spec: issue-3639 Line attribution that survives later edits

[jiparis]

Summary

Chainloop Trace reports, for each file in an AI coding session, how many lines the AI wrote and how many a human wrote. Today this split is wrong when a human changes AI-written lines later. The CLI records AI line ranges at edit time and never updates them.

This spec changes the CLI to attribute each line to its last writer. The CLI then reports the net contribution of each session: the lines it added that no later commit replaced. When a later commit replaces lines of a session, the CLI sends that session's evidence again with the new numbers. A commit outside any session that replaces lines of a session joins that session as human work. The platform then stores the CLI split for each file.

Spec: docs/specs/issue-3639-trace-line-attribution.md

Open questions for reviewers

• How long does the CLI keep the trace state (ledger and commit records) of a pushed session? Proposed: 30 days at most, and only while a local branch can reach the session's commits. After that, a replacement of these lines does not update the session.

We would like two reviewers to approve this spec before it merges.

Refs #3639

AI disclosure: Claude Code helped to research and draft this spec.

[chainloop-platform]

PR validation — ✅ 3 passing

Status	Policy	Material	Messages
✅ Passed	pr-min-approvals	pr-info	-
✅ Passed	pr-description-required	pr-info	-
✅ Passed	pr-user-story-linked	pr-info	-

_{View attestation ↗}

AI Session Checks — 🟡 81% · ⚠️ 1 failing

Avg score	Sessions	Failing policies	Attribution	Files	Lines	Total Duration
🟡 81%	1	⚠️ 1	100% AI / 0% Human	1	+256 / -13	6h52m22s

🟡 81% — 100% AI — ⚠️ 1 policies failing

Oct 16, 2026 09:53 UTC · 6h52m22s · $14.14 · 456 in / 140.8k out · claude-code 2.1.301 (claude-opus-5-5)

_{View session details ↗}

Change Summary

• Drafts and iterates a design spec for issue-3639 line attribution.
• Opens the spec PR, addresses review comments, and posts review replies.
• Adds generated-lines tracking text and reorders R-011 at the end of requirements.

AI Session Overall Score

🟡 81% — Strong spec work with mild process friction and a late unconfirmed final edit.

AI Session Analysis Breakdown

🟢 92% · scope-discipline

🟢 Edits stayed on the requested spec, PR metadata, and review replies. · High Impact

🟢 88% · solution-quality

🟢 Reviewer-raised contradictions were fixed in the spec instead of papered over. · High Impact

🟡 78% · context-and-planning

🟢 AI split discovery across parallel research tracks before drafting. · High Impact

🟠 No written plan or todo list was captured for a long research, drafting, PR, and review workflow. · Medium Severity

💡 For multi-stage spec work, write a short plan before drafting so review loops have a visible map.

🟡 74% · alignment

🟠 The final reorder request ended with a missing command result, so the session never explicitly confirmed it shipped. · Medium Severity

💡 After a late user correction, close with a clear success or failure message before ending.

🟡 72% · user-trust-signal

🟠 The user re-explained several design details and requested review-driven changes, signaling mild friction but continued engagement. · Medium Severity

💡 When the user refines requirements repeatedly, pause and restate the new contract before more edits.

abstained · verification

No notes.

---

File Attribution

████████████████████ 100% AI / 0% Human

Status	Attribution	File	Lines
modified	ai	docs/specs/issue-3639-trace-line-attribution.md	+256 / -13

---

Policies (5, 1 failing)

Status	Policy	Material	Messages
⚠️ Failed	ai-session-no-auto-pr	ai-coding-session-36ae65	Pull request opened without human approval (auto-approved: source=config, reason=subcommandResults): gh pr create --repo chainloop-dev/chainloop --base main --head jiparis:issue-3639-spec-trace-line-attribution --title "spec: issue-3639 Line attribution that su...
✅ Passed	ai-config-ai-agents-allowed	ai-coding-session-36ae65	-
✅ Passed	ai-config-no-dangerous-commands	ai-coding-session-36ae65	-
✅ Passed	ai-config-no-secrets	ai-coding-session-36ae65	-
✅ Passed	ai-config-mcp-servers-allowed	ai-coding-session-36ae65	-

Security Checks — ✅ 5 passing

✅ secret-scan

Status	Policy	Messages
✅ Passed	secrets-detection	-

✅ sast-scan

Status	Policy	Messages
✅ Passed	owasp-top10-2025	-
✅ Passed	sast	-
✅ Passed	cwe-top25	-
✅ Passed	cwe-top26-40-cusp	-

Scans not applied (3)

Scan	Reason
vulnerability-scan	no manifest/lockfile changed
github-actions-scan	no workflow files changed
iac-scan	no IaC files changed

_{View attestation ↗}

Security context

✅ Nothing this change touches has a recorded security-fix history.

_{View in Chainloop ↗ · How this works ↗}

---

Powered by Chainloop and Chainloop Trace

[cubic-dev-ai]

All reported issues were addressed across 1 file

<sub>Heads up: you’ve reached your flex budget. Increase your flex budget or wait for usage to reset.

View guided diff | Re-trigger cubic</sub>