@prism-d1/cli 1.0.77 → 1.0.80

package/dist/assets/infra/lib/dashboard-stack.ts

@@ -6,8 +6,15 @@ import { NagSuppressions } from 'cdk-nag';
 const METRIC_NAMESPACE = 'PRISM/D1/Velocity';
 const DEFAULT_PERIOD = cdk.Duration.hours(1);
 
+export interface DashboardStackProps extends cdk.StackProps {
+  /** ARN of the productivity custom-widget Lambda (from the OTEL collector construct). */
+  readonly productivityWidgetArn?: string;
+  /** ARN of the Team Velocity custom-widget Lambda (DDB-backed panels). */
+  readonly velocityWidgetArn?: string;
+}
+
 export class DashboardStack extends cdk.Stack {
-  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
+  constructor(scope: Construct, id: string, props?: DashboardStackProps) {
     super(scope, id, props);
 
     // cdk-nag: CloudWatch alarms in this stack are for observability dashboards.
@@ -31,1140 +38,433 @@ export class DashboardStack extends cdk.Stack {
       defaultInterval: cdk.Duration.days(7),
     });
 
-    // --- AI Acceptance Rate (time series) ---
-    const aiAcceptanceMetric = new cloudwatch.Metric({
-      namespace: METRIC_NAMESPACE,
-      metricName: 'AIAcceptanceRate',
-      statistic: 'Average',
-      period: DEFAULT_PERIOD,
-      label: 'AI Acceptance Rate (%)',
-    });
-
-    teamDashboard.addWidgets(
-      new cloudwatch.TextWidget({
-        markdown: '# PRISM D1 - Team Velocity Dashboard\nReal-time AI-enhanced DORA metrics for engineering teams.',
+    // --- Hybrid layout ---
+    // KPI and detail panels are DDB-backed custom widgets (velocity-widget
+    // Lambda) reading the events table via the by-detail-type GSI: full
+    // 365-day history, real event timestamps, no CloudWatch metric-dimension
+    // matching, and honest empty states naming the missing emitter. Native
+    // graphs are retained only for attribution/OTEL-fed series, which are
+    // dimensionless and verified live. Access to panel data is gated by
+    // lambda:InvokeFunction on the widget Lambda (viewer's IAM creds).
+    const velocityPanel = (title: string, view: string, height: number): cloudwatch.CustomWidget =>
+      new cloudwatch.CustomWidget({
+        functionArn: props?.velocityWidgetArn ?? '',
+        title,
         width: 24,
-        height: 1,
-      }),
-    );
-
-    teamDashboard.addWidgets(
-      new cloudwatch.GraphWidget({
-        title: 'AI Acceptance Rate',
-        left: [aiAcceptanceMetric],
-        width: 12,
-        height: 6,
-        leftYAxis: { min: 0, max: 100, label: 'Percent' },
-        statistic: 'Average',
-        period: DEFAULT_PERIOD,
-      }),
-      new cloudwatch.GraphWidget({
-        title: 'Deployment Frequency',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'DeploymentFrequency',
-            statistic: 'Sum',
-            period: cdk.Duration.days(1),
-            label: 'Deploys / Day',
-          }),
-        ],
-        width: 12,
-        height: 6,
-        view: cloudwatch.GraphWidgetView.BAR,
-        leftYAxis: { min: 0, label: 'Deployments' },
-      }),
-    );
-
-    teamDashboard.addWidgets(
-      new cloudwatch.GraphWidget({
-        title: 'Lead Time for Changes',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'LeadTimeForChanges',
-            statistic: 'Average',
-            period: DEFAULT_PERIOD,
-            label: 'Lead Time (seconds)',
-          }),
-        ],
-        width: 8,
-        height: 6,
-        leftYAxis: { min: 0, label: 'Seconds' },
-      }),
-      new cloudwatch.GaugeWidget({
-        title: 'Eval Gate Pass Rate',
-        metrics: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'EvalGatePassRate',
-            statistic: 'Average',
-            period: cdk.Duration.days(1),
-            label: 'Eval Pass Rate (%)',
-          }),
-        ],
-        width: 8,
-        height: 6,
-        leftYAxis: { min: 0, max: 100 },
-      }),
-      new cloudwatch.GraphWidget({
-        title: 'AI Test Coverage Delta',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'AITestCoverageDelta',
-            statistic: 'Average',
-            period: DEFAULT_PERIOD,
-            label: 'Coverage Delta (%)',
-          }),
-        ],
-        width: 8,
-        height: 6,
-        leftYAxis: { label: 'Percent' },
-      }),
-    );
-
-    // --- Additional team metrics row ---
-    teamDashboard.addWidgets(
-      new cloudwatch.GraphWidget({
-        title: 'Change Failure Rate',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'ChangeFailureRate',
-            statistic: 'Average',
-            period: DEFAULT_PERIOD,
-            label: 'Change Failure Rate (%)',
-          }),
-        ],
-        width: 8,
-        height: 6,
-        leftYAxis: { min: 0, max: 100, label: 'Percent' },
-      }),
-      new cloudwatch.GraphWidget({
-        title: 'Mean Time to Recovery',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'MTTR',
-            statistic: 'Average',
-            period: DEFAULT_PERIOD,
-            label: 'MTTR (seconds)',
-          }),
-        ],
-        width: 8,
-        height: 6,
-        leftYAxis: { min: 0, label: 'Seconds' },
-      }),
-      new cloudwatch.GraphWidget({
-        title: 'AI to Merge Ratio',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'AIToMergeRatio',
-            statistic: 'Average',
-            period: DEFAULT_PERIOD,
-            label: 'AI-to-Merge Ratio (%)',
-          }),
-        ],
-        width: 8,
-        height: 6,
-        leftYAxis: { min: 0, max: 100, label: 'Percent' },
-      }),
-    );
-
-    // --- Agent Metrics Row ---
-    const teamId = 'ALL';
-    const repository = 'ALL';
+        height,
+        params: { view },
+        updateOnRefresh: true,
+        updateOnResize: false,
+        updateOnTimeRangeChange: true,
+      });
 
     teamDashboard.addWidgets(
       new cloudwatch.TextWidget({
-        markdown: '### AI Token Usage & Cost',
+        markdown:
+          '# PRISM D1 - Team Velocity Dashboard\n' +
+          'Delivery health: DORA proxies, AI-DORA quality, eval gates, governance, security. ' +
+          'Spend and per-developer output live on **PRISM-D1-Developer-Productivity**.',
         width: 24,
-        height: 1,
-      }),
-    );
-
-    teamDashboard.addWidgets(
-      new cloudwatch.GraphWidget({
-        title: 'AI Input Tokens',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'AIInputTokens',
-            statistic: 'Sum',
-            period: cdk.Duration.days(1),
-            label: 'Input Tokens',
-          }),
-        ],
-        width: 8,
-        height: 6,
-        leftYAxis: { min: 0, label: 'Tokens' },
-      }),
-      new cloudwatch.GraphWidget({
-        title: 'AI Output Tokens',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'AIOutputTokens',
-            statistic: 'Sum',
-            period: cdk.Duration.days(1),
-            label: 'Output Tokens',
-          }),
-        ],
-        width: 8,
-        height: 6,
-        leftYAxis: { min: 0, label: 'Tokens' },
-      }),
-      new cloudwatch.GraphWidget({
-        title: 'AI Cost (USD)',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'AICostUSD',
-            statistic: 'Sum',
-            period: cdk.Duration.days(1),
-            label: 'Cost (USD)',
-          }),
-        ],
-        width: 8,
-        height: 6,
-        leftYAxis: { min: 0, label: 'USD' },
+        height: 2,
       }),
     );
 
