[jiparis]

Implements milestone 1 of spec issue-3639 "Line ranges that point into the pushed code" (docs/specs/issue-3639-line-ranges.md), D-005.

The AI coding session schema now lets each line range carry an optional attribution property, ai or human. The Go type gets the same field. The CLI does not write the property yet. A later release writes it, so readers that check evidence against their own copy of the schema can take the new schema first.

Part of #3639. The follow-up PR that writes the attributed ranges depends on a release with this change.

AI disclosure: this change was written with the assistance of Claude Code.

🤖 Generated with Claude Code

[chainloop-platform]

PR validation — ✅ 3 passing

Status	Policy	Material	Messages
✅ Passed	pr-description-required	pr-info	-
✅ Passed	pr-min-approvals	pr-info	-
✅ Passed	pr-user-story-linked	pr-info	-

_{View attestation ↗}

AI Session Checks — 🟢 92% · ⚠️ 1 failing

Avg score	Sessions	Failing policies	Attribution	Files	Lines	Total Duration
🟢 92%	1	⚠️ 1	95% AI / 5% Human	9	+251 / -16	12h16m48s

🟢 92% — 95% AI — ⚠️ 1 policies failing

Oct 19, 2026 19:38 UTC · 12h16m48s · $8.93 · 276 in / 87.9k out · claude-code 2.1.303 (claude-opus-5-5)

_{View session details ↗}

Change Summary

• Opens the AI coding session schema so each line range can carry optional attribution.
• Records AI and human ranges at pushed-file positions in trace enrichment.
• Adds schema, attribution, action-level, and e2e coverage plus a README update for line ranges.

AI Session Overall Score

🟢 92% — Spec-driven session with broad validation; only the opening prompt was thin.

AI Session Analysis Breakdown

🟢 95% · scope-discipline

No notes.

🟢 94% · user-trust-signal

🟢 User approved the two-PR plan immediately after the implementation summary. · High Impact

🟢 93% · alignment

🟢 Shipped schema, CLI, README, and tests line up with the captured scope. · High Impact

🟢 92% · verification

🟢 Targeted and aggregate go test runs passed after the failing tests were fixed. · High Impact

🟢 91% · solution-quality

No notes.

🟢 86% · context-and-planning

🟠 Opening ask was one line for a multi-milestone spec and CLI change. · Medium Severity

💡 Front-load scope and success criteria when work spans spec, schema, CLI, tests, and docs.

---

File Attribution

███████████████████░ 95% AI / 5% Human

Status	Attribution	File	Lines
modified	ai	app/cli/pkg/action/trace_line_attribution_test.go	+91 / -0
modified	ai	internal/schemavalidators/schemavalidators_test.go	+55 / -5
modified	ai	app/cli/internal/trace/attribution/enrich_test.go	+40 / -6
modified	ai	app/cli/internal/trace/attribution/enrich.go	+31 / -4
modified	ai	app/cli/internal/trace/e2e/checks_more.go	+23 / -0
modified	ai	internal/schemavalidators/internal_schemas/aicodingsession/ai-coding-session-0.1.schema.json	+4 / -0
modified	ai	pkg/attestation/crafter/materials/aicodingsession/aicodingsession.go	+4 / -0
modified	ai	app/cli/internal/trace/README.md	+2 / -1
modified	ai	app/cli/internal/trace/e2e/checks.go	+1 / -0

---

Policies (5, 1 failing)

Status	Policy	Material	Messages
⚠️ Failed	ai-session-no-auto-pr	ai-coding-session-9d041a	Pull request opened without human approval (auto-approved: source=config, reason=subcommandResults): gh api repos/chainloop-dev/chainloop/pulls/3664/comments/4318142957/replies -X POST -F body=@/private/tmp/claude-501/-Users-jiparis-projects-chainloop/9d041a37-... Pull request opened without human approval (auto-approved: source=config, reason=subcommandResults): gh pr create --draft --repo chainloop-dev/chainloop --base main --head jiparis:feat/trace-line-ranges --title "feat(trace): line ranges that point into the push... Pull request opened without human approval (auto-approved: source=config, reason=subcommandResults): gh pr create --repo chainloop-dev/chainloop --base main --head jiparis:feat/trace-line-ranges-schema --title "feat(trace): allow an attribution on each line ran...
✅ Passed	ai-config-ai-agents-allowed	ai-coding-session-9d041a	-
✅ Passed	ai-config-no-dangerous-commands	ai-coding-session-9d041a	-
✅ Passed	ai-config-no-secrets	ai-coding-session-9d041a	-
✅ Passed	ai-config-mcp-servers-allowed	ai-coding-session-9d041a	-

Security Checks — ✅ 6 passing

✅ secret-scan

Status	Policy	Messages
✅ Passed	secrets-detection	-

✅ sast-scan

Status	Policy	Messages
✅ Passed	cwe-top26-40-cusp	-
✅ Passed	owasp-top10-2025	-
✅ Passed	sast	-
✅ Passed	cwe-top25	-

✅ iac-scan

Status	Policy	Messages
✅ Passed	iac-misconfiguration	-

Scans not applied (2)

Scan	Reason
vulnerability-scan	no manifest/lockfile changed
github-actions-scan	no workflow files changed

_{View attestation ↗}

Security context

✅ Nothing this change touches has a recorded security-fix history.

_{View in Chainloop ↗ · How this works ↗}

---

Powered by Chainloop and Chainloop Trace

[cubic-dev-ai]

All reported issues were addressed across 3 files

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Re-trigger cubic</sub>