@prism-d1/cli 1.0.77 → 1.0.79

package/dist/assets/infra/bin/app.ts

@@ -41,6 +41,7 @@ const apiStack = new ApiStack(app, 'PrismD1Api', {
 const dashboardStack = new DashboardStack(app, 'PrismD1Dashboard', {
   env,
   description: 'PRISM D1 Velocity - CloudWatch dashboards and alarms',
+  productivityWidgetArn: pipelineStack.otelCollector?.productivityWidgetArn,
   tags: {
     'prism:project': 'PRISM',
     'prism:domain': 'D1-Velocity',

package/dist/assets/infra/lib/constructs/otel-collector-construct.ts

@@ -54,6 +54,8 @@ export class OtelCollectorConstruct extends Construct {
   public readonly archiveBucket: s3.Bucket;
   public readonly userPool?: cognito.UserPool;
   public readonly userPoolClient?: cognito.UserPoolClient;
+  /** ARN of the CloudWatch custom-widget Lambda (Developer Productivity table). */
+  public productivityWidgetArn?: string;
 
   constructor(scope: Construct, id: string, props: OtelCollectorConstructProps) {
     super(scope, id);
@@ -197,6 +199,62 @@ export class OtelCollectorConstruct extends Construct {
     this.archiveBucket.grantPut(receiver);
     props.kmsKey.grantEncryptDecrypt(receiver);
 
+    // -------------------------------------------------------
+    // CloudWatch Custom Widget: Developer Productivity
+    // Invoked by CloudWatch dashboards with the VIEWING user's IAM creds
+    // (access = lambda:InvokeFunction on this function). Delegates
+    // aggregation to the receiver's /v1/productivity handler via direct
+    // invoke so there is a single aggregation implementation.
+    // -------------------------------------------------------
+    const productivityWidget = new lambda.Function(this, 'ProductivityWidget', {
+      functionName: 'prism-d1-productivity-widget',
+      runtime: lambda.Runtime.NODEJS_22_X,
+      handler: 'productivity-widget.handler',
+      code: lambda.Code.fromAsset(path.join(__dirname, '..', 'lambda'), {
+        bundling: {
+          image: lambda.Runtime.NODEJS_22_X.bundlingImage,
+          command: [
+            'bash', '-c',
+            [
+              'npm init -y > /dev/null 2>&1',
+              'npm install --save @aws-sdk/client-lambda esbuild > /dev/null 2>&1',
+              'npx esbuild productivity-widget.ts --bundle --platform=node --target=node22 --outfile=/asset-output/productivity-widget.js --external:@aws-sdk/*',
+            ].join(' && '),
+          ],
+          local: {
+            tryBundle(outputDir: string): boolean {
+              try {
+                const { execSync } = require('child_process');
+                execSync(
+                  `npx esbuild ${path.join(__dirname, '..', 'lambda', 'productivity-widget.ts')} --bundle --platform=node --target=node22 --outfile=${path.join(outputDir, 'productivity-widget.js')} --external:@aws-sdk/*`,
+                  { stdio: 'pipe' },
+                );
+                return true;
+              } catch {
+                return false;
+              }
+            },
+          },
+        },
+      }),
+      timeout: cdk.Duration.seconds(30),
+      memorySize: 256,
+      environment: {
+        RECEIVER_FUNCTION: receiver.functionName,
+      },
+      logRetention: logs.RetentionDays.ONE_MONTH,
+      description: 'CloudWatch custom widget: per-developer productivity table from the attribution store',
+    });
+    receiver.grantInvoke(productivityWidget);
+    NagSuppressions.addResourceSuppressions(productivityWidget, [
+      {
+        id: 'AwsSolutions-IAM5',
+        reason: 'lambda.grantInvoke scopes to the receiver function ARN plus its versions/aliases (<fn-arn>:*) — a single-function grant, not a broad wildcard.',
+        appliesTo: [{ regex: '/^Resource::<OtelCollectorReceiver.*\\.Arn>:\\*$/' }],
+      },
+    ], true);
+    this.productivityWidgetArn = productivityWidget.functionArn;
+
     // -------------------------------------------------------
     // HTTP API — discovery (public) + traces (JWT)
     // -------------------------------------------------------

package/dist/assets/infra/lib/dashboard-stack.ts

@@ -6,8 +6,13 @@ import { NagSuppressions } from 'cdk-nag';
 const METRIC_NAMESPACE = 'PRISM/D1/Velocity';
 const DEFAULT_PERIOD = cdk.Duration.hours(1);
 