-    // Cost breakdowns by Tool and Model. SEARCH expressions auto-discover
-    // every dimension value, so new tools/models appear without dashboard
-    // changes. These series are populated by the otel-metrics-publisher
-    // (deployed by default; skip with -c skipOtelCollector=true); the trailer
-    // path has no per-tool/per-model breakdown and leaves these widgets empty.
-    teamDashboard.addWidgets(
-      new cloudwatch.GraphWidget({
-        title: 'AI Cost by Tool (USD)',
-        left: [
-          new cloudwatch.MathExpression({
-            expression: `SEARCH('{${METRIC_NAMESPACE},Tool} MetricName="AICostUSD"', 'Sum')`,
-            usingMetrics: {},
-            // Dynamic label: each discovered series is legend-labeled with
-            // its Tool dimension value (e.g. "claude-code").
-            label: "${PROP('Dim.Tool')}",
-            period: cdk.Duration.days(1),
-          }),
-        ],
-        width: 12,
-        height: 6,
-        leftYAxis: { min: 0, label: 'USD' },
-        legendPosition: cloudwatch.LegendPosition.RIGHT,
-      }),
-      new cloudwatch.GraphWidget({
-        title: 'AI Cost by Model (USD)',
-        left: [
-          new cloudwatch.MathExpression({
-            expression: `SEARCH('{${METRIC_NAMESPACE},Model} MetricName="AICostUSD"', 'Sum')`,
-            usingMetrics: {},
-            // Dynamic label: each discovered series is legend-labeled with
-            // its Model dimension value (e.g. "claude-sonnet-4-5-20250929").
-            label: "${PROP('Dim.Model')}",
-            period: cdk.Duration.days(1),
-          }),
-        ],
-        width: 12,
-        height: 6,
-        leftYAxis: { min: 0, label: 'USD' },
-        legendPosition: cloudwatch.LegendPosition.RIGHT,
-      }),
-    );
+    if (props?.velocityWidgetArn) {
+      // Row 1: DORA proxy KPIs (merge frequency, PR cycle time, revert rate/turnaround)
+      teamDashboard.addWidgets(velocityPanel('Delivery KPIs (DORA proxies)', 'dora', 4));
+      // Row 2: AI-DORA KPIs (attribution store + eval events, L2/L4 coloring)
+      teamDashboard.addWidgets(velocityPanel('AI-DORA KPIs', 'aidora', 4));
+    }
 
-    teamDashboard.addWidgets(
-      new cloudwatch.TextWidget({
-        markdown: '### Agent Operations',
-        width: 24,
-        height: 1,
-      }),
-    );
+    // Row 3: native graphs — attribution/OTEL-fed series only. These are the
+    // dimensionless series published by the attribution/OTEL publishers, so
+    // plain (dimensionless) metric queries match. FILL/IF guards throughout:
+    // commit data is sparse and an unguarded ratio renders NaN on empty
+    // buckets; FILL(..., REPEAT) carries the last value through gap days so
+    // the series draws a line instead of invisible isolated dots.
+    const dailySum = (metricName: string, label?: string): cloudwatch.Metric =>
+      new cloudwatch.Metric({
+        namespace: METRIC_NAMESPACE,
+        metricName,
+        statistic: 'Sum',
+        period: cdk.Duration.days(1),
+        ...(label ? { label } : {}),
+      });
 
