too, because it targets main. Part of #3639.

AI disclosure: this change was written with the assistance of Claude Code.

🤖 Generated with Claude Code

[chainloop-platform]

PR validation — ✅ 3 passing

Status	Policy	Material	Messages
✅ Passed	pr-min-approvals	pr-info	-
✅ Passed	pr-description-required	pr-info	-
✅ Passed	pr-user-story-linked	pr-info	-

_{View attestation ↗}

AI Session Checks — 🟢 92% · ⚠️ 1 failing

Avg score	Sessions	Failing policies	Attribution	Files	Lines	Total Duration
🟢 92%	1	⚠️ 1	95% AI / 5% Human	9	+251 / -16	12h16m48s

🟢 92% — 95% AI — ⚠️ 1 policies failing

Oct 19, 2026 19:38 UTC · 12h16m48s · $8.93 · 276 in / 87.9k out · claude-code 2.1.303 (claude-opus-5-5)

_{View session details ↗}

Change Summary

• Opens the AI coding session schema so each line range can carry optional attribution.
• Records AI and human ranges at pushed-file positions in trace enrichment.
• Adds schema, attribution, action-level, and e2e coverage plus a README update for line ranges.

AI Session Overall Score

🟢 92% — Spec-driven session with broad validation; only the opening prompt was thin.

AI Session Analysis Breakdown

🟢 95% · scope-discipline

No notes.

🟢 94% · user-trust-signal

🟢 User approved the two-PR plan immediately after the implementation summary. · High Impact

🟢 93% · alignment

🟢 Shipped schema, CLI, README, and tests line up with the captured scope. · High Impact

🟢 92% · verification

🟢 Targeted and aggregate go test runs passed after the failing tests were fixed. · High Impact

🟢 91% · solution-quality

No notes.

🟢 86% · context-and-planning

🟠 Opening ask was one line for a multi-milestone spec and CLI change. · Medium Severity

💡 Front-load scope and success criteria when work spans spec, schema, CLI, tests, and docs.

---

File Attribution

███████████████████░ 95% AI / 5% Human

Status	Attribution	File	Lines
modified	ai	app/cli/pkg/action/trace_line_attribution_test.go	+91 / -0
modified	ai	internal/schemavalidators/schemavalidators_test.go	+55 / -5
modified	ai	app/cli/internal/trace/attribution/enrich_test.go	+40 / -6
modified	ai	app/cli/internal/trace/attribution/enrich.go	+31 / -4
modified	ai	app/cli/internal/trace/e2e/checks_more.go	+23 / -0
modified	ai	internal/schemavalidators/internal_schemas/aicodingsession/ai-coding-session-0.1.schema.json	+4 / -0
modified	ai	pkg/attestation/crafter/materials/aicodingsession/aicodingsession.go	+4 / -0
modified	ai	app/cli/internal/trace/README.md	+2 / -1
modified	ai	app/cli/internal/trace/e2e/checks.go	+1 / -0

---

Policies (5, 1 failing)

Status	Policy	Material	Messages
⚠️ Failed	ai-session-no-auto-pr	ai-coding-session-9d041a	Pull request opened without human approval (auto-approved: source=config, reason=subcommandResults): gh api repos/chainloop-dev/chainloop/pulls/3664/comments/4318142957/replies -X POST -F body=@/private/tmp/claude-501/-Users-jiparis-projects-chainloop/9d041a37-... Pull request opened without human approval (auto-approved: source=config, reason=subcommandResults): gh pr create --draft --repo chainloop-dev/chainloop --base main --head jiparis:feat/trace-line-ranges --title "feat(trace): line ranges that point into the push... Pull request opened without human approval (auto-approved: source=config, reason=subcommandResults): gh pr create --repo chainloop-dev/chainloop --base main --head jiparis:feat/trace-line-ranges-schema --title "feat(trace): allow an attribution on each line ran...
✅ Passed	ai-config-ai-agents-allowed	ai-coding-session-9d041a	-
✅ Passed	ai-config-no-dangerous-commands	ai-coding-session-9d041a	-
✅ Passed	ai-config-no-secrets	ai-coding-session-9d041a	-
✅ Passed	ai-config-mcp-servers-allowed	ai-coding-session-9d041a	-

Security Checks — ✅ 5 passing

✅ secret-scan

Status	Policy	Messages
✅ Passed	secrets-detection	-

✅ sast-scan

Status	Policy	Messages
✅ Passed	owasp-top10-2025	-
✅ Passed	cwe-top25	-
✅ Passed	sast	-
✅ Passed	cwe-top26-40-cusp	-

Scans not applied (3)

Scan	Reason
vulnerability-scan	no manifest/lockfile changed
github-actions-scan	no workflow files changed
iac-scan	no IaC files changed

_{View attestation ↗}

Security context

✅ Nothing this change touches has a recorded security-fix history.

_{View in Chainloop ↗ · How this works ↗}

---

Powered by Chainloop and Chainloop Trace

[cubic-dev-ai]

All reported issues were addressed across 9 files

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Re-trigger cubic</sub>