@prism-d1/cli 1.0.79 → 1.0.80

package/dist/assets/github-workflows/prism-ai-metrics.yml

@@ -1,12 +1,30 @@
-# prism-ai-metrics.yml — Emit AI-assisted development metrics on PR merge.
+# prism-ai-metrics.yml — Per-merge delivery telemetry.
 #
 # Copy this file to .github/workflows/prism-ai-metrics.yml in your repo.
 #
+# DESIGN: this workflow emits immutable per-PR FACTS and computes no rates.
+# Every aggregation (frequency, averages, change-failure rate, MTTR) happens at
+# query time in the dashboard widgets. That means:
+#   - the dashboard's time-range picker applies to every KPI uniformly
+#   - no metric bakes in a fixed window (the old weekly job hardcoded 7 days)
+#   - lead-time distribution survives, so p50/p95 stay computable
+#
+# AI origin is deliberately NOT computed here. It is resolved at render time by
+# joining `pr.commit_shas` against the codeburn attribution store. Origin
+# verdicts computed at merge time are frequently wrong, because attribution
+# syncs on a ~12h schedule and may not yet cover these commits. See
+# docs/data-architecture.md → "AI Origin Resolution: Deferred Attribution Join".
+#
+# Replaces the former prism-dora-weekly.yml, which computed a parallel 7-day
+# aggregate from the GitHub API. That duplicated deployment-frequency
+# measurement, disagreed with this workflow on `master`-based repos, and
+# published six CloudWatch metrics no dashboard read.
+#
 # Required setup:
 #   - OIDC provider configured for GitHub Actions in your AWS account
 #   - IAM role with events:PutEvents on the prism-d1-metrics bus
 #   - Repository secret PRISM_METRICS_ROLE_ARN set to the OIDC role ARN
-#   - .prism/config.json committed to the repo (created by: bash prism-cli bootstrapper install-git-hooks)
+#   - .prism/config.json committed to the repo (optional; defaults to no_team)
 
 name: PRISM AI Metrics
 
@@ -28,6 +46,8 @@ jobs:
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
+          # Full history is required: `git rev-list BASE..HEAD` below needs the
+          # base commit present to enumerate the PR's commit SHAs.
           fetch-depth: 0
 
       - name: Configure AWS credentials (OIDC)
@@ -44,178 +64,111 @@ jobs:
           else
             TEAM_ID=""
           fi
+          # Missing config is not fatal — emit under no_team rather than failing
+          # the run and losing this PR's facts permanently.
           if [[ -z "${TEAM_ID}" ]]; then
             TEAM_ID="no_team"
           fi
           echo "team_id=${TEAM_ID}" >> "$GITHUB_OUTPUT"
 
-      - name: Calculate AI-to-merge ratio
-        id: ai-ratio
+      - name: Collect PR facts
+        id: facts
+        env:
+          # PR titles are attacker-controlled. Bind to env and match with
+          # printf rather than interpolating into the shell (script injection).
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          CREATED_AT: ${{ github.event.pull_request.created_at }}
+          MERGED_AT: ${{ github.event.pull_request.merged_at }}
         run: |
+          set -uo pipefail
           BASE_SHA="${{ github.event.pull_request.base.sha }}"
           HEAD_SHA="${{ github.event.pull_request.merge_commit_sha }}"
 
