spec: issue-3639 Line ranges that point into the pushed code

[jiparis]

Summary

Each file entry of the Chainloop Trace session evidence has a list of line ranges. Today these ranges are the positions that each agent edit wrote, at the time of the edit. The CLI never adjusts them, so they do not point into any version of the file that a reader can open. This spec changes the ranges to point into the file at the pushed commit. Each range also gets an attribution, AI or human. A viewer can then mark the lines of a session in the pushed code.

This spec builds on the net contribution of docs/specs/issue-3639-trace-line-attribution.md and ships after its milestone 2.

Open questions for reviewers

None. The rollout order is in D-005 (open the schema one release before the CLI writes the property) and D-006 (the CLI writes attributed ranges before the platform reads them).

We would like two reviewers to approve this spec before it merges.

Refs #3639

AI disclosure: this spec was drafted with the assistance of Claude Code.

🤖 Generated with Claude Code

[chainloop-platform]

PR validation — ✅ 3 passing

Status	Policy	Material	Messages
✅ Passed	pr-min-approvals	pr-info	-
✅ Passed	pr-description-required	pr-info	-
✅ Passed	pr-user-story-linked	pr-info	-

_{View attestation ↗}

AI Session Checks — 🟢 90% · ⚠️ 1 failing

Avg score	Sessions	Failing policies	Attribution	Files	Lines	Total Duration
🟢 90%	1	⚠️ 1	100% AI / 0% Human	1	+161 / -7	4h44m57s

🟢 90% — 100% AI — ⚠️ 1 policies failing

Oct 19, 2026 07:47 UTC · 4h44m57s · $43.93 · 878 in / 519.4k out · claude-code 2.1.303 (claude-opus-5-5)

_{View session details ↗}

Change Summary

• Adds docs/specs/issue-3639-line-ranges.md as a follow-up design spec for pushed-code ranges.
• Defines attributed AI and human ranges in the pushed commit while keeping legacy line_ranges compatible.
• Incorporates review-driven clarifications on blame scope, milestone order, and joined-commit human ranges.

AI Session Overall Score

🟢 90% — Spec follow-up is aligned and tightly scoped, with implementation lanes inapplicable.

AI Session Analysis Breakdown

🟢 96% · scope-discipline

🟢 Only the requested follow-up spec file landed. · High Impact

🟢 92% · alignment

No notes.

🟢 88% · user-trust-signal

🟢 The user approved the draft and review fixes without friction. · Medium Impact

🟢 84% · context-and-planning

🟢 The AI surfaced review changes and sought approval before revising. · High Impact

abstained · solution-quality

🟡 Solution quality was not assessed because no implementation change landed in this PR. · Low Severity

abstained · verification

🟡 Verification was not assessed because the final diff is spec-only with no runtime behavior. · Low Severity

Missing criteria: solution-quality, verification

---

File Attribution

████████████████████ 100% AI / 0% Human

Status	Attribution	File	Lines
modified	ai	docs/specs/issue-3639-line-ranges.md	+161 / -7

---

Policies (5, 1 failing)

Status	Policy	Material	Messages
⚠️ Failed	ai-session-no-auto-pr	ai-coding-session-813121	Pull request opened without human approval (auto-approved: source=config, reason=subcommandResults): gh api repos/chainloop-dev/chainloop/pulls/3649/comments/4312067305/replies -X POST -f body="Fixed in 5d9671a: LoadShellPreHeads returns its error. The post ho... Pull request opened without human approval (auto-approved: source=config, reason=subcommandResults): gh api repos/chainloop-dev/chainloop/pulls/3650/comments/4312780540/replies -X POST -f body="Fixed in f38f027: D-006 now ties the write to the attributed-range... Pull request opened without human approval (auto-approved: source=config, reason=subcommandResults): gh api repos/chainloop-dev/chainloop/pulls/3650/comments/4313530527/replies -X POST -f body="Fixed in d6160d1: the Positions step now matches the session's own... Pull request opened without human approval (auto-approved: source=config, reason=subcommandResults): gh pr create --repo chainloop-dev/chainloop --base main --head jiparis:feat/trace-line-attribution-m1 --title "feat(trace): attribute lines to their last writer... Pull request opened without human approval (auto-approved: source=config, reason=subcommandResults): gh pr create --repo chainloop-dev/chainloop --base main --head jiparis:issue-3639-spec-line-ranges --title "spec: issue-3639 Line ranges that point into the pus...
✅ Passed	ai-config-ai-agents-allowed	ai-coding-session-813121	-
✅ Passed	ai-config-no-dangerous-commands	ai-coding-session-813121	-
✅ Passed	ai-config-no-secrets	ai-coding-session-813121	-
✅ Passed	ai-config-mcp-servers-allowed	ai-coding-session-813121	-

Security Checks — ✅ 5 passing

✅ secret-scan

Status	Policy	Messages
✅ Passed	secrets-detection	-

✅ sast-scan

Status	Policy	Messages
✅ Passed	owasp-top10-2025	-
✅ Passed	sast	-
✅ Passed	cwe-top25	-
✅ Passed	cwe-top26-40-cusp	-

Scans not applied (3)

Scan	Reason
vulnerability-scan	no manifest/lockfile changed
github-actions-scan	no workflow files changed
iac-scan	no IaC files changed

_{View attestation ↗}

Security context

✅ Nothing this change touches has a recorded security-fix history.

_{View in Chainloop ↗ · How this works ↗}

---

Powered by Chainloop and Chainloop Trace

[cubic-dev-ai]

All reported issues were addressed across 1 file

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 1 file (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 1 file (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Re-trigger cubic</sub>