+export interface DashboardStackProps extends cdk.StackProps {
+  /** ARN of the productivity custom-widget Lambda (from the OTEL collector construct). */
+  readonly productivityWidgetArn?: string;
+}
+
 export class DashboardStack extends cdk.Stack {
-  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
+  constructor(scope: Construct, id: string, props?: DashboardStackProps) {
     super(scope, id, props);
 
     // cdk-nag: CloudWatch alarms in this stack are for observability dashboards.
@@ -159,18 +164,77 @@ export class DashboardStack extends cdk.Stack {
       new cloudwatch.GraphWidget({
         title: 'AI to Merge Ratio',
         left: [
+          // Line 1: CI-fed metric (git trailers, computed per PR at merge time
+          // by prism-ai-metrics.yml). Requires an instrumented repo.
           new cloudwatch.Metric({
             namespace: METRIC_NAMESPACE,
             metricName: 'AIToMergeRatio',
             statistic: 'Average',
             period: DEFAULT_PERIOD,
-            label: 'AI-to-Merge Ratio (%)',
+            label: 'CI (git trailers, per-PR)',
+          }),
+          // Line 2: attribution-derived (codeburn spans, fleet aggregate).
+          // Populates for any user running `codeburn sync --attribution`.
+          // Divergence from line 1 indicates attribution coverage gaps.
+          // Inner FILL/IF: avoid NaN on empty buckets (gap, not 0). Outer
+          // FILL(..., REPEAT): carry the last ratio forward through gap days —
+          // commit data is sparse, and CloudWatch renders an isolated
+          // datapoint between gaps as an invisible dot, not a line.
+          new cloudwatch.MathExpression({
+            expression: 'FILL(IF(FILL(aiCommits, 0) > 0, 100 * FILL(mergedAi, 0) / FILL(aiCommits, 0)), REPEAT)',
+            usingMetrics: {
+              mergedAi: new cloudwatch.Metric({
+                namespace: METRIC_NAMESPACE,
+                metricName: 'MergedAICommits',
+                statistic: 'Sum',
+                period: cdk.Duration.days(1),
+              }),
+              aiCommits: new cloudwatch.Metric({
+                namespace: METRIC_NAMESPACE,
+                metricName: 'AICommits',
+                statistic: 'Sum',
+                period: cdk.Duration.days(1),
+              }),
+            },
+            label: 'Attribution (codeburn spans)',
+            period: cdk.Duration.days(1),
           }),
         ],
-        width: 8,
+        width: 6,
         height: 6,
         leftYAxis: { min: 0, max: 100, label: 'Percent' },
       }),
+      // KPI card: the aggregate ratio over the whole displayed time range.
+      // Always shows a number regardless of how sparse the daily series is —
+      // the graph next door can render near-empty when the range holds only
+      // isolated datapoints.
+      new cloudwatch.SingleValueWidget({
+        title: 'AI Merge Rate (range)',
+        metrics: [
+          new cloudwatch.MathExpression({
+            expression: 'IF(FILL(aiCommitsKpi, 0) > 0, 100 * FILL(mergedAiKpi, 0) / FILL(aiCommitsKpi, 0))',
+            usingMetrics: {
+              mergedAiKpi: new cloudwatch.Metric({
+                namespace: METRIC_NAMESPACE,
+                metricName: 'MergedAICommits',
+                statistic: 'Sum',
+                period: cdk.Duration.days(1),
+              }),
+              aiCommitsKpi: new cloudwatch.Metric({
+                namespace: METRIC_NAMESPACE,
+                metricName: 'AICommits',
+                statistic: 'Sum',
+                period: cdk.Duration.days(1),
+              }),
+            },
+            label: 'Merged AI / AI commits (%)',
+            period: cdk.Duration.days(1),
+          }),
+        ],
+        setPeriodToTimeRange: true,
+        width: 2,
+        height: 6,
+      }),
     );
 