-          TOTAL_COMMITS=$(git rev-list --count "${BASE_SHA}..${HEAD_SHA}")
-
-          # Count AI origin per-commit (not per-line) to avoid overcounting
-          AI_GENERATED=0
-          AI_ASSISTED=0
-          HUMAN_ONLY=0
-          TOTAL_INPUT_TOKENS=0
-          TOTAL_OUTPUT_TOKENS=0
-          TOTAL_COST="0"
-          for SHA in $(git rev-list "${BASE_SHA}..${HEAD_SHA}"); do
-            MSG=$(git log -1 --format='%B' "${SHA}")
-            if echo "${MSG}" | grep -q '^AI-Origin: ai-generated'; then
-              AI_GENERATED=$((AI_GENERATED + 1))
-            elif echo "${MSG}" | grep -q '^AI-Origin: ai-assisted'; then
-              AI_ASSISTED=$((AI_ASSISTED + 1))
-            elif echo "${MSG}" | grep -q '^AI-Origin: human'; then
-              HUMAN_ONLY=$((HUMAN_ONLY + 1))
-            fi
-
-            # Accumulate token usage trailers (clamped to prevent injection)
-            INPUT_T=$(echo "${MSG}" | grep -oP '(?<=^AI-Input-Tokens: )\d+' || echo "0")
-            OUTPUT_T=$(echo "${MSG}" | grep -oP '(?<=^AI-Output-Tokens: )\d+' || echo "0")
-            COST_T=$(echo "${MSG}" | grep -oP '(?<=^AI-Cost: )[0-9.]+' || echo "0")
-            [[ ${INPUT_T} -gt 1000000 ]] && INPUT_T=0
-            [[ ${OUTPUT_T} -gt 1000000 ]] && OUTPUT_T=0
-            (( $(echo "${COST_T} > 100" | bc -l) )) && COST_T=0
-            TOTAL_INPUT_TOKENS=$((TOTAL_INPUT_TOKENS + INPUT_T))
-            TOTAL_OUTPUT_TOKENS=$((TOTAL_OUTPUT_TOKENS + OUTPUT_T))
-            TOTAL_COST=$(echo "${TOTAL_COST} + ${COST_T}" | bc -l)
-          done
-
-          AI_COMMITS=$((AI_GENERATED + AI_ASSISTED))
-          if [[ "${TOTAL_COMMITS}" -gt 0 ]]; then
-            AI_RATIO=$(echo "scale=4; ${AI_COMMITS} / ${TOTAL_COMMITS}" | bc -l | sed 's/^\./0./')
-          else
-            AI_RATIO="0"
-          fi
-
-          # Detect tools used
-          TOOLS_USED=$(git log "${BASE_SHA}..${HEAD_SHA}" --format='%B' | grep '^AI-Origin:' | sort -u | head -5 | tr '\n' ',' | sed 's/,$//')
-
-          echo "total_commits=${TOTAL_COMMITS}" >> "$GITHUB_OUTPUT"
-          echo "ai_commits=${AI_COMMITS}" >> "$GITHUB_OUTPUT"
-          echo "ai_ratio=${AI_RATIO}" >> "$GITHUB_OUTPUT"
-          echo "ai_generated=${AI_GENERATED}" >> "$GITHUB_OUTPUT"
-          echo "ai_assisted=${AI_ASSISTED}" >> "$GITHUB_OUTPUT"
-          echo "human_only=${HUMAN_ONLY}" >> "$GITHUB_OUTPUT"
-          echo "total_input_tokens=${TOTAL_INPUT_TOKENS}" >> "$GITHUB_OUTPUT"
-          echo "total_output_tokens=${TOTAL_OUTPUT_TOKENS}" >> "$GITHUB_OUTPUT"
-          echo "total_cost=${TOTAL_COST}" >> "$GITHUB_OUTPUT"
-
-      - name: Calculate lead time
-        id: lead-time
-        run: |
-          CREATED_AT="${{ github.event.pull_request.created_at }}"
-          MERGED_AT="${{ github.event.pull_request.merged_at }}"
+          # --- Commit SHAs: immutable facts for deferred origin resolution.
+          # Capped at 50 to bound the event size and the render-time join.
+          COMMIT_SHAS=$(git rev-list "${BASE_SHA}..${HEAD_SHA}" 2>/dev/null | head -50 | jq -R . | jq -sc . || echo '[]')
+          TOTAL_COMMITS=$(git rev-list --count "${BASE_SHA}..${HEAD_SHA}" 2>/dev/null || echo 0)
 
+          # --- Lead time: PR open → merge. From the event payload, not git, so
+          # it is unaffected by rebases and squashes.
           CREATED_TS=$(date -d "${CREATED_AT}" +%s 2>/dev/null || date -jf "%Y-%m-%dT%H:%M:%SZ" "${CREATED_AT}" +%s)
           MERGED_TS=$(date -d "${MERGED_AT}" +%s 2>/dev/null || date -jf "%Y-%m-%dT%H:%M:%SZ" "${MERGED_AT}" +%s)
-
           LEAD_TIME_SECONDS=$((MERGED_TS - CREATED_TS))
-          LEAD_TIME_HOURS=$(echo "scale=2; ${LEAD_TIME_SECONDS} / 3600" | bc -l | sed 's/^\./0./')
+          [[ "${LEAD_TIME_SECONDS}" -lt 0 ]] && LEAD_TIME_SECONDS=0
+
+          # --- Failure-fix label: the change-failure-rate NUMERATOR, emitted as
+          # a per-PR boolean. The rate itself (and MTTR, the mean lead time of
+          # labelled PRs) is computed at query time over the dashboard's window.
+          # Still a title heuristic — it misses failures that aren't named.
+          if printf '%s' "${PR_TITLE}" | grep -qiE 'revert|hotfix|rollback'; then
+            IS_FAILURE_FIX=true
+          else
+            IS_FAILURE_FIX=false
+          fi
 