     teamDashboard.addWidgets(
       new cloudwatch.GraphWidget({
-        title: 'Agent Invocations',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'AgentInvocationCount',
-            dimensionsMap: { TeamId: teamId, Repository: repository },
-            statistic: 'Sum',
-            period: DEFAULT_PERIOD,
-            label: 'Invocations',
-          }),
-        ],
-        width: 8,
-        height: 6,
-      }),
-      new cloudwatch.GraphWidget({
-        title: 'Agent Success Rate',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'AgentSuccessRate',
-            dimensionsMap: { TeamId: teamId, Repository: repository },
-            statistic: 'Average',
-            period: DEFAULT_PERIOD,
-            label: 'Success Rate (%)',
-          }),
-        ],
-        width: 8,
-        height: 6,
-        leftYAxis: { min: 0, max: 100, label: 'Percent' },
-      }),
-      new cloudwatch.GraphWidget({
-        title: 'Agent Avg Duration',
+        title: 'Commits / Day (AI vs Human)',
         left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'AgentDurationMs',
-            dimensionsMap: { TeamId: teamId, Repository: repository },
-            statistic: 'Average',
-            period: DEFAULT_PERIOD,
-            label: 'Duration (ms)',
-          }),
+          dailySum('AICommits', 'AI commits'),
+          dailySum('HumanCommits', 'Human commits'),
         ],
+        view: cloudwatch.GraphWidgetView.BAR,
+        stacked: true,
         width: 8,
         height: 6,
+        leftYAxis: { min: 0, label: 'Commits' },
       }),
-    );
-
-    // =======================================================
-    // Dashboard 2: Executive Readout
-    // =======================================================
-    const execDashboard = new cloudwatch.Dashboard(this, 'ExecutiveReadoutDashboard', {
-      dashboardName: 'PRISM-D1-Executive-Readout',
-      defaultInterval: cdk.Duration.days(30),
-    });
-
-    execDashboard.addWidgets(
-      new cloudwatch.TextWidget({
-        markdown: '# PRISM D1 - Executive Readout\nLeadership view of AI-assisted engineering velocity and DORA performance.',
-        width: 24,
-        height: 1,
-      }),
-    );
-
-    // --- PRISM Level Progress + Enhanced DORA Summary row ---
-    execDashboard.addWidgets(
-      new cloudwatch.SingleValueWidget({
-        title: 'PRISM Level Progress',
-        metrics: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'PRISMLevel',
-            statistic: 'Maximum',
-            period: cdk.Duration.days(1),
-            label: 'Current PRISM Level',
-          }),
-        ],
-        width: 6,
-        height: 4,
-      }),
-      new cloudwatch.SingleValueWidget({
-        title: 'Enhanced DORA Summary',
-        metrics: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'DeploymentFrequency',
-            statistic: 'Sum',
-            period: cdk.Duration.days(7),
-            label: 'Deploy Freq (7d)',
-          }),
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'LeadTimeForChanges',
-            statistic: 'Average',
-            period: cdk.Duration.days(7),
-            label: 'Avg Lead Time (s)',
-          }),
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'ChangeFailureRate',
-            statistic: 'Average',
-            period: cdk.Duration.days(7),
-            label: 'Change Fail Rate (%)',
-          }),
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'MTTR',
-            statistic: 'Average',
-            period: cdk.Duration.days(7),
-            label: 'Avg MTTR (s)',
-          }),
-        ],
-        width: 12,
-        height: 4,
-      }),
-      new cloudwatch.SingleValueWidget({
-        title: 'AI Cost & Cycle Time',
-        metrics: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'AICostUSD',
-            statistic: 'Sum',
-            period: cdk.Duration.days(7),
-            label: 'Total AI Cost (7d, USD)',
-          }),
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'SpecToCodeHours',
-            statistic: 'Average',
-            period: cdk.Duration.days(7),
-            label: 'Avg Spec-to-Code (hrs)',
-          }),
-        ],
-        width: 6,
-        height: 4,
-      }),
-    );
-
-    // --- AI Contribution Trend + Feature Cycle Time Trend ---
-    execDashboard.addWidgets(
-      new cloudwatch.GraphWidget({
-        title: 'AI Contribution Trend',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'AIAcceptanceRate',
-            statistic: 'Average',
-            period: cdk.Duration.days(1),
-            label: 'AI Acceptance Rate (%)',
-          }),
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'AIToMergeRatio',
-            statistic: 'Average',
-            period: cdk.Duration.days(1),
-            label: 'AI-to-Merge Ratio (%)',
-          }),
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'AITestCoverageDelta',
-            statistic: 'Average',
-            period: cdk.Duration.days(1),
-            label: 'AI Test Coverage Delta (%)',
-          }),
-        ],
-        width: 12,
-        height: 6,
-        leftYAxis: { min: 0, max: 100, label: 'Percent' },
-      }),
-      new cloudwatch.GraphWidget({
-        title: 'Feature Cycle Time Trend',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'SpecToCodeHours',
-            statistic: 'Average',
-            period: cdk.Duration.days(1),
-            label: 'Spec-to-Code (hrs)',
-          }),
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'LeadTimeForChanges',
-            statistic: 'Average',
-            period: cdk.Duration.days(1),
-            label: 'Lead Time (seconds)',
-          }),
-        ],
-        width: 12,
-        height: 6,
-      }),
-    );
-
-    // --- Eval gate, quality, and cost trend row ---
-    execDashboard.addWidgets(
-      new cloudwatch.GaugeWidget({
-        title: 'Eval Gate Pass Rate',
-        metrics: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'EvalGatePassRate',
-            statistic: 'Average',
-            period: cdk.Duration.days(7),
-            label: 'Eval Pass Rate (%)',
-          }),
-        ],
-        width: 6,
-        height: 6,
-        leftYAxis: { min: 0, max: 100 },
-      }),
-      new cloudwatch.GraphWidget({
-        title: 'Post-Merge Defect Rate',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'PostMergeDefectRate',
-            statistic: 'Average',
-            period: cdk.Duration.days(1),
-            label: 'Defect Rate (%)',
-          }),
-        ],
-        width: 6,
-        height: 6,
-        leftYAxis: { min: 0, label: 'Percent' },
-      }),
-      new cloudwatch.GraphWidget({
-        title: 'AI Cost Trend (Weekly)',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'AICostUSD',
-            statistic: 'Sum',
-            period: cdk.Duration.days(7),
-            label: 'Total Cost (USD)',
-          }),
-        ],
-        width: 6,
-        height: 6,
-        leftYAxis: { min: 0, label: 'USD' },
-      }),
-      new cloudwatch.GraphWidget({
-        title: 'Deployment Frequency (Weekly)',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'DeploymentFrequency',
-            statistic: 'Sum',
-            period: cdk.Duration.days(7),
-            label: 'Deploys / Week',
-          }),
-        ],
-        width: 6,
-        height: 6,
-        view: cloudwatch.GraphWidgetView.BAR,
-        leftYAxis: { min: 0, label: 'Deployments' },
-      }),
-    );
-
-    // =======================================================
-    // CloudWatch Alarms
-    // =======================================================
-
-    // Alarm: AI acceptance rate dropping below 20%
-    new cloudwatch.Alarm(this, 'AiAcceptanceRateLowAlarm', {
-      alarmName: 'PRISM-D1-AIAcceptanceRate-Low',
-      alarmDescription: 'AI acceptance rate has dropped below 20%, indicating potential issues with AI-generated code quality or review friction.',
-      metric: new cloudwatch.Metric({
-        namespace: METRIC_NAMESPACE,
-        metricName: 'AIAcceptanceRate',
-        statistic: 'Average',
-        period: cdk.Duration.hours(6),
-      }),
-      threshold: 20,
-      evaluationPeriods: 3,
-      datapointsToAlarm: 2,
-      comparisonOperator: cloudwatch.ComparisonOperator.LESS_THAN_THRESHOLD,
-      treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING,
-    });
-
-    // Alarm: Eval gate pass rate dropping below 70%
-    new cloudwatch.Alarm(this, 'EvalGatePassRateLowAlarm', {
-      alarmName: 'PRISM-D1-EvalGatePassRate-Low',
-      alarmDescription: 'Eval gate pass rate has dropped below 70%, indicating degraded quality in AI-generated outputs.',
-      metric: new cloudwatch.Metric({
-        namespace: METRIC_NAMESPACE,
-        metricName: 'EvalGatePassRate',
-        statistic: 'Average',
-        period: cdk.Duration.hours(6),
-      }),
-      threshold: 70,
-      evaluationPeriods: 3,
-      datapointsToAlarm: 2,
-      comparisonOperator: cloudwatch.ComparisonOperator.LESS_THAN_THRESHOLD,
-      treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING,
-    });
-
-    // Alarm: Change failure rate exceeding 20%
-    new cloudwatch.Alarm(this, 'ChangeFailureRateHighAlarm', {
-      alarmName: 'PRISM-D1-ChangeFailureRate-High',
-      alarmDescription: 'Change failure rate exceeds 20%, indicating deployment quality regression.',
-      metric: new cloudwatch.Metric({
-        namespace: METRIC_NAMESPACE,
-        metricName: 'ChangeFailureRate',
-        statistic: 'Average',
-        period: cdk.Duration.hours(6),
-      }),
-      threshold: 20,
-      evaluationPeriods: 3,
-      datapointsToAlarm: 2,
-      comparisonOperator: cloudwatch.ComparisonOperator.GREATER_THAN_THRESHOLD,
-      treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING,
-    });
-
-    // =======================================================
-    // Team Dashboard: Eval Gate by Rubric (Pillar 2)
-    // =======================================================
-    teamDashboard.addWidgets(
-      new cloudwatch.TextWidget({
-        markdown: '### Eval Gate Quality by Rubric',
-        width: 24,
-        height: 1,
-      }),
-    );
-
-    const rubricNames = ['code-quality', 'api-response-quality', 'agent-quality', 'security-compliance', 'spec-compliance'];
-    teamDashboard.addWidgets(
-      new cloudwatch.GraphWidget({
-        title: 'Eval Pass Rate by Rubric',
-        left: rubricNames.map((rubric) =>
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'EvalGatePassRateByRubric',
-            dimensionsMap: { RubricName: rubric },
-            statistic: 'Average',
-            period: cdk.Duration.days(1),
-            label: rubric,
-          }),
-        ),
-        width: 12,
-        height: 6,
-        leftYAxis: { min: 0, max: 100, label: 'Pass Rate (%)' },
-      }),
-      new cloudwatch.GraphWidget({
-        title: 'Eval Score Trend',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'EvalScore',
-            statistic: 'Average',
-            period: cdk.Duration.days(1),
-            label: 'Avg Eval Score',
-          }),
-        ],
-        width: 12,
-        height: 6,
-        leftYAxis: { min: 0, max: 1, label: 'Score (0-1)' },
-      }),
-    );
-
-    // =======================================================
-    // Team Dashboard: Guardrails & Safety (Pillar 4)
-    // =======================================================
-    teamDashboard.addWidgets(
-      new cloudwatch.TextWidget({
-        markdown: '### Guardrails & Safety',
-        width: 24,
-        height: 1,
-      }),
-    );
-
-    const guardrailCategories = ['CONTENT_FILTER', 'DENIED_TOPIC', 'SENSITIVE_INFO', 'WORD_FILTER'];
-    teamDashboard.addWidgets(
-      new cloudwatch.GraphWidget({
-        title: 'Guardrail Triggers by Category',
-        left: guardrailCategories.map((category) =>
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'GuardrailTriggerCount',
-            dimensionsMap: { TriggerCategory: category },
-            statistic: 'Sum',
-            period: DEFAULT_PERIOD,
-            label: category,
-          }),
-        ),
-        width: 12,
-        height: 6,
-        leftYAxis: { min: 0, label: 'Triggers' },
-        view: cloudwatch.GraphWidgetView.BAR,
-      }),
-      new cloudwatch.GraphWidget({
-        title: 'Guardrail Actions: Block vs Anonymize',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'GuardrailBlockCount',
-            statistic: 'Sum',
-            period: DEFAULT_PERIOD,
-            label: 'Blocked',
-          }),
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'GuardrailAnonymizeCount',
-            statistic: 'Sum',
-            period: DEFAULT_PERIOD,
-            label: 'Anonymized',
-          }),
-        ],
-        width: 12,
-        height: 6,
-        leftYAxis: { min: 0, label: 'Count' },
-      }),
-    );
-
-    // =======================================================
-    // Team Dashboard: MCP Tool Governance (Pillar 3)
-    // =======================================================
-    teamDashboard.addWidgets(
-      new cloudwatch.TextWidget({
-        markdown: '### MCP Tool Governance',
-        width: 24,
-        height: 1,
-      }),
-    );
-
-    teamDashboard.addWidgets(
-      new cloudwatch.GraphWidget({
-        title: 'MCP Tool Call Volume',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'MCPToolCallCount',
-            statistic: 'Sum',
-            period: DEFAULT_PERIOD,
-            label: 'Tool Calls',
-          }),
-        ],
-        width: 12,
-        height: 6,
-        leftYAxis: { min: 0, label: 'Calls' },
-      }),
-      new cloudwatch.GraphWidget({
-        title: 'MCP Auth Denied Rate',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'MCPAuthDeniedCount',
-            statistic: 'Sum',
-            period: DEFAULT_PERIOD,
-            label: 'Denied Calls',
-          }),
-        ],
-        width: 12,
-        height: 6,
-        leftYAxis: { min: 0, label: 'Denied' },
-      }),
-    );
-
-    // =======================================================
-    // Team Dashboard: Cost Intelligence (Pillar 5)
-    // =======================================================
-    teamDashboard.addWidgets(
-      new cloudwatch.TextWidget({
-        markdown: '### Cost Intelligence',
-        width: 24,
-        height: 1,
-      }),
-    );
-
-    teamDashboard.addWidgets(
-      new cloudwatch.GraphWidget({
-        title: 'Bedrock Cost (USD)',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'BedrockCostUSD',
-            statistic: 'Sum',
-            period: cdk.Duration.days(1),
-            label: 'Daily Cost ($)',
-          }),
-        ],
-        width: 12,
-        height: 6,
-        leftYAxis: { min: 0, label: 'USD' },
-      }),
-      new cloudwatch.GraphWidget({
-        title: 'Token Efficiency',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'TokenEfficiency',
-            statistic: 'Average',
-            period: cdk.Duration.days(1),
-            label: 'Tokens per Line Changed',
-          }),
-        ],
-        width: 12,
-        height: 6,
-        leftYAxis: { min: 0, label: 'Tokens/Line' },
-      }),
-    );
-
-    // =======================================================
-    // Team Dashboard: AI Attribution (Pillar 7)
-    // =======================================================
-    teamDashboard.addWidgets(
-      new cloudwatch.TextWidget({
-        markdown: '### AI Attribution & Quality',
-        width: 24,
-        height: 1,
-      }),
-    );
-
-    teamDashboard.addWidgets(
-      new cloudwatch.GraphWidget({
-        title: 'Defect Rate: AI vs Human Code',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'PostMergeDefectRateAI',
-            statistic: 'Average',
-            period: cdk.Duration.days(1),
-            label: 'AI Code Defect Rate (%)',
-          }),
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'PostMergeDefectRateHuman',
-            statistic: 'Average',
-            period: cdk.Duration.days(1),
-            label: 'Human Code Defect Rate (%)',
-          }),
-        ],
-        width: 12,
-        height: 6,
-        leftYAxis: { min: 0, label: 'Defect Rate (%)' },
-      }),
-      new cloudwatch.GraphWidget({
-        title: 'Spec-to-Code Hours',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'SpecToCodeHours',
-            statistic: 'Average',
-            period: cdk.Duration.days(1),
-            label: 'Avg Hours',
-          }),
-        ],
-        width: 12,
-        height: 6,
-        leftYAxis: { min: 0, label: 'Hours' },
-      }),
-    );
-
-    // =======================================================
-    // Team Dashboard: Security Agent Findings
-    // =======================================================
-    teamDashboard.addWidgets(
-      new cloudwatch.TextWidget({
-        markdown: '### Security Agent Findings',
-        width: 24,
-        height: 1,
-      }),
-    );
-
-    teamDashboard.addWidgets(
-      new cloudwatch.SingleValueWidget({
-        title: 'Open Critical/High Findings',
-        metrics: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'SecurityCriticalFindingCount',
-            statistic: 'Sum',
-            period: cdk.Duration.days(7),
-            label: 'Critical + High',
-          }),
-        ],
-        width: 6,
-        height: 4,
-      }),
-      new cloudwatch.GraphWidget({
-        title: 'Finding Trend by Severity',
-        left: ['CRITICAL', 'HIGH', 'MEDIUM', 'LOW'].map((severity) =>
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'SecurityFindingCount',
-            dimensionsMap: { Severity: severity },
-            statistic: 'Sum',
-            period: cdk.Duration.days(1),
-            label: severity,
-          }),
-        ),
-        width: 8,
-        height: 4,
-        leftYAxis: { min: 0, label: 'Findings' },
-      }),
-      new cloudwatch.SingleValueWidget({
-        title: 'Avg Remediation (hrs)',
-        metrics: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'SecurityRemediationTimeHours',
-            statistic: 'Average',
-            period: cdk.Duration.days(7),
-            label: 'Hours',
-          }),
-        ],
-        width: 4,
-        height: 4,
-      }),
-    );
-
-    teamDashboard.addWidgets(
-      new cloudwatch.GraphWidget({
-        title: 'Findings: AI vs Human Code',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'SecurityFindingByOrigin',
-            dimensionsMap: { AIOrigin: 'ai-assisted' },
-            statistic: 'Sum',
-            period: cdk.Duration.days(1),
-            label: 'AI Code',
-          }),
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'SecurityFindingByOrigin',
-            dimensionsMap: { AIOrigin: 'human' },
-            statistic: 'Sum',
-            period: cdk.Duration.days(1),
-            label: 'Human Code',
-          }),
-        ],
-        width: 12,
-        height: 6,
-        leftYAxis: { min: 0, label: 'Findings' },
-      }),
-      new cloudwatch.GraphWidget({
-        title: 'Remediation Time: AI vs Human',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'SecurityRemediationTimeHours',
-            dimensionsMap: { AIOrigin: 'ai-assisted' },
-            statistic: 'Average',
-            period: cdk.Duration.days(1),
-            label: 'AI Code Fix Time (hrs)',
-          }),
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'SecurityRemediationTimeHours',
-            dimensionsMap: { AIOrigin: 'human' },
-            statistic: 'Average',
-            period: cdk.Duration.days(1),
-            label: 'Human Code Fix Time (hrs)',
-          }),
-        ],
-        width: 12,
-        height: 6,
-        leftYAxis: { min: 0, label: 'Hours' },
-      }),
-    );
-
-    teamDashboard.addWidgets(
-      new cloudwatch.GraphWidget({
-        title: 'Findings by Phase',
-        left: ['design_review', 'code_review', 'pen_test'].map((phase) =>
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'SecurityFindingCount',
-            dimensionsMap: { Phase: phase },
-            statistic: 'Sum',
-            period: cdk.Duration.days(7),
-            label: phase.replace('_', ' '),
+      new cloudwatch.GraphWidget({
+        title: 'Merge Ratio: AI vs Human',
+        left: [
+          // Both lines from attribution spans. Divergence is the signal:
+          // AI code merging at a materially lower rate than human code means
+          // review friction or quality problems, not just "AI is used a lot".
+          new cloudwatch.MathExpression({
+            expression: 'FILL(IF(FILL(aiCommits, 0) > 0, 100 * FILL(mergedAi, 0) / FILL(aiCommits, 0)), REPEAT)',
+            usingMetrics: {
+              mergedAi: dailySum('MergedAICommits'),
+              aiCommits: dailySum('AICommits'),
+            },
+            label: 'AI merge rate (%)',
+            period: cdk.Duration.days(1),
           }),
-        ),
-        width: 12,
+          new cloudwatch.MathExpression({
+            expression: 'FILL(IF(FILL(humanCommits, 0) > 0, 100 * FILL(mergedHuman, 0) / FILL(humanCommits, 0)), REPEAT)',
+            usingMetrics: {
+              mergedHuman: dailySum('MergedHumanCommits'),
+              humanCommits: dailySum('HumanCommits'),
+            },
+            label: 'Human merge rate (%)',
+            period: cdk.Duration.days(1),
+          }),
+        ],
+        width: 8,
         height: 6,
-        leftYAxis: { min: 0, label: 'Findings' },
-        view: cloudwatch.GraphWidgetView.BAR,
+        leftYAxis: { min: 0, max: 100, label: 'Percent' },
       }),
       new cloudwatch.GraphWidget({
-        title: 'Security Scan Volume',
+        title: 'AI Defect Trend (reverted / merged)',
         left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'SecurityScanCount',
-            statistic: 'Sum',
+          // RevertedAICommits may not exist at all until the first revert is
+          // published — a metric with zero datums is MISSING, not zero, so the
+          // inner FILL is required or the whole expression renders NaN.
+          new cloudwatch.MathExpression({
+            expression: 'FILL(IF(FILL(mergedAi2, 0) > 0, 100 * FILL(revertedAi, 0) / FILL(mergedAi2, 0)), REPEAT)',
+            usingMetrics: {
+              revertedAi: dailySum('RevertedAICommits'),
+              mergedAi2: dailySum('MergedAICommits'),
+            },
+            label: 'AI defect rate (%)',
             period: cdk.Duration.days(1),
-            label: 'Scans / Day',
           }),
         ],
-        width: 12,
+        right: [dailySum('RevertedAICommits', 'Reverted AI commits')],
+        width: 8,
         height: 6,
-        leftYAxis: { min: 0, label: 'Scans' },
+        leftYAxis: { min: 0, label: 'Percent' },
+        rightYAxis: { min: 0, label: 'Count' },
+      }),
+    );
+
+    if (props?.velocityWidgetArn) {
+      // Row 4: per-repo drill-down — bridges org-level trends above to the
+      // per-concern detail panels below. Attribution store, full history.
+      teamDashboard.addWidgets(velocityPanel('Repository Breakdown (attribution, full history)', 'repos', 7));
+      // Rows 5-8: DDB-backed detail panels
+      teamDashboard.addWidgets(velocityPanel('Eval Gates (auto-discovers rubrics, incl. kiro-headless)', 'eval', 9));
+      teamDashboard.addWidgets(velocityPanel('Governance — Guardrails & MCP (populates during sample-app runs)', 'governance', 7));
+      teamDashboard.addWidgets(velocityPanel('Agent Operations (populates during sample-app runs)', 'agents', 7));
+      teamDashboard.addWidgets(velocityPanel('Security — Continuum Findings & Remediation SLA', 'security', 10));
+    }
+
+    teamDashboard.addWidgets(
+      new cloudwatch.TextWidget({
+        markdown:
+          `Spend, tokens, and per-developer breakdowns: [PRISM-D1-Developer-Productivity](https://${this.region}.console.aws.amazon.com/cloudwatch/home?region=${this.region}#dashboards:name=PRISM-D1-Developer-Productivity)`,
+        width: 24,
+        height: 1,
       }),
     );
 