     // --- Agent Metrics Row ---
@@ -439,7 +503,26 @@ export class DashboardStack extends cdk.Stack {
             metricName: 'AIToMergeRatio',
             statistic: 'Average',
             period: cdk.Duration.days(1),
-            label: 'AI-to-Merge Ratio (%)',
+            label: 'AI-to-Merge Ratio (CI, %)',
+          }),
+          new cloudwatch.MathExpression({
+            expression: 'IF(FILL(execAiCommits, 0) > 0, 100 * FILL(execMergedAi, 0) / FILL(execAiCommits, 0))',
+            usingMetrics: {
+              execMergedAi: new cloudwatch.Metric({
+                namespace: METRIC_NAMESPACE,
+                metricName: 'MergedAICommits',
+                statistic: 'Sum',
+                period: cdk.Duration.days(1),
+              }),
+              execAiCommits: new cloudwatch.Metric({
+                namespace: METRIC_NAMESPACE,
+                metricName: 'AICommits',
+                statistic: 'Sum',
+                period: cdk.Duration.days(1),
+              }),
+            },
+            label: 'AI-to-Merge Ratio (Attribution, %)',
+            period: cdk.Duration.days(1),
           }),
           new cloudwatch.Metric({
             namespace: METRIC_NAMESPACE,
@@ -496,12 +579,37 @@ export class DashboardStack extends cdk.Stack {
       new cloudwatch.GraphWidget({
         title: 'Post-Merge Defect Rate',
         left: [
+          // CI-fed (git trailers + revert scan in prism-ai-metrics.yml)
           new cloudwatch.Metric({
             namespace: METRIC_NAMESPACE,
             metricName: 'PostMergeDefectRate',
             statistic: 'Average',
             period: cdk.Duration.days(1),
-            label: 'Defect Rate (%)',
+            label: 'CI (per-PR)',
+          }),
+          // Attribution-derived: reverted AI commits over merged AI commits.
+          // FILL guards both series: RevertedAICommits may not exist AT ALL
+          // until the first revert is published (a metric with zero datums is
+          // missing, not zero — unguarded math renders NaN). The IF guard
+          // gaps buckets with no merged commits instead of dividing by zero.
+          new cloudwatch.MathExpression({
+            expression: 'IF(FILL(mergedAi, 0) > 0, 100 * FILL(revertedAi, 0) / FILL(mergedAi, 0))',
+            usingMetrics: {
+              revertedAi: new cloudwatch.Metric({
+                namespace: METRIC_NAMESPACE,
+                metricName: 'RevertedAICommits',
+                statistic: 'Sum',
+                period: cdk.Duration.days(1),
+              }),
+              mergedAi: new cloudwatch.Metric({
+                namespace: METRIC_NAMESPACE,
+                metricName: 'MergedAICommits',
+                statistic: 'Sum',
+                period: cdk.Duration.days(1),
+              }),
+            },
+            label: 'Attribution (codeburn spans)',
+            period: cdk.Duration.days(1),
           }),
         ],
         width: 6,
@@ -1430,5 +1538,151 @@ export class DashboardStack extends cdk.Stack {
       value: `https://${this.region}.console.aws.amazon.com/cloudwatch/home?region=${this.region}#dashboards:name=PRISM-D1-Executive-Readout`,
       description: 'Executive Readout Dashboard URL',
     });
+
+    // =======================================================
+    // Dashboard 3: Developer Productivity (attribution store)
+    // Only created when the OTEL collector (and its custom-widget
+    // Lambda) is deployed.
+    // =======================================================
+    if (props?.productivityWidgetArn) {
+      // Type-in filter for the detail row. PATTERN variables literal-replace
+      // the token below anywhere in the dashboard JSON, so the token must be
+      // unique. Default 'all' = organization scope.
+      const USER_TOKEN = 'PRISM_USER_FILTER_TOKEN';
+      const devDashboard = new cloudwatch.Dashboard(this, 'DeveloperProductivityDashboard', {
+        dashboardName: 'PRISM-D1-Developer-Productivity',
+        defaultInterval: cdk.Duration.days(30),
+        variables: [
+          new cloudwatch.DashboardVariable({
+            id: 'devFilter',
+            label: 'Developer',
+            type: cloudwatch.VariableType.PATTERN,
+            value: USER_TOKEN,
+            inputType: cloudwatch.VariableInputType.INPUT,
+            defaultValue: cloudwatch.DefaultValue.value('all'),
+            visible: true,
+          }),
+        ],
+      });
+
+      devDashboard.addWidgets(
+        new cloudwatch.TextWidget({
+          markdown:
+            '# PRISM D1 - Developer Productivity\n' +
+            'Rows 1-2: org metrics (CloudWatch, 2-week ingestion window applies to backfills). ' +