+          echo "commit_shas=${COMMIT_SHAS}" >> "$GITHUB_OUTPUT"
+          echo "total_commits=${TOTAL_COMMITS}" >> "$GITHUB_OUTPUT"
           echo "lead_time_seconds=${LEAD_TIME_SECONDS}" >> "$GITHUB_OUTPUT"
-          echo "lead_time_hours=${LEAD_TIME_HOURS}" >> "$GITHUB_OUTPUT"
+          echo "is_failure_fix=${IS_FAILURE_FIX}" >> "$GITHUB_OUTPUT"
 
-      - name: Calculate AI acceptance rate
-        id: acceptance
+      - name: Collect review verdicts
+        id: reviews
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
+          set -uo pipefail
           PR_NUMBER="${{ github.event.pull_request.number }}"
           REPO="${{ github.repository }}"
 
-          # Get review decisions for this PR
+          # Raw counts only. The approval RATE is derived at query time, where it
+          # can be compared against the human-origin baseline — an absolute
+          # approval rate answers no useful question on its own.
           REVIEWS=$(gh api "repos/${REPO}/pulls/${PR_NUMBER}/reviews" \
             --jq '[.[] | select(.state == "APPROVED" or .state == "CHANGES_REQUESTED")]' 2>/dev/null || echo "[]")
 
           APPROVED=$(echo "${REVIEWS}" | jq '[.[] | select(.state == "APPROVED")] | length')
           CHANGES_REQUESTED=$(echo "${REVIEWS}" | jq '[.[] | select(.state == "CHANGES_REQUESTED")] | length')
-          TOTAL_REVIEWS=$((APPROVED + CHANGES_REQUESTED))
 
-          if [[ "${TOTAL_REVIEWS}" -gt 0 ]]; then
-            ACCEPTANCE_RATE=$(echo "scale=4; ${APPROVED} / ${TOTAL_REVIEWS}" | bc -l | sed 's/^\./0./')
-          else
-            ACCEPTANCE_RATE="1"  # No reviews = accepted by default
-          fi
-
-          # Only meaningful for AI PRs
-          AI_RATIO="${{ steps.ai-ratio.outputs.ai_ratio }}"
-          if [[ $(echo "${AI_RATIO} > 0" | bc -l) -eq 1 ]]; then
-            AI_ACCEPTANCE_RATE="${ACCEPTANCE_RATE}"
-          else
-            AI_ACCEPTANCE_RATE=""
-          fi
-
-          echo "acceptance_rate=${ACCEPTANCE_RATE}" >> "$GITHUB_OUTPUT"
-          echo "ai_acceptance_rate=${AI_ACCEPTANCE_RATE}" >> "$GITHUB_OUTPUT"
           echo "approved=${APPROVED}" >> "$GITHUB_OUTPUT"
           echo "changes_requested=${CHANGES_REQUESTED}" >> "$GITHUB_OUTPUT"
 
       - name: Emit prism.d1.pr event
         run: |
           TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
-          TEAM_ID="${{ steps.prism-config.outputs.team_id }}"
-          REPO="${{ github.repository }}"
 