     // =======================================================
-    // Executive Dashboard: Security & Compliance section
+    // Dashboard 2: Executive Readout
     // =======================================================
+    // Same hybrid approach as Team Velocity, with a stricter bar: this is the
+    // highest-stakes audience, so every widget must be backed by a real
+    // emitter, units are humanized (hours, not seconds), and proxies say so.
+    // Deleted in the rebuild: PRISM Level Progress, AI Cost & Cycle Time,
+    // Feature Cycle Time Trend, Weekly Bedrock Cost, and AI vs Human Defect
+    // Rate — all fed only by `prism-cli workshop generate-demo-data`. Security
+    // collapsed from 7 widgets to 1 panel; CISO Compliance owns the depth.
+    const execDashboard = new cloudwatch.Dashboard(this, 'ExecutiveReadoutDashboard', {
+      dashboardName: 'PRISM-D1-Executive-Readout',
+      defaultInterval: cdk.Duration.days(30),
+    });
+
+    const execPanel = (title: string, view: string, height: number): cloudwatch.CustomWidget =>
+      new cloudwatch.CustomWidget({
+        functionArn: props?.velocityWidgetArn ?? '',
+        title,
+        width: 24,
+        height,
+        params: { view },
+        updateOnRefresh: true,
+        updateOnResize: false,
+        updateOnTimeRangeChange: true,
+      });
+
     execDashboard.addWidgets(
       new cloudwatch.TextWidget({
-        markdown: '### Security & Compliance',
+        markdown:
+          '# PRISM D1 - Executive Readout\n' +
+          'AI adoption, unit economics, delivery health, and security posture. ' +
+          'Delivery figures are merge-based proxies, labeled as such.',
         width: 24,
-        height: 1,
+        height: 2,
       }),
     );
 