+            'Rows 3-4: attribution store — full history, real commit timestamps. ' +
+            'Type a developer email into the **Developer** variable (default `all`) to scope the detail row.',
+          width: 24,
+          height: 2,
+        }),
+      );
+
+      // --- Row 1: Org KPIs (NaN-guarded metric math, follow time range) ---
+      const dailyMetric = (metricName: string, id: string): cloudwatch.Metric =>
+        new cloudwatch.Metric({
+          namespace: METRIC_NAMESPACE,
+          metricName,
+          statistic: 'Sum',
+          period: cdk.Duration.days(1),
+          label: id,
+        });
+      const ratioKpi = (title: string, expression: string, using: Record<string, cloudwatch.IMetric>): cloudwatch.SingleValueWidget =>
+        new cloudwatch.SingleValueWidget({
+          title,
+          metrics: [new cloudwatch.MathExpression({ expression, usingMetrics: using, label: title, period: cdk.Duration.days(1) })],
+          setPeriodToTimeRange: true,
+          width: 6,
+          height: 4,
+        });
+
+      devDashboard.addWidgets(
+        ratioKpi('AI Share of Commits (%)', 'IF(FILL(kTotal, 0) > 0, 100 * FILL(kAi, 0) / FILL(kTotal, 0))', {
+          kAi: dailyMetric('AICommits', 'kAi'), kTotal: dailyMetric('CommitsTotal', 'kTotal'),
+        }),
+        ratioKpi('AI Merge Rate (%)', 'IF(FILL(kAi2, 0) > 0, 100 * FILL(kMerged, 0) / FILL(kAi2, 0))', {
+          kMerged: dailyMetric('MergedAICommits', 'kMerged'), kAi2: dailyMetric('AICommits', 'kAi2'),
+        }),
+        ratioKpi('Cost per Shipped Commit ($)', 'IF(FILL(kMerged2, 0) > 0, FILL(kCost, 0) / FILL(kMerged2, 0))', {
+          kCost: dailyMetric('AICostUSD', 'kCost'), kMerged2: dailyMetric('MergedAICommits', 'kMerged2'),
+        }),
+        new cloudwatch.SingleValueWidget({
+          title: 'AI Spend (range, $)',
+          metrics: [dailyMetric('AICostUSD', 'AI Spend')],
+          setPeriodToTimeRange: true,
+          width: 6,
+          height: 4,
+        }),
+      );
+
+      // --- Row 2: Org trends (native interactive charts) ---
+      devDashboard.addWidgets(
+        new cloudwatch.GraphWidget({
+          title: 'Commits / Day (AI vs Human)',
+          left: [
+            dailyMetric('AICommits', 'AI commits'),
+            dailyMetric('HumanCommits', 'Human commits'),
+          ],
+          view: cloudwatch.GraphWidgetView.BAR,
+          stacked: true,
+          width: 8,
+          height: 6,
+          leftYAxis: { min: 0, label: 'Commits' },
+        }),
+        new cloudwatch.GraphWidget({
+          title: 'AI Spend / Day',
+          left: [dailyMetric('AICostUSD', 'Spend ($)')],
+          width: 8,
+          height: 6,
+          leftYAxis: { min: 0, label: 'USD' },
+        }),
+        new cloudwatch.GraphWidget({
+          title: 'AI Merge Ratio Trend',
+          left: [
+            new cloudwatch.MathExpression({
+              expression: 'FILL(IF(FILL(tAi, 0) > 0, 100 * FILL(tMerged, 0) / FILL(tAi, 0)), REPEAT)',
+              usingMetrics: { tMerged: dailyMetric('MergedAICommits', 'tMerged'), tAi: dailyMetric('AICommits', 'tAi') },
+              label: 'Merge ratio (%)',
+              period: cdk.Duration.days(1),
+            }),
+          ],
+          width: 8,
+          height: 6,
+          leftYAxis: { min: 0, max: 100, label: 'Percent' },
+        }),
+      );
+
+      // --- Row 3: Team comparison table (custom widget, view=table) ---
+      devDashboard.addWidgets(
+        new cloudwatch.CustomWidget({
+          functionArn: props.productivityWidgetArn,
+          title: 'Team Comparison (full history)',
+          width: 24,
+          height: 8,
+          params: { view: 'table' },
+          updateOnRefresh: true,
+          updateOnResize: false,
+          updateOnTimeRangeChange: true,
+        }),
+      );
+
+      // --- Row 4: Detail panel (custom widget, view=detail, follows filter) ---
+      devDashboard.addWidgets(
+        new cloudwatch.CustomWidget({
+          functionArn: props.productivityWidgetArn,
+          title: 'Detail: By Tool / By Model / Ratios',
+          width: 24,
+          height: 8,
+          params: { view: 'detail', user: USER_TOKEN },
+          updateOnRefresh: true,
+          updateOnResize: false,
+          updateOnTimeRangeChange: true,
+        }),
+      );
+
+      new cdk.CfnOutput(this, 'DevProductivityDashboardUrl', {
+        value: `https://${this.region}.console.aws.amazon.com/cloudwatch/home?region=${this.region}#dashboards:name=PRISM-D1-Developer-Productivity`,
+        description: 'Developer Productivity Dashboard URL',
+      });
+    }
   }
 }