           PR_EVENT=$(jq -n \
-            --arg team_id "${TEAM_ID}" \
-            --arg repo "${REPO}" \
+            --arg team_id "${{ steps.prism-config.outputs.team_id }}" \
+            --arg repo "${{ github.repository }}" \
             --arg timestamp "${TIMESTAMP}" \
-            --argjson ai_ratio "${{ steps.ai-ratio.outputs.ai_ratio }}" \
-            --argjson total_commits "${{ steps.ai-ratio.outputs.total_commits }}" \
-            --argjson ai_commits "${{ steps.ai-ratio.outputs.ai_commits }}" \
-            --argjson ai_generated "${{ steps.ai-ratio.outputs.ai_generated }}" \
-            --argjson ai_assisted "${{ steps.ai-ratio.outputs.ai_assisted }}" \
-            --argjson lead_time_seconds "${{ steps.lead-time.outputs.lead_time_seconds }}" \
+            --argjson lead_time_seconds "${{ steps.facts.outputs.lead_time_seconds }}" \
+            --argjson is_failure_fix "${{ steps.facts.outputs.is_failure_fix }}" \
+            --argjson total_commits "${{ steps.facts.outputs.total_commits }}" \
+            --argjson commit_shas '${{ steps.facts.outputs.commit_shas }}' \
             --arg pr_number "${{ github.event.pull_request.number }}" \
             --arg pr_author "${{ github.event.pull_request.user.login }}" \
-            --argjson approved "${{ steps.acceptance.outputs.approved }}" \
-            --argjson changes_requested "${{ steps.acceptance.outputs.changes_requested }}" \
-            --arg acceptance_rate "${{ steps.acceptance.outputs.acceptance_rate }}" \
-            --arg ai_acceptance_rate "${{ steps.acceptance.outputs.ai_acceptance_rate }}" \
-            --argjson total_input_tokens "${{ steps.ai-ratio.outputs.total_input_tokens }}" \
-            --argjson total_output_tokens "${{ steps.ai-ratio.outputs.total_output_tokens }}" \
-            --arg total_cost "${{ steps.ai-ratio.outputs.total_cost }}" \
+            --argjson approved "${{ steps.reviews.outputs.approved }}" \
+            --argjson changes_requested "${{ steps.reviews.outputs.changes_requested }}" \
             '{
               "team_id": $team_id,
               "repo": $repo,
               "timestamp": $timestamp,
               "prism_level": 2,
               "metric": {
-                "name": "ai_to_merge_ratio",
-                "value": $ai_ratio,
-                "unit": "ratio"
-              },
-              "ai_context": {
-                "tool": "github-actions",
-                "model": "n/a",
-                "origin": (if $ai_ratio > 0.5 then "ai-assisted" elif $ai_ratio > 0 then "ai-assisted" else "human" end)
+                "name": "pr_merged",
+                "value": 1,
+                "unit": "count"
               },
               "dora": {
-                "deployment_frequency": 1,
-                "lead_time_seconds": $lead_time_seconds
-              },
-              "ai_dora": {
-                "ai_to_merge_ratio": $ai_ratio,
-                "ai_acceptance_rate": (if $ai_acceptance_rate != "" then ($ai_acceptance_rate | tonumber) else null end),
-                "total_commits": $total_commits,
-                "ai_commits": $ai_commits,
-                "ai_generated_commits": $ai_generated,
-                "ai_assisted_commits": $ai_assisted,
-                "total_input_tokens": $total_input_tokens,
-                "total_output_tokens": $total_output_tokens,
-                "total_cost_usd": (if $total_cost != "0" and $total_cost != "" then ($total_cost | tonumber) else 0 end)
+                "lead_time_seconds": $lead_time_seconds,
+                "is_failure_fix": $is_failure_fix
               },
               "pr": {
                 "number": ($pr_number | tonumber),
                 "author": $pr_author,
                 "reviews_approved": $approved,
-                "reviews_changes_requested": $changes_requested
+                "reviews_changes_requested": $changes_requested,
+                "total_commits": $total_commits,
+                "commit_shas": $commit_shas
               }
             }')
 
@@ -228,10 +181,18 @@ jobs:
               \"Detail\": $(echo "${PR_EVENT}" | jq -c '.' | jq -Rs '.')
             }]"
 
+          echo "Emitted prism.d1.pr for #${{ github.event.pull_request.number }}"
+          echo "  lead time: ${{ steps.facts.outputs.lead_time_seconds }}s"
+          echo "  failure fix: ${{ steps.facts.outputs.is_failure_fix }}"
+          echo "  commit SHAs: ${{ steps.facts.outputs.total_commits }} (origin resolved at render time)"
+
       - name: Emit prism.d1.deploy event
         run: |
           TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
 
+          # Sole deployment signal. `dora.deployment_frequency` lives ONLY here
+          # and not on prism.d1.pr — both events fire on the same merge, so
+          # carrying it on both double-counted the DeploymentFrequency metric.
           DEPLOY_EVENT=$(jq -n \
             --arg team_id "${{ steps.prism-config.outputs.team_id }}" \
             --arg repo "${{ github.repository }}" \

package/dist/assets/github-workflows/prism-eval-gate-kiro.yml

@@ -372,10 +372,76 @@ jobs:
           echo "critical=${CRITICAL}" >> "$GITHUB_OUTPUT"
           echo "high=${HIGH}" >> "$GITHUB_OUTPUT"
 
+          # Persist full findings for the EventBridge emission step. A file
+          # (not a step output) sidesteps GITHUB_OUTPUT size limits and avoids
+          # interpolating finding text into a later script (injection surface).
+          echo "$FINDINGS_JSON" > "$RUNNER_TEMP/continuum-findings.json"
+
           if [ "$TOTAL" -gt 0 ]; then
             echo "$FINDINGS_JSON" | jq -r '.findingsSummaries[] | "::warning::[\(.riskLevel)] \(.name)"'
           fi
 