+    if (props?.velocityWidgetArn) {
+      // Rows 1-2: observed PRISM level + business KPIs + delivery proxies
+      execDashboard.addWidgets(execPanel('Business Outcomes & Observed Maturity', 'exec', 9));
+    }
+
+    // Row 3: adoption and cost trends (native, attribution/OTEL-fed).
+    // Weekly periods — an exec view wants the trend, not daily noise.
+    const weeklySum = (metricName: string, label?: string): cloudwatch.Metric =>
+      new cloudwatch.Metric({
+        namespace: METRIC_NAMESPACE,
+        metricName,
+        statistic: 'Sum',
+        period: cdk.Duration.days(7),
+        ...(label ? { label } : {}),
+      });
+
     execDashboard.addWidgets(
-      new cloudwatch.SingleValueWidget({
-        title: 'Guardrail Blocks (7d)',
-        metrics: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'GuardrailBlockCount',
-            statistic: 'Sum',
-            period: cdk.Duration.days(7),
-            label: 'Blocks',
-          }),
+      new cloudwatch.GraphWidget({
+        title: 'AI vs Human Commits (Weekly)',
+        left: [
+          weeklySum('AICommits', 'AI commits'),
+          weeklySum('HumanCommits', 'Human commits'),
         ],
-        width: 6,
-        height: 4,
+        view: cloudwatch.GraphWidgetView.BAR,
+        stacked: true,
+        width: 8,
+        height: 6,
+        leftYAxis: { min: 0, label: 'Commits' },
+      }),
+      new cloudwatch.GraphWidget({
+        title: 'AI Spend Trend (Weekly)',
+        left: [weeklySum('AICostUSD', 'Spend ($)')],
+        width: 8,
+        height: 6,
+        leftYAxis: { min: 0, label: 'USD' },
       }),
       new cloudwatch.GraphWidget({
-        title: 'Guardrail Trigger Trend',
+        title: 'Cost per Shipped Commit (Weekly)',
         left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'GuardrailTriggerCount',
-            statistic: 'Sum',
-            period: cdk.Duration.days(1),
-            label: 'Daily Triggers',
+          // The ROI narrative: spend can rise while this falls, which means AI
+          // is getting more efficient per unit of shipped work.
+          new cloudwatch.MathExpression({
+            expression: 'FILL(IF(FILL(execMerged, 0) > 0, FILL(execCost, 0) / FILL(execMerged, 0)), REPEAT)',
+            usingMetrics: {
+              execCost: weeklySum('AICostUSD'),
+              execMerged: weeklySum('MergedAICommits'),
+            },
+            label: '$ / shipped AI commit',
+            period: cdk.Duration.days(7),
           }),
         ],
-        width: 9,
-        height: 4,
-        leftYAxis: { min: 0, label: 'Count' },
+        width: 8,
+        height: 6,
+        leftYAxis: { min: 0, label: 'USD' },
       }),
-      new cloudwatch.SingleValueWidget({
-        title: 'MCP Auth Denied (7d)',
-        metrics: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'MCPAuthDeniedCount',
-            statistic: 'Sum',
+    );
+
+    // Row 4: quality — "is AI code as reliable as human code?"
+    execDashboard.addWidgets(
+      new cloudwatch.GraphWidget({
+        title: 'Merge Rate: AI vs Human (Weekly)',
+        left: [
+          new cloudwatch.MathExpression({
+            expression: 'FILL(IF(FILL(xAi, 0) > 0, 100 * FILL(xMergedAi, 0) / FILL(xAi, 0)), REPEAT)',
+            usingMetrics: { xMergedAi: weeklySum('MergedAICommits'), xAi: weeklySum('AICommits') },
+            label: 'AI merge rate (%)',
+            period: cdk.Duration.days(7),
+          }),
+          new cloudwatch.MathExpression({
+            expression: 'FILL(IF(FILL(xHuman, 0) > 0, 100 * FILL(xMergedHuman, 0) / FILL(xHuman, 0)), REPEAT)',
+            usingMetrics: { xMergedHuman: weeklySum('MergedHumanCommits'), xHuman: weeklySum('HumanCommits') },
+            label: 'Human merge rate (%)',
             period: cdk.Duration.days(7),
-            label: 'Denied',
           }),
         ],
-        width: 3,
-        height: 4,
+        width: 12,
+        height: 6,
+        leftYAxis: { min: 0, max: 100, label: 'Percent' },
       }),
-      new cloudwatch.SingleValueWidget({
-        title: 'Exfiltration Alerts (7d)',
-        metrics: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'ExfiltrationAlertCount',
-            statistic: 'Sum',
+      new cloudwatch.GraphWidget({
+        title: 'AI Defect Trend (Weekly)',
+        left: [
+          // RevertedAICommits may not exist at all until the first revert is
+          // published — a metric with zero datums is missing, not zero, so the
+          // inner FILL is required to avoid a NaN series.
+          new cloudwatch.MathExpression({
+            expression: 'FILL(IF(FILL(xMergedAi2, 0) > 0, 100 * FILL(xReverted, 0) / FILL(xMergedAi2, 0)), REPEAT)',
+            usingMetrics: { xReverted: weeklySum('RevertedAICommits'), xMergedAi2: weeklySum('MergedAICommits') },
+            label: 'AI defect rate (%)',
             period: cdk.Duration.days(7),
-            label: 'Alerts',
           }),
         ],
-        width: 6,
-        height: 4,
+        width: 12,
+        height: 6,
+        leftYAxis: { min: 0, label: 'Percent' },
       }),
     );
 