package/dist/assets/infra/lib/lambda/attribution-metrics-publisher.ts

@@ -0,0 +1,248 @@
+/**
+ * PRISM D1 — Attribution metrics publisher.
+ *
+ * Consumes the prism-d1-ai-usage DynamoDB stream (filtered to COMMIT# items
+ * under REPO# pk) and publishes commit attribution metrics to CloudWatch.
+ *
+ * AI-Origin inference: joins commit → usage spans via traceId.
+ * - Has correlated usage spans → ai-generated, tool from span
+ * - No correlated usage spans → human, tool=none
+ *
+ * Metrics published (namespace: PRISM/D1/Velocity):
+ *   AICommits        — count of ai-generated commits (dimensionless + by Tool)
+ *   HumanCommits     — count of human commits (dimensionless only)
+ *   RevertedAICommits — ai-generated commits that were later reverted
+ *   CommitsTotal     — all tracked commits regardless of origin
+ */
+
+import {
+  CloudWatchClient,
+  PutMetricDataCommand,
+  MetricDatum,
+  StandardUnit,
+} from '@aws-sdk/client-cloudwatch';
+import {
+  DynamoDBClient,
+  QueryCommand,
+} from '@aws-sdk/client-dynamodb';
+
+const cloudwatch = new CloudWatchClient({});
+const dynamoClient = new DynamoDBClient({});
+
+const METRIC_NAMESPACE = process.env.METRIC_NAMESPACE || 'PRISM/D1/Velocity';
+const AI_USAGE_TABLE = process.env.AI_USAGE_TABLE || 'prism-d1-ai-usage';
+const PUT_METRIC_BATCH_SIZE = 1000;
+
+// ---- Types ----
+
+interface AttributeValue {
+  S?: string;
+  N?: string;
+  BOOL?: boolean;
+}
+
+interface StreamImage {
+  pk?: AttributeValue;
+  sk?: AttributeValue;
+  trace_id?: AttributeValue;
+  user?: AttributeValue;
+  tool?: AttributeValue;
+  model?: AttributeValue;
+  in_main?: AttributeValue;
+  was_reverted?: AttributeValue;
+  timestamp?: AttributeValue;
+  record_type?: AttributeValue;
+}
+
+interface StreamRecord {
+  eventName?: string;
+  dynamodb?: {
+    Keys?: { pk?: AttributeValue; sk?: AttributeValue };
+    NewImage?: StreamImage;
+    OldImage?: StreamImage;
+  };
+}
+
+interface StreamEvent {
+  Records?: StreamRecord[];
+}
+
+// ---- Helpers ----
+
+/** Resolve the AI tool for a commit by joining with usage spans via traceId. */
+async function resolveAiTool(user: string, traceId: string): Promise<{ tool: string; isAi: boolean }> {
+  if (!user || !traceId) return { tool: 'none', isAi: false };
+
+  try {
+    // NOTE: DynamoDB applies `Limit` BEFORE `FilterExpression` — `Limit: 1`
+    // would evaluate exactly one span and almost always miss the match,
+    // resolving every commit as human. Paginate the user's spans and stop at
+    // the first trace_id hit. Page size bounds per-call read cost; the loop
+    // bounds total pages defensively (a user with >50k spans and no match
+    // resolves as human rather than scanning forever).
+    let lastKey: import('@aws-sdk/client-dynamodb').QueryCommandOutput['LastEvaluatedKey'];
+    for (let page = 0; page < 50; page++) {
+      const result = await dynamoClient.send(new QueryCommand({