+      - name: Emit Continuum findings to EventBridge
+        if: steps.security-gate.outputs.skipped != 'true' && steps.security-gate.outputs.findings != '0' && steps.security-gate.outputs.findings != ''
+        continue-on-error: true
+        env:
+          AWS_REGION: us-west-2
+          TEAM_ID: ${{ steps.prism-config.outputs.team_id }}
+          REPO: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.sha }}
+        run: |
+          # Feeds the Team Velocity / CISO dashboards: without this step,
+          # Continuum findings gate the PR but never reach the metrics
+          # pipeline (prism.d1.security.code_review -> metrics-processor).
+          FINDINGS_FILE="$RUNNER_TEMP/continuum-findings.json"
+          if [ ! -s "$FINDINGS_FILE" ]; then
+            echo "No findings file — nothing to emit"
+            exit 0
+          fi
+
+          # Emit the PR's commit SHAs, NOT a derived AI-origin verdict.
+          #
+          # Deferred join: dashboards resolve origin at render time by looking
+          # these SHAs up in the attribution store. Two reasons not to decide
+          # here: (1) trailer grep dies with the git hooks, and (2) attribution
+          # spans arrive via `codeburn sync push --attribution` on a ~12h
+          # schedule, so at merge time the data usually does not exist yet — a
+          # verdict computed now would be wrong and permanently baked into an
+          # immutable event. SHAs are facts that never expire, so a PR merged
+          # before its attribution syncs simply renders correctly the next day.
+          #
+          # Capped at 50 to bound event size; PRs larger than that are rare and
+          # a partial sample is enough to classify origin.
+          COMMIT_SHAS=$(git rev-list "${BASE_SHA}..${HEAD_SHA}" 2>/dev/null | head -50 | jq -R . | jq -sc . || echo '[]')
+          echo "Emitting findings with $(echo "${COMMIT_SHAS}" | jq 'length') commit SHAs for deferred origin resolution"
+
+          ENTRIES=$(jq --arg team_id "${TEAM_ID}" --arg repo "${REPO}" \
+            --argjson commit_shas "${COMMIT_SHAS}" --argjson pr_number "${PR_NUMBER}" '
+            .findingsSummaries | to_entries | map(.value as $f |
+              {Source:"prism.d1.velocity", DetailType:"prism.d1.security.code_review",
+               EventBusName:"prism-d1-metrics",
+               Detail:({team_id:$team_id, repo:$repo, timestamp:(now | todate), prism_level:3,
+                 metric:{name:"security_finding",value:1,unit:"count"},
+                 ai_context:{tool:"continuum",model:"aws-continuum"},
+                 security_agent_finding:{finding_id:($f.findingId // "cf-pr\($pr_number)-\(.key)"), phase:"code_review",
+                   severity:($f.riskLevel // "MEDIUM"),
+                   cwe_id:($f.cweId // null),
+                   commit_shas:$commit_shas, pr_number:$pr_number,
+                   found_at:($f.createdAt // null)}
+               } | tostring)})' "$FINDINGS_FILE" 2>/dev/null || echo "[]")
+
+          TOTAL=$(echo "${ENTRIES}" | jq 'length')
+          if [ "$TOTAL" -gt 0 ]; then
+            # EventBridge accepts max 10 entries per call
+            for i in $(seq 0 10 $((TOTAL - 1))); do
+              aws events put-events --region us-west-2 \
+                --entries "$(echo "${ENTRIES}" | jq -c ".[$i:$((i+10))]")" || true
+            done
+            echo "Emitted ${TOTAL} Continuum finding events to EventBridge"
+          fi
+
       - name: Fail on eval gate failure
         if: ${{ steps.review.outputs.result == 'FAIL' || steps.review.outputs.result == 'ERROR' || (steps.security-gate.outputs.skipped != 'true' && (steps.security-gate.outputs.critical != '0' || steps.security-gate.outputs.high != '0')) }}
         env:

package/dist/assets/github-workflows/prism-eval-gate.yml

@@ -426,7 +426,7 @@ jobs:
                Detail:({team_id:$team_id, repo:$repo, timestamp:($f.createdAt // now | tostring), prism_level:3,
                  metric:{name:"security_finding",value:1,unit:"count"},
                  ai_context:{tool:"continuum",model:"aws-continuum",origin:$ai_origin},
-                 continuum_finding:{finding_id:($f.findingId // "cf-pr\($pr_number)-\(.key)"), phase:"code_review",
+                 security_agent_finding:{finding_id:($f.findingId // "cf-pr\($pr_number)-\(.key)"), phase:"code_review",
                    severity:($f.riskLevel // "MEDIUM"),
                    cwe_id:($f.cweId // null),
                    ai_origin:$ai_origin, found_at:($f.createdAt // null)}