-    // =======================================================
-    // Executive Dashboard: Cost Intelligence
-    // =======================================================
+    if (props?.velocityWidgetArn) {
+      // Row 5: condensed security posture (CISO dashboard has the breakdowns)
+      execDashboard.addWidgets(execPanel('Security & Governance Posture', 'exec-security', 5));
+    }
+
     execDashboard.addWidgets(
       new cloudwatch.TextWidget({
-        markdown: '### Cost Intelligence',
+        markdown:
+          `Drill down: [Team Velocity](https://${this.region}.console.aws.amazon.com/cloudwatch/home?region=${this.region}#dashboards:name=PRISM-D1-Team-Velocity) (delivery detail) · ` +
+          `[Developer Productivity](https://${this.region}.console.aws.amazon.com/cloudwatch/home?region=${this.region}#dashboards:name=PRISM-D1-Developer-Productivity) (per-developer spend) · ` +
+          `[CISO Compliance](https://${this.region}.console.aws.amazon.com/cloudwatch/home?region=${this.region}#dashboards:name=PRISM-D1-CISO-Compliance) (full security posture)`,
         width: 24,
         height: 1,
       }),
     );
 
-    execDashboard.addWidgets(
-      new cloudwatch.GraphWidget({
-        title: 'Weekly Bedrock Cost',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'BedrockCostUSD',
-            statistic: 'Sum',
-            period: cdk.Duration.days(7),
-            label: 'Weekly Cost ($)',
-          }),
-        ],
-        width: 12,
-        height: 6,
-        leftYAxis: { min: 0, label: 'USD' },
-        view: cloudwatch.GraphWidgetView.BAR,
+    // =======================================================
+    // CloudWatch Alarms
+    // =======================================================
+
+    // NOTE: the PRISM-D1-AIAcceptanceRate-Low alarm was removed along with the
+    // AIAcceptanceRate metric. It could not fire in either direction: the
+    // workflow defaulted a review-less PR to 100% acceptance (so healthy repos
+    // without mandatory review pinned the metric at 100), and the metric's AI
+    // gate was trailer-derived, so it stopped emitting entirely once git hooks
+    // were removed. "Does AI code pass review as well as human code?" is a
+    // comparative question and belongs on a dashboard panel, not an absolute
+    // threshold alarm.
+
+    // Alarm: Eval gate pass rate dropping below 70%
+    new cloudwatch.Alarm(this, 'EvalGatePassRateLowAlarm', {
+      alarmName: 'PRISM-D1-EvalGatePassRate-Low',
+      alarmDescription: 'Eval gate pass rate has dropped below 70%, indicating degraded quality in AI-generated outputs.',
+      metric: new cloudwatch.Metric({
+        namespace: METRIC_NAMESPACE,
+        metricName: 'EvalGatePassRate',
+        statistic: 'Average',
+        period: cdk.Duration.hours(6),
       }),
-      new cloudwatch.SingleValueWidget({
-        title: 'AI vs Human Defect Rate',
-        metrics: [
-          new cloudwatch.Metric({
+      threshold: 70,
+      evaluationPeriods: 3,
+      datapointsToAlarm: 2,
+      comparisonOperator: cloudwatch.ComparisonOperator.LESS_THAN_THRESHOLD,
+      treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING,
+    });
+
+    // Alarm: Change failure rate exceeding 20%.
+    //
+    // Computed as a ratio of two per-merge counters rather than reading a
+    // pre-computed ChangeFailureRate metric. The old source was the weekly
+    // assessment, which baked in a fixed 7-day window and stopped existing when
+    // prism-dora-weekly.yml was removed. Deriving it here means the ratio is
+    // evaluated over the alarm's own window, and both counters are emitted on
+    // every merged PR so a healthy period reads as a real 0% rather than
+    // INSUFFICIENT_DATA.
+    new cloudwatch.Alarm(this, 'ChangeFailureRateHighAlarm', {
+      alarmName: 'PRISM-D1-ChangeFailureRate-High',
+      alarmDescription: 'Change failure rate exceeds 20% (revert/hotfix-titled PRs / merged PRs), indicating deployment quality regression.',
+      metric: new cloudwatch.MathExpression({
+        expression: 'IF(deploys > 0, 100 * fixes / deploys, 0)',
+        usingMetrics: {
+          fixes: new cloudwatch.Metric({
             namespace: METRIC_NAMESPACE,
-            metricName: 'PostMergeDefectRateAI',
-            statistic: 'Average',
-            period: cdk.Duration.days(7),
-            label: 'AI Defect Rate (%)',
+            metricName: 'ChangeFailureCount',
+            statistic: 'Sum',
+            period: cdk.Duration.days(1),
           }),
-          new cloudwatch.Metric({
+          deploys: new cloudwatch.Metric({
             namespace: METRIC_NAMESPACE,
-            metricName: 'PostMergeDefectRateHuman',
-            statistic: 'Average',
-            period: cdk.Duration.days(7),
-            label: 'Human Defect Rate (%)',
+            metricName: 'DeploymentFrequency',
+            statistic: 'Sum',
+            period: cdk.Duration.days(1),
           }),
-        ],
-        width: 6,
-        height: 6,
+        },
+        label: 'Change Failure Rate %',
+        period: cdk.Duration.days(1),
       }),
-    );
+      threshold: 20,
+      evaluationPeriods: 3,
+      datapointsToAlarm: 2,
+      comparisonOperator: cloudwatch.ComparisonOperator.GREATER_THAN_THRESHOLD,
+      treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING,
+    });
 
     // =======================================================
     // Dashboard 3: CISO Compliance
+    //
+    // This dashboard is DEPTH. The Executive Readout owns the headline
+    // posture strip; everything past Row 2 here is detail the exec view
+    // deliberately omits.
+    //
+    // Rows 1-5 are DDB-backed custom widgets rather than metric graphs. The
+    // previous build used metric graphs and three of them could never render:
+    // the metrics publisher emits either the FULL dimension set
+    // ([TeamId, Repository, Phase, Severity, AIOrigin]) or a dimensionless
+    // aggregate copy — never a subset. Widgets querying a partial set
+    // ({AIOrigin} or {Phase} alone) silently matched nothing. Reading events
+    // directly sidesteps dimension matching, and is the only way to surface
+    // compliance_mappings, which is a string array and therefore cannot be a
+    // CloudWatch dimension at all.
     // =======================================================
     const cisoDashboard = new cloudwatch.Dashboard(this, 'CISOComplianceDashboard', {
       dashboardName: 'PRISM-D1-CISO-Compliance',
       defaultInterval: cdk.Duration.days(30),
     });
 
+    const cisoPanel = (title: string, view: string, height: number): cloudwatch.CustomWidget =>
+      new cloudwatch.CustomWidget({
+        functionArn: props?.velocityWidgetArn ?? '',
+        title,
+        width: 24,
+        height,
+        params: { view },
+        updateOnRefresh: true,
+        updateOnResize: false,
+        updateOnTimeRangeChange: true,
+      });
+
     cisoDashboard.addWidgets(
       new cloudwatch.TextWidget({
-        markdown: '# PRISM D1 - CISO Compliance Dashboard\nSecurity posture, remediation SLAs, and AI code risk profile across all teams.',
+        markdown:
+          '# PRISM D1 - CISO Compliance Dashboard\n' +
+          'Security depth: exposure, remediation SLA compliance, AI code risk normalized by ' +
+          'commit volume, shift-left effectiveness, and vulnerability classes. ' +
+          'Headline posture is on **PRISM-D1-Executive-Readout**.',
         width: 24,
-        height: 1,
+        height: 2,
       }),
     );
 
-    cisoDashboard.addWidgets(
-      new cloudwatch.SingleValueWidget({
-        title: 'Open Critical Findings',
-        metrics: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'SecurityCriticalFindingCount',
-            statistic: 'Sum',
-            period: cdk.Duration.days(30),
-            label: 'Critical + High (30d)',
-          }),
-        ],
-        width: 6,
-        height: 4,
-      }),
-      new cloudwatch.SingleValueWidget({
-        title: 'Avg Remediation Time',
-        metrics: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'SecurityRemediationTimeHours',
-            statistic: 'Average',
-            period: cdk.Duration.days(30),
-            label: 'Hours (30d avg)',
-          }),
-        ],
-        width: 6,
-        height: 4,
-      }),
-      new cloudwatch.SingleValueWidget({
-        title: 'Security Scans Run',
-        metrics: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'SecurityScanCount',
-            statistic: 'Sum',
-            period: cdk.Duration.days(30),
-            label: 'Scans (30d)',
-          }),
-        ],
-        width: 6,
-        height: 4,
-      }),
-    );
+    // Row 1 — current exposure
+    cisoDashboard.addWidgets(cisoPanel('Current Exposure', 'ciso-exposure', 5));
+
+    // Row 2 — remediation SLA compliance (SECURITY-09 budgets)
+    cisoDashboard.addWidgets(cisoPanel('Remediation SLA Compliance', 'ciso-sla', 8));
 