+        TableName: AI_USAGE_TABLE,
+        KeyConditionExpression: 'pk = :pk AND begins_with(sk, :prefix)',
+        FilterExpression: 'trace_id = :tid',
+        ExpressionAttributeValues: {
+          ':pk': { S: `USER#${user}` },
+          ':prefix': { S: 'SPAN#' },
+          ':tid': { S: traceId },
+        },
+        Limit: 1000,
+        ...(lastKey ? { ExclusiveStartKey: lastKey } : {}),
+      }));
+
+      if ((result.Items?.length ?? 0) > 0) {
+        const tool = result.Items![0].tool?.S ?? 'unknown';
+        return { tool, isAi: true };
+      }
+      lastKey = result.LastEvaluatedKey;
+      if (!lastKey) break;
+    }
+  } catch (e) {
+    console.warn(`[attribution-metrics] Failed to resolve tool for trace=${traceId}: ${e}`);
+  }
+
+  return { tool: 'none', isAi: false };
+}
+
+/** Parse a stream record into commit metadata. Only processes COMMIT# items. */
+function parseCommitRecord(record: StreamRecord): {
+  user: string;
+  traceId: string;
+  wasReverted: boolean;
+  inMain: boolean;
+  timestamp: string;
+  /** Which state transitions this event represents. INSERT = 'new'. A MODIFY
+   * can flip in_main and/or was_reverted (receiver writes only when one of
+   * them changed). */
+  isNew: boolean;
+  mergedNow: boolean;   // in_main flipped false → true
+  revertedNow: boolean; // was_reverted flipped false → true
+} | null {
+  if (record.eventName !== 'INSERT' && record.eventName !== 'MODIFY') return null;
+
+  const newImage = record.dynamodb?.NewImage;
+  if (!newImage) return null;
+
+  const recordType = newImage.record_type?.S;
+  if (recordType !== 'OTEL_ATTR_COMMIT') return null;
+
+  const inMain = newImage.in_main?.BOOL ?? false;
+  const wasReverted = newImage.was_reverted?.BOOL ?? false;
+
+  let isNew = record.eventName === 'INSERT';
+  let mergedNow = false;
+  let revertedNow = false;
+
+  if (record.eventName === 'MODIFY') {
+    const oldImage = record.dynamodb?.OldImage;
+    const oldInMain = oldImage?.in_main?.BOOL ?? false;
+    const oldReverted = oldImage?.was_reverted?.BOOL ?? false;
+    mergedNow = inMain && !oldInMain;
+    revertedNow = wasReverted && !oldReverted;
+    if (!mergedNow && !revertedNow) return null; // no meaningful transition
+  }
+
+  return {
+    user: newImage.user?.S ?? '',
+    traceId: newImage.trace_id?.S ?? '',
+    wasReverted,
+    inMain,
+    timestamp: newImage.timestamp?.S ?? new Date().toISOString(),
+    isNew,
+    mergedNow,
+    revertedNow,
+  };
+}
+
+// ---- Handler ----
+
+export async function handler(event: StreamEvent): Promise<void> {
+  const now = new Date();
+  const datums: MetricDatum[] = [];
+  let aiCommits = 0;
+  let humanCommits = 0;
+  let mergedAi = 0;
+  let revertedAi = 0;
+
+  /** Push a Count=1 datum, dimensionless plus an optional Tool-dimensioned twin. */
+  const emit = (name: string, ts: Date, tool?: string): void => {