package/dist/assets/gitlab-workflows/.gitlab-ci.yml

@@ -8,17 +8,14 @@
 #   2. Add CI/CD variable PRISM_METRICS_ROLE_ARN with the output role ARN
 #   3. Copy gitlab-workflows/*.yml to .prism/gitlab-workflows/ in your repo
 #   4. (Optional) Set GITLAB_OIDC_AUDIENCE if not using gitlab.aws.dev
-#   5. (Optional) Create a pipeline schedule for prism-dora-weekly (Monday 09:00 UTC)
 
 workflow:
   rules:
     - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
     - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
-    - if: '$CI_PIPELINE_SOURCE == "schedule"'
     - if: '$CI_PIPELINE_SOURCE == "web"'
 
 include:
   - local: '.prism/gitlab-workflows/prism-ai-metrics.yml'
-  - local: '.prism/gitlab-workflows/prism-dora-weekly.yml'
   - local: '.prism/gitlab-workflows/prism-agent-eval.yml'
   - local: '.prism/gitlab-workflows/prism-eval-gate.yml'

package/dist/assets/gitlab-workflows/prism-ai-metrics.yml

@@ -1,14 +1,25 @@
-# prism-ai-metrics.yml — Emit AI-assisted development metrics on MR merge.
+# prism-ai-metrics.yml — Per-merge delivery telemetry (GitLab).
 #
 # Include this file in your .gitlab-ci.yml:
 #   include:
 #     - local: '.prism/gitlab-workflows/prism-ai-metrics.yml'
 #
+# DESIGN: emits immutable per-MR FACTS and computes no rates. All aggregation
+# (frequency, lead-time percentiles, change-failure rate, MTTR) happens at query
+# time in the dashboard widgets. See the GitHub twin at
+# bootstrapper/github-workflows/prism-ai-metrics.yml for the full rationale.
+#
+# AI origin is NOT computed here — it is resolved at render time by joining
+# pr.commit_shas against the codeburn attribution store. See
+# docs/data-architecture.md → "AI Origin Resolution: Deferred Attribution Join".
+#
+# Replaces the former prism-dora-weekly.yml, which published a parallel 7-day
+# aggregate that no dashboard consumed.
+#
 # Required setup:
 #   - CI/CD variable PRISM_METRICS_ROLE_ARN (IAM role ARN with events:PutEvents)
-#   - CI/CD variable AWS_REGION (default: us-west-2)
-#   - .prism/config.json committed to the repo
-#   - AWS credentials configured via OIDC or CI/CD variables
+#   - .prism/config.json committed to the repo (optional; defaults to no_team)
+#   - AWS credentials configured via OIDC
 
 prism-ai-metrics:
   stage: test
@@ -23,7 +34,7 @@ prism-ai-metrics:
   variables:
     AWS_DEFAULT_REGION: us-west-2
   before_script:
-    - yum install -y -q jq bc git
+    - yum install -y -q jq git
     - git fetch --unshallow || true
     - |
       # Assume AWS role via GitLab OIDC
@@ -47,87 +58,69 @@ prism-ai-metrics:
       fi
   script:
     - |
-      # Skip if no AWS credentials available
       if ! aws sts get-caller-identity &>/dev/null; then
         echo "⚠️ No AWS credentials. Set PRISM_METRICS_ROLE_ARN or configure AWS access."
         exit 0
       fi
 
-      # Read team ID
       TEAM_ID=$(jq -r '.team_id // "no_team"' .prism/config.json 2>/dev/null || echo "no_team")
 
-      # Determine commit range
+      # Commit range for this merge
       if [[ -n "${CI_MERGE_REQUEST_DIFF_BASE_SHA}" ]]; then
         BASE_SHA="${CI_MERGE_REQUEST_DIFF_BASE_SHA}"
-        HEAD_SHA="${CI_COMMIT_SHA}"
       else
         BASE_SHA=$(git rev-parse HEAD~1 2>/dev/null || git rev-parse HEAD)
-        HEAD_SHA="${CI_COMMIT_SHA}"
       fi
+      HEAD_SHA="${CI_COMMIT_SHA}"
 
+      # --- Commit SHAs: immutable facts for deferred origin resolution.
+      COMMIT_SHAS=$(git rev-list "${BASE_SHA}..${HEAD_SHA}" 2>/dev/null | head -50 | jq -R . | jq -sc . || echo '[]')
       TOTAL_COMMITS=$(git rev-list --count "${BASE_SHA}..${HEAD_SHA}" 2>/dev/null || echo "1")
 