+    // Row 3 — AI code risk, normalized. Raw finding counts are not comparable
+    // across origins; this joins findings to attribution commit volume.
+    cisoDashboard.addWidgets(cisoPanel('AI Code Risk Profile (per 100 commits)', 'ciso-risk', 10));
+
+    // Row 4 — shift-left effectiveness, incl. computed finding survival rate
+    cisoDashboard.addWidgets(cisoPanel('Shift-Left Effectiveness', 'ciso-shiftleft', 10));
+
+    // Row 5 — vulnerability classes + compliance framework coverage
+    cisoDashboard.addWidgets(cisoPanel('Vulnerability Classes & Compliance Coverage', 'ciso-classes', 12));
+
+    // Row 6 — runtime governance. These stay native graphs: the guardrail /
+    // MCP / exfiltration metrics are published with a dimensionless copy and
+    // these widgets query dimensionlessly, so they match correctly.
     cisoDashboard.addWidgets(
       new cloudwatch.TextWidget({
-        markdown: '### AI Code Risk Profile',
+        markdown: '### Runtime Governance',
         width: 24,
         height: 1,
       }),
@@ -1172,112 +472,69 @@ export class DashboardStack extends cdk.Stack {
 
     cisoDashboard.addWidgets(
       new cloudwatch.GraphWidget({
-        title: 'Security Findings: AI vs Human Code',
+        title: 'Guardrail Triggers vs Blocks',
         left: [
           new cloudwatch.Metric({
             namespace: METRIC_NAMESPACE,
-            metricName: 'SecurityFindingByOrigin',
-            dimensionsMap: { AIOrigin: 'ai-assisted' },
+            metricName: 'GuardrailTriggerCount',
             statistic: 'Sum',
-            period: cdk.Duration.days(7),
-            label: 'AI Code Findings',
+            period: cdk.Duration.days(1),
+            label: 'Triggers',
           }),
           new cloudwatch.Metric({
             namespace: METRIC_NAMESPACE,
-            metricName: 'SecurityFindingByOrigin',
-            dimensionsMap: { AIOrigin: 'human' },
+            metricName: 'GuardrailBlockCount',
             statistic: 'Sum',
-            period: cdk.Duration.days(7),
-            label: 'Human Code Findings',
+            period: cdk.Duration.days(1),
+            label: 'Blocks',
           }),
         ],
-        width: 12,
+        width: 8,
         height: 6,
-        leftYAxis: { min: 0, label: 'Findings' },
+        leftYAxis: { min: 0, label: 'Count' },
       }),
       new cloudwatch.GraphWidget({
-        title: 'Remediation Time by Code Origin',
+        title: 'MCP Authorization Denials',
         left: [
           new cloudwatch.Metric({
             namespace: METRIC_NAMESPACE,
-            metricName: 'SecurityRemediationTimeHours',
-            dimensionsMap: { AIOrigin: 'ai-assisted' },
-            statistic: 'Average',
-            period: cdk.Duration.days(7),
-            label: 'AI Code (hrs)',
-          }),
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'SecurityRemediationTimeHours',
-            dimensionsMap: { AIOrigin: 'human' },
-            statistic: 'Average',
-            period: cdk.Duration.days(7),
-            label: 'Human Code (hrs)',
-          }),
-        ],
-        width: 12,
-        height: 6,
-        leftYAxis: { min: 0, label: 'Hours' },
-      }),
-    );
-
-    cisoDashboard.addWidgets(
-      new cloudwatch.TextWidget({
-        markdown: '### Shift-Left Effectiveness',
-        width: 24,
-        height: 1,
-      }),
-    );
-
-    cisoDashboard.addWidgets(
-      new cloudwatch.GraphWidget({
-        title: 'Findings by Phase (Monthly Trend)',
-        left: ['design_review', 'code_review', 'pen_test'].map((phase) =>
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'SecurityFindingCount',
-            dimensionsMap: { Phase: phase },
+            metricName: 'MCPAuthDeniedCount',
             statistic: 'Sum',
-            period: cdk.Duration.days(7),
-            label: phase.replace('_', ' '),
+            period: cdk.Duration.days(1),
+            label: 'Out-of-scope tool calls',
           }),
-        ),
-        width: 12,
+        ],
+        width: 8,
         height: 6,
-        leftYAxis: { min: 0, label: 'Findings' },
-        view: cloudwatch.GraphWidgetView.BAR,
+        leftYAxis: { min: 0, label: 'Count' },
       }),
       new cloudwatch.GraphWidget({
-        title: 'Guardrail + Exfiltration Trends',
+        title: 'Exfiltration Alerts',
         left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'GuardrailBlockCount',
-            statistic: 'Sum',
-            period: cdk.Duration.days(7),
-            label: 'Guardrail Blocks',
-          }),
           new cloudwatch.Metric({
             namespace: METRIC_NAMESPACE,
             metricName: 'ExfiltrationAlertCount',
             statistic: 'Sum',
-            period: cdk.Duration.days(7),
-            label: 'Exfiltration Alerts',
-          }),
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'MCPAuthDeniedCount',
-            statistic: 'Sum',
-            period: cdk.Duration.days(7),
-            label: 'MCP Auth Denied',
+            period: cdk.Duration.days(1),
+            label: 'Alerts',
           }),
         ],
-        width: 12,
+        width: 8,
         height: 6,
         leftYAxis: { min: 0, label: 'Count' },
       }),
     );
 
+    cisoDashboard.addWidgets(
+      new cloudwatch.TextWidget({
+        markdown:
+          `**Related:** [Executive Readout](https://${this.region}.console.aws.amazon.com/cloudwatch/home?region=${this.region}#dashboards:name=PRISM-D1-Executive-Readout) (headline posture) · ` +
+          `[Team Velocity](https://${this.region}.console.aws.amazon.com/cloudwatch/home?region=${this.region}#dashboards:name=PRISM-D1-Team-Velocity) (per-repo delivery and security)`,
+        width: 24,
+        height: 2,
+      }),
+    );
+
     new cdk.CfnOutput(this, 'CISODashboardUrl', {
       value: `https://${this.region}.console.aws.amazon.com/cloudwatch/home?region=${this.region}#dashboards:name=PRISM-D1-CISO-Compliance`,
       description: 'CISO Compliance Dashboard URL',
@@ -1353,13 +610,17 @@ export class DashboardStack extends cdk.Stack {
       treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING,
     });
 
-    // Alarm: Daily Bedrock cost exceeding budget
+    // Alarm: Daily AI cost exceeding budget.
+    // Watches AICostUSD (real — otel-metrics-publisher from codeburn usage
+    // spans) rather than BedrockCostUSD, which has no emitter outside
+    // `prism-cli workshop generate-demo-data` and left this alarm permanently
+    // in INSUFFICIENT_DATA.
     new cloudwatch.Alarm(this, 'BedrockDailyCostHighAlarm', {
-      alarmName: 'PRISM-D1-BedrockDailyCost-High',
-      alarmDescription: 'Daily Bedrock cost exceeds $100 threshold.',
+      alarmName: 'PRISM-D1-AIDailyCost-High',
+      alarmDescription: 'Daily AI tooling cost exceeds the $100 threshold.',
       metric: new cloudwatch.Metric({
         namespace: METRIC_NAMESPACE,
-        metricName: 'BedrockCostUSD',
+        metricName: 'AICostUSD',
         statistic: 'Sum',
         period: cdk.Duration.days(1),
       }),
@@ -1369,22 +630,10 @@ export class DashboardStack extends cdk.Stack {
       treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING,
     });
 
-    // Alarm: Token efficiency below threshold
-    new cloudwatch.Alarm(this, 'TokenEfficiencyLowAlarm', {
-      alarmName: 'PRISM-D1-TokenEfficiency-Low',
-      alarmDescription: 'Token efficiency is low — high token consumption relative to code output.',
-      metric: new cloudwatch.Metric({
-        namespace: METRIC_NAMESPACE,
-        metricName: 'TokenEfficiency',
-        statistic: 'Average',
-        period: cdk.Duration.hours(6),
-      }),
-      threshold: 500,
-      evaluationPeriods: 3,
-      datapointsToAlarm: 2,
-      comparisonOperator: cloudwatch.ComparisonOperator.GREATER_THAN_THRESHOLD,
-      treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING,
-    });
+    // NOTE: a TokenEfficiency alarm was removed here. The metric (tokens per
+    // line changed) has no emitter — the only source is `prism-cli workshop
+    // generate-demo-data` — so the alarm sat in INSUFFICIENT_DATA permanently.
+    // Reinstate it if/when a real emitter computes tokens-per-line.
 