+    datums.push({ MetricName: name, Value: 1, Unit: StandardUnit.Count, Timestamp: ts, Dimensions: [] });
+    if (tool) {
+      datums.push({ MetricName: name, Value: 1, Unit: StandardUnit.Count, Timestamp: ts, Dimensions: [{ Name: 'Tool', Value: tool }] });
+    }
+  };
+
+  for (const record of event.Records ?? []) {
+    const commit = parseCommitRecord(record);
+    if (!commit) continue;
+
+    const { tool, isAi } = await resolveAiTool(commit.user, commit.traceId);
+    const timestamp = new Date(commit.timestamp);
+    // CloudWatch rejects PutMetricData timestamps older than 2 weeks (and one
+    // bad member rejects the whole batch, wedging the stream in a retry loop).
+    // Use the commit's own time when it's inside the window so live traffic
+    // charts at commit time; clamp backfilled history to ingest time.
+    const OLDEST_ALLOWED_MS = 13 * 24 * 60 * 60 * 1000; // 13d — safety margin inside CW's 14d limit
+    const metricTimestamp =
+      isNaN(timestamp.getTime()) || now.getTime() - timestamp.getTime() > OLDEST_ALLOWED_MS
+        ? now
+        : timestamp;
+
+    if (commit.isNew) {
+      // New commit: CommitsTotal always, then AI/Human split.
+      emit('CommitsTotal', metricTimestamp);
+      if (isAi) {
+        aiCommits++;
+        emit('AICommits', metricTimestamp, tool);
+        // States already true at INSERT time (backfill of an old commit whose
+        // merge/revert happened before codeburn first synced it).
+        if (commit.inMain) {
+          mergedAi++;
+          emit('MergedAICommits', metricTimestamp, tool);
+        }
+        if (commit.wasReverted) {
+          revertedAi++;
+          emit('RevertedAICommits', metricTimestamp);
+        }
+      } else {
+        humanCommits++;
+        emit('HumanCommits', metricTimestamp);
+        if (commit.inMain) emit('MergedHumanCommits', metricTimestamp);
+      }
+      continue;
+    }
+
+    // MODIFY — state transition(s). The receiver writes only when in_main or
+    // was_reverted actually changed, and a single MODIFY can carry both flips.
+    if (commit.mergedNow) {
+      if (isAi) {
+        mergedAi++;
+        emit('MergedAICommits', metricTimestamp, tool);
+      } else {
+        emit('MergedHumanCommits', metricTimestamp);
+      }
+    }
+    if (commit.revertedNow && isAi) {
+      revertedAi++;
+      emit('RevertedAICommits', metricTimestamp, tool);
+    }
+  }
+
+  // Publish in batches
+  for (let i = 0; i < datums.length; i += PUT_METRIC_BATCH_SIZE) {
+    await cloudwatch.send(new PutMetricDataCommand({
+      Namespace: METRIC_NAMESPACE,
+      MetricData: datums.slice(i, i + PUT_METRIC_BATCH_SIZE),
+    }));
+  }
+
+  console.log(
+    `[attribution-metrics-publisher] records=${event.Records?.length ?? 0} ` +
+    `ai=${aiCommits} human=${humanCommits} merged=${mergedAi} reverted=${revertedAi} datums=${datums.length}`,
+  );
+}