-      # Count AI origin per-commit
-      AI_GENERATED=0; AI_ASSISTED=0; HUMAN_ONLY=0
-      TOTAL_INPUT_TOKENS=0; TOTAL_OUTPUT_TOKENS=0; TOTAL_COST="0"
-
-      for SHA in $(git rev-list "${BASE_SHA}..${HEAD_SHA}" 2>/dev/null || echo "${HEAD_SHA}"); do
-        MSG=$(git log -1 --format='%B' "${SHA}")
-        echo "${MSG}" | grep -q '^AI-Origin: ai-generated' && AI_GENERATED=$((AI_GENERATED + 1))
-        echo "${MSG}" | grep -q '^AI-Origin: ai-assisted' && AI_ASSISTED=$((AI_ASSISTED + 1))
-        echo "${MSG}" | grep -q '^AI-Origin: human' && HUMAN_ONLY=$((HUMAN_ONLY + 1))
-
-        INPUT_T=$(echo "${MSG}" | grep -oP '(?<=^AI-Input-Tokens: )\d+' || echo "0")
-        OUTPUT_T=$(echo "${MSG}" | grep -oP '(?<=^AI-Output-Tokens: )\d+' || echo "0")
-        COST_T=$(echo "${MSG}" | grep -oP '(?<=^AI-Cost: )[0-9.]+' || echo "0")
-        [[ ${INPUT_T} -gt 1000000 ]] && INPUT_T=0
-        [[ ${OUTPUT_T} -gt 1000000 ]] && OUTPUT_T=0
-        TOTAL_INPUT_TOKENS=$((TOTAL_INPUT_TOKENS + INPUT_T))
-        TOTAL_OUTPUT_TOKENS=$((TOTAL_OUTPUT_TOKENS + OUTPUT_T))
-        TOTAL_COST=$(echo "${TOTAL_COST} + ${COST_T}" | bc -l)
-      done
-
-      AI_COMMITS=$((AI_GENERATED + AI_ASSISTED))
-      [[ "${TOTAL_COMMITS}" -gt 0 ]] && AI_RATIO=$(echo "scale=4; ${AI_COMMITS} / ${TOTAL_COMMITS}" | bc -l | sed 's/^\./0./') || AI_RATIO="0"
-
-      # Calculate lead time (MR created to merged)
+      # --- Lead time: MR open → now (this job runs on the post-merge push).
       LEAD_TIME_SECONDS=0
       if [[ -n "${CI_MERGE_REQUEST_CREATED_AT}" ]]; then
         CREATED_TS=$(date -d "${CI_MERGE_REQUEST_CREATED_AT}" +%s 2>/dev/null || echo "0")
-        MERGED_TS=$(date +%s)
-        LEAD_TIME_SECONDS=$((MERGED_TS - CREATED_TS))
+        if [[ "${CREATED_TS}" -gt 0 ]]; then
+          LEAD_TIME_SECONDS=$(( $(date +%s) - CREATED_TS ))
+          [[ "${LEAD_TIME_SECONDS}" -lt 0 ]] && LEAD_TIME_SECONDS=0
+        fi
+      fi
+
+      # --- Failure-fix label: change-failure-rate numerator as a per-MR fact.
+      # On the post-merge push pipeline CI_MERGE_REQUEST_TITLE is usually unset,
+      # so fall back to the merge commit title. Matched via printf against a
+      # variable rather than interpolated, since titles are user-controlled.
+      FIX_TITLE="${CI_MERGE_REQUEST_TITLE:-${CI_COMMIT_TITLE:-}}"
+      if printf '%s' "${FIX_TITLE}" | grep -qiE 'revert|hotfix|rollback'; then
+        IS_FAILURE_FIX=true
+      else
+        IS_FAILURE_FIX=false
       fi
 
       TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
 
+      # NOTE: no review verdicts here. GitLab approvals would need an API call
+      # with a project token; the GitHub twin gets them from the reviews API.
+      # Emitted under `pr` (not `mr`) so both CI providers land in the same
+      # shape — the processor only persists a known section list.
       PR_EVENT=$(jq -n \
         --arg team_id "${TEAM_ID}" \
         --arg repo "${CI_PROJECT_PATH}" \
         --arg timestamp "${TIMESTAMP}" \
-        --argjson ai_ratio "${AI_RATIO}" \
-        --argjson total_commits "${TOTAL_COMMITS}" \
-        --argjson ai_commits "${AI_COMMITS}" \
-        --argjson ai_generated "${AI_GENERATED}" \
-        --argjson ai_assisted "${AI_ASSISTED}" \
         --argjson lead_time_seconds "${LEAD_TIME_SECONDS}" \
+        --argjson is_failure_fix "${IS_FAILURE_FIX}" \
+        --argjson total_commits "${TOTAL_COMMITS}" \
+        --argjson commit_shas "${COMMIT_SHAS}" \
         --arg mr_iid "${CI_MERGE_REQUEST_IID:-0}" \
         --arg mr_author "${GITLAB_USER_LOGIN}" \
-        --argjson total_input_tokens "${TOTAL_INPUT_TOKENS}" \
-        --argjson total_output_tokens "${TOTAL_OUTPUT_TOKENS}" \
-        --arg total_cost "${TOTAL_COST}" \
         '{
           team_id: $team_id, repo: $repo, timestamp: $timestamp, prism_level: 2,
-          metric: {name: "ai_to_merge_ratio", value: $ai_ratio, unit: "ratio"},
-          ai_context: {tool: "gitlab-ci", model: "n/a",
-            origin: (if $ai_ratio > 0 then "ai-assisted" else "human" end)},
-          dora: {deployment_frequency: 1, lead_time_seconds: $lead_time_seconds},
-          ai_dora: {ai_to_merge_ratio: $ai_ratio, total_commits: $total_commits,
-            ai_commits: $ai_commits, ai_generated_commits: $ai_generated,
-            ai_assisted_commits: $ai_assisted,
-            total_input_tokens: $total_input_tokens,
-            total_output_tokens: $total_output_tokens,
-            total_cost_usd: (if $total_cost != "0" and $total_cost != "" then ($total_cost | tonumber) else 0 end)},
-          mr: {iid: ($mr_iid | tonumber), author: $mr_author}
+          metric: {name: "pr_merged", value: 1, unit: "count"},
+          dora: {lead_time_seconds: $lead_time_seconds, is_failure_fix: $is_failure_fix},
+          pr: {number: ($mr_iid | tonumber), author: $mr_author,
+               reviews_approved: 0, reviews_changes_requested: 0,
+               total_commits: $total_commits, commit_shas: $commit_shas}
         }')
 
       aws events put-events --region "${AWS_DEFAULT_REGION}" \
@@ -138,7 +131,8 @@ prism-ai-metrics:
           \"Detail\": $(echo "${PR_EVENT}" | jq -c '.' | jq -Rs '.')
         }]"
 
-      # Also emit deploy event
+      # Sole deployment signal — deployment_frequency lives ONLY on this event.
+      # Carrying it on prism.d1.pr as well double-counted the metric.
       DEPLOY_EVENT=$(jq -n --arg team_id "${TEAM_ID}" --arg repo "${CI_PROJECT_PATH}" --arg timestamp "${TIMESTAMP}" \
         '{team_id: $team_id, repo: $repo, timestamp: $timestamp, prism_level: 2,
          metric: {name: "deployment", value: 1, unit: "count"},
@@ -151,3 +145,6 @@ prism-ai-metrics:
           \"EventBusName\": \"prism-d1-metrics\",
           \"Detail\": $(echo "${DEPLOY_EVENT}" | jq -c '.' | jq -Rs '.')
         }]"
+
+      echo "Emitted prism.d1.pr + prism.d1.deploy"
+      echo "  lead time: ${LEAD_TIME_SECONDS}s · failure fix: ${IS_FAILURE_FIX} · commits: ${TOTAL_COMMITS}"

package/dist/assets/infra/bin/app.ts

@@ -42,6 +42,7 @@ const dashboardStack = new DashboardStack(app, 'PrismD1Dashboard', {
   env,
   description: 'PRISM D1 Velocity - CloudWatch dashboards and alarms',
   productivityWidgetArn: pipelineStack.otelCollector?.productivityWidgetArn,
+  velocityWidgetArn: pipelineStack.velocityWidgetArn,
   tags: {
     'prism:project': 'PRISM',
     'prism:domain': 'D1-Velocity',

package/dist/assets/infra/lib/constructs/otel-collector-construct.ts

@@ -56,6 +56,9 @@ export class OtelCollectorConstruct extends Construct {
   public readonly userPoolClient?: cognito.UserPoolClient;
   /** ARN of the CloudWatch custom-widget Lambda (Developer Productivity table). */
   public productivityWidgetArn?: string;
+  /** The otel-receiver Lambda — other constructs may grant themselves invoke
+   *  for direct aggregation queries (single implementation, no drift). */
+  public receiverFunction!: lambda.Function;
 
   constructor(scope: Construct, id: string, props: OtelCollectorConstructProps) {
     super(scope, id);
@@ -198,6 +201,7 @@ export class OtelCollectorConstruct extends Construct {
     props.aiUsageTable.grantReadWriteData(receiver);
     this.archiveBucket.grantPut(receiver);
     props.kmsKey.grantEncryptDecrypt(receiver);
+    this.receiverFunction = receiver;
 
     // -------------------------------------------------------
     // CloudWatch Custom Widget: Developer Productivity