     // Alarm: Exfiltration detection
     new cloudwatch.Alarm(this, 'ExfiltrationAlertAlarm', {
@@ -1403,11 +652,13 @@ export class DashboardStack extends cdk.Stack {
     });
 
     // Alarm: Agent success rate dropping below 80%
+    // Uses the dimensionless aggregate series (dual-published by the
+    // processor). The previous TeamId=ALL/Repository=ALL dimensions never
+    // matched real events, so the alarm sat in INSUFFICIENT_DATA forever.
     new cloudwatch.Alarm(this, 'AgentSuccessRateAlarm', {
       metric: new cloudwatch.Metric({
         namespace: METRIC_NAMESPACE,
         metricName: 'AgentSuccessRate',
-        dimensionsMap: { TeamId: teamId, Repository: repository },
         statistic: 'Average',
         period: cdk.Duration.hours(1),
       }),
@@ -1415,7 +666,7 @@ export class DashboardStack extends cdk.Stack {
       evaluationPeriods: 3,
       comparisonOperator: cloudwatch.ComparisonOperator.LESS_THAN_THRESHOLD,
       alarmDescription: 'Agent success rate below 80% for 3 consecutive hours',
-      alarmName: `prism-d1-${teamId}-agent-success-rate`,
+      alarmName: 'prism-d1-agent-success-rate',
     });
 
     // -------------------------------------------------------
@@ -1430,5 +681,151 @@ export class DashboardStack extends cdk.Stack {
       value: `https://${this.region}.console.aws.amazon.com/cloudwatch/home?region=${this.region}#dashboards:name=PRISM-D1-Executive-Readout`,
       description: 'Executive Readout Dashboard URL',
     });
+
+    // =======================================================
+    // Dashboard 3: Developer Productivity (attribution store)
+    // Only created when the OTEL collector (and its custom-widget
+    // Lambda) is deployed.
+    // =======================================================
+    if (props?.productivityWidgetArn) {
+      // Type-in filter for the detail row. PATTERN variables literal-replace
+      // the token below anywhere in the dashboard JSON, so the token must be
+      // unique. Default 'all' = organization scope.
+      const USER_TOKEN = 'PRISM_USER_FILTER_TOKEN';
+      const devDashboard = new cloudwatch.Dashboard(this, 'DeveloperProductivityDashboard', {
+        dashboardName: 'PRISM-D1-Developer-Productivity',
+        defaultInterval: cdk.Duration.days(30),
+        variables: [
+          new cloudwatch.DashboardVariable({
+            id: 'devFilter',
+            label: 'Developer',
+            type: cloudwatch.VariableType.PATTERN,
+            value: USER_TOKEN,
+            inputType: cloudwatch.VariableInputType.INPUT,
+            defaultValue: cloudwatch.DefaultValue.value('all'),
+            visible: true,
+          }),
+        ],
+      });
+
+      devDashboard.addWidgets(
+        new cloudwatch.TextWidget({
+          markdown:
+            '# PRISM D1 - Developer Productivity\n' +
+            'Rows 1-2: org metrics (CloudWatch, 2-week ingestion window applies to backfills). ' +
+            'Rows 3-4: attribution store — full history, real commit timestamps. ' +
+            'Type a developer email into the **Developer** variable (default `all`) to scope the detail row.',
+          width: 24,
+          height: 2,
+        }),
+      );
+
+      // --- Row 1: Org KPIs (NaN-guarded metric math, follow time range) ---
+      const dailyMetric = (metricName: string, id: string): cloudwatch.Metric =>
+        new cloudwatch.Metric({
+          namespace: METRIC_NAMESPACE,
+          metricName,
+          statistic: 'Sum',
+          period: cdk.Duration.days(1),
+          label: id,
+        });
+      const ratioKpi = (title: string, expression: string, using: Record<string, cloudwatch.IMetric>): cloudwatch.SingleValueWidget =>
+        new cloudwatch.SingleValueWidget({
+          title,
+          metrics: [new cloudwatch.MathExpression({ expression, usingMetrics: using, label: title, period: cdk.Duration.days(1) })],
+          setPeriodToTimeRange: true,
+          width: 6,
+          height: 4,
+        });
+
+      devDashboard.addWidgets(
+        ratioKpi('AI Share of Commits (%)', 'IF(FILL(kTotal, 0) > 0, 100 * FILL(kAi, 0) / FILL(kTotal, 0))', {
+          kAi: dailyMetric('AICommits', 'kAi'), kTotal: dailyMetric('CommitsTotal', 'kTotal'),
+        }),
+        ratioKpi('AI Merge Rate (%)', 'IF(FILL(kAi2, 0) > 0, 100 * FILL(kMerged, 0) / FILL(kAi2, 0))', {
+          kMerged: dailyMetric('MergedAICommits', 'kMerged'), kAi2: dailyMetric('AICommits', 'kAi2'),
+        }),
+        ratioKpi('Cost per Shipped Commit ($)', 'IF(FILL(kMerged2, 0) > 0, FILL(kCost, 0) / FILL(kMerged2, 0))', {
+          kCost: dailyMetric('AICostUSD', 'kCost'), kMerged2: dailyMetric('MergedAICommits', 'kMerged2'),
+        }),
+        new cloudwatch.SingleValueWidget({
+          title: 'AI Spend (range, $)',
+          metrics: [dailyMetric('AICostUSD', 'AI Spend')],
+          setPeriodToTimeRange: true,
+          width: 6,
+          height: 4,
+        }),
+      );
+
+      // --- Row 2: Org trends (native interactive charts) ---
+      devDashboard.addWidgets(
+        new cloudwatch.GraphWidget({
+          title: 'Commits / Day (AI vs Human)',
+          left: [
+            dailyMetric('AICommits', 'AI commits'),
+            dailyMetric('HumanCommits', 'Human commits'),
+          ],
+          view: cloudwatch.GraphWidgetView.BAR,
+          stacked: true,
+          width: 8,
+          height: 6,
+          leftYAxis: { min: 0, label: 'Commits' },
+        }),
+        new cloudwatch.GraphWidget({
+          title: 'AI Spend / Day',
+          left: [dailyMetric('AICostUSD', 'Spend ($)')],
+          width: 8,
+          height: 6,
+          leftYAxis: { min: 0, label: 'USD' },
+        }),
+        new cloudwatch.GraphWidget({
+          title: 'AI Merge Ratio Trend',
+          left: [
+            new cloudwatch.MathExpression({
+              expression: 'FILL(IF(FILL(tAi, 0) > 0, 100 * FILL(tMerged, 0) / FILL(tAi, 0)), REPEAT)',
+              usingMetrics: { tMerged: dailyMetric('MergedAICommits', 'tMerged'), tAi: dailyMetric('AICommits', 'tAi') },
+              label: 'Merge ratio (%)',
+              period: cdk.Duration.days(1),
+            }),
+          ],
+          width: 8,
+          height: 6,
+          leftYAxis: { min: 0, max: 100, label: 'Percent' },
+        }),
+      );
+
+      // --- Row 3: Team comparison table (custom widget, view=table) ---
+      devDashboard.addWidgets(
+        new cloudwatch.CustomWidget({
+          functionArn: props.productivityWidgetArn,
+          title: 'Team Comparison (full history)',
+          width: 24,
+          height: 8,
+          params: { view: 'table' },
+          updateOnRefresh: true,
+          updateOnResize: false,
+          updateOnTimeRangeChange: true,
+        }),
+      );
+
+      // --- Row 4: Detail panel (custom widget, view=detail, follows filter) ---
+      devDashboard.addWidgets(
+        new cloudwatch.CustomWidget({
+          functionArn: props.productivityWidgetArn,
+          title: 'Detail: By Tool / By Model / Ratios',
+          width: 24,
+          height: 8,
+          params: { view: 'detail', user: USER_TOKEN },
+          updateOnRefresh: true,
+          updateOnResize: false,
+          updateOnTimeRangeChange: true,
+        }),
+      );
+
+      new cdk.CfnOutput(this, 'DevProductivityDashboardUrl', {
+        value: `https://${this.region}.console.aws.amazon.com/cloudwatch/home?region=${this.region}#dashboards:name=PRISM-D1-Developer-Productivity`,
+        description: 'Developer Productivity Dashboard URL',
+      });
+    }
   }